Analysis
- max time kernel
72s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 13:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_ea163b8bf486f4fb5476dc4835070779_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-11_ea163b8bf486f4fb5476dc4835070779_elex_emotet_stop.exe
- Size 448KB
- Sample260811-qmkjsatepe
- SHA256 c60f694dcb499743b518145ab0a39d5dd31e57fd18c76f713cd38df748bf734b
- MD5 ea163b8bf486f4fb5476dc4835070779
- SHA1 80819a87a1f1ad31bac84a1684c6ba5691e907c9
- SHA512 7a19630d0a6f11b371389a1313565b8009453e8f81cfa9d6c4b44fb301f76ac2c06eedd87282c4012e03b6ae98c2b66a9cdb79a0214d13af27b193f632b52bab
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOqkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOqkmZzcukG2/
- TLSH T103A49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4500 VHYOFPP.exe 3464 TSPLKQL.exe 5260 OYCPV.exe 1184 WDOV.exe 5156 TJHLW.exe 4364 SUJB.exe 3376 URPVMD.exe 4680 TADSZU.exe 4160 XDCN.exe 2628 IVRY.exe 5880 WQDZ.exe 4668 OZJXIU.exe 2028 LZTZU.exe 568 OHZ.exe 2344 NSCXHWA.exe 1600 RIRX.exe 5660 SLHTI.exe 2404 HBI.exe 1292 GMLAXRB.exe 1416 ORYHIQX.exe 2000 KXIWY.exe 6032 LAMA.exe 4996 KLW.exe 1468 SYB.exe 3752 UWPRE.exe 3568 EUUDM.exe 3804 RSU.exe 2836 ECLOCB.exe 2760 OAQIRJ.exe 4720 YYWCZ.exe 3040 RTIYEHS.exe 3328 FZIKOT.exe 1412 ACQI.exe 1744 CZE.exe 4516 KNI.exe 1188 ULOWCLK.exe 5152 YOURJ.exe 5764 WDFU.exe 2108 VWI.exe 2708 XUWWN.exe 5728 SSWI.exe 896 CQOUFLC.exe 4112 KDABQKY.exe 820 PGZW.exe 5476 LMR.exe 2436 RHIMKB.exe 3296 LZYX.exe 6056 YCGW.exe 3184 LIOHSYX.exe 4488 KTRXBE.exe 5492 GYJNR.exe 1260 FJMD.exe 3224 RZSDEY.exe 5460 FXSON.exe 3368 SIJNU.exe 2520 WQPNGNR.exe 5516 ABOIO.exe 256 MJHABJ.exe 1144 ZPHMD.exe 5456 YZRC.exe 916 WPDFHGW.exe 2252 MFEWFC.exe 3916 UTQLQ.exe 4864 RLSN.exe - Drops file in System32 directory 63 IoCs
description ioc Process File created C:\windows\SysWOW64\RSU.exe EUUDM.exe File opened for modification C:\windows\SysWOW64\RSU.exe EUUDM.exe File created C:\windows\SysWOW64\KNI.exe CZE.exe File created C:\windows\SysWOW64\ULOWCLK.exe.bat KNI.exe File created C:\windows\SysWOW64\WQPNGNR.exe.bat SIJNU.exe File opened for modification C:\windows\SysWOW64\MJHABJ.exe ABOIO.exe File opened for modification C:\windows\SysWOW64\VCLPRZ.exe AFZM.exe File created C:\windows\SysWOW64\LZTZU.exe.bat OZJXIU.exe File opened for modification C:\windows\SysWOW64\SYB.exe KLW.exe File created C:\windows\SysWOW64\SYB.exe.bat KLW.exe File created C:\windows\SysWOW64\UWDNN.exe YLNPZJL.exe File created C:\windows\SysWOW64\VMYOIY.exe HQNNDJL.exe File created C:\windows\SysWOW64\WQDZ.exe.bat IVRY.exe File created C:\windows\SysWOW64\RSU.exe.bat EUUDM.exe File opened for modification C:\windows\SysWOW64\RTIYEHS.exe YYWCZ.exe File created C:\windows\SysWOW64\KNI.exe.bat CZE.exe File opened for modification C:\windows\SysWOW64\ULOWCLK.exe KNI.exe File opened for modification C:\windows\SysWOW64\NSCXHWA.exe OHZ.exe File created C:\windows\SysWOW64\RTIYEHS.exe YYWCZ.exe File created C:\windows\SysWOW64\YCGW.exe.bat LZYX.exe File created C:\windows\SysWOW64\MJHABJ.exe.bat ABOIO.exe File created C:\windows\SysWOW64\MFA.exe.bat EZWO.exe File created C:\windows\SysWOW64\WDOV.exe OYCPV.exe File created C:\windows\SysWOW64\ABOIO.exe WQPNGNR.exe File created C:\windows\SysWOW64\MFA.exe EZWO.exe File opened for modification C:\windows\SysWOW64\MFA.exe EZWO.exe File created C:\windows\SysWOW64\WQDZ.exe IVRY.exe File opened for modification C:\windows\SysWOW64\UWDNN.exe YLNPZJL.exe