Analysis
- max time kernel
78s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 08:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_38493b931e0d11d95c11bb4ba7bb9abb_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-16_38493b931e0d11d95c11bb4ba7bb9abb_elex_emotet_stop.exe
- Size 208KB
- Sample260816-j244eacb73
- SHA256 19d22ef118f65f60a84fb9d29930f3873741721f13073b843c8b91f41ea621d2
- MD5 38493b931e0d11d95c11bb4ba7bb9abb
- SHA1 b61f765e006a6fce5bb2ec88667243a3e5944af7
- SHA512 f41909d4fdd1f4e171d2ff4600713533fb4ccd98201e86409990f4fc32314d22a2b972cf1d20d6f7d04c1663facb47731197ab4d036ab558cbc2f2fc49558ea1
- SSDEEP 3072:cLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfR4pLthEjQT6j:olZtbLWIgd1LZ9oECZbslc5+LOZkEj1
- TLSH T173247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2844 MPVHTWE.exe 2604 UPDB.exe 3808 NITM.exe 4608 RYZUWA.exe 2456 MLE.exe 4208 LWHTPOV.exe 1604 VUNGXWE.exe 5512 PHR.exe 2712 ZPTCK.exe 5352 QPIZX.exe 1300 RSMD.exe 5532 SQZPSJ.exe 1844 RBCFS.exe 4476 MWHPDWL.exe 2460 OKMY.exe 6088 ACTR.exe 4404 KAHDMY.exe 3060 CDLHR.exe 4312 DYODXLB.exe 1616 WBSHKB.exe 1688 BBAUTV.exe 3720 CEEQZ.exe 3724 XSIZJTC.exe 2452 XXJ.exe 1900 RLNXV.exe 4752 IYYPK.exe 5644 DLDH.exe 6096 OEY.exe 6024 EUZRCXB.exe 2132 IKFR.exe 5136 XFXDZCX.exe 5836 DAOEE.exe 4524 FYCYLOW.exe 4812 JGIYX.exe 5420 LBNIHGY.exe 1920 GPS.exe 2112 ZKWVXWX.exe 1284 DACVJ.exe 2668 LFCJL.exe 2296 AAM.exe 4612 EQSWIG.exe 1964 NRUB.exe 2056 EZWGP.exe 2868 IHD.exe 2448 OHLCS.exe 4168 WXMTRR.exe 5732 FVRNGZ.exe 4760 EGCEP.exe 2784 KGKRYIZ.exe 700 OWQZ.exe 776 JJVJNS.exe 5980 ASXOYXM.exe 4588 YSFBH.exe 4940 AFKLRRC.exe 3984 YBBMOUR.exe 1320 OWSYH.exe 5164 IJXHRHP.exe 296 QPP.exe 1508 XKZAEG.exe 5008 PSBF.exe 3752 TAHNUE.exe 6036 NVM.exe 2888 DLNO.exe 5292 BBGRX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RBCFS.exe.bat SQZPSJ.exe File created C:\windows\SysWOW64\WBSHKB.exe.bat DYODXLB.exe File created C:\windows\SysWOW64\PSXESJP.exe HMTXHDU.exe File created C:\windows\SysWOW64\FBH.exe FYDNDX.exe File opened for modification C:\windows\SysWOW64\NRIQPJ.exe FBH.exe File opened for modification C:\windows\SysWOW64\IKFR.exe EUZRCXB.exe File created C:\windows\SysWOW64\NRUB.exe.bat EQSWIG.exe File created C:\windows\SysWOW64\NVM.exe TAHNUE.exe File opened for modification C:\windows\SysWOW64\OIO.exe ZNEYC.exe File opened for modification C:\windows\SysWOW64\RJBL.exe XWWBMQW.exe File created C:\windows\SysWOW64\KAHDMY.exe ACTR.exe File opened for modification C:\windows\SysWOW64\FVRNGZ.exe WXMTRR.exe File created C:\windows\SysWOW64\PSBF.exe.bat XKZAEG.exe File opened for modification C:\windows\SysWOW64\PSXESJP.exe HMTXHDU.exe File created C:\windows\SysWOW64\JFC.exe PSXESJP.exe File created C:\windows\SysWOW64\RJBL.exe XWWBMQW.exe File created C:\windows\SysWOW64\MWHPDWL.exe RBCFS.exe File created C:\windows\SysWOW64\IKFR.exe EUZRCXB.exe File created C:\windows\SysWOW64\JJVJNS.exe.bat OWQZ.exe File opened for modification C:\windows\SysWOW64\NVM.exe TAHNUE.exe File created C:\windows\SysWOW64\GPS.exe.bat LBNIHGY.exe File created C:\windows\SysWOW64\ZKWVXWX.exe.bat GPS.exe File created C:\windows\SysWOW64\OIO.exe ZNEYC.exe File created C:\windows\SysWOW64\HMTXHDU.exe RJBL.exe File opened for modification C:\windows\SysWOW64\HMTXHDU.exe RJBL.exe File created C:\windows\SysWOW64\JFC.exe.bat PSXESJP.exe File created C:\windows\SysWOW64\ACTR.exe OKMY.exe File opened for modification C:\windows\SysWOW64\WBSHKB.exe DYODXLB.exe File opened for modification C:\windows\SysWOW64\ZKWVXWX.exe GPS.exe File