Analysis
- max time kernel
73s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 19:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe
- Size 208KB
- Sample260811-xwwfzabn21
- SHA256 304e9f798abca75f647511c611ccc671e9c22052ebd662acf6d88424acfebf79
- MD5 87bfa4903604deccbf32698ccf2953fc
- SHA1 055f3d3da9a9d72b0bd6bc62dd30e9bc983d3bbd
- SHA512 dfd218e76278228ba8cee98ee935832e7384055f8c4dd152a4c259b95a836af893145b2181c5d637b4ffdd37c32830485aaf1eeda61d80197f11093b4cdbb067
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfP4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOnkEj1
- TLSH T188247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4272 KYLLZ.exe 4112 TWX.exe 1272 ZWF.exe 880 UJKJD.exe 2256 OXPTODQ.exe 5716 YXRGR.exe 3144 RXG.exe 2596 STKMGRJ.exe 5380 MOPW.exe 1324 KBOE.exe 4976 JZZ.exe 4700 AZBFTF.exe 2696 LSIP.exe 2620 TFJEE.exe 5584 VDOY.exe 4692 BDWMDVL.exe 1480 JJITNT.exe 3284 THON.exe 5432 TMOBWP.exe 4012 IPYGPCS.exe 5628 SQATTZ.exe 4524 EYG.exe 2640 NGIY.exe 3172 OJM.exe 5556 IWRLY.exe 3304 XRA.exe 3076 OCLFS.exe 6096 ESM.exe 2228 TVWJKN.exe 1292 EOZCSDT.exe 2440 OEEWZ.exe 4492 ORE.exe 5972 DMO.exe 1160 OFRIC.exe 5384 JSORES.exe 1840 NICR.exe 4440 EIEWUIZ.exe 4848 ZWBG.exe 2284 OZTSPUW.exe 204 HUWO.exe 3904 NPWXZN.exe 804 JVTMOX.exe 2296 SIEE.exe 5768 TDIIKS.exe 3152 EVLAKZU.exe 4396 XZOW.exe 4304 IRRPY.exe 1076 ORZDPYU.exe 844 LXFA.exe 1416 UXZFZ.exe 2316 AYH.exe 3844 IDH.exe 5300 GDOVBP.exe 5820 MEWIKJ.exe 3944 DMYN.exe 3364 HUFVAHV.exe 3008 SNI.exe 3308 PSF.exe 684 ALIW.exe 1284 ZOU.exe 5596 CWAOY.exe 1756 CKBCHV.exe 2728 OSHCM.exe 1100 USPQDH.exe - Drops file in System32 directory 63 IoCs
description ioc Process File created C:\windows\SysWOW64\KYLLZ.exe.bat 2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe File created C:\windows\SysWOW64\RXG.exe YXRGR.exe File created C:\windows\SysWOW64\KBOE.exe MOPW.exe File created C:\windows\SysWOW64\NICR.exe.bat JSORES.exe File created C:\windows\SysWOW64\JVTMOX.exe.bat NPWXZN.exe File opened for modification C:\windows\SysWOW64\IXP.exe LXP.exe File created C:\windows\SysWOW64\IWZHZDD.exe.bat FIVXPD.exe File created C:\windows\SysWOW64\MQB.exe.bat LVYXLF.exe File created C:\windows\SysWOW64\THON.exe.bat JJITNT.exe File created C:\windows\SysWOW64\STKMGRJ.exe.bat RXG.exe File opened for modification C:\windows\SysWOW64\MOPW.exe STKMGRJ.exe File opened for modification C:\windows\SysWOW64\NPWXZN.exe HUWO.exe File created C:\windows\SysWOW64\ESRD.exe USPQDH.exe File created C:\windows\SysWOW64\KUDC.exe.bat NOFF.exe File opened for modification C:\windows\SysWOW64\THON.exe JJITNT.exe File created C:\windows\SysWOW64\OFRIC.exe DMO.exe File opened for modification C:\windows\SysWOW64\OFRIC.exe DMO.exe File opened for modification C:\windows\SysWOW64\ESRD.exe USPQDH.exe File opened for modification C:\windows\SysWOW64\IWZHZDD.exe FIVXPD.exe File opened for modification C:\windows\SysWOW64\KBOE.exe MOPW.exe File created C:\windows\SysWOW64\JVTMOX.exe NPWXZN.exe File created C:\windows\SysWOW64\RXG.exe.bat YXRGR.exe File created C:\windows\SysWOW64\KBOE.exe.bat MOPW.exe File opened for modification C:\windows\SysWOW64\EYG.exe SQATTZ.exe File created C:\windows\SysWOW64\IWZHZDD.exe FIVXPD.exe File opened for modification C:\windows\SysWOW64\TMRXLF.exe GJBYXD.exe File created C:\windows\SysWOW64\THON.exe JJITNT.exe File opened for modification C:\windows\SysWOW64\UJKJD.exe ZWF.exe