Analysis
- max time kernel
79s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_6fc6ddda9053efcd048fdd7066064c5b_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_6fc6ddda9053efcd048fdd7066064c5b_elex_emotet_stop.exe
- Size 208KB
- Sample260809-w5g49stdlf
- SHA256 ff6bf1533ad10756b9a775c255738202d21d3625639473ca222d8e631c6049b7
- MD5 6fc6ddda9053efcd048fdd7066064c5b
- SHA1 f0f49c4f945e66b0e41a4aa5363e3e675d25c3a1
- SHA512 006232c44352a2c48dd00300a3fed08ad5a1fe10634e1c81148020e5ba8dc75bed1ec92e1856474e4060d072070c9e9c09d0e8a1efa6246c71990202fc15c69f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb1lldL+LOfu4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb1ll5+LOmkEj1
- TLSH T1CB247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4844 RSMD.exe 3724 CWLXPA.exe 3012 TERUCRX.exe 3404 WZJENKN.exe 5992 CMUXBZV.exe 5604 PSUJD.exe 2640 MYMYTG.exe 4768 NWUHDQQ.exe 4400 CRELO.exe 3736 GUC.exe 5020 DKPYE.exe 2356 SFZCPY.exe 1800 RYJSY.exe 852 HOKR.exe 856 SGSC.exe 5756 MTXMY.exe 3744 LEHC.exe 3332 GSMLJG.exe 5996 ZSUW.exe 3452 YDF.exe 4932 SQBWL.exe 1124 GBSUA.exe 3372 EMVCIDM.exe 3820 DXFSRR.exe 5640 HNM.exe 2144 TVT.exe 3304 CDVF.exe 4456 GLBOFKI.exe 5508 RDE.exe 5356 XEMUW.exe 616 IWHFXJ.exe 5900 SXJ.exe 1308 USOB.exe 5800 YAUBXYB.exe 6096 KTX.exe 2520 ZOHYQS.exe 4332 TJM.exe 5560 DJOV.exe 4596 USQAH.exe 1692 RXAPXQ.exe 3564 IXCUJWH.exe 5188 GYJI.exe 4416 VOK.exe 5972 KJCM.exe 4600 AZDLQUV.exe 3892 EPJL.exe 2920 TFK.exe 872 OSPUL.exe 3756 USXIUCW.exe 4880 ZTFW.exe 6128 UGJFOE.exe 2992 ZRFDB.exe 2080 KJIWBC.exe 5444 NXN.exe 1832 HVGIRRB.exe 3908 ESM.exe 4892 LLV.exe 3028 AQTVT.exe 2264 ZBDL.exe 3420 LJKLOND.exe 2664 URM.exe 5340 HUU.exe 4444 PIVE.exe 5644 EDEISV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ZOHYQS.exe.bat KTX.exe File created C:\windows\SysWOW64\DJOV.exe.bat TJM.exe File opened for modification C:\windows\SysWOW64\URM.exe LJKLOND.exe File created C:\windows\SysWOW64\URM.exe.bat LJKLOND.exe File opened for modification C:\windows\SysWOW64\LVHFQ.exe OPCIJA.exe File created C:\windows\SysWOW64\IOWT.exe IJW.exe File created C:\windows\SysWOW64\GYJI.exe IXCUJWH.exe File created C:\windows\SysWOW64\KUJC.exe JQFHY.exe File opened for modification C:\windows\SysWOW64\IJW.exe NWRVLIP.exe File opened for modification C:\windows\SysWOW64\EVXX.exe FKMHA.exe File opened for modification C:\windows\SysWOW64\LKRWGRT.exe OELHZHZ.exe File created C:\windows\SysWOW64\XEKRBUX.exe GQAZ.exe File opened for modification C:\windows\SysWOW64\KJCM.exe VOK.exe File created C:\windows\SysWOW64\LJKLOND.exe.bat ZBDL.exe File created C:\windows\SysWOW64\XEMUW.exe RDE.exe File opened for modification C:\windows\SysWOW64\DJOV.exe TJM.exe File opened for modification C:\windows\SysWOW64\LJKLOND.exe ZBDL.exe File created C:\windows\SysWOW64\TDOJN.exe.bat EIEWUIZ.exe File created C:\windows\SysWOW64\FHL.exe ICO.exe File opened for modification C:\windows\SysWOW64\CWLXPA.exe RSMD.exe File created C:\windows\SysWOW64\OELHZHZ.exe.bat DMQOQA.exe File opened for modification C:\windows\SysWOW64\IWN.exe XEKRBUX.exe File opened for modification C:\windows\SysWOW64\KUJC.exe JQFHY.exe File created C:\windows\SysWOW64\LVHFQ.exe OPCIJA.exe File opened for modification C:\windows\SysWOW64\KUDC.exe PHYTIWT.exe File created C:\windows\SysWOW64\KJCM.exe.bat VOK.exe File opened for modification C:\windows\SysWOW64\HVGIRRB.exe NXN.exe File created