Analysis
- max time kernel
84s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe
- Size 208KB
- Sample260802-v4ahcsdc86
- SHA256 775e8081b8704f27c2eddab7c03c0fd11585d517d001ae1eb357f3831ef082cd
- MD5 9981d0510ecd772327a27a6b75639fda
- SHA1 db1bcfcc741361f34d2c64aa298d156ab8fc5e8c
- SHA512 b07d11629a174b90f6f388e49f7721387b0e951ac1cb2e490f0601fbc3430f7a046f0ad45f91f60a3a48f3de2dd7ffc508d98dfcf17514372b4f1b33cc0d567e
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfi4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO6kEj1
- TLSH T10F247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2016 DRJ.exe 1008 HFQCSM.exe 5128 KAHDMY.exe 1132 SFLKWW.exe 3192 UDZEEE.exe 1488 IYDFK.exe 4504 XPEX.exe 2908 SKVG.exe 1080 YXUHGLX.exe 4164 LIKGV.exe 3292 AYLX.exe 2104 BBCT.exe 5348 CEFPVI.exe 2912 ECLJLR.exe 3800 EXP.exe 3624 DQADZNZ.exe 2500 UQGALEU.exe 4772 NTSWRC.exe 5800 GLZPAV.exe 4144 MHZQFYB.exe 3036 LWKLA.exe 2452 UFMYDI.exe 5172 YNAYQT.exe 2256 ZQE.exe 5964 ZVW.exe 5368 XTQLKBL.exe 5012 WESBSP.exe 5832 RRX.exe 4136 LFCU.exe 2352 VCIO.exe 3536 UVT.exe 612 TGVUL.exe 4896 XOCU.exe 2920 RBHDAB.exe 2536 BKJILGR.exe 2492 DXOA.exe 852 BXVOFA.exe 5852 NNCO.exe 5640 GIGRWJ.exe 4500 XRIW.exe 1620 EMRBL.exe 688 HZWKVAW.exe 776 QHYPZ.exe 3268 WHGDQ.exe 3552 WNG.exe 2460 LIPECA.exe 1680 CQRJGFN.exe 1400 VLVF.exe 3372 ZBCNFF.exe 1608 OSDEE.exe 5724 ENM.exe 3212 ESM.exe 2684 EVQBE.exe 2616 NIA.exe 5872 KOGQB.exe 5784 KUYEC.exe 1836 QUGSTE.exe 2688 BMJLUUN.exe 5576 HNRY.exe 4212 HSJNM.exe 3312 TAYNYTG.exe 2288 ETT.exe 3476 TWKKSN.exe 3016 FPFDSCL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\KAHDMY.exe.bat HFQCSM.exe File created C:\windows\SysWOW64\YXUHGLX.exe.bat SKVG.exe File opened for modification C:\windows\SysWOW64\TGVUL.exe UVT.exe File created C:\windows\SysWOW64\EVQBE.exe.bat ESM.exe File created C:\windows\SysWOW64\UCDZCL.exe FHL.exe File opened for modification C:\windows\SysWOW64\TSD.exe EXMSO.exe File opened for modification C:\windows\SysWOW64\ZQE.exe YNAYQT.exe File opened for modification C:\windows\SysWOW64\JUSJOJQ.exe DUKV.exe File created C:\windows\SysWOW64\OLY.exe ENSR.exe File opened for modification C:\windows\SysWOW64\LWKLA.exe MHZQFYB.exe File created C:\windows\SysWOW64\ZQE.exe YNAYQT.exe File created C:\windows\SysWOW64\ZQE.exe.bat YNAYQT.exe File opened for modification C:\windows\SysWOW64\WESBSP.exe XTQLKBL.exe File created C:\windows\SysWOW64\TGVUL.exe UVT.exe File created C:\windows\SysWOW64\KOGQB.exe NIA.exe File opened for modification C:\windows\SysWOW64\ZCKM.exe FPFDSCL.exe File opened for modification C:\windows\SysWOW64\KAHDMY.exe HFQCSM.exe File created C:\windows\SysWOW64\WHGDQ.exe QHYPZ.exe File created C:\windows\SysWOW64\OSDEE.exe ZBCNFF.exe File created C:\windows\SysWOW64\NIA.exe.bat EVQBE.exe File created C:\windows\SysWOW64\ZCKM.exe.bat FPFDSCL.exe File created C:\windows\SysWOW64\DMEM.exe IYHVRXQ.exe File opened for modification C:\windows\SysWOW64\DMEM.exe IYHVRXQ.exe File created C:\windows\SysWOW64\LRETD.exe.bat DMEM.exe File created C:\windows\SysWOW64\SKVG.exe XPEX.exe File created C:\windows\SysWOW64\MHZQFYB.exe GLZPAV.exe File created C:\windows\SysWOW64\MHZQFYB.exe.bat GLZPAV.exe File created C:\windows\SysWOW64\HNRY.exe BMJLUUN.exe File opened for modification C:\windows\SysWOW64\HNRY.exe BMJLUUN.exe File created C:\windows\SysWOW64\APW.exe.bat FCRALXB.exe File created C:\windows\SysWOW64\UCDZCL.exe.bat FHL.exe File opened for modification C:\windows\SysWOW64\CJUSI.exe