created C:\windows\SysWOW64\PSBF.exe XKZAEG.exe File created C:\windows\SysWOW64\NRIQPJ.exe.bat FBH.exe File created C:\windows\SysWOW64\WIGDWM.exe.bat ODCWLN.exe File created C:\windows\SysWOW64\EQSWIG.exe.bat AAM.exe File created C:\windows\SysWOW64\SJFV.exe GTQNZHD.exe File created C:\windows\SysWOW64\XAPN.exe LSBFTU.exe File created C:\windows\SysWOW64\ACTR.exe.bat OKMY.exe File created C:\windows\SysWOW64\NRUB.exe EQSWIG.exe File opened for modification C:\windows\SysWOW64\PSBF.exe XKZAEG.exe File created C:\windows\SysWOW64\CLKNNPP.exe ZVDNB.exe File created C:\windows\SysWOW64\SJFV.exe.bat GTQNZHD.exe File created C:\windows\SysWOW64\WIGDWM.exe ODCWLN.exe File created C:\windows\SysWOW64\EQSWIG.exe AAM.exe File opened for modification C:\windows\SysWOW64\NRUB.exe EQSWIG.exe File created C:\windows\SysWOW64\JJVJNS.exe OWQZ.exe File opened for modification C:\windows\SysWOW64\JJVJNS.exe OWQZ.exe File created C:\windows\SysWOW64\RJBL.exe.bat XWWBMQW.exe File created C:\windows\SysWOW64\PSXESJP.exe.bat HMTXHDU.exe File opened for modification C:\windows\SysWOW64\WIGDWM.exe ODCWLN.exe File created C:\windows\SysWOW64\WBSHKB.exe DYODXLB.exe File created C:\windows\SysWOW64\FYCYLOW.exe.bat DAOEE.exe File created C:\windows\SysWOW64\NVM.exe.bat TAHNUE.exe File created C:\windows\SysWOW64\BBGRX.exe.bat DLNO.exe File created C:\windows\SysWOW64\NRIQPJ.exe FBH.exe File created C:\windows\SysWOW64\RBCFS.exe SQZPSJ.exe File opened for modification C:\windows\SysWOW64\MWHPDWL.exe RBCFS.exe File opened for modification C:\windows\SysWOW64\KAHDMY.exe ACTR.exe File created C:\windows\SysWOW64\KAHDMY.exe.bat ACTR.exe File opened for modification C:\windows\SysWOW64\FYCYLOW.exe DAOEE.exe File created C:\windows\SysWOW64\BBGRX.exe DLNO.exe File opened for modification C:\windows\SysWOW64\BBGRX.exe DLNO.exe File opened for modification C:\windows\SysWOW64\CLKNNPP.exe ZVDNB.exe File opened for modification C:\windows\SysWOW64\RBCFS.exe SQZPSJ.exe File created C:\windows\SysWOW64\GPS.exe LBNIHGY.exe File opened for modification C:\windows\SysWOW64\JFC.exe PSXESJP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\YRW.exe ULDSUYU.exe File created C:\windows\system\NITM.exe.bat UPDB.exe File created C:\windows\system\DYODXLB.exe.bat CDLHR.exe File created C:\windows\system\RLNXV.exe XXJ.exe File created C:\windows\system\DLDH.exe.bat IYYPK.exe File created C:\windows\system\DAOEE.exe.bat XFXDZCX.exe File opened for modification C:\windows\IHD.exe EZWGP.exe File created C:\windows\system\YBBMOUR.exe AFKLRRC.exe File opened for modification C:\windows\system\YBBMOUR.exe AFKLRRC.exe File created C:\windows\system\SQZPSJ.exe RSMD.exe File created C:\windows\system\OWSYH.exe.bat YBBMOUR.exe File created C:\windows\YRW.exe.bat ULDSUYU.exe File opened for modification C:\windows\system\XOIUQL.exe OQVAID.exe File created C:\windows\RSMD.exe QPIZX.exe File opened for modification C:\windows\system\CDLHR.exe KAHDMY.exe File created C:\windows\IYYPK.exe.bat RLNXV.exe File opened for modification C:\windows\KGKRYIZ.exe EGCEP.exe File created C:\windows\KIYJDKQ.exe EIQWUIP.exe File opened for modification C:\windows\KIYJDKQ.exe EIQWUIP.exe File opened for modification C:\windows\WMNI.exe YRW.exe File created C:\windows\system\LHENARM.exe.bat WMNI.exe File created C:\windows\system\VUNGXWE.exe.bat LWHTPOV.exe File opened for modification C:\windows\system\SQZPSJ.exe RSMD.exe File created C:\windows\system\LFCJL.exe DACVJ.exe File created C:\windows\system\QPP.exe.bat IJXHRHP.exe File created