File created C:\windows\SysWOW64\YXRGR.exe OXPTODQ.exe File created C:\windows\SysWOW64\YXRGR.exe.bat OXPTODQ.exe File opened for modification C:\windows\SysWOW64\NICR.exe JSORES.exe File created C:\windows\SysWOW64\KYLLZ.exe 2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe File created C:\windows\SysWOW64\UJKJD.exe.bat ZWF.exe File created C:\windows\SysWOW64\VDOY.exe.bat TFJEE.exe File opened for modification C:\windows\SysWOW64\KYLLZ.exe 2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\FHYL.exe ZHRXIJ.exe File created C:\windows\SysWOW64\NPWXZN.exe.bat HUWO.exe File opened for modification C:\windows\SysWOW64\JVTMOX.exe NPWXZN.exe File created C:\windows\SysWOW64\ESRD.exe.bat USPQDH.exe File created C:\windows\SysWOW64\VDOY.exe TFJEE.exe File created C:\windows\SysWOW64\UJKJD.exe ZWF.exe File created C:\windows\SysWOW64\MOPW.exe STKMGRJ.exe File created C:\windows\SysWOW64\NPWXZN.exe HUWO.exe File created C:\windows\SysWOW64\FHYL.exe ZHRXIJ.exe File opened for modification C:\windows\SysWOW64\VDOY.exe TFJEE.exe File created C:\windows\SysWOW64\EYG.exe.bat SQATTZ.exe File created C:\windows\SysWOW64\TMRXLF.exe GJBYXD.exe File created C:\windows\SysWOW64\STKMGRJ.exe RXG.exe File opened for modification C:\windows\SysWOW64\KUDC.exe NOFF.exe File created C:\windows\SysWOW64\IXP.exe.bat LXP.exe File created C:\windows\SysWOW64\TMRXLF.exe.bat GJBYXD.exe File created C:\windows\SysWOW64\EYG.exe SQATTZ.exe File created C:\windows\SysWOW64\NICR.exe JSORES.exe File opened for modification C:\windows\SysWOW64\MQB.exe LVYXLF.exe File opened for modification C:\windows\SysWOW64\RXG.exe YXRGR.exe File created C:\windows\SysWOW64\KUDC.exe NOFF.exe File created C:\windows\SysWOW64\FHYL.exe.bat ZHRXIJ.exe File opened for modification C:\windows\SysWOW64\STKMGRJ.exe RXG.exe File created C:\windows\SysWOW64\OFRIC.exe.bat DMO.exe File created C:\windows\SysWOW64\IXP.exe LXP.exe File created C:\windows\SysWOW64\MQB.exe LVYXLF.exe File opened for modification C:\windows\SysWOW64\YXRGR.exe OXPTODQ.exe File created C:\windows\SysWOW64\MOPW.exe.bat STKMGRJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\JZZ.exe KBOE.exe File created C:\windows\NGIY.exe.bat EYG.exe File created C:\windows\system\JSORES.exe OFRIC.exe File created C:\windows\system\JSORES.exe.bat OFRIC.exe File opened for modification C:\windows\system\OSHCM.exe CKBCHV.exe File created C:\windows\system\KSOZNYY.exe.bat ERGMW.exe File created C:\windows\system\ENSR.exe.bat KSOZNYY.exe File opened for modification C:\windows\system\TSUCGPL.exe YEPKW.exe File created C:\windows\OCLFS.exe XRA.exe File opened for modification C:\windows\OCLFS.exe XRA.exe File created C:\windows\system\OZTSPUW.exe.bat ZWBG.exe File created C:\windows\TDIIKS.exe.bat SIEE.exe File created C:\windows\LXFA.exe.bat ORZDPYU.exe File opened for modification C:\windows\system\ONUWA.exe ENSR.exe File created C:\windows\OBZT.exe.bat UNC.exe File created C:\windows\RDJAOC.exe.bat SSHKNOP.exe File opened for modification C:\windows\system\OXPTODQ.exe UJKJD.exe File created C:\windows\TFJEE.exe LSIP.exe File created C:\windows\EOZCSDT.exe TVWJKN.exe File created C:\windows\TDIIKS.exe SIEE.exe File opened for modification C:\windows\EVLAKZU.exe TDIIKS.exe File created C:\windows\system\UQSE.exe.bat IXP.exe File created C:\windows\RDJAOC.exe SSHKNOP.exe File created C:\windows\system\OXPTODQ.exe.bat UJKJD.exe File created