File created C:\windows\SysWOW64\TSPLKQL.exe VHYOFPP.exe File opened for modification C:\windows\SysWOW64\ACQI.exe FZIKOT.exe File opened for modification C:\windows\SysWOW64\KNI.exe CZE.exe File created C:\windows\SysWOW64\YCGW.exe LZYX.exe File created C:\windows\SysWOW64\GYJNR.exe.bat KTRXBE.exe File created C:\windows\SysWOW64\TCIKO.exe ZPJMRVI.exe File opened for modification C:\windows\SysWOW64\TCIKO.exe ZPJMRVI.exe File opened for modification C:\windows\SysWOW64\WQPNGNR.exe SIJNU.exe File created C:\windows\SysWOW64\MJHABJ.exe ABOIO.exe File created C:\windows\SysWOW64\VCLPRZ.exe.bat AFZM.exe File created C:\windows\SysWOW64\ACQI.exe.bat FZIKOT.exe File opened for modification C:\windows\SysWOW64\GYJNR.exe KTRXBE.exe File opened for modification C:\windows\SysWOW64\LZTZU.exe OZJXIU.exe File created C:\windows\SysWOW64\NSCXHWA.exe OHZ.exe File created C:\windows\SysWOW64\NSCXHWA.exe.bat OHZ.exe File created C:\windows\SysWOW64\ULOWCLK.exe KNI.exe File opened for modification C:\windows\SysWOW64\YCGW.exe LZYX.exe File created C:\windows\SysWOW64\VCLPRZ.exe AFZM.exe File opened for modification C:\windows\SysWOW64\TSPLKQL.exe VHYOFPP.exe File created C:\windows\SysWOW64\SYB.exe KLW.exe File opened for modification C:\windows\SysWOW64\ABOIO.exe WQPNGNR.exe File created C:\windows\SysWOW64\WDOV.exe.bat OYCPV.exe File created C:\windows\SysWOW64\TCIKO.exe.bat ZPJMRVI.exe File created C:\windows\SysWOW64\UWDNN.exe.bat YLNPZJL.exe File created C:\windows\SysWOW64\ACQI.exe FZIKOT.exe File opened for modification C:\windows\SysWOW64\WDOV.exe OYCPV.exe File created C:\windows\SysWOW64\GYJNR.exe KTRXBE.exe File opened for modification C:\windows\SysWOW64\VMYOIY.exe HQNNDJL.exe File created C:\windows\SysWOW64\VMYOIY.exe.bat HQNNDJL.exe File created C:\windows\SysWOW64\LZTZU.exe OZJXIU.exe File created C:\windows\SysWOW64\ABOIO.exe.bat WQPNGNR.exe File created C:\windows\SysWOW64\TSPLKQL.exe.bat VHYOFPP.exe File opened for modification C:\windows\SysWOW64\WQDZ.exe IVRY.exe File created C:\windows\SysWOW64\RTIYEHS.exe.bat YYWCZ.exe File created C:\windows\SysWOW64\WQPNGNR.exe SIJNU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\EUUDM.exe.bat UWPRE.exe File created C:\windows\FZIKOT.exe.bat RTIYEHS.exe File created C:\windows\system\XUWWN.exe.bat VWI.exe File created C:\windows\system\KDABQKY.exe.bat CQOUFLC.exe File created C:\windows\FJMD.exe.bat GYJNR.exe File opened for modification C:\windows\UTQLQ.exe MFEWFC.exe File opened for modification C:\windows\system\OYCPV.exe TSPLKQL.exe File created C:\windows\system\HBI.exe SLHTI.exe File created C:\windows\system\ECLOCB.exe RSU.exe File opened for modification C:\windows\OAQIRJ.exe ECLOCB.exe File created C:\windows\system\YOURJ.exe.bat ULOWCLK.exe File created C:\windows\IVRY.exe.bat XDCN.exe File created C:\windows\system\OZJXIU.exe WQDZ.exe File created C:\windows\system\OZJXIU.exe.bat WQDZ.exe File created C:\windows\GMLAXRB.exe.bat HBI.exe File created C:\windows\WDFU.exe YOURJ.exe File created C:\windows\WDFU.exe.bat YOURJ.exe File opened for modification C:\windows\LZYX.exe RHIMKB.exe File created C:\windows\UTQLQ.exe.bat MFEWFC.exe File created C:\windows\FXSON.exe.bat RZSDEY.exe File created C:\windows\system\YZRC.exe ZPHMD.exe File created C:\windows\UTQLQ.exe MFEWFC.exe File opened for modification C:\windows\system\RLSN.exe UTQLQ.exe File opened for modification C:\windows\system\TGJPN.exe RLSN.exe File opened for modification C:\windows\system\YDDOEYJ.exe