Analysis
- max time kernel
62s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe
- Size 208KB
- Sample260803-k79rhsshlf
- SHA256 23f9302c07292465a381f43b96c756909d7a7fc5cc5c1e82df444dcdbf8cf0b8
- MD5 58d3b5c0c61f18c826bc1b390bdc3eef
- SHA1 b68a1701a03f66d530ccfad01b21afa216f8d138
- SHA512 eb97e5443707ba24564ab02f7db12f570f08185a5372fd47b176c380e2595f50930374662f5f3ef898e500d6f952adc3a165e71791f3bde64f5cad031fc0098a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOfK4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LOCkEj1
- TLSH T1B9247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1416 XCALG.exe 2040 EANTE.exe 2628 QLYGNP.exe 5028 GTZXM.exe 2616 CZR.exe 1340 DCVQQWM.exe 1960 JXGJWKU.exe 4732 CQOUFLC.exe 4944 HTMPN.exe 2836 DYE.exe 5428 NWK.exe 2772 KWUBOMR.exe 6100 JHXRXS.exe 4872 TFKE.exe 3860 BTP.exe 2804 JYB.exe 1700 AGQWM.exe 2120 FHE.exe 2308 APNN.exe 2632 ASDJV.exe 4248 UGC.exe 2568 KLBOUBH.exe 3276 FTK.exe 1988 DMNTBBZ.exe 4752 GZE.exe 5048 FKHKDBD.exe 2692 HIMF.exe 4624 HLY.exe 3932 BDGTIA.exe 2372 TGJPN.exe 1212 SRUF.exe 2912 PSW.exe 6088 IKL.exe 5552 JNCO.exe 4804 RTGV.exe 1308 XOFWNM.exe 1460 ZMTQ.exe 2700 JKZ.exe 4976 ASNH.exe 1588 KQT.exe 2656 YNTNOFC.exe 1096 AJKPZZR.exe 5820 AOXEKXN.exe 4616 ZZZM.exe 2436 SSPF.exe 4660 AFTL.exe 5668 ZQE.exe 2732 WQGEZNJ.exe 2672 PJVPQNA.exe 4704 XOAVBM.exe 4432 OXPTODQ.exe 3460 USA.exe 5000 EQGOBA.exe 2796 JTEB.exe 820 UJXBW.exe 6140 TUIR.exe 4816 XCORRD.exe 2472 MSPRY.exe 3052 ACY.exe 5736 EFWCMU.exe 1196 ALOSCQ.exe 1248 ZWRID.exe 1200 PMAHJR.exe 4596 RHJJDLY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ZMTQ.exe XOFWNM.exe File opened for modification C:\windows\SysWOW64\AOXEKXN.exe AJKPZZR.exe File created C:\windows\SysWOW64\HIMF.exe FKHKDBD.exe File opened for modification C:\windows\SysWOW64\IKL.exe PSW.exe File created C:\windows\SysWOW64\AJKPZZR.exe.bat YNTNOFC.exe File created C:\windows\SysWOW64\XCALG.exe.bat 2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe File created C:\windows\SysWOW64\FKHKDBD.exe GZE.exe File created C:\windows\SysWOW64\ZZZM.exe AOXEKXN.exe File opened for modification C:\windows\SysWOW64\USA.exe OXPTODQ.exe File created C:\windows\SysWOW64\ACY.exe.bat MSPRY.exe File created C:\windows\SysWOW64\PMAHJR.exe.bat ZWRID.exe File opened for modification C:\windows\SysWOW64\KLBOUBH.exe UGC.exe File opened for modification C:\windows\SysWOW64\ZZZM.exe AOXEKXN.exe File created C:\windows\SysWOW64\SSPF.exe.bat ZZZM.exe File created C:\windows\SysWOW64\PMAHJR.exe ZWRID.exe File created C:\windows\SysWOW64\WEDZU.exe DLNO.exe File created C:\windows\SysWOW64\JXGJWKU.exe.bat DCVQQWM.exe File created C:\windows\SysWOW64\SRUF.exe TGJPN.exe File opened for modification C:\windows\SysWOW64\JKZ.exe ZMTQ.exe File created C:\windows\SysWOW64\ALOSCQ.exe.bat EFWCMU.exe File created C:\windows\SysWOW64\FKHKDBD.exe.bat GZE.exe File created C:\windows\SysWOW64\ZMTQ.exe.bat XOFWNM.exe File created C:\windows\SysWOW64\JXGJWKU.exe DCVQQWM.exe File opened for modification C:\windows\SysWOW64\SRUF.exe TGJPN.exe File created C:\windows\SysWOW64\PSW.exe SRUF.exe File created C:\windows\SysWOW64\JKZ.exe ZMTQ.exe File created C:\windows\SysWOW64\ALOSCQ.exe EFWCMU.exe File opened for modification C:\windows\SysWOW64\PMAHJR.exe ZWRID.exe File created C:\windows\SysWOW64\XCALG.exe 2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\EANTE.exe XCALG.exe File