PYETUOC.exe File created C:\windows\SysWOW64\DMEM.exe.bat IYHVRXQ.exe File created C:\windows\SysWOW64\TSD.exe.bat EXMSO.exe File opened for modification C:\windows\SysWOW64\ZZLPER.exe EMGF.exe File created C:\windows\SysWOW64\HLCVLJ.exe.bat MYXM.exe File created C:\windows\SysWOW64\CQRJGFN.exe LIPECA.exe File created C:\windows\SysWOW64\EVQBE.exe ESM.exe File created C:\windows\SysWOW64\FHL.exe ZMUMNWT.exe File opened for modification C:\windows\SysWOW64\UCDZCL.exe FHL.exe File created C:\windows\SysWOW64\EYS.exe.bat JSKI.exe File created C:\windows\SysWOW64\JUSJOJQ.exe.bat DUKV.exe File created C:\windows\SysWOW64\ZZLPER.exe.bat EMGF.exe File opened for modification C:\windows\SysWOW64\MYXM.exe OLY.exe File opened for modification C:\windows\SysWOW64\SKVG.exe XPEX.exe File created C:\windows\SysWOW64\BMJLUUN.exe QUGSTE.exe File created C:\windows\SysWOW64\HSJNM.exe HNRY.exe File created C:\windows\SysWOW64\ZCKM.exe FPFDSCL.exe File created C:\windows\SysWOW64\OLY.exe.bat ENSR.exe File created C:\windows\SysWOW64\NNCO.exe BXVOFA.exe File opened for modification C:\windows\SysWOW64\OSDEE.exe ZBCNFF.exe File created C:\windows\SysWOW64\OSDEE.exe.bat ZBCNFF.exe File created C:\windows\SysWOW64\NIA.exe EVQBE.exe File created C:\windows\SysWOW64\TSD.exe EXMSO.exe File opened for modification C:\windows\SysWOW64\YXUHGLX.exe SKVG.exe File created C:\windows\SysWOW64\TGVUL.exe.bat UVT.exe File created C:\windows\SysWOW64\BXVOFA.exe DXOA.exe File created C:\windows\SysWOW64\NNCO.exe.bat BXVOFA.exe File created C:\windows\SysWOW64\CQRJGFN.exe.bat LIPECA.exe File opened for modification C:\windows\SysWOW64\APW.exe FCRALXB.exe File opened for modification C:\windows\SysWOW64\FHL.exe ZMUMNWT.exe File created C:\windows\SysWOW64\EYS.exe JSKI.exe File created C:\windows\SysWOW64\UFMYDI.exe LWKLA.exe File created C:\windows\SysWOW64\WESBSP.exe XTQLKBL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\KSOZNYY.exe ZZLPER.exe File opened for modification C:\windows\system\ENSR.exe KSOZNYY.exe File opened for modification C:\windows\system\ECLJLR.exe CEFPVI.exe File created C:\windows\XOCU.exe.bat TGVUL.exe File created C:\windows\system\ENM.exe.bat OSDEE.exe File created C:\windows\KUYEC.exe.bat KOGQB.exe File created C:\windows\system\NPKN.exe.bat LRETD.exe File created C:\windows\ULI.exe.bat ITFXTCX.exe File opened for modification C:\windows\system\XPEX.exe IYDFK.exe File opened for modification C:\windows\system\BBCT.exe AYLX.exe File created C:\windows\RRX.exe WESBSP.exe File created C:\windows\FCRALXB.exe.bat ZCKM.exe File opened for modification C:\windows\UDBTG.exe APW.exe File created C:\windows\IYHVRXQ.exe CYAHA.exe File created C:\windows\system\GLZPAV.exe.bat NTSWRC.exe File opened for modification C:\windows\system\UVT.exe VCIO.exe File created C:\windows\system\RBHDAB.exe.bat XOCU.exe File opened for modification C:\windows\system\LIPECA.exe WNG.exe File created C:\windows\system\TAYNYTG.exe.bat HSJNM.exe File created C:\windows\system\PYETUOC.exe.bat YYCOQR.exe File created C:\windows\JSKI.exe OFFYFQP.exe File created C:\windows\IYHVRXQ.exe.bat CYAHA.exe File created C:\windows\HFQCSM.exe DRJ.exe File created C:\windows\system\UQGALEU.exe.bat DQADZNZ.exe File opened for modification C:\windows\system\NTSWRC.exe UQGALEU.exe File opened for modification C:\windows\system\GLZPAV.exe NTSWRC.exe File created C:\windows\RRX.exe.bat WESBSP.exe File opened for modification C:\windows\system\RBHDAB.exe XOCU.exe File