OGP.exe File created C:\windows\HMX.exe ABIAU.exe File opened for modification C:\windows\system\ZPJMRVI.exe HMX.exe File opened for modification C:\windows\XDCN.exe TADSZU.exe File opened for modification C:\windows\YYWCZ.exe OAQIRJ.exe File created C:\windows\KTRXBE.exe LIOHSYX.exe File created C:\windows\WPDFHGW.exe.bat YZRC.exe File created C:\windows\system\TGJPN.exe RLSN.exe File opened for modification C:\windows\UFZGDG.exe TCIKO.exe File opened for modification C:\windows\system\EZWO.exe YEKNSEC.exe File created C:\windows\KLW.exe.bat LAMA.exe File created C:\windows\system\SLHTI.exe.bat RIRX.exe File created C:\windows\system\ORYHIQX.exe GMLAXRB.exe File opened for modification C:\windows\system\ORYHIQX.exe GMLAXRB.exe File created C:\windows\system\CQOUFLC.exe.bat SSWI.exe File created C:\windows\system\PGZW.exe.bat KDABQKY.exe File opened for modification C:\windows\system\OZJXIU.exe WQDZ.exe File created C:\windows\YYWCZ.exe OAQIRJ.exe File created C:\windows\SSWI.exe.bat XUWWN.exe File opened for modification C:\windows\system\RZSDEY.exe FJMD.exe File created C:\windows\IVRY.exe XDCN.exe File created C:\windows\system\KXIWY.exe.bat ORYHIQX.exe File opened for modification C:\windows\SIJNU.exe FXSON.exe File created C:\windows\system\SUJB.exe.bat TJHLW.exe File opened for modification C:\windows\GMLAXRB.exe HBI.exe File created C:\windows\system\LAMA.exe.bat KXIWY.exe File created C:\windows\system\UWPRE.exe SYB.exe File opened for modification C:\windows\system\CQOUFLC.exe SSWI.exe File created C:\windows\NYORUH.exe.bat UFZGDG.exe File opened for modification C:\windows\IVRY.exe XDCN.exe File opened for modification C:\windows\system\CZE.exe ACQI.exe File created C:\windows\system\LMR.exe.bat PGZW.exe File created C:\windows\UFZGDG.exe.bat TCIKO.exe File opened for modification C:\windows\YLNPZJL.exe NYORUH.exe File created C:\windows\GMLAXRB.exe HBI.exe File opened for modification C:\windows\SSWI.exe XUWWN.exe File created C:\windows\LZYX.exe.bat RHIMKB.exe File opened for modification C:\windows\system\LIOHSYX.exe YCGW.exe File created C:\windows\system\LIOHSYX.exe.bat YCGW.exe File opened for modification C:\windows\BMWWY.exe TGJPN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3260 cmd.exe 3668 cmd.exe 4624 cmd.exe 5352 cmd.exe 4664 cmd.exe 1688 cmd.exe 1972 cmd.exe 4240 cmd.exe 4892 cmd.exe 416 cmd.exe 3624 cmd.exe 4920 cmd.exe 3600 cmd.exe 1136 cmd.exe 1380 cmd.exe 5040 cmd.exe 3688 cmd.exe 1864 cmd.exe 5332 cmd.exe 2884 cmd.exe 4564 cmd.exe 4800 cmd.exe 4144 cmd.exe 4168 cmd.exe 2676 cmd.exe 5776 cmd.exe 4984 cmd.exe 5864 cmd.exe 3800 cmd.exe 1476 cmd.exe 3268 cmd.exe 5340 cmd.exe 1328 cmd.exe 1232 cmd.exe 5960 cmd.exe 1488 cmd.exe 3492 cmd.exe 3848 cmd.exe 6044 cmd.exe 4136 cmd.exe 5088 cmd.exe 3408 cmd.exe 4436 cmd.exe 5480 cmd.exe 712 cmd.exe 5452 cmd.exe 3820 cmd.exe 900 cmd.exe 2856 cmd.exe 3664 cmd.exe 3256 cmd.exe 6048 cmd.exe 200 cmd.exe 6036 cmd.exe 5224 cmd.exe 1308 cmd.exe 2600 cmd.exe 5032 cmd.exe 2036 cmd.exe 4404 cmd.exe 3596 cmd.exe 5140 cmd.exe 2932 cmd.exe 6016 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5076 908 WerFault.exe 87 4236 4500 WerFault.exe 93 3184 3464 WerFault.exe 99 3596 5260 WerFault.exe 104 5660 1184 WerFault.exe 109 2996 5156 WerFault.exe 114 2252 4364 WerFault.exe 119 1296 3376 WerFault.exe 124 1848 4680 WerFault.exe 129 2264 4160 WerFault.exe 134 4436 2628 WerFault.exe 139 1396 5880 WerFault.exe 144 2536 4668 WerFault.exe 149 3296 2028 WerFault.exe 