C:\windows\OCLFS.exe.bat XRA.exe File created C:\windows\EVLAKZU.exe.bat TDIIKS.exe File created C:\windows\ZOU.exe.bat ALIW.exe File created C:\windows\system\WVVZMD.exe ESRD.exe File opened for modification C:\windows\system\UQSE.exe IXP.exe File opened for modification C:\windows\SSHKNOP.exe FHYL.exe File created C:\windows\system\HWBNJ.exe NETCA.exe File opened for modification C:\windows\OBZT.exe UNC.exe File created C:\windows\SSHKNOP.exe FHYL.exe File created C:\windows\system\YEPKW.exe HWBNJ.exe File opened for modification C:\windows\system\YEPKW.exe HWBNJ.exe File created C:\windows\ZWF.exe TWX.exe File opened for modification C:\windows\EOZCSDT.exe TVWJKN.exe File created C:\windows\OEEWZ.exe EOZCSDT.exe File created C:\windows\system\ZWBG.exe.bat EIEWUIZ.exe File opened for modification C:\windows\system\HUWO.exe OZTSPUW.exe File opened for modification C:\windows\SIEE.exe JVTMOX.exe File opened for modification C:\windows\system\IRRPY.exe XZOW.exe File created C:\windows\system\IRRPY.exe.bat XZOW.exe File opened for modification C:\windows\OJM.exe NGIY.exe File opened for modification C:\windows\OEEWZ.exe EOZCSDT.exe File created C:\windows\DMO.exe.bat ORE.exe File opened for modification C:\windows\system\PSF.exe SNI.exe File created C:\windows\system\ALIW.exe PSF.exe File created C:\windows\system\CWAOY.exe ZOU.exe File opened for modification C:\windows\system\WVVZMD.exe ESRD.exe File opened for modification C:\windows\LXP.exe KUDC.exe File opened for modification C:\windows\TFJEE.exe LSIP.exe File created C:\windows\system\IWRLY.exe.bat OJM.exe File created C:\windows\system\HUWO.exe.bat OZTSPUW.exe File created C:\windows\LXFA.exe ORZDPYU.exe File created C:\windows\IDH.exe AYH.exe File opened for modification C:\windows\system\ALIW.exe PSF.exe File created C:\windows\SSHKNOP.exe.bat FHYL.exe File created C:\windows\system\IPYGPCS.exe.bat TMOBWP.exe File created C:\windows\SQATTZ.exe IPYGPCS.exe File created C:\windows\system\ORE.exe.bat OEEWZ.exe File created C:\windows\EIEWUIZ.exe NICR.exe File opened for modification C:\windows\system\MEWIKJ.exe GDOVBP.exe File created C:\windows\LXP.exe.bat KUDC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1396 cmd.exe 1800 cmd.exe 4776 cmd.exe 3724 cmd.exe 1808 cmd.exe 3056 cmd.exe 3336 cmd.exe 4540 cmd.exe 3988 cmd.exe 4984 cmd.exe 4116 cmd.exe 5532 cmd.exe 4760 cmd.exe 4488 cmd.exe 2748 cmd.exe 3760 cmd.exe 5624 cmd.exe 1320 cmd.exe 3012 cmd.exe 2312 cmd.exe 5612 cmd.exe 2280 cmd.exe 4612 cmd.exe 5216 cmd.exe 5528 cmd.exe 5788 cmd.exe 1572 cmd.exe 1920 cmd.exe 4636 cmd.exe 5600 cmd.exe 3676 cmd.exe 4256 cmd.exe 4052 cmd.exe 4804 cmd.exe 3124 cmd.exe 688 cmd.exe 1496 cmd.exe 4520 cmd.exe 2704 cmd.exe 1520 cmd.exe 2344 cmd.exe 5724 cmd.exe 2528 cmd.exe 2288 cmd.exe 5296 cmd.exe 1972 cmd.exe 5884 cmd.exe 1312 cmd.exe 5288 cmd.exe 2600 cmd.exe 4292 cmd.exe 5132 cmd.exe 2540 cmd.exe 5208 cmd.exe 1784 cmd.exe 3408 cmd.exe 5668 cmd.exe 4040 cmd.exe 2700 cmd.exe 2432 cmd.exe 6004 cmd.exe 4348 cmd.exe 4620 cmd.exe 5020 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1684 4712 WerFault.exe 87 260 4272 WerFault.exe 92 6048 4112 WerFault.exe 98 2480 1272 WerFault.exe 103 4304 880 WerFault.exe 108 6120 2256 WerFault.exe 113 1472 5716 WerFault.exe 118 1572 3144 WerFault.exe 123 6092 2596 WerFault.exe 128 6056 5380 WerFault.exe 133 5312 1324 WerFault.exe 138 2364 4976 WerFault.exe 143 6132 4700 WerFault.exe 