C:\windows\SysWOW64\DMQOQA.exe TDOJN.exe File opened for modification C:\windows\SysWOW64\DMQOQA.exe TDOJN.exe File created C:\windows\SysWOW64\DMQOQA.exe.bat TDOJN.exe File created C:\windows\SysWOW64\LKRWGRT.exe.bat OELHZHZ.exe File created C:\windows\SysWOW64\IOWT.exe.bat IJW.exe File created C:\windows\SysWOW64\FKMHA.exe FHIMUW.exe File opened for modification C:\windows\SysWOW64\KTX.exe YAUBXYB.exe File opened for modification C:\windows\SysWOW64\FHL.exe ICO.exe File created C:\windows\SysWOW64\FHL.exe.bat ICO.exe File opened for modification C:\windows\SysWOW64\JQFHY.exe AIDU.exe File created C:\windows\SysWOW64\JQFHY.exe.bat AIDU.exe File created C:\windows\SysWOW64\PHYTIWT.exe CWQU.exe File created C:\windows\SysWOW64\FKMHA.exe.bat FHIMUW.exe File created C:\windows\SysWOW64\ZOHYQS.exe KTX.exe File opened for modification C:\windows\SysWOW64\ZOHYQS.exe KTX.exe File created C:\windows\SysWOW64\CWLXPA.exe RSMD.exe File created C:\windows\SysWOW64\CWLXPA.exe.bat RSMD.exe File opened for modification C:\windows\SysWOW64\TDOJN.exe EIEWUIZ.exe File created C:\windows\SysWOW64\IJW.exe NWRVLIP.exe File created C:\windows\SysWOW64\HVGIRRB.exe NXN.exe File opened for modification C:\windows\SysWOW64\OELHZHZ.exe DMQOQA.exe File opened for modification C:\windows\SysWOW64\WCU.exe LKRWGRT.exe File created C:\windows\SysWOW64\XEKRBUX.exe.bat GQAZ.exe File created C:\windows\SysWOW64\LVHFQ.exe.bat OPCIJA.exe File created C:\windows\SysWOW64\EVXX.exe FKMHA.exe File created C:\windows\SysWOW64\NWUHDQQ.exe.bat MYMYTG.exe File created C:\windows\SysWOW64\XEMUW.exe.bat RDE.exe File created C:\windows\SysWOW64\KTX.exe.bat YAUBXYB.exe File created C:\windows\SysWOW64\OELHZHZ.exe DMQOQA.exe File opened for modification C:\windows\SysWOW64\XEKRBUX.exe GQAZ.exe File opened for modification C:\windows\SysWOW64\IOWT.exe IJW.exe File opened for modification C:\windows\SysWOW64\FKMHA.exe FHIMUW.exe File created C:\windows\SysWOW64\GYJI.exe.bat IXCUJWH.exe File created C:\windows\SysWOW64\KJCM.exe VOK.exe File opened for modification C:\windows\SysWOW64\NWUHDQQ.exe MYMYTG.exe File opened for modification C:\windows\SysWOW64\XEMUW.exe RDE.exe File opened for modification C:\windows\SysWOW64\GYJI.exe IXCUJWH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\EIEWUIZ.exe EDEISV.exe File created C:\windows\QIB.exe.bat WVWFHV.exe File opened for modification C:\windows\CRELO.exe NWUHDQQ.exe File opened for modification C:\windows\system\SGSC.exe HOKR.exe File created C:\windows\LEHC.exe MTXMY.exe File created C:\windows\ESM.exe HVGIRRB.exe File created C:\windows\ESM.exe.bat HVGIRRB.exe File created C:\windows\system\LLV.exe ESM.exe File created C:\windows\GQAZ.exe.bat GLI.exe File opened for modification C:\windows\RDN.exe OQISBE.exe File opened for modification C:\windows\LEHC.exe MTXMY.exe File created C:\windows\RDE.exe GLBOFKI.exe File created C:\windows\SXJ.exe IWHFXJ.exe File created C:\windows\system\USOB.exe.bat SXJ.exe File opened for modification C:\windows\system\ZTFW.exe USXIUCW.exe File created C:\windows\FHIMUW.exe.bat KUDC.exe File created C:\windows\SFZCPY.exe.bat DKPYE.exe File created C:\windows\system\TVT.exe HNM.exe File created C:\windows\system\CDVF.exe.bat TVT.exe File opened for modification C:\windows\system\KJIWBC.exe ZRFDB.exe File created C:\windows\system\OPCIJA.exe.bat KHV.exe File opened for modification C:\windows\OQISBE.exe OCQDZR.exe