opened for modification C:\windows\DXOA.exe BKJILGR.exe File opened for modification C:\windows\system\QHYPZ.exe HZWKVAW.exe File created C:\windows\ESM.exe ENM.exe File created C:\windows\XTQLKBL.exe ZVW.exe File opened for modification C:\windows\system\EMRBL.exe XRIW.exe File created C:\windows\system\TAYNYTG.exe HSJNM.exe File opened for modification C:\windows\system\ETT.exe TAYNYTG.exe File created C:\windows\system\AYUA.exe.bat UCDZCL.exe File created C:\windows\system\OFFYFQP.exe.bat WBCDZ.exe File created C:\windows\system\ITFXTCX.exe DTXKK.exe File created C:\windows\system\GLZPAV.exe NTSWRC.exe File created C:\windows\UDBTG.exe APW.exe File created C:\windows\YYCOQR.exe AYUA.exe File opened for modification C:\windows\system\ITFXTCX.exe DTXKK.exe File created C:\windows\system\VLPTQQ.exe VQLY.exe File created C:\windows\system\PRWTJE.exe XIUOG.exe File created C:\windows\system\PRWTJE.exe.bat XIUOG.exe File created C:\windows\system\DRJ.exe 2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe File opened for modification C:\windows\system\EXP.exe ECLJLR.exe File created C:\windows\HZWKVAW.exe EMRBL.exe File created C:\windows\system\VLPTQQ.exe.bat VQLY.exe File opened for modification C:\windows\system\KSOZNYY.exe ZZLPER.exe File created C:\windows\system\ENSR.exe.bat KSOZNYY.exe File created C:\windows\system\UDZEEE.exe SFLKWW.exe File opened for modification C:\windows\IYDFK.exe UDZEEE.exe File created C:\windows\FPFDSCL.exe TWKKSN.exe File created C:\windows\system\EOH.exe LORRF.exe File opened for modification C:\windows\YYCOQR.exe AYUA.exe File created C:\windows\system\DTXKK.exe.bat TSD.exe File opened for modification C:\windows\XTQLKBL.exe ZVW.exe File opened for modification C:\windows\system\DRJ.exe 2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe File created C:\windows\system\ECLJLR.exe.bat CEFPVI.exe File created C:\windows\system\NTSWRC.exe.bat UQGALEU.exe File created C:\windows\XIUOG.exe.bat VLPTQQ.exe File opened for modification C:\windows\EMGF.exe PRWTJE.exe File opened for modification C:\windows\CEFPVI.exe BBCT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1388 cmd.exe 3324 cmd.exe 2356 cmd.exe 4840 cmd.exe 3628 cmd.exe 3252 cmd.exe 4768 cmd.exe 4944 cmd.exe 6080 cmd.exe 1304 cmd.exe 1352 cmd.exe 3068 cmd.exe 3532 cmd.exe 5008 cmd.exe 1396 cmd.exe 3948 cmd.exe 828 cmd.exe 6088 cmd.exe 4380 cmd.exe 3808 cmd.exe 4612 cmd.exe 6060 cmd.exe 5248 cmd.exe 2872 cmd.exe 4720 cmd.exe 5704 cmd.exe 3332 cmd.exe 2608 cmd.exe 248 cmd.exe 676 cmd.exe 3572 cmd.exe 4352 cmd.exe 1832 cmd.exe 4368 cmd.exe 4532 cmd.exe 2568 cmd.exe 5776 cmd.exe 4488 cmd.exe 5316 cmd.exe 5352 cmd.exe 4780 cmd.exe 4908 cmd.exe 5600 cmd.exe 5940 cmd.exe 6040 cmd.exe 2904 cmd.exe 1196 cmd.exe 2392 cmd.exe 3588 cmd.exe 5108 cmd.exe 6016 cmd.exe 4160 cmd.exe 5688 cmd.exe 5932 cmd.exe 2136 cmd.exe 4816 cmd.exe 2876 cmd.exe 4404 cmd.exe 5744 cmd.exe 2564 cmd.exe 5980 cmd.exe 2756 cmd.exe 3196 cmd.exe 948 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5684 5536 WerFault.exe 86 6012 2016 WerFault.exe 92 6056 1008 WerFault.exe 98 4220 5128 WerFault.exe 103 600 1132 WerFault.exe 108 1576 3192 WerFault.exe 113 2600 1488 WerFault.exe 118 4964 4504 WerFault.exe 123 2336 2908 WerFault.exe 128 940 1080 WerFault.exe 133 3436 4164 WerFault.exe 138 4588 3292 WerFault.exe 143 4192 2104 WerFault.exe 148 676 5348 WerFault.exe 153 5956 2912 WerFault.exe 158 1180 3800 WerFault.exe 163 3612 3624 WerFault.exe 168 3040 2500 WerFault.exe 