opened for modification C:\windows\SysWOW64\SSPF.exe ZZZM.exe File opened for modification C:\windows\SysWOW64\TUIR.exe UJXBW.exe File opened for modification C:\windows\SysWOW64\ALOSCQ.exe EFWCMU.exe File opened for modification C:\windows\SysWOW64\WEDZU.exe DLNO.exe File created C:\windows\SysWOW64\RUYE.exe EJPO.exe File created C:\windows\SysWOW64\DCVQQWM.exe CZR.exe File opened for modification C:\windows\SysWOW64\HIMF.exe FKHKDBD.exe File created C:\windows\SysWOW64\SRUF.exe.bat TGJPN.exe File created C:\windows\SysWOW64\AJKPZZR.exe YNTNOFC.exe File created C:\windows\SysWOW64\AOXEKXN.exe.bat AJKPZZR.exe File opened for modification C:\windows\SysWOW64\RUYE.exe EJPO.exe File opened for modification C:\windows\SysWOW64\XCALG.exe 2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\JXGJWKU.exe DCVQQWM.exe File created C:\windows\SysWOW64\HIMF.exe.bat FKHKDBD.exe File opened for modification C:\windows\SysWOW64\ZMTQ.exe XOFWNM.exe File created C:\windows\SysWOW64\SSPF.exe ZZZM.exe File created C:\windows\SysWOW64\ZQE.exe AFTL.exe File created C:\windows\SysWOW64\USA.exe OXPTODQ.exe File created C:\windows\SysWOW64\APNN.exe.bat FHE.exe File created C:\windows\SysWOW64\AOXEKXN.exe AJKPZZR.exe File created C:\windows\SysWOW64\RUYE.exe.bat EJPO.exe File opened for modification C:\windows\SysWOW64\DCVQQWM.exe CZR.exe File created C:\windows\SysWOW64\DCVQQWM.exe.bat CZR.exe File opened for modification C:\windows\SysWOW64\APNN.exe FHE.exe File created C:\windows\SysWOW64\KLBOUBH.exe UGC.exe File created C:\windows\SysWOW64\ZZZM.exe.bat AOXEKXN.exe File created C:\windows\SysWOW64\ZQE.exe.bat AFTL.exe File created C:\windows\SysWOW64\XOAVBM.exe.bat PJVPQNA.exe File created C:\windows\SysWOW64\WEDZU.exe.bat DLNO.exe File created C:\windows\SysWOW64\APNN.exe FHE.exe File created C:\windows\SysWOW64\KLBOUBH.exe.bat UGC.exe File opened for modification C:\windows\SysWOW64\FKHKDBD.exe GZE.exe File created C:\windows\SysWOW64\IKL.exe PSW.exe File created C:\windows\SysWOW64\IKL.exe.bat PSW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\EJPO.exe.bat WEDZU.exe File opened for modification C:\windows\DMNTBBZ.exe FTK.exe File created C:\windows\system\HTMPN.exe CQOUFLC.exe File created C:\windows\system\HTMPN.exe.bat CQOUFLC.exe File opened for modification C:\windows\system\ASDJV.exe APNN.exe File created C:\windows\JNCO.exe.bat IKL.exe File opened for modification C:\windows\ASNH.exe JKZ.exe File created C:\windows\system\OXPTODQ.exe XOAVBM.exe File created C:\windows\DMNTBBZ.exe.bat FTK.exe File created C:\windows\system\CQOUFLC.exe JXGJWKU.exe File opened for modification C:\windows\system\HTMPN.exe CQOUFLC.exe File created C:\windows\HLY.exe HIMF.exe File opened for modification C:\windows\system\NSWBP.exe IPYGPCS.exe File created C:\windows\JYB.exe BTP.exe File created C:\windows\system\RTGV.exe JNCO.exe File opened for modification C:\windows\system\KQT.exe ASNH.exe File opened for modification C:\windows\YNTNOFC.exe KQT.exe File created C:\windows\EFWCMU.exe.bat ACY.exe File opened for modification C:\windows\FTK.exe KLBOUBH.exe File created C:\windows\system\TFKE.exe JHXRXS.exe File created C:\windows\FHE.exe.bat AGQWM.exe File created C:\windows\FTK.exe KLBOUBH.exe File opened for modification C:\windows\system\WQGEZNJ.exe ZQE.exe File created C:\windows\GTZXM.exe.bat QLYGNP.exe File opened for modification C:\windows\NWK.exe DYE.exe