File created C:\windows\FHIMUW.exe KUDC.exe File created C:\windows\system\WZJENKN.exe TERUCRX.exe File created C:\windows\system\GSMLJG.exe.bat LEHC.exe File created C:\windows\SXJ.exe.bat IWHFXJ.exe File created C:\windows\system\KJIWBC.exe ZRFDB.exe File created C:\windows\system\QUQQNQ.exe KUJC.exe File opened for modification C:\windows\NWRVLIP.exe YBHI.exe File opened for modification C:\windows\CKBCHV.exe IOWT.exe File created C:\windows\system\GUC.exe CRELO.exe File created C:\windows\system\DKPYE.exe.bat GUC.exe File created C:\windows\RDE.exe.bat GLBOFKI.exe File created C:\windows\system\USOB.exe SXJ.exe File created C:\windows\system\TJM.exe ZOHYQS.exe File created C:\windows\system\RXAPXQ.exe.bat USQAH.exe File created C:\windows\system\ZTFW.exe.bat USXIUCW.exe File opened for modification C:\windows\KHV.exe QUQQNQ.exe File created C:\windows\TERUCRX.exe.bat CWLXPA.exe File created C:\windows\system\GUC.exe.bat CRELO.exe File created C:\windows\system\HNM.exe.bat DXFSRR.exe File created C:\windows\system\CDVF.exe TVT.exe File opened for modification C:\windows\system\TJM.exe ZOHYQS.exe File opened for modification C:\windows\USXIUCW.exe OSPUL.exe File created C:\windows\AKAXSR.exe WCU.exe File created C:\windows\WVWFHV.exe.bat FHL.exe File created C:\windows\system\GBSUA.exe SQBWL.exe File created C:\windows\IWHFXJ.exe XEMUW.exe File created C:\windows\system\TFK.exe EPJL.exe File created C:\windows\system\ZTFW.exe USXIUCW.exe File opened for modification C:\windows\WVWFHV.exe FHL.exe File opened for modification C:\windows\system\AIDU.exe QIB.exe File created C:\windows\system\HOKR.exe.bat RYJSY.exe File created C:\windows\system\AIDU.exe QIB.exe File created C:\windows\KHV.exe QUQQNQ.exe File created C:\windows\OCQDZR.exe UPLU.exe File created C:\windows\CMUXBZV.exe WZJENKN.exe File created C:\windows\system\PSUJD.exe.bat CMUXBZV.exe File opened for modification C:\windows\ZSUW.exe GSMLJG.exe File created C:\windows\HUU.exe.bat URM.exe File created C:\windows\GQAZ.exe GLI.exe File opened for modification C:\windows\system\VOK.exe GYJI.exe File created C:\windows\PIVE.exe HUU.exe File opened for modification C:\windows\UPLU.exe CKBCHV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 888 cmd.exe 1084 cmd.exe 3532 cmd.exe 2484 cmd.exe 1028 cmd.exe 1624 cmd.exe 4924 cmd.exe 4080 cmd.exe 1972 cmd.exe 3208 cmd.exe 4948 cmd.exe 1524 cmd.exe 4460 cmd.exe 3104 cmd.exe 1568 cmd.exe 5556 cmd.exe 2872 cmd.exe 1156 cmd.exe 1496 cmd.exe 4260 cmd.exe 4760 cmd.exe 2044 cmd.exe 552 cmd.exe 3336 cmd.exe 4972 cmd.exe 4704 cmd.exe 5692 cmd.exe 2000 cmd.exe 904 cmd.exe 3444 cmd.exe 248 cmd.exe 1544 cmd.exe 4748 cmd.exe 5744 cmd.exe 52 cmd.exe 6124 cmd.exe 4856 cmd.exe 3980 cmd.exe 5032 cmd.exe 352 cmd.exe 2216 cmd.exe 1208 cmd.exe 260 cmd.exe 6012 cmd.exe 752 cmd.exe 256 cmd.exe 2832 cmd.exe 1136 cmd.exe 4684 cmd.exe 828 cmd.exe 1696 cmd.exe 3648 cmd.exe 3476 cmd.exe 1944 cmd.exe 6140 cmd.exe 4368 cmd.exe 1196 cmd.exe 1372 cmd.exe 4300 cmd.exe 2496 cmd.exe 460 cmd.exe 4248 cmd.exe 5436 cmd.exe 3952 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 204 3064 WerFault.exe 89 1456 4844 WerFault.exe 94 4664 3724 WerFault.exe 100 1216 3012 WerFault.exe 105 2496 3404 WerFault.exe 110 2484 5992 WerFault.exe 115 4960 5604 WerFault.exe 120 2964 2640 WerFault.exe 125 3112 4768 WerFault.exe 130 5636 4400 WerFault.exe 135 5528 3736 WerFault.exe 