148 6048 2696 WerFault.exe 153 2480 2620 WerFault.exe 158 4996 5584 WerFault.exe 163 972 4692 WerFault.exe 168 4460 1480 WerFault.exe 173 2452 3284 WerFault.exe 178 4056 5432 WerFault.exe 183 1592 4012 WerFault.exe 188 2728 5628 WerFault.exe 193 4208 4524 WerFault.exe 198 3944 2640 WerFault.exe 203 5508 3172 WerFault.exe 208 1108 5556 WerFault.exe 213 2908 3304 WerFault.exe 218 5780 3076 WerFault.exe 223 2916 6096 WerFault.exe 228 2768 2228 WerFault.exe 233 4884 1292 WerFault.exe 238 1216 2440 WerFault.exe 243 1820 4492 WerFault.exe 248 2616 5972 WerFault.exe 253 3100 1160 WerFault.exe 258 4292 5384 WerFault.exe 263 5032 1840 WerFault.exe 268 5860 4440 WerFault.exe 273 3872 4848 WerFault.exe 279 2172 2284 WerFault.exe 284 2332 204 WerFault.exe 289 3644 3904 WerFault.exe 294 2860 804 WerFault.exe 299 4756 2296 WerFault.exe 304 5764 5768 WerFault.exe 309 3968 3152 WerFault.exe 314 1932 4396 WerFault.exe 319 3308 4304 WerFault.exe 324 2484 1076 WerFault.exe 329 5644 844 WerFault.exe 334 5376 1416 WerFault.exe 339 4564 2316 WerFault.exe 344 3936 3844 WerFault.exe 349 4052 5300 WerFault.exe 354 1476 5820 WerFault.exe 359 2540 3944 WerFault.exe 364 5076 3364 WerFault.exe 369 3864 3008 WerFault.exe 374 2396 3308 WerFault.exe 379 2780 684 WerFault.exe 384 5376 1284 WerFault.exe 389 2264 5596 WerFault.exe 394 2852 1756 WerFault.exe 399 5364 2728 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MOPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEEWZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJBYXD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVWJKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTMOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWRLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEWIKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUFVAHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EIEWUIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CWC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSOZNYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZBFTF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDIIKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFJEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJITNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STKMGRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPYGPCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSORES.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZTSPUW.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4712 2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe 4712 2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe 4272 KYLLZ.exe 4272 KYLLZ.exe 4112 TWX.exe 4112 TWX.exe 1272 ZWF.exe 1272 ZWF.exe 880 UJKJD.exe 880 UJKJD.exe 2256 OXPTODQ.exe 2256 OXPTODQ.exe 5716 YXRGR.exe 5716 YXRGR.exe 3144 RXG.exe 3144 RXG.exe 2596 STKMGRJ.exe 2596 STKMGRJ.exe 5380 MOPW.exe 5380 MOPW.exe 1324 KBOE.exe 1324 KBOE.exe 4976 JZZ.exe 4976 JZZ.exe 4700 AZBFTF.exe 4700 AZBFTF.exe 2696 LSIP.exe 2696 LSIP.exe 2620 TFJEE.exe 2620 TFJEE.exe 5584 VDOY.exe 5584 VDOY.exe 4692 BDWMDVL.exe 4692 BDWMDVL.exe 1480 JJITNT.exe 1480 JJITNT.exe 3284 THON.exe 3284 THON.exe 5432 TMOBWP.exe 5432 TMOBWP.exe 4012 IPYGPCS.exe 4012 IPYGPCS.exe 5628 SQATTZ.exe 5628 SQATTZ.exe 4524 EYG.exe 4524 EYG.exe 2640 NGIY.exe 2640 NGIY.exe 3172 OJM.exe 3172 OJM.exe 5556 IWRLY.exe 5556 IWRLY.exe 3304 XRA.exe 3304 XRA.exe 3076 OCLFS.exe 3076 OCLFS.exe 