File created C:\windows\BDGTIA.exe.bat HLY.exe File opened for modification C:\windows\JYB.exe BTP.exe File created C:\windows\UJXBW.exe JTEB.exe File created C:\windows\system\ASDJV.exe APNN.exe File created C:\windows\DMNTBBZ.exe FTK.exe File created C:\windows\ZWRID.exe ALOSCQ.exe File opened for modification C:\windows\system\XOFWNM.exe RTGV.exe File created C:\windows\system\IPYGPCS.exe.bat RHJJDLY.exe File opened for modification C:\windows\system\KWUBOMR.exe NWK.exe File opened for modification C:\windows\system\BTP.exe TFKE.exe File opened for modification C:\windows\HLY.exe HIMF.exe File opened for modification C:\windows\JNCO.exe IKL.exe File created C:\windows\system\RTGV.exe.bat JNCO.exe File created C:\windows\AFTL.exe.bat SSPF.exe File created C:\windows\system\JHXRXS.exe.bat KWUBOMR.exe File created C:\windows\system\KWUBOMR.exe.bat NWK.exe File created C:\windows\system\AGQWM.exe.bat JYB.exe File created C:\windows\FHE.exe AGQWM.exe File created C:\windows\system\TGJPN.exe.bat BDGTIA.exe File opened for modification C:\windows\system\OXPTODQ.exe XOAVBM.exe File opened for modification C:\windows\system\QLYGNP.exe EANTE.exe File created C:\windows\AFTL.exe SSPF.exe File created C:\windows\system\BTP.exe.bat TFKE.exe File created C:\windows\HLY.exe.bat HIMF.exe File created C:\windows\system\RHJJDLY.exe PMAHJR.exe File opened for modification C:\windows\FHE.exe AGQWM.exe File opened for modification C:\windows\system\UGC.exe ASDJV.exe File opened for modification C:\windows\system\RHJJDLY.exe PMAHJR.exe File created C:\windows\system\ETKYCMY.exe.bat NSWBP.exe File created C:\windows\system\JTEB.exe.bat EQGOBA.exe File opened for modification C:\windows\system\CZR.exe GTZXM.exe File created C:\windows\JNCO.exe IKL.exe File created C:\windows\system\XCORRD.exe.bat TUIR.exe File created C:\windows\system\MSPRY.exe XCORRD.exe File created C:\windows\DLNO.exe ETKYCMY.exe File created C:\windows\system\CZR.exe GTZXM.exe File created C:\windows\system\UGC.exe ASDJV.exe File created C:\windows\ASNH.exe.bat JKZ.exe File opened for modification C:\windows\AFTL.exe SSPF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2172 cmd.exe 5612 cmd.exe 888 cmd.exe 3040 cmd.exe 4848 cmd.exe 3300 cmd.exe 3736 cmd.exe 4880 cmd.exe 1644 cmd.exe 2972 cmd.exe 5004 cmd.exe 704 cmd.exe 4812 cmd.exe 200 cmd.exe 4900 cmd.exe 5560 cmd.exe 1760 cmd.exe 1708 cmd.exe 3548 cmd.exe 5292 cmd.exe 4556 cmd.exe 1176 cmd.exe 5144 cmd.exe 5636 cmd.exe 4232 cmd.exe 1360 cmd.exe 5916 cmd.exe 5212 cmd.exe 3492 cmd.exe 4604 cmd.exe 4972 cmd.exe 4548 cmd.exe 4584 cmd.exe 476 cmd.exe 1892 cmd.exe 3032 cmd.exe 3412 cmd.exe 1292 cmd.exe 4840 cmd.exe 4252 cmd.exe 5100 cmd.exe 1880 cmd.exe 2968 cmd.exe 1136 cmd.exe 2944 cmd.exe 5420 cmd.exe 5544 cmd.exe 3388 cmd.exe 5720 cmd.exe 1476 cmd.exe 3432 cmd.exe 480 cmd.exe 4472 cmd.exe 3744 cmd.exe 5880 cmd.exe 1764 cmd.exe 3732 cmd.exe 4200 cmd.exe 3384 cmd.exe 4264 cmd.exe 4920 cmd.exe 1896 cmd.exe 1240 cmd.exe 1012 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4648 5104 WerFault.exe 87 2580 1416 WerFault.exe 93 2108 2040 WerFault.exe 99 3436 2628 WerFault.exe 104 6044 5028 WerFault.exe 109 6136 2616 WerFault.exe 113 2756 1340 WerFault.exe 119 4088 1960 WerFault.exe 124 6108 4732 WerFault.exe 129 5260 4944 WerFault.exe 134 5416 2836 WerFault.exe 139 2832 5428 WerFault.exe 144 240 2772 WerFault.exe 149 5532 6100 