140 4224 5020 WerFault.exe 145 3840 2356 WerFault.exe 150 4212 1800 WerFault.exe 155 2520 852 WerFault.exe 160 2812 856 WerFault.exe 165 2880 5756 WerFault.exe 170 5024 3744 WerFault.exe 175 3148 3332 WerFault.exe 180 5216 5996 WerFault.exe 185 4676 3452 WerFault.exe 190 248 4932 WerFault.exe 195 1308 1124 WerFault.exe 200 4580 3372 WerFault.exe 205 5456 3820 WerFault.exe 210 3060 5640 WerFault.exe 215 2920 2144 WerFault.exe 220 2896 3304 WerFault.exe 225 4548 4456 WerFault.exe 230 5452 5508 WerFault.exe 235 1848 5356 WerFault.exe 240 1252 616 WerFault.exe 245 2516 5900 WerFault.exe 250 2540 1308 WerFault.exe 255 4528 5800 WerFault.exe 260 1540 6096 WerFault.exe 265 1976 2520 WerFault.exe 271 1556 4332 WerFault.exe 276 4948 5560 WerFault.exe 281 5636 4596 WerFault.exe 286 888 1692 WerFault.exe 291 124 3564 WerFault.exe 296 5500 5188 WerFault.exe 301 3608 4416 WerFault.exe 306 1320 5972 WerFault.exe 311 3616 4600 WerFault.exe 316 2880 3892 WerFault.exe 321 4440 2920 WerFault.exe 326 2932 872 WerFault.exe 331 1848 3756 WerFault.exe 336 4968 4880 WerFault.exe 341 5892 6128 WerFault.exe 346 988 2992 WerFault.exe 351 5052 2080 WerFault.exe 356 3196 5444 WerFault.exe 361 1524 1832 WerFault.exe 366 480 3908 WerFault.exe 371 2932 4892 WerFault.exe 376 3336 3028 WerFault.exe 381 2884 2264 WerFault.exe 386 2516 3420 WerFault.exe 391 4168 2664 WerFault.exe 396 3984 5340 WerFault.exe 401 3196 4444 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_6fc6ddda9053efcd048fdd7066064c5b_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYMYTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXFSRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSMLJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLBOFKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEKRBUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKRWGRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQFHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVGIRRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSUJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRFDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQISBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAUBXYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVWFHV.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3064 2026-08-09_6fc6ddda9053efcd048fdd7066064c5b_elex_emotet_stop.exe 3064 2026-08-09_6fc6ddda9053efcd048fdd7066064c5b_elex_emotet_stop.exe 4844 RSMD.exe 4844 RSMD.exe 3724 CWLXPA.exe 3724 CWLXPA.exe 3012 TERUCRX.exe 3012 TERUCRX.exe 3404 WZJENKN.exe 3404 WZJENKN.exe 5992 CMUXBZV.exe 5992 CMUXBZV.exe 5604 PSUJD.exe 5604 PSUJD.exe 2640 MYMYTG.exe 2640 MYMYTG.exe 4768 NWUHDQQ.exe 4768 NWUHDQQ.exe 4400 CRELO.exe 4400 CRELO.exe 3736 GUC.exe 3736 GUC.exe 5020 DKPYE.exe 5020 DKPYE.exe 2356 SFZCPY.exe 2356 SFZCPY.exe 1800 RYJSY.exe 1800 RYJSY.exe 852 HOKR.exe 852 HOKR.exe 856 SGSC.exe 856 SGSC.exe 5756 MTXMY.exe 5756 MTXMY.exe 3744 LEHC.exe 3744 LEHC.exe 3332 GSMLJG.exe 3332 GSMLJG.exe 5996 ZSUW.exe 5996 ZSUW.exe 3452 YDF.exe 3452 YDF.exe 4932 SQBWL.exe 4932 SQBWL.exe 1124 GBSUA.exe 1124 GBSUA.exe 3372 EMVCIDM.exe 3372 EMVCIDM.exe 3820 DXFSRR.exe 3820 DXFSRR.exe 5640 HNM.exe 5640 HNM.exe 2144 TVT.exe 2144 TVT.exe 3304 CDVF.exe 3304 CDVF.exe 4456 GLBOFKI.exe 4456 GLBOFKI.exe 5508 RDE.exe 5508 RDE.exe 5356 XEMUW.exe 5356 XEMUW.exe 616 IWHFXJ.exe 616 IWHFXJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3064 