173 1388 4772 WerFault.exe 178 4944 5800 WerFault.exe 183 2248 4144 WerFault.exe 188 4632 3036 WerFault.exe 193 5228 2452 WerFault.exe 198 2568 5172 WerFault.exe 203 2604 2256 WerFault.exe 208 5268 5964 WerFault.exe 213 6072 5368 WerFault.exe 218 3364 5012 WerFault.exe 223 2232 5832 WerFault.exe 228 4560 4136 WerFault.exe 233 1980 2352 WerFault.exe 238 4600 3536 WerFault.exe 243 4124 612 WerFault.exe 248 1436 4896 WerFault.exe 253 4568 2920 WerFault.exe 258 2360 2536 WerFault.exe 263 4536 2492 WerFault.exe 269 5224 852 WerFault.exe 274 1156 5852 WerFault.exe 279 4848 5640 WerFault.exe 284 620 4500 WerFault.exe 289 2620 1620 WerFault.exe 294 5860 688 WerFault.exe 299 2604 776 WerFault.exe 304 2940 3268 WerFault.exe 309 4548 3552 WerFault.exe 314 5780 2460 WerFault.exe 319 3780 1680 WerFault.exe 324 1768 1400 WerFault.exe 329 1208 3372 WerFault.exe 334 472 1608 WerFault.exe 339 3080 5724 WerFault.exe 344 3628 3212 WerFault.exe 349 4992 2684 WerFault.exe 354 2360 2616 WerFault.exe 359 1516 5872 WerFault.exe 364 2488 5784 WerFault.exe 369 3148 1836 WerFault.exe 374 2024 2688 WerFault.exe 379 5968 5576 WerFault.exe 384 3076 4212 WerFault.exe 389 616 3312 WerFault.exe 394 4440 2288 WerFault.exe 399 2192 3476 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIGRWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBCDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUGSTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWKKSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSDEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQRJGFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYHVRXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUYEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFFYFQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIKGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUSJOJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLPTQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TAYNYTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPFDSCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVQBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMJLUUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNCO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHYPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYLX.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5536 2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe 5536 2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe 2016 DRJ.exe 2016 DRJ.exe 1008 HFQCSM.exe 1008 HFQCSM.exe 5128 KAHDMY.exe 5128 KAHDMY.exe 1132 SFLKWW.exe 1132 SFLKWW.exe 3192 UDZEEE.exe 3192 UDZEEE.exe 1488 IYDFK.exe 1488 IYDFK.exe 4504 XPEX.exe 4504 XPEX.exe 2908 SKVG.exe 2908 SKVG.exe 1080 YXUHGLX.exe 1080 YXUHGLX.exe 4164 LIKGV.exe 4164 LIKGV.exe 3292 AYLX.exe 3292 AYLX.exe 2104 BBCT.exe 2104 BBCT.exe 5348 CEFPVI.exe 5348 CEFPVI.exe 2912 ECLJLR.exe 2912 ECLJLR.exe 3800 EXP.exe 3800 EXP.exe 3624 DQADZNZ.exe 3624 DQADZNZ.exe 2500 UQGALEU.exe 2500 UQGALEU.exe 4772 NTSWRC.exe 4772 NTSWRC.exe 5800 GLZPAV.exe 5800 GLZPAV.exe 4144 MHZQFYB.exe 4144 MHZQFYB.exe 3036 LWKLA.exe 3036 LWKLA.exe 2452 UFMYDI.exe 2452 UFMYDI.exe 5172 YNAYQT.exe 5172 YNAYQT.exe 2256 ZQE.exe 2256 ZQE.exe 5964 ZVW.exe 5964 ZVW.exe 5368 XTQLKBL.exe 5368 XTQLKBL.exe 5012 WESBSP.exe 5012 WESBSP.exe 5832 RRX.exe 5832 RRX.exe 4136 LFCU.exe 4136 LFCU.exe 2352 VCIO.exe 2352 VCIO.exe 3536 UVT.exe 3536 UVT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5536 