WerFault.exe 153 4168 4872 WerFault.exe 159 4200 3860 WerFault.exe 164 2868 2804 WerFault.exe 169 3384 1700 WerFault.exe 174 2492 2120 WerFault.exe 179 688 2308 WerFault.exe 184 4480 2632 WerFault.exe 189 1264 4248 WerFault.exe 194 4768 2568 WerFault.exe 199 480 3276 WerFault.exe 204 4988 1988 WerFault.exe 209 1972 4752 WerFault.exe 214 2092 5048 WerFault.exe 219 5800 2692 WerFault.exe 224 5488 4624 WerFault.exe 229 5680 3932 WerFault.exe 234 2216 2372 WerFault.exe 239 5560 1212 WerFault.exe 244 2884 2912 WerFault.exe 249 5132 6088 WerFault.exe 254 2280 5552 WerFault.exe 260 4844 4804 WerFault.exe 265 6068 1308 WerFault.exe 270 4816 1460 WerFault.exe 275 5540 2700 WerFault.exe 280 4240 4976 WerFault.exe 285 4076 1588 WerFault.exe 289 1176 2656 WerFault.exe 295 5760 1096 WerFault.exe 300 5708 5820 WerFault.exe 305 2280 4616 WerFault.exe 310 3432 2436 WerFault.exe 315 3600 4660 WerFault.exe 320 5880 5668 WerFault.exe 325 5632 2732 WerFault.exe 330 2544 2672 WerFault.exe 335 1264 4704 WerFault.exe 340 3040 4432 WerFault.exe 345 5932 3460 WerFault.exe 350 4724 5000 WerFault.exe 355 4996 2796 WerFault.exe 360 5992 820 WerFault.exe 365 1796 6140 WerFault.exe 370 3556 4816 WerFault.exe 375 4940 2472 WerFault.exe 380 3536 3052 WerFault.exe 385 472 5736 WerFault.exe 390 5868 1196 WerFault.exe 395 4980 1248 WerFault.exe 400 1592 1200 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EANTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOFWNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALOSCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFWCMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWRID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEDZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AGQWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSWBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWUBOMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOAVBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPYGPCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMAHJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXGJWKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCALG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSPRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQOUFLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5104 2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe 5104 2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe 1416 XCALG.exe 1416 XCALG.exe 2040 EANTE.exe 2040 EANTE.exe 2628 QLYGNP.exe 2628 QLYGNP.exe 5028 GTZXM.exe 5028 GTZXM.exe 2616 CZR.exe 2616 CZR.exe 1340 DCVQQWM.exe 1340 DCVQQWM.exe 1960 JXGJWKU.exe 1960 JXGJWKU.exe 4732 CQOUFLC.exe 4732 CQOUFLC.exe 4944 HTMPN.exe 4944 HTMPN.exe 2836 DYE.exe 2836 DYE.exe 5428 NWK.exe 5428 NWK.exe 2772 KWUBOMR.exe 2772 KWUBOMR.exe 6100 JHXRXS.exe 6100 JHXRXS.exe 4872 TFKE.exe 4872 TFKE.exe 3860 BTP.exe 3860 BTP.exe 2804 JYB.exe 2804 JYB.exe 1700 AGQWM.exe 1700 AGQWM.exe 2120 FHE.exe 2120 FHE.exe 2308 APNN.exe 2308 APNN.exe 2632 ASDJV.exe 2632 ASDJV.exe 4248 UGC.exe 4248 UGC.exe 2568 KLBOUBH.exe 2568 KLBOUBH.exe 3276 FTK.exe 3276 FTK.exe 1988 DMNTBBZ.exe 1988 DMNTBBZ.exe 4752 GZE.exe 4752 GZE.exe 5048 FKHKDBD.exe 5048 FKHKDBD.exe 2692 HIMF.exe 2692 HIMF.exe 4624 HLY.exe 4624 HLY.exe 3932 BDGTIA.exe 3932 BDGTIA.exe 2372 TGJPN.exe 2372 TGJPN.exe 1212 SRUF.exe 1212 SRUF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5104 