2026-08-09_6fc6ddda9053efcd048fdd7066064c5b_elex_emotet_stop.exe 3064 2026-08-09_6fc6ddda9053efcd048fdd7066064c5b_elex_emotet_stop.exe 4844 RSMD.exe 4844 RSMD.exe 3724 CWLXPA.exe 3724 CWLXPA.exe 3012 TERUCRX.exe 3012 TERUCRX.exe 3404 WZJENKN.exe 3404 WZJENKN.exe 5992 CMUXBZV.exe 5992 CMUXBZV.exe 5604 PSUJD.exe 5604 PSUJD.exe 2640 MYMYTG.exe 2640 MYMYTG.exe 4768 NWUHDQQ.exe 4768 NWUHDQQ.exe 4400 CRELO.exe 4400 CRELO.exe 3736 GUC.exe 3736 GUC.exe 5020 DKPYE.exe 5020 DKPYE.exe 2356 SFZCPY.exe 2356 SFZCPY.exe 1800 RYJSY.exe 1800 RYJSY.exe 852 HOKR.exe 852 HOKR.exe 856 SGSC.exe 856 SGSC.exe 5756 MTXMY.exe 5756 MTXMY.exe 3744 LEHC.exe 3744 LEHC.exe 3332 GSMLJG.exe 3332 GSMLJG.exe 5996 ZSUW.exe 5996 ZSUW.exe 3452 YDF.exe 3452 YDF.exe 4932 SQBWL.exe 4932 SQBWL.exe 1124 GBSUA.exe 1124 GBSUA.exe 3372 EMVCIDM.exe 3372 EMVCIDM.exe 3820 DXFSRR.exe 3820 DXFSRR.exe 5640 HNM.exe 5640 HNM.exe 2144 TVT.exe 2144 TVT.exe 3304 CDVF.exe 3304 CDVF.exe 4456 GLBOFKI.exe 4456 GLBOFKI.exe 5508 RDE.exe 5508 RDE.exe 5356 XEMUW.exe 5356 XEMUW.exe 616 IWHFXJ.exe 616 IWHFXJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2332 3064 2026-08-09_6fc6ddda9053efcd048fdd7066064c5b_elex_emotet_stop.exe 90 PID 2332 wrote to memory of 4844 2332 cmd.exe 94 PID 4844 wrote to memory of 260 4844 RSMD.exe 96 PID 260 wrote to memory of 3724 260 cmd.exe 100 PID 3724 wrote to memory of 4748 3724 CWLXPA.exe 101 PID 4748 wrote to memory of 3012 4748 cmd.exe 105 PID 3012 wrote to memory of 1028 3012 TERUCRX.exe 106 PID 1028 wrote to memory of 3404 1028 cmd.exe 110 PID 3404 wrote to memory of 2856 3404 WZJENKN.exe 111 PID 2856 wrote to memory of 5992 2856 cmd.exe 115 PID 5992 wrote to memory of 4816 5992 CMUXBZV.exe 116 PID 4816 wrote to memory of 5604 4816 cmd.exe 120 PID 5604 wrote to memory of 3696 5604 PSUJD.exe 121 PID 3696 wrote to memory of 2640 3696 cmd.exe 125 PID 2640 wrote to memory of 3440 2640 MYMYTG.exe 126 PID 3440 wrote to memory of 4768 3440 cmd.exe 130 PID 4768 wrote to memory of 1248 4768 NWUHDQQ.exe 131 PID 1248 wrote to memory of 4400 1248 cmd.exe 135 PID 4400 wrote to memory of 3448 4400 CRELO.exe 136 PID 3448 wrote to memory of 3736 3448 cmd.exe 140 PID 3736 wrote to memory of 4296 3736 GUC.exe 141 PID 4296 wrote to memory of 5020 4296 cmd.exe 145 PID 5020 wrote to memory of 4460 5020 DKPYE.exe 146 PID 4460 wrote to memory of 2356 4460 cmd.exe 150 PID 2356 wrote to memory of 4516 2356 SFZCPY.exe 151 PID 4516 wrote to memory of 1800 4516 cmd.exe 155 PID 1800 wrote to memory of 2988 1800 RYJSY.exe 156 PID 2988 wrote to memory of 852 2988 cmd.exe 160 PID 852 wrote to memory of 4300 852 HOKR.exe 161 PID 4300 wrote to memory of 856 4300 cmd.exe 165 PID 856 wrote to memory of 3268 856 SGSC.exe 166 PID 3268 wrote to memory of 5756 3268 cmd.exe 170 PID 5756 wrote to memory of 2816 5756 MTXMY.exe 171 PID 2816 wrote to memory of 3744 2816 cmd.exe 175 PID 3744 wrote to memory of 4260 3744 LEHC.exe 176 PID 4260 wrote to memory of 3332 4260 cmd.exe 180 PID 3332 wrote to memory of 4540 3332 GSMLJG.exe 181 PID 4540 wrote to memory of 5996 4540 cmd.exe 185 PID 5996 wrote to memory of 1408 5996 ZSUW.exe 186 PID 1408 wrote to memory of 3452 1408 cmd.exe 190 PID 3452 wrote to memory of 4992 3452 YDF.exe 191 PID 4992 wrote to memory of 4932 4992 cmd.exe 195 PID 4932 wrote to memory of 1696 4932 SQBWL.exe 196 PID 1696 wrote to memory of 1124 1696 cmd.exe 200 PID 