6096 ESM.exe 6096 ESM.exe 2228 TVWJKN.exe 2228 TVWJKN.exe 1292 EOZCSDT.exe 1292 EOZCSDT.exe 2440 OEEWZ.exe 2440 OEEWZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4712 2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe 4712 2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe 4272 KYLLZ.exe 4272 KYLLZ.exe 4112 TWX.exe 4112 TWX.exe 1272 ZWF.exe 1272 ZWF.exe 880 UJKJD.exe 880 UJKJD.exe 2256 OXPTODQ.exe 2256 OXPTODQ.exe 5716 YXRGR.exe 5716 YXRGR.exe 3144 RXG.exe 3144 RXG.exe 2596 STKMGRJ.exe 2596 STKMGRJ.exe 5380 MOPW.exe 5380 MOPW.exe 1324 KBOE.exe 1324 KBOE.exe 4976 JZZ.exe 4976 JZZ.exe 4700 AZBFTF.exe 4700 AZBFTF.exe 2696 LSIP.exe 2696 LSIP.exe 2620 TFJEE.exe 2620 TFJEE.exe 5584 VDOY.exe 5584 VDOY.exe 4692 BDWMDVL.exe 4692 BDWMDVL.exe 1480 JJITNT.exe 1480 JJITNT.exe 3284 THON.exe 3284 THON.exe 5432 TMOBWP.exe 5432 TMOBWP.exe 4012 IPYGPCS.exe 4012 IPYGPCS.exe 5628 SQATTZ.exe 5628 SQATTZ.exe 4524 EYG.exe 4524 EYG.exe 2640 NGIY.exe 2640 NGIY.exe 3172 OJM.exe 3172 OJM.exe 5556 IWRLY.exe 5556 IWRLY.exe 3304 XRA.exe 3304 XRA.exe 3076 OCLFS.exe 3076 OCLFS.exe 6096 ESM.exe 6096 ESM.exe 2228 TVWJKN.exe 2228 TVWJKN.exe 1292 EOZCSDT.exe 1292 EOZCSDT.exe 2440 OEEWZ.exe 2440 OEEWZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 4924 4712 2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe 88 PID 4924 wrote to memory of 4272 4924 cmd.exe 92 PID 4272 wrote to memory of 1972 4272 KYLLZ.exe 94 PID 1972 wrote to memory of 4112 1972 cmd.exe 98 PID 4112 wrote to memory of 5216 4112 TWX.exe 99 PID 5216 wrote to memory of 1272 5216 cmd.exe 103 PID 1272 wrote to memory of 2100 1272 ZWF.exe 104 PID 2100 wrote to memory of 880 2100 cmd.exe 108 PID 880 wrote to memory of 2600 880 UJKJD.exe 109 PID 2600 wrote to memory of 2256 2600 cmd.exe 113 PID 2256 wrote to memory of 4608 2256 OXPTODQ.exe 114 PID 4608 wrote to memory of 5716 4608 cmd.exe 118 PID 5716 wrote to memory of 1092 5716 YXRGR.exe 119 PID 1092 wrote to memory of 3144 1092 cmd.exe 123 PID 3144 wrote to memory of 4588 3144 RXG.exe 124 PID 4588 wrote to memory of 2596 4588 cmd.exe 128 PID 2596 wrote to memory of 5884 2596 STKMGRJ.exe 129 PID 5884 wrote to memory of 5380 5884 cmd.exe 133 PID 5380 wrote to memory of 4520 5380 MOPW.exe 134 PID 4520 wrote to memory of 1324 4520 cmd.exe 138 PID 1324 wrote to memory of 5600 1324 KBOE.exe 139 PID 5600 wrote to memory of 4976 5600 cmd.exe 143 PID 4976 wrote to memory of 2444 4976 JZZ.exe 144 PID 2444 wrote to memory of 4700 2444 cmd.exe 148 PID 4700 wrote to memory of 5668 4700 AZBFTF.exe 149 PID 5668 wrote to memory of 2696 5668 cmd.exe 153 PID 2696 wrote to memory of 5096 2696 LSIP.exe 154 PID 5096 wrote to memory of 2620 5096 cmd.exe 158 PID 2620 wrote to memory of 3396 2620 TFJEE.exe 159 PID 3396 wrote to memory of 5584 3396 cmd.exe 163 PID 5584 wrote to memory of 5476 5584 VDOY.exe 164 PID 5476 wrote to memory of 4692 5476 cmd.exe 168 PID 4692 wrote to memory of 5528 4692 BDWMDVL.exe 169 PID 5528 wrote to memory of 1480 5528 cmd.exe 173 PID 1480 wrote to memory of 3636 1480 JJITNT.exe 174 PID 3636 wrote to memory of 3284 3636 cmd.exe 178 PID 3284 wrote to memory of 5304 3284 THON.exe 179 PID 5304 wrote to memory of 5432 5304 cmd.exe 183 PID 5432 wrote to memory of 5800 5432 TMOBWP.exe 184 PID 5800 wrote to memory of 4012 5800 cmd.exe 188 PID 4012 wrote to memory of 4040 4012 IPYGPCS.exe 189 PID 4040 wrote to memory of 5628 4040 cmd.exe 193 PID 