2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe 5104 2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe 1416 XCALG.exe 1416 XCALG.exe 2040 EANTE.exe 2040 EANTE.exe 2628 QLYGNP.exe 2628 QLYGNP.exe 5028 GTZXM.exe 5028 GTZXM.exe 2616 CZR.exe 2616 CZR.exe 1340 DCVQQWM.exe 1340 DCVQQWM.exe 1960 JXGJWKU.exe 1960 JXGJWKU.exe 4732 CQOUFLC.exe 4732 CQOUFLC.exe 4944 HTMPN.exe 4944 HTMPN.exe 2836 DYE.exe 2836 DYE.exe 5428 NWK.exe 5428 NWK.exe 2772 KWUBOMR.exe 2772 KWUBOMR.exe 6100 JHXRXS.exe 6100 JHXRXS.exe 4872 TFKE.exe 4872 TFKE.exe 3860 BTP.exe 3860 BTP.exe 2804 JYB.exe 2804 JYB.exe 1700 AGQWM.exe 1700 AGQWM.exe 2120 FHE.exe 2120 FHE.exe 2308 APNN.exe 2308 APNN.exe 2632 ASDJV.exe 2632 ASDJV.exe 4248 UGC.exe 4248 UGC.exe 2568 KLBOUBH.exe 2568 KLBOUBH.exe 3276 FTK.exe 3276 FTK.exe 1988 DMNTBBZ.exe 1988 DMNTBBZ.exe 4752 GZE.exe 4752 GZE.exe 5048 FKHKDBD.exe 5048 FKHKDBD.exe 2692 HIMF.exe 2692 HIMF.exe 4624 HLY.exe 4624 HLY.exe 3932 BDGTIA.exe 3932 BDGTIA.exe 2372 TGJPN.exe 2372 TGJPN.exe 1212 SRUF.exe 1212 SRUF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 4252 5104 2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe 89 PID 4252 wrote to memory of 1416 4252 cmd.exe 93 PID 1416 wrote to memory of 2636 1416 XCALG.exe 95 PID 2636 wrote to memory of 2040 2636 cmd.exe 99 PID 2040 wrote to memory of 5032 2040 EANTE.exe 100 PID 5032 wrote to memory of 2628 5032 cmd.exe 104 PID 2628 wrote to memory of 5016 2628 QLYGNP.exe 105 PID 5016 wrote to memory of 5028 5016 cmd.exe 109 PID 5028 wrote to memory of 3388 5028 GTZXM.exe 110 PID 3388 wrote to memory of 2616 3388 cmd.exe 113 PID 2616 wrote to memory of 1764 2616 CZR.exe 115 PID 1764 wrote to memory of 1340 1764 cmd.exe 119 PID 1340 wrote to memory of 5940 1340 DCVQQWM.exe 120 PID 5940 wrote to memory of 1960 5940 cmd.exe 124 PID 1960 wrote to memory of 5020 1960 JXGJWKU.exe 125 PID 5020 wrote to memory of 4732 5020 cmd.exe 129 PID 4732 wrote to memory of 4216 4732 CQOUFLC.exe 130 PID 4216 wrote to memory of 4944 4216 cmd.exe 134 PID 4944 wrote to memory of 4880 4944 HTMPN.exe 135 PID 4880 wrote to memory of 2836 4880 cmd.exe 139 PID 2836 wrote to memory of 952 2836 DYE.exe 140 PID 952 wrote to memory of 5428 952 cmd.exe 144 PID 5428 wrote to memory of 3732 5428 NWK.exe 145 PID 3732 wrote to memory of 2772 3732 cmd.exe 149 PID 2772 wrote to memory of 1360 2772 KWUBOMR.exe 150 PID 1360 wrote to memory of 6100 1360 cmd.exe 153 PID 6100 wrote to memory of 1892 6100 JHXRXS.exe 155 PID 1892 wrote to memory of 4872 1892 cmd.exe 159 PID 4872 wrote to memory of 5336 4872 TFKE.exe 160 PID 5336 wrote to memory of 3860 5336 cmd.exe 164 PID 3860 wrote to memory of 1060 3860 BTP.exe 165 PID 1060 wrote to memory of 2804 1060 cmd.exe 169 PID 2804 wrote to memory of 1908 2804 JYB.exe 170 PID 1908 wrote to memory of 1700 1908 cmd.exe 174 PID 1700 wrote to memory of 1168 1700 AGQWM.exe 175 PID 1168 wrote to memory of 2120 1168 cmd.exe 179 PID 2120 wrote to memory of 3256 2120 FHE.exe 180 PID 3256 wrote to memory of 2308 3256 cmd.exe 184 PID 2308 wrote to memory of 3032 2308 APNN.exe 185 PID 3032 wrote to memory of 2632 3032 cmd.exe 189 PID 2632 wrote to memory of 976 2632 ASDJV.exe 190 PID 976 wrote to memory of 4248 976 cmd.exe 194 PID 4248 wrote to memory of 4556 4248 UGC.exe 195 PID 4556 wrote to memory of 2568 4556 cmd.exe 199 PID 2568 wrote to memory of 2596 2568 KLBOUBH.exe 200 PID 2596 wrote