1124 wrote to memory of 4572 1124 GBSUA.exe 201 PID 4572 wrote to memory of 3372 4572 cmd.exe 205 PID 3372 wrote to memory of 2000 3372 EMVCIDM.exe 206 PID 2000 wrote to memory of 3820 2000 cmd.exe 210 PID 3820 wrote to memory of 2496 3820 DXFSRR.exe 211 PID 2496 wrote to memory of 5640 2496 cmd.exe 215 PID 5640 wrote to memory of 5684 5640 HNM.exe 216 PID 5684 wrote to memory of 2144 5684 cmd.exe 220 PID 2144 wrote to memory of 3104 2144 TVT.exe 221 PID 3104 wrote to memory of 3304 3104 cmd.exe 225 PID 3304 wrote to memory of 1624 3304 CDVF.exe 226 PID 1624 wrote to memory of 4456 1624 cmd.exe 230 PID 4456 wrote to memory of 2900 4456 GLBOFKI.exe 231 PID 2900 wrote to memory of 5508 2900 cmd.exe 235 PID 5508 wrote to memory of 460 5508 RDE.exe 236 PID 460 wrote to memory of 5356 460 cmd.exe 240 PID 5356 wrote to memory of 5816 5356 XEMUW.exe 241 PID 5816 wrote to memory of 616 5816 cmd.exe 245 PID 616 wrote to memory of 5580 616 IWHFXJ.exe 246 PID 5580 wrote to memory of 5900 5580 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_6fc6ddda9053efcd048fdd7066064c5b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_6fc6ddda9053efcd048fdd7066064c5b_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RSMD.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\windows\RSMD.exeC:\windows\RSMD.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWLXPA.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:260 -
C:\windows\SysWOW64\CWLXPA.exeC:\windows\system32\CWLXPA.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZJENKN.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\windows\system\WZJENKN.exeC:\windows\system\WZJENKN.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMUXBZV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\CMUXBZV.exeC:\windows\CMUXBZV.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSUJD.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\system\PSUJD.exeC:\windows\system\PSUJD.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYMYTG.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\windows\MYMYTG.exeC:\windows\MYMYTG.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWUHDQQ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\SysWOW64\NWUHDQQ.exeC:\windows\system32\NWUHDQQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRELO.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\CRELO.exeC:\windows\CRELO.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GUC.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\system\GUC.exeC:\windows\system\GUC.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKPYE.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\system\DKPYE.exeC:\windows\system\DKPYE.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFZCPY.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\windows\SFZCPY.exeC:\windows\SFZCPY.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYJSY.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\windows\system\RYJSY.exeC:\windows\system\RYJSY.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOKR.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\windows\system\HOKR.exeC:\windows\system\HOKR.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGSC.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\system\SGSC.exeC:\windows\system\SGSC.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTXMY.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\MTXMY.exeC:\windows\MTXMY.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LEHC.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\LEHC.exeC:\windows\LEHC.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GSMLJG.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\system\GSMLJG.exeC:\windows\system\GSMLJG.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSUW.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\ZSUW.exeC:\windows\ZSUW.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDF.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\windows\system\YDF.exeC:\windows\system\YDF.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQBWL.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\windows\system\SQBWL.exeC:\windows\system\SQBWL.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBSUA.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\windows\system\GBSUA.exeC:\windows\system\GBSUA.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EMVCIDM.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\EMVCIDM.exeC:\windows\EMVCIDM.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DXFSRR.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\windows\DXFSRR.exeC:\windows\DXFSRR.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNM.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\windows\system\HNM.exeC:\windows\system\HNM.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TVT.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\windows\system\TVT.exeC:\windows\system\TVT.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDVF.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\windows\system\CDVF.exeC:\windows\system\CDVF.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLBOFKI.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\windows\GLBOFKI.exeC:\windows\GLBOFKI.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDE.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\RDE.exeC:\windows\RDE.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEMUW.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:460 -
C:\windows\SysWOW64\XEMUW.exeC:\windows\system32\XEMUW.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWHFXJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\IWHFXJ.exeC:\windows\IWHFXJ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\SXJ.exeC:\windows\SXJ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USOB.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5744 -
C:\windows\system\USOB.exeC:\windows\system\USOB.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAUBXYB.exe.bat" "68⤵PID:5984
-
C:\windows\system\YAUBXYB.exeC:\windows\system\YAUBXYB.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KTX.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:4152 -
C:\windows\SysWOW64\KTX.exeC:\windows\system32\KTX.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOHYQS.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6012 -
C:\windows\SysWOW64\ZOHYQS.exeC:\windows\system32\ZOHYQS.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJM.exe.bat" "74⤵
- Executes a command shell one-liner
PID:4760 -
C:\windows\system\TJM.exeC:\windows\system\TJM.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DJOV.exe.bat" "76⤵PID:2972
-
C:\windows\SysWOW64\DJOV.exeC:\windows\system32\DJOV.exe77⤵
- Executes dropped EXE