5628 wrote to memory of 3564 5628 SQATTZ.exe 194 PID 3564 wrote to memory of 4524 3564 cmd.exe 198 PID 4524 wrote to memory of 5788 4524 EYG.exe 199 PID 5788 wrote to memory of 2640 5788 cmd.exe 203 PID 2640 wrote to memory of 4612 2640 NGIY.exe 204 PID 4612 wrote to memory of 3172 4612 cmd.exe 208 PID 3172 wrote to memory of 2400 3172 OJM.exe 209 PID 2400 wrote to memory of 5556 2400 cmd.exe 213 PID 5556 wrote to memory of 2700 5556 IWRLY.exe 214 PID 2700 wrote to memory of 3304 2700 cmd.exe 218 PID 3304 wrote to memory of 2944 3304 XRA.exe 219 PID 2944 wrote to memory of 3076 2944 cmd.exe 223 PID 3076 wrote to memory of 1436 3076 OCLFS.exe 224 PID 1436 wrote to memory of 6096 1436 cmd.exe 228 PID 6096 wrote to memory of 5524 6096 ESM.exe 229 PID 5524 wrote to memory of 2228 5524 cmd.exe 233 PID 2228 wrote to memory of 1572 2228 TVWJKN.exe 234 PID 1572 wrote to memory of 1292 1572 cmd.exe 238 PID 1292 wrote to memory of 4604 1292 EOZCSDT.exe 239 PID 4604 wrote to memory of 2440 4604 cmd.exe 243 PID 2440 wrote to memory of 2408 2440 OEEWZ.exe 244 PID 2408 wrote to memory of 4492 2408 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_87bfa4903604deccbf32698ccf2953fc_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYLLZ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\SysWOW64\KYLLZ.exeC:\windows\system32\KYLLZ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWX.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\system\TWX.exeC:\windows\system\TWX.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWF.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\windows\ZWF.exeC:\windows\ZWF.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UJKJD.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\windows\SysWOW64\UJKJD.exeC:\windows\system32\UJKJD.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXPTODQ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\system\OXPTODQ.exeC:\windows\system\OXPTODQ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXRGR.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\windows\SysWOW64\YXRGR.exeC:\windows\system32\YXRGR.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXG.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\windows\SysWOW64\RXG.exeC:\windows\system32\RXG.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOPW.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\SysWOW64\MOPW.exeC:\windows\system32\MOPW.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KBOE.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\SysWOW64\KBOE.exeC:\windows\system32\KBOE.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JZZ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\windows\system\JZZ.exeC:\windows\system\JZZ.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZBFTF.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\AZBFTF.exeC:\windows\AZBFTF.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSIP.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\windows\LSIP.exeC:\windows\LSIP.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TFJEE.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\windows\TFJEE.exeC:\windows\TFJEE.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDOY.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\SysWOW64\VDOY.exeC:\windows\system32\VDOY.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDWMDVL.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\windows\BDWMDVL.exeC:\windows\BDWMDVL.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJITNT.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\windows\system\JJITNT.exeC:\windows\system\JJITNT.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THON.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\windows\SysWOW64\THON.exeC:\windows\system32\THON.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TMOBWP.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\windows\system\TMOBWP.exeC:\windows\system\TMOBWP.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IPYGPCS.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\windows\system\IPYGPCS.exeC:\windows\system\IPYGPCS.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SQATTZ.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\windows\SQATTZ.exeC:\windows\SQATTZ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYG.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\windows\SysWOW64\EYG.exeC:\windows\system32\EYG.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGIY.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\NGIY.exeC:\windows\NGIY.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJM.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\OJM.exeC:\windows\OJM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWRLY.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\system\IWRLY.exeC:\windows\system\IWRLY.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRA.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\windows\XRA.exeC:\windows\XRA.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OCLFS.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\windows\OCLFS.exeC:\windows\OCLFS.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ESM.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\windows\ESM.exeC:\windows\ESM.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TVWJKN.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\windows\TVWJKN.exeC:\windows\TVWJKN.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EOZCSDT.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\windows\EOZCSDT.exeC:\windows\EOZCSDT.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEEWZ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\OEEWZ.exeC:\windows\OEEWZ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORE.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\windows\system\ORE.exeC:\windows\system\ORE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMO.exe.bat" "66⤵PID:5332
-
C:\windows\DMO.exeC:\windows\DMO.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OFRIC.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5308 -
C:\windows\SysWOW64\OFRIC.exeC:\windows\system32\OFRIC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JSORES.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2260 -
C:\windows\system\JSORES.exeC:\windows\system\JSORES.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NICR.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5532 -
C:\windows\SysWOW64\NICR.exeC:\windows\system32\NICR.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EIEWUIZ.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2528 -
C:\windows\EIEWUIZ.exeC:\windows\EIEWUIZ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZWBG.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:3700 -