154 384 568 WerFault.exe 159 4180 2344 WerFault.exe 164 5584 1600 WerFault.exe 169 4328 5660 WerFault.exe 174 1992 2404 WerFault.exe 179 3456 1292 WerFault.exe 184 5188 1416 WerFault.exe 189 5084 2000 WerFault.exe 194 3444 6032 WerFault.exe 199 6084 4996 WerFault.exe 204 5464 1468 WerFault.exe 209 1160 3752 WerFault.exe 214 2388 3568 WerFault.exe 219 2648 3804 WerFault.exe 224 5420 2836 WerFault.exe 229 2480 2760 WerFault.exe 234 2884 4720 WerFault.exe 239 4848 3040 WerFault.exe 244 1228 3328 WerFault.exe 249 5848 1412 WerFault.exe 254 3052 1744 WerFault.exe 259 2484 4516 WerFault.exe 264 3932 1188 WerFault.exe 269 5644 5152 WerFault.exe 274 1088 5764 WerFault.exe 279 712 2108 WerFault.exe 284 2200 2708 WerFault.exe 289 1852 5728 WerFault.exe 294 4380 896 WerFault.exe 299 5160 4112 WerFault.exe 304 5084 820 WerFault.exe 309 4836 5476 WerFault.exe 314 1836 2436 WerFault.exe 319 1956 3296 WerFault.exe 324 3240 6056 WerFault.exe 329 5756 3184 WerFault.exe 334 2568 4488 WerFault.exe 339 3432 5492 WerFault.exe 344 1488 1260 WerFault.exe 349 3264 3224 WerFault.exe 354 5548 5460 WerFault.exe 359 5844 3368 WerFault.exe 364 1352 2520 WerFault.exe 369 4280 5516 WerFault.exe 374 1956 256 WerFault.exe 379 2168 1144 WerFault.exe 384 2648 5456 WerFault.exe 389 672 916 WerFault.exe 394 3256 2252 WerFault.exe 399 1488 3916 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTHTVBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URPVMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHYOFPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHIMKB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABOIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIJNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMWWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYJNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TJHLW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQOUFLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFZGDG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TADSZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPDFHGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAQIRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPHMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPJMRVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYWCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGJPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCLPRZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXSON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUUDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 908 2026-08-11_ea163b8bf486f4fb5476dc4835070779_elex_emotet_stop.exe 908 2026-08-11_ea163b8bf486f4fb5476dc4835070779_elex_emotet_stop.exe 4500 VHYOFPP.exe 4500 VHYOFPP.exe 3464 TSPLKQL.exe 3464 TSPLKQL.exe 5260 OYCPV.exe 5260 OYCPV.exe 1184 WDOV.exe 1184 WDOV.exe 5156 TJHLW.exe 5156 TJHLW.exe 4364 SUJB.exe 4364 SUJB.exe 3376 URPVMD.exe 3376 URPVMD.exe 4680 TADSZU.exe 4680 TADSZU.exe 4160 XDCN.exe 4160 XDCN.exe 2628 IVRY.exe 2628 IVRY.exe 5880 WQDZ.exe 5880 WQDZ.exe 4668 OZJXIU.exe 4668 OZJXIU.exe 2028 LZTZU.exe 2028 LZTZU.exe 568 OHZ.exe 568 OHZ.exe 2344 NSCXHWA.exe 2344 NSCXHWA.exe 1600 RIRX.exe 1600 RIRX.exe 5660 SLHTI.exe 5660 SLHTI.exe 2404 HBI.exe 2404 HBI.exe 1292 GMLAXRB.exe 1292 GMLAXRB.exe 1416 ORYHIQX.exe 1416 ORYHIQX.exe 2000 KXIWY.exe 2000 KXIWY.exe 6032 LAMA.exe 6032 LAMA.exe 4996 KLW.exe 4996 KLW.exe 1468 SYB.exe 1468 SYB.exe 3752 UWPRE.exe 3752 UWPRE.exe 3568 