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USQAH.exe.bat" "78⤵PID:4200
-
C:\windows\system\USQAH.exeC:\windows\system\USQAH.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXAPXQ.exe.bat" "80⤵PID:4508
-
C:\windows\system\RXAPXQ.exeC:\windows\system\RXAPXQ.exe81⤵
- Executes dropped EXE
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXCUJWH.exe.bat" "82⤵
- Executes a command shell one-liner
PID:52 -
C:\windows\system\IXCUJWH.exeC:\windows\system\IXCUJWH.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYJI.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1568 -
C:\windows\SysWOW64\GYJI.exeC:\windows\system32\GYJI.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VOK.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:904 -
C:\windows\system\VOK.exeC:\windows\system\VOK.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCM.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:3020 -
C:\windows\SysWOW64\KJCM.exeC:\windows\system32\KJCM.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZDLQUV.exe.bat" "90⤵PID:4412
-
C:\windows\AZDLQUV.exeC:\windows\AZDLQUV.exe91⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPJL.exe.bat" "92⤵PID:4232
-
C:\windows\system\EPJL.exeC:\windows\system\EPJL.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFK.exe.bat" "94⤵PID:5024
-
C:\windows\system\TFK.exeC:\windows\system\TFK.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OSPUL.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1412 -
C:\windows\system\OSPUL.exeC:\windows\system\OSPUL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USXIUCW.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5304 -
C:\windows\USXIUCW.exeC:\windows\USXIUCW.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZTFW.exe.bat" "100⤵PID:4884
-
C:\windows\system\ZTFW.exeC:\windows\system\ZTFW.exe101⤵
- Executes dropped EXE
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGJFOE.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:888 -
C:\windows\UGJFOE.exeC:\windows\UGJFOE.exe103⤵
- Executes dropped EXE
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRFDB.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2044 -
C:\windows\ZRFDB.exeC:\windows\ZRFDB.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJIWBC.exe.bat" "106⤵PID:200
-
C:\windows\system\KJIWBC.exeC:\windows\system\KJIWBC.exe107⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXN.exe.bat" "108⤵PID:108
-
C:\windows\NXN.exeC:\windows\NXN.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVGIRRB.exe.bat" "110⤵PID:4804
-
C:\windows\SysWOW64\HVGIRRB.exeC:\windows\system32\HVGIRRB.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ESM.exe.bat" "112⤵PID:4552
-
C:\windows\ESM.exeC:\windows\ESM.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLV.exe.bat" "114⤵PID:2620
-
C:\windows\system\LLV.exeC:\windows\system\LLV.exe115⤵
- Executes dropped EXE
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AQTVT.exe.bat" "116⤵
- Executes a command shell one-liner
PID:552 -
C:\windows\AQTVT.exeC:\windows\AQTVT.exe117⤵
- Executes dropped EXE
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBDL.exe.bat" "118⤵PID:5884
-
C:\windows\system\ZBDL.exeC:\windows\system\ZBDL.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJKLOND.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4248 -
C:\windows\SysWOW64\LJKLOND.exeC:\windows\system32\LJKLOND.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-