2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe 5536 2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe 2016 DRJ.exe 2016 DRJ.exe 1008 HFQCSM.exe 1008 HFQCSM.exe 5128 KAHDMY.exe 5128 KAHDMY.exe 1132 SFLKWW.exe 1132 SFLKWW.exe 3192 UDZEEE.exe 3192 UDZEEE.exe 1488 IYDFK.exe 1488 IYDFK.exe 4504 XPEX.exe 4504 XPEX.exe 2908 SKVG.exe 2908 SKVG.exe 1080 YXUHGLX.exe 1080 YXUHGLX.exe 4164 LIKGV.exe 4164 LIKGV.exe 3292 AYLX.exe 3292 AYLX.exe 2104 BBCT.exe 2104 BBCT.exe 5348 CEFPVI.exe 5348 CEFPVI.exe 2912 ECLJLR.exe 2912 ECLJLR.exe 3800 EXP.exe 3800 EXP.exe 3624 DQADZNZ.exe 3624 DQADZNZ.exe 2500 UQGALEU.exe 2500 UQGALEU.exe 4772 NTSWRC.exe 4772 NTSWRC.exe 5800 GLZPAV.exe 5800 GLZPAV.exe 4144 MHZQFYB.exe 4144 MHZQFYB.exe 3036 LWKLA.exe 3036 LWKLA.exe 2452 UFMYDI.exe 2452 UFMYDI.exe 5172 YNAYQT.exe 5172 YNAYQT.exe 2256 ZQE.exe 2256 ZQE.exe 5964 ZVW.exe 5964 ZVW.exe 5368 XTQLKBL.exe 5368 XTQLKBL.exe 5012 WESBSP.exe 5012 WESBSP.exe 5832 RRX.exe 5832 RRX.exe 4136 LFCU.exe 4136 LFCU.exe 2352 VCIO.exe 2352 VCIO.exe 3536 UVT.exe 3536 UVT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5536 wrote to memory of 3248 5536 2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe 88 PID 3248 wrote to memory of 2016 3248 cmd.exe 92 PID 2016 wrote to memory of 2464 2016 DRJ.exe 94 PID 2464 wrote to memory of 1008 2464 cmd.exe 98 PID 1008 wrote to memory of 4660 1008 HFQCSM.exe 99 PID 4660 wrote to memory of 5128 4660 cmd.exe 103 PID 5128 wrote to memory of 4084 5128 KAHDMY.exe 104 PID 4084 wrote to memory of 1132 4084 cmd.exe 108 PID 1132 wrote to memory of 5040 1132 SFLKWW.exe 109 PID 5040 wrote to memory of 3192 5040 cmd.exe 113 PID 3192 wrote to memory of 2676 3192 UDZEEE.exe 114 PID 2676 wrote to memory of 1488 2676 cmd.exe 118 PID 1488 wrote to memory of 3648 1488 IYDFK.exe 119 PID 3648 wrote to memory of 4504 3648 cmd.exe 123 PID 4504 wrote to memory of 1304 4504 XPEX.exe 124 PID 1304 wrote to memory of 2908 1304 cmd.exe 128 PID 2908 wrote to memory of 4816 2908 SKVG.exe 129 PID 4816 wrote to memory of 1080 4816 cmd.exe 133 PID 1080 wrote to memory of 4268 1080 YXUHGLX.exe 134 PID 4268 wrote to memory of 4164 4268 cmd.exe 138 PID 4164 wrote to memory of 4228 4164 LIKGV.exe 139 PID 4228 wrote to memory of 3292 4228 cmd.exe 143 PID 3292 wrote to memory of 2608 3292 AYLX.exe 144 PID 2608 wrote to memory of 2104 2608 cmd.exe 148 PID 2104 wrote to memory of 2028 2104 BBCT.exe 149 PID 2028 wrote to memory of 5348 2028 cmd.exe 153 PID 5348 wrote to memory of 3752 5348 CEFPVI.exe 154 PID 3752 wrote to memory of 2912 3752 cmd.exe 158 PID 2912 wrote to memory of 6076 2912 ECLJLR.exe 159 PID 6076 wrote to memory of 3800 6076 cmd.exe 163 PID 3800 wrote to memory of 5920 3800 EXP.exe 164 PID 5920 wrote to memory of 3624 5920 cmd.exe 168 PID 3624 wrote to memory of 3588 3624 DQADZNZ.exe 169 PID 3588 wrote to memory of 2500 3588 cmd.exe 173 PID 2500 wrote to memory of 1264 2500 UQGALEU.exe 174 PID 1264 wrote to memory of 4772 1264 cmd.exe 178 PID 4772 wrote to memory of 3508 4772 NTSWRC.exe 179 PID 3508 wrote to memory of 5800 3508 cmd.exe 183 PID 5800 wrote to memory of 1880 5800 GLZPAV.exe 184 PID 1880 wrote to memory of 4144 1880 cmd.exe 188 PID 4144 wrote to memory of 5088 4144 MHZQFYB.exe 189 PID 5088 wrote to memory of 3036 5088 cmd.exe 193 PID 3036 wrote to memory of 1796 3036 LWKLA.exe 194 PID 1796 wrote to memory of 2452 1796 cmd.exe 198 PID 2452 wrote to memory of 5864 2452 UFMYDI.exe 199 PID 5864 wrote to memory of 5172 5864 cmd.exe 