EUUDM.exe 3568 EUUDM.exe 3804 RSU.exe 3804 RSU.exe 2836 ECLOCB.exe 2836 ECLOCB.exe 2760 OAQIRJ.exe 2760 OAQIRJ.exe 4720 YYWCZ.exe 4720 YYWCZ.exe 3040 RTIYEHS.exe 3040 RTIYEHS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 908 2026-08-11_ea163b8bf486f4fb5476dc4835070779_elex_emotet_stop.exe 908 2026-08-11_ea163b8bf486f4fb5476dc4835070779_elex_emotet_stop.exe 4500 VHYOFPP.exe 4500 VHYOFPP.exe 3464 TSPLKQL.exe 3464 TSPLKQL.exe 5260 OYCPV.exe 5260 OYCPV.exe 1184 WDOV.exe 1184 WDOV.exe 5156 TJHLW.exe 5156 TJHLW.exe 4364 SUJB.exe 4364 SUJB.exe 3376 URPVMD.exe 3376 URPVMD.exe 4680 TADSZU.exe 4680 TADSZU.exe 4160 XDCN.exe 4160 XDCN.exe 2628 IVRY.exe 2628 IVRY.exe 5880 WQDZ.exe 5880 WQDZ.exe 4668 OZJXIU.exe 4668 OZJXIU.exe 2028 LZTZU.exe 2028 LZTZU.exe 568 OHZ.exe 568 OHZ.exe 2344 NSCXHWA.exe 2344 NSCXHWA.exe 1600 RIRX.exe 1600 RIRX.exe 5660 SLHTI.exe 5660 SLHTI.exe 2404 HBI.exe 2404 HBI.exe 1292 GMLAXRB.exe 1292 GMLAXRB.exe 1416 ORYHIQX.exe 1416 ORYHIQX.exe 2000 KXIWY.exe 2000 KXIWY.exe 6032 LAMA.exe 6032 LAMA.exe 4996 KLW.exe 4996 KLW.exe 1468 SYB.exe 1468 SYB.exe 3752 UWPRE.exe 3752 UWPRE.exe 3568 EUUDM.exe 3568 EUUDM.exe 3804 RSU.exe 3804 RSU.exe 2836 ECLOCB.exe 2836 ECLOCB.exe 2760 OAQIRJ.exe 2760 OAQIRJ.exe 4720 YYWCZ.exe 4720 YYWCZ.exe 3040 RTIYEHS.exe 3040 RTIYEHS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 908 wrote to memory of 4868 908 2026-08-11_ea163b8bf486f4fb5476dc4835070779_elex_emotet_stop.exe 89 PID 4868 wrote to memory of 4500 4868 cmd.exe 93 PID 4500 wrote to memory of 3492 4500 VHYOFPP.exe 95 PID 3492 wrote to memory of 3464 3492 cmd.exe 99 PID 3464 wrote to memory of 5896 3464 TSPLKQL.exe 100 PID 5896 wrote to memory of 5260 5896 cmd.exe 104 PID 5260 wrote to memory of 352 5260 OYCPV.exe 105 PID 352 wrote to memory of 1184 352 cmd.exe 109 PID 1184 wrote to memory of 2036 1184 WDOV.exe 110 PID 2036 wrote to memory of 5156 2036 cmd.exe 114 PID 5156 wrote to memory of 5148 5156 TJHLW.exe 115 PID 5148 wrote to memory of 4364 5148 cmd.exe 119 PID 4364 wrote to memory of 4616 4364 SUJB.exe 120 PID 4616 wrote to memory of 3376 4616 cmd.exe 124 PID 3376 wrote to memory of 5776 3376 URPVMD.exe 125 PID 5776 wrote to memory of 4680 5776 cmd.exe 129 PID 4680 wrote to memory of 4828 4680 TADSZU.exe 130 PID 4828 wrote to memory of 4160 4828 cmd.exe 134 PID 4160 wrote to memory of 2260 4160 XDCN.exe 135 PID 2260 wrote to memory of 2628 2260 cmd.exe 139 PID 2628 wrote to memory of 3688 2628 IVRY.exe 140 PID 3688 wrote to memory of 5880 3688 cmd.exe 144 PID 5880 wrote to memory of 5072 5880 WQDZ.exe 145 PID 5072 wrote to memory of 4668 5072 cmd.exe 149 PID 4668 wrote to memory of 2856 4668 OZJXIU.exe 150 PID 2856 wrote to memory of 2028 2856 cmd.exe 154 PID 2028 wrote to memory of 5816 2028 LZTZU.exe 155 PID 5816 wrote to memory of 568 5816 cmd.exe 159 PID 568 wrote to memory of 6036 568 OHZ.exe 160 PID 6036 wrote to memory of 2344 6036 cmd.exe 164 PID 2344 wrote to memory of 3700 2344 NSCXHWA.exe 165 PID 3700 wrote to memory of 1600 3700 cmd.exe 169 PID 1600 wrote to memory of 5400 1600 RIRX.exe 170 PID 5400 wrote to memory of 5660 5400 cmd.exe 174 PID 5660 wrote to memory of 4844 5660 SLHTI.exe 175 PID 4844 wrote to memory of 2404 4844 cmd.exe 179 PID 2404 wrote to memory of 1492 2404 HBI.exe 180 PID 1492 wrote to memory of 1292 1492 cmd.exe 184 PID 1292 wrote to memory of 4892 1292 GMLAXRB.exe 185 PID 4892 wrote to memory of 1416 4892 cmd.exe 189 PID 1416 wrote to memory of 2400 1416 ORYHIQX.exe 190 PID 2400 