C:\windows\system\ZWBG.exeC:\windows\system\ZWBG.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OZTSPUW.exe.bat" "78⤵PID:1552
-
C:\windows\system\OZTSPUW.exeC:\windows\system\OZTSPUW.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUWO.exe.bat" "80⤵PID:3404
-
C:\windows\system\HUWO.exeC:\windows\system\HUWO.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NPWXZN.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2432 -
C:\windows\SysWOW64\NPWXZN.exeC:\windows\system32\NPWXZN.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JVTMOX.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4980 -
C:\windows\SysWOW64\JVTMOX.exeC:\windows\system32\JVTMOX.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIEE.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4760 -
C:\windows\SIEE.exeC:\windows\SIEE.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TDIIKS.exe.bat" "88⤵PID:4732
-
C:\windows\TDIIKS.exeC:\windows\TDIIKS.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EVLAKZU.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2024 -
C:\windows\EVLAKZU.exeC:\windows\EVLAKZU.exe91⤵
- Executes dropped EXE
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XZOW.exe.bat" "92⤵PID:5112
-
C:\windows\system\XZOW.exeC:\windows\system\XZOW.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRRPY.exe.bat" "94⤵PID:592
-
C:\windows\system\IRRPY.exeC:\windows\system\IRRPY.exe95⤵
- Executes dropped EXE
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORZDPYU.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5552 -
C:\windows\system\ORZDPYU.exeC:\windows\system\ORZDPYU.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXFA.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2288 -
C:\windows\LXFA.exeC:\windows\LXFA.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXZFZ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:1312 -
C:\windows\system\UXZFZ.exeC:\windows\system\UXZFZ.exe101⤵
- Executes dropped EXE
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYH.exe.bat" "102⤵PID:4336
-
C:\windows\system\AYH.exeC:\windows\system\AYH.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IDH.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2280 -
C:\windows\IDH.exeC:\windows\IDH.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GDOVBP.exe.bat" "106⤵PID:4092
-
C:\windows\system\GDOVBP.exeC:\windows\system\GDOVBP.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEWIKJ.exe.bat" "108⤵PID:4568
-
C:\windows\system\MEWIKJ.exeC:\windows\system\MEWIKJ.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMYN.exe.bat" "110⤵PID:1584
-
C:\windows\system\DMYN.exeC:\windows\system\DMYN.exe111⤵
- Executes dropped EXE
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUFVAHV.exe.bat" "112⤵PID:2552
-
C:\windows\system\HUFVAHV.exeC:\windows\system\HUFVAHV.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNI.exe.bat" "114⤵PID:1936
-
C:\windows\SNI.exeC:\windows\SNI.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSF.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:1268 -
C:\windows\system\PSF.exeC:\windows\system\PSF.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ALIW.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5620 -
C:\windows\system\ALIW.exeC:\windows\system\ALIW.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOU.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:1904 -
C:\windows\ZOU.exeC:\windows\ZOU.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-