203 PID 5172 wrote to memory of 6060 5172 YNAYQT.exe 204 PID 6060 wrote to memory of 2256 6060 cmd.exe 208 PID 2256 wrote to memory of 864 2256 ZQE.exe 209 PID 864 wrote to memory of 5964 864 cmd.exe 213 PID 5964 wrote to memory of 6080 5964 ZVW.exe 214 PID 6080 wrote to memory of 5368 6080 cmd.exe 218 PID 5368 wrote to memory of 4512 5368 XTQLKBL.exe 219 PID 4512 wrote to memory of 5012 4512 cmd.exe 223 PID 5012 wrote to memory of 4412 5012 WESBSP.exe 224 PID 4412 wrote to memory of 5832 4412 cmd.exe 228 PID 5832 wrote to memory of 2876 5832 RRX.exe 229 PID 2876 wrote to memory of 4136 2876 cmd.exe 233 PID 4136 wrote to memory of 3196 4136 LFCU.exe 234 PID 3196 wrote to memory of 2352 3196 cmd.exe 238 PID 2352 wrote to memory of 828 2352 VCIO.exe 239 PID 828 wrote to memory of 3536 828 cmd.exe 243 PID 3536 wrote to memory of 5940 3536 UVT.exe 244 PID 5940 wrote to memory of 612 5940 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9981d0510ecd772327a27a6b75639fda_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRJ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\windows\system\DRJ.exeC:\windows\system\DRJ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HFQCSM.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\windows\HFQCSM.exeC:\windows\HFQCSM.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KAHDMY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\SysWOW64\KAHDMY.exeC:\windows\system32\KAHDMY.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFLKWW.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\windows\system\SFLKWW.exeC:\windows\system\SFLKWW.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDZEEE.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\system\UDZEEE.exeC:\windows\system\UDZEEE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\IYDFK.exeC:\windows\IYDFK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPEX.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\windows\system\XPEX.exeC:\windows\system\XPEX.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKVG.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\windows\SysWOW64\SKVG.exeC:\windows\system32\SKVG.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXUHGLX.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\SysWOW64\YXUHGLX.exeC:\windows\system32\YXUHGLX.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LIKGV.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\LIKGV.exeC:\windows\LIKGV.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYLX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\system\AYLX.exeC:\windows\system\AYLX.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBCT.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\system\BBCT.exeC:\windows\system\BBCT.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEFPVI.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\windows\CEFPVI.exeC:\windows\CEFPVI.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECLJLR.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\windows\system\ECLJLR.exeC:\windows\system\ECLJLR.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXP.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\windows\system\EXP.exeC:\windows\system\EXP.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQADZNZ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\system\DQADZNZ.exeC:\windows\system\DQADZNZ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQGALEU.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\windows\system\UQGALEU.exeC:\windows\system\UQGALEU.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NTSWRC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\windows\system\NTSWRC.exeC:\windows\system\NTSWRC.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLZPAV.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\windows\system\GLZPAV.exeC:\windows\system\GLZPAV.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHZQFYB.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\windows\SysWOW64\MHZQFYB.exeC:\windows\system32\MHZQFYB.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWKLA.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\windows\SysWOW64\LWKLA.exeC:\windows\system32\LWKLA.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFMYDI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\windows\SysWOW64\UFMYDI.exeC:\windows\system32\UFMYDI.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNAYQT.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\YNAYQT.exeC:\windows\YNAYQT.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQE.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\SysWOW64\ZQE.exeC:\windows\system32\ZQE.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZVW.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:864 -
C:\windows\ZVW.exeC:\windows\ZVW.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTQLKBL.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\XTQLKBL.exeC:\windows\XTQLKBL.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WESBSP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\SysWOW64\WESBSP.exeC:\windows\system32\WESBSP.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRX.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\RRX.exeC:\windows\RRX.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFCU.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\windows\LFCU.exeC:\windows\LFCU.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCIO.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\windows\system\VCIO.exeC:\windows\system\VCIO.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVT.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:828 -
C:\windows\system\UVT.exeC:\windows\system\UVT.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGVUL.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\SysWOW64\TGVUL.exeC:\windows\system32\TGVUL.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOCU.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:948 -
C:\windows\XOCU.exeC:\windows\XOCU.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBHDAB.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:796 -
C:\windows\system\RBHDAB.exeC:\windows\system\RBHDAB.exe69⤵
- Executes dropped EXE
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKJILGR.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4532 -
C:\windows\BKJILGR.exeC:\windows\BKJILGR.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DXOA.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:2296 -
C:\windows\DXOA.exeC:\windows\DXOA.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BXVOFA.exe.bat" "74⤵PID:4520
-
C:\windows\SysWOW64\BXVOFA.exeC:\windows\system32\BXVOFA.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NNCO.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1160 -
C:\windows\SysWOW64\NNCO.exeC:\windows\system32\NNCO.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIGRWJ.exe.bat" "78⤵PID:1336
-