wrote to memory of 2000 2400 cmd.exe 194 PID 2000 wrote to memory of 5480 2000 KXIWY.exe 195 PID 5480 wrote to memory of 6032 5480 cmd.exe 199 PID 6032 wrote to memory of 4132 6032 LAMA.exe 200 PID 4132 wrote to memory of 4996 4132 cmd.exe 204 PID 4996 wrote to memory of 4176 4996 KLW.exe 205 PID 4176 wrote to memory of 1468 4176 cmd.exe 209 PID 1468 wrote to memory of 2536 1468 SYB.exe 210 PID 2536 wrote to memory of 3752 2536 cmd.exe 214 PID 3752 wrote to memory of 4236 3752 UWPRE.exe 215 PID 4236 wrote to memory of 3568 4236 cmd.exe 219 PID 3568 wrote to memory of 3600 3568 EUUDM.exe 220 PID 3600 wrote to memory of 3804 3600 cmd.exe 224 PID 3804 wrote to memory of 3244 3804 RSU.exe 225 PID 3244 wrote to memory of 2836 3244 cmd.exe 229 PID 2836 wrote to memory of 4344 2836 ECLOCB.exe 230 PID 4344 wrote to memory of 2760 4344 cmd.exe 234 PID 2760 wrote to memory of 4448 2760 OAQIRJ.exe 235 PID 4448 wrote to memory of 4720 4448 cmd.exe 239 PID 4720 wrote to memory of 2744 4720 YYWCZ.exe 240 PID 2744 wrote to memory of 3040 2744 cmd.exe 244 PID 3040 wrote to memory of 3268 3040 RTIYEHS.exe 245 PID 3268 wrote to memory of 3328 3268 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_ea163b8bf486f4fb5476dc4835070779_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_ea163b8bf486f4fb5476dc4835070779_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VHYOFPP.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\windows\system\VHYOFPP.exeC:\windows\system\VHYOFPP.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TSPLKQL.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\SysWOW64\TSPLKQL.exeC:\windows\system32\TSPLKQL.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYCPV.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\windows\system\OYCPV.exeC:\windows\system\OYCPV.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDOV.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:352 -
C:\windows\SysWOW64\WDOV.exeC:\windows\system32\WDOV.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TJHLW.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\windows\TJHLW.exeC:\windows\TJHLW.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUJB.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\windows\system\SUJB.exeC:\windows\system\SUJB.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URPVMD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\windows\system\URPVMD.exeC:\windows\system\URPVMD.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TADSZU.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\windows\TADSZU.exeC:\windows\TADSZU.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDCN.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\XDCN.exeC:\windows\XDCN.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVRY.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\IVRY.exeC:\windows\IVRY.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQDZ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\windows\SysWOW64\WQDZ.exeC:\windows\system32\WQDZ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OZJXIU.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\windows\system\OZJXIU.exeC:\windows\system\OZJXIU.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZTZU.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\SysWOW64\LZTZU.exeC:\windows\system32\LZTZU.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHZ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\system\OHZ.exeC:\windows\system\OHZ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NSCXHWA.