to memory of 3276 2596 cmd.exe 204 PID 3276 wrote to memory of 5272 3276 FTK.exe 205 PID 5272 wrote to memory of 1988 5272 cmd.exe 209 PID 1988 wrote to memory of 5100 1988 DMNTBBZ.exe 210 PID 5100 wrote to memory of 4752 5100 cmd.exe 214 PID 4752 wrote to memory of 1128 4752 GZE.exe 215 PID 1128 wrote to memory of 5048 1128 cmd.exe 219 PID 5048 wrote to memory of 5612 5048 FKHKDBD.exe 220 PID 5612 wrote to memory of 2692 5612 cmd.exe 224 PID 2692 wrote to memory of 888 2692 HIMF.exe 225 PID 888 wrote to memory of 4624 888 cmd.exe 229 PID 4624 wrote to memory of 1668 4624 HLY.exe 230 PID 1668 wrote to memory of 3932 1668 cmd.exe 234 PID 3932 wrote to memory of 2364 3932 BDGTIA.exe 235 PID 2364 wrote to memory of 2372 2364 cmd.exe 239 PID 2372 wrote to memory of 3412 2372 TGJPN.exe 240 PID 3412 wrote to memory of 1212 3412 cmd.exe 244 PID 1212 wrote to memory of 616 1212 SRUF.exe 245 PID 616 wrote to memory of 2912 616 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_58d3b5c0c61f18c826bc1b390bdc3eef_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XCALG.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\windows\SysWOW64\XCALG.exeC:\windows\system32\XCALG.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EANTE.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\SysWOW64\EANTE.exeC:\windows\system32\EANTE.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QLYGNP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\system\QLYGNP.exeC:\windows\system\QLYGNP.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTZXM.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\windows\GTZXM.exeC:\windows\GTZXM.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZR.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\system\CZR.exeC:\windows\system\CZR.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCVQQWM.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\windows\SysWOW64\DCVQQWM.exeC:\windows\system32\DCVQQWM.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXGJWKU.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\SysWOW64\JXGJWKU.exeC:\windows\system32\JXGJWKU.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQOUFLC.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\system\CQOUFLC.exeC:\windows\system\CQOUFLC.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HTMPN.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\system\HTMPN.exeC:\windows\system\HTMPN.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYE.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\system\DYE.exeC:\windows\system\DYE.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NWK.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:952 -
C:\windows\NWK.exeC:\windows\NWK.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWUBOMR.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\windows\system\KWUBOMR.exeC:\windows\system\KWUBOMR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHXRXS.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\windows\system\JHXRXS.exeC:\windows\system\JHXRXS.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFKE.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\windows\system\TFKE.exeC:\windows\system\TFKE.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTP.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\windows\system\BTP.exeC:\windows\system\BTP.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYB.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\JYB.exeC:\windows\JYB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGQWM.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\windows\system\AGQWM.exeC:\windows\system\AGQWM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\windows\FHE.exeC:\windows\FHE.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APNN.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\SysWOW64\APNN.exeC:\windows\system32\APNN.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASDJV.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\system\ASDJV.exeC:\windows\system\ASDJV.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\windows\system\UGC.exeC:\windows\system\UGC.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLBOUBH.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\windows\SysWOW64\KLBOUBH.exeC:\windows\system32\KLBOUBH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTK.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\FTK.exeC:\windows\FTK.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMNTBBZ.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\windows\DMNTBBZ.exeC:\windows\DMNTBBZ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZE.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\windows\GZE.exeC:\windows\GZE.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FKHKDBD.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\windows\SysWOW64\FKHKDBD.exeC:\windows\system32\FKHKDBD.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HIMF.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\SysWOW64\HIMF.exeC:\windows\system32\HIMF.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLY.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:888 -
C:\windows\HLY.exeC:\windows\HLY.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGTIA.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\windows\BDGTIA.exeC:\windows\BDGTIA.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGJPN.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\system\TGJPN.exeC:\windows\system\TGJPN.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRUF.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\SysWOW64\SRUF.exeC:\windows\system32\SRUF.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\SysWOW64\PSW.exeC:\windows\system32\PSW.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKL.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1880 -
C:\windows\SysWOW64\IKL.exeC:\windows\system32\IKL.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNCO.exe.bat" "68⤵PID:256
-
C:\windows\JNCO.exeC:\windows\JNCO.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTGV.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3884 -
C:\windows\system\RTGV.exeC:\windows\system\RTGV.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOFWNM.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4296 -
C:\windows\system\XOFWNM.exeC:\windows\system\XOFWNM.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMTQ.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2240 -
C:\windows\SysWOW64\ZMTQ.exeC:\windows\system32\ZMTQ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JKZ.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4920 -
C:\windows\SysWOW64\JKZ.exeC:\windows\system32\JKZ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASNH.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5192 -