C:\windows\system\GIGRWJ.exeC:\windows\system\GIGRWJ.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRIW.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4072 -
C:\windows\XRIW.exeC:\windows\XRIW.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMRBL.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5108 -
C:\windows\system\EMRBL.exeC:\windows\system\EMRBL.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZWKVAW.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1952 -
C:\windows\HZWKVAW.exeC:\windows\HZWKVAW.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHYPZ.exe.bat" "86⤵PID:5716
-
C:\windows\system\QHYPZ.exeC:\windows\system\QHYPZ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHGDQ.exe.bat" "88⤵PID:3488
-
C:\windows\SysWOW64\WHGDQ.exeC:\windows\system32\WHGDQ.exe89⤵
- Executes dropped EXE
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WNG.exe.bat" "90⤵
- Executes a command shell one-liner
PID:248 -
C:\windows\system\WNG.exeC:\windows\system\WNG.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIPECA.exe.bat" "92⤵
- Executes a command shell one-liner
PID:6016 -
C:\windows\system\LIPECA.exeC:\windows\system\LIPECA.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQRJGFN.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2440 -
C:\windows\SysWOW64\CQRJGFN.exeC:\windows\system32\CQRJGFN.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLVF.exe.bat" "96⤵PID:5552
-
C:\windows\VLVF.exeC:\windows\VLVF.exe97⤵
- Executes dropped EXE
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZBCNFF.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5248 -
C:\windows\SysWOW64\ZBCNFF.exeC:\windows\system32\ZBCNFF.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSDEE.exe.bat" "100⤵PID:2484
-
C:\windows\SysWOW64\OSDEE.exeC:\windows\system32\OSDEE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ENM.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1980 -
C:\windows\system\ENM.exeC:\windows\system\ENM.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ESM.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5912 -
C:\windows\ESM.exeC:\windows\ESM.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVQBE.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5228 -
C:\windows\SysWOW64\EVQBE.exeC:\windows\system32\EVQBE.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NIA.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2568 -
C:\windows\SysWOW64\NIA.exeC:\windows\system32\NIA.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KOGQB.exe.bat" "110⤵
- Executes a command shell one-liner
PID:676 -
C:\windows\SysWOW64\KOGQB.exeC:\windows\system32\KOGQB.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KUYEC.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:6100 -
C:\windows\KUYEC.exeC:\windows\KUYEC.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUGSTE.exe.bat" "114⤵PID:4628
-
C:\windows\system\QUGSTE.exeC:\windows\system\QUGSTE.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMJLUUN.exe.bat" "116⤵
- Executes a command shell one-liner
PID:1388 -
C:\windows\SysWOW64\BMJLUUN.exeC:\windows\system32\BMJLUUN.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNRY.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\windows\SysWOW64\HNRY.exeC:\windows\system32\HNRY.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HSJNM.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5352 -
C:\windows\SysWOW64\HSJNM.exeC:\windows\system32\HSJNM.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-