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\SysWOW64\NSCXHWA.exeC:\windows\system32\NSCXHWA.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RIRX.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\RIRX.exeC:\windows\RIRX.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SLHTI.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\system\SLHTI.exeC:\windows\system\SLHTI.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBI.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\windows\system\HBI.exeC:\windows\system\HBI.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMLAXRB.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\windows\GMLAXRB.exeC:\windows\GMLAXRB.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORYHIQX.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\windows\system\ORYHIQX.exeC:\windows\system\ORYHIQX.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KXIWY.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\system\KXIWY.exeC:\windows\system\KXIWY.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LAMA.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\windows\system\LAMA.exeC:\windows\system\LAMA.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KLW.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\KLW.exeC:\windows\KLW.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SYB.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\windows\SysWOW64\SYB.exeC:\windows\system32\SYB.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UWPRE.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\windows\system\UWPRE.exeC:\windows\system\UWPRE.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUUDM.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\windows\EUUDM.exeC:\windows\EUUDM.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSU.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\windows\SysWOW64\RSU.exeC:\windows\system32\RSU.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECLOCB.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\windows\system\ECLOCB.exeC:\windows\system\ECLOCB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OAQIRJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\OAQIRJ.exeC:\windows\OAQIRJ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YYWCZ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\windows\YYWCZ.exeC:\windows\YYWCZ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RTIYEHS.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\windows\SysWOW64\RTIYEHS.exeC:\windows\system32\RTIYEHS.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZIKOT.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\FZIKOT.exeC:\windows\FZIKOT.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACQI.exe.bat" "66⤵
- Executes a command shell one-liner
PID:6016 -
C:\windows\SysWOW64\ACQI.exeC:\windows\system32\ACQI.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZE.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5340 -
C:\windows\system\CZE.exeC:\windows\system\CZE.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNI.exe.bat" "70⤵PID:4860
-
C:\windows\SysWOW64\KNI.exeC:\windows\system32\KNI.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULOWCLK.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4984 -
C:\windows\SysWOW64\ULOWCLK.exeC:\windows\system32\ULOWCLK.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOURJ.exe.bat" "74⤵