C:\windows\ASNH.exeC:\windows\ASNH.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "80⤵PID:4512
-
C:\windows\system\KQT.exeC:\windows\system\KQT.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNTNOFC.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5212 -
C:\windows\YNTNOFC.exeC:\windows\YNTNOFC.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJKPZZR.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5560 -
C:\windows\SysWOW64\AJKPZZR.exeC:\windows\system32\AJKPZZR.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOXEKXN.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2704 -
C:\windows\SysWOW64\AOXEKXN.exeC:\windows\system32\AOXEKXN.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZZM.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1760 -
C:\windows\SysWOW64\ZZZM.exeC:\windows\system32\ZZZM.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSPF.exe.bat" "90⤵PID:3420
-
C:\windows\SysWOW64\SSPF.exeC:\windows\system32\SSPF.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFTL.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2968 -
C:\windows\AFTL.exeC:\windows\AFTL.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQE.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4200 -
C:\windows\SysWOW64\ZQE.exeC:\windows\system32\ZQE.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQGEZNJ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:6036 -
C:\windows\system\WQGEZNJ.exeC:\windows\system\WQGEZNJ.exe97⤵
- Executes dropped EXE
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJVPQNA.exe.bat" "98⤵PID:5908
-
C:\windows\SysWOW64\PJVPQNA.exeC:\windows\system32\PJVPQNA.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOAVBM.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1136 -
C:\windows\SysWOW64\XOAVBM.exeC:\windows\system32\XOAVBM.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXPTODQ.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2944 -
C:\windows\system\OXPTODQ.exeC:\windows\system\OXPTODQ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USA.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1176 -
C:\windows\SysWOW64\USA.exeC:\windows\system32\USA.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQGOBA.exe.bat" "106⤵PID:6132
-
C:\windows\EQGOBA.exeC:\windows\EQGOBA.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTEB.exe.bat" "108⤵PID:1552
-
C:\windows\system\JTEB.exeC:\windows\system\JTEB.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJXBW.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:5396 -
C:\windows\UJXBW.exeC:\windows\UJXBW.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TUIR.exe.bat" "112⤵PID:3652
-
C:\windows\SysWOW64\TUIR.exeC:\windows\system32\TUIR.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCORRD.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3384 -
C:\windows\system\XCORRD.exeC:\windows\system\XCORRD.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MSPRY.exe.bat" "116⤵PID:6136
-
C:\windows\system\MSPRY.exeC:\windows\system\MSPRY.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACY.exe.bat" "118⤵PID:5464
-
C:\windows\SysWOW64\ACY.exeC:\windows\system32\ACY.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EFWCMU.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1896 -
C:\windows\EFWCMU.exeC:\windows\EFWCMU.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-