- Executes a command shell one-liner
PID:5864 -
C:\windows\system\YOURJ.exeC:\windows\system\YOURJ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDFU.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\windows\WDFU.exeC:\windows\WDFU.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VWI.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3848 -
C:\windows\system\VWI.exeC:\windows\system\VWI.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUWWN.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5640 -
C:\windows\system\XUWWN.exeC:\windows\system\XUWWN.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSWI.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1864 -
C:\windows\SSWI.exeC:\windows\SSWI.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQOUFLC.exe.bat" "84⤵PID:5220
-
C:\windows\system\CQOUFLC.exeC:\windows\system\CQOUFLC.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDABQKY.exe.bat" "86⤵PID:1732
-
C:\windows\system\KDABQKY.exeC:\windows\system\KDABQKY.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGZW.exe.bat" "88⤵PID:3736
-
C:\windows\system\PGZW.exeC:\windows\system\PGZW.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "90⤵PID:4796
-
C:\windows\system\LMR.exeC:\windows\system\LMR.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHIMKB.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4276 -
C:\windows\RHIMKB.exeC:\windows\RHIMKB.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZYX.exe.bat" "94⤵PID:1584
-
C:\windows\LZYX.exeC:\windows\LZYX.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCGW.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4108 -
C:\windows\SysWOW64\YCGW.exeC:\windows\system32\YCGW.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIOHSYX.exe.bat" "98⤵PID:1676
-
C:\windows\system\LIOHSYX.exeC:\windows\system\LIOHSYX.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTRXBE.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3260 -
C:\windows\KTRXBE.exeC:\windows\KTRXBE.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYJNR.exe.bat" "102⤵PID:4232
-
C:\windows\SysWOW64\GYJNR.exeC:\windows\system32\GYJNR.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJMD.exe.bat" "104⤵
- Executes a command shell one-liner
PID:712 -
C:\windows\FJMD.exeC:\windows\FJMD.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZSDEY.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6044 -
C:\windows\system\RZSDEY.exeC:\windows\system\RZSDEY.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXSON.exe.bat" "108⤵PID:1204
-
C:\windows\FXSON.exeC:\windows\FXSON.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIJNU.exe.bat" "110⤵PID:1100
-
C:\windows\SIJNU.exeC:\windows\SIJNU.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQPNGNR.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3652 -
C:\windows\SysWOW64\WQPNGNR.exeC:\windows\system32\WQPNGNR.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABOIO.exe.bat" "114⤵PID:3052
-
C:\windows\SysWOW64\ABOIO.exeC:\windows\system32\ABOIO.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJHABJ.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5200 -
C:\windows\SysWOW64\MJHABJ.exeC:\windows\system32\MJHABJ.exe117⤵
- Executes dropped EXE
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPHMD.exe.bat" "118⤵PID:1748
-
C:\windows\system\ZPHMD.exeC:\windows\system\ZPHMD.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "120⤵PID:5644
-
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-