C:\windows\ZVDNB.exe JFC.exe File opened for modification C:\windows\system\LCKYY.exe NRIQPJ.exe File opened for modification C:\windows\system\OWSYH.exe YBBMOUR.exe File created C:\windows\system\TAHNUE.exe.bat PSBF.exe File opened for modification C:\windows\system\ULDSUYU.exe WQERPDE.exe File opened for modification C:\windows\VAYSFXX.exe LCKYY.exe File created C:\windows\system\NITM.exe UPDB.exe File opened for modification C:\windows\system\NITM.exe UPDB.exe File opened for modification C:\windows\QPIZX.exe ZPTCK.exe File created C:\windows\XFXDZCX.exe IKFR.exe File created C:\windows\system\KJIWBC.exe BBGRX.exe File created C:\windows\system\KJIWBC.exe.bat BBGRX.exe File created C:\windows\system\DYPCTKM.exe OIO.exe File created C:\windows\system\GTQNZHD.exe.bat CLKNNPP.exe File created C:\windows\UPDB.exe MPVHTWE.exe File created C:\windows\DACVJ.exe.bat ZKWVXWX.exe File created C:\windows\OHLCS.exe IHD.exe File created C:\windows\system\OWQZ.exe.bat KGKRYIZ.exe File opened for modification C:\windows\WQERPDE.exe KIYJDKQ.exe File created C:\windows\WMNI.exe YRW.exe File created C:\windows\LSBFTU.exe.bat NXKEOZ.exe File opened for modification C:\windows\DACVJ.exe ZKWVXWX.exe File opened for modification C:\windows\system\XWWBMQW.exe XQENDDU.exe File created C:\windows\LSBFTU.exe NXKEOZ.exe File created C:\windows\system\XOIUQL.exe.bat OQVAID.exe File opened for modification C:\windows\system\OKMY.exe MWHPDWL.exe File created C:\windows\system\DYODXLB.exe CDLHR.exe File created C:\windows\system\EGCEP.exe FVRNGZ.exe File created C:\windows\system\AFKLRRC.exe YSFBH.exe File opened for modification C:\windows\DLNO.exe NVM.exe File opened for modification C:\windows\system\LHENARM.exe WMNI.exe File created C:\windows\system\LWHTPOV.exe.bat MLE.exe File opened for modification C:\windows\BBAUTV.exe WBSHKB.exe File created C:\windows\EUZRCXB.exe.bat OEY.exe File created C:\windows\XFXDZCX.exe.bat IKFR.exe File created C:\windows\WQERPDE.exe.bat KIYJDKQ.exe File opened for modification C:\windows\XQENDDU.exe DYPCTKM.exe File created C:\windows\system\GIJSIST.exe.bat XAPN.exe File created C:\windows\system\OEY.exe.bat DLDH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2424 cmd.exe 4844 cmd.exe 5628 cmd.exe 5752 cmd.exe 5096 cmd.exe 1468 cmd.exe 4908 cmd.exe 3288 cmd.exe 2540 cmd.exe 2676 cmd.exe 3920 cmd.exe 3160 cmd.exe 5964 cmd.exe 1824 cmd.exe 2392 cmd.exe 2508 cmd.exe 3248 cmd.exe 2408 cmd.exe 4852 cmd.exe 3540 cmd.exe 6056 cmd.exe 2116 cmd.exe 5888 cmd.exe 4952 cmd.exe 5776 cmd.exe 2836 cmd.exe 2128 cmd.exe 4376 cmd.exe 5012 cmd.exe 4960 cmd.exe 2156 cmd.exe 1648 cmd.exe 3676 cmd.exe 5956 cmd.exe 464 cmd.exe 5492 cmd.exe 4948 cmd.exe 5744 cmd.exe 2716 cmd.exe 4920 cmd.exe 4924 cmd.exe 3928 cmd.exe 5824 cmd.exe 2360 cmd.exe 2280 cmd.exe 4628 cmd.exe 3208 cmd.exe 4324 cmd.exe 3132 cmd.exe 1864 cmd.exe 4868 cmd.exe 4856 cmd.exe 5800 cmd.exe 2492 cmd.exe 5592 cmd.exe 2940 cmd.exe 1672 cmd.exe 5252 cmd.exe 596 cmd.exe 4344 cmd.exe 3780 cmd.exe 436 cmd.exe 4992 cmd.exe 2024 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2420 1004 WerFault.exe 88 4976 2844 WerFault.exe 94 1508 2604 WerFault.exe 100 5336 3808 WerFault.exe 105 2136 4608 WerFault.exe 110 3040 2456 WerFault.exe 115 1512 4208 WerFault.exe 120 5732 1604 WerFault.exe 125 5376 5512 WerFault.exe 130 576 2712 WerFault.exe 135 2780 5352 WerFault.exe 140 5312 1300 WerFault.exe 145 3384 5532 WerFault.exe 150 5236 1844 WerFault.exe 155 1748 4476 WerFault.exe 160 1572 2460 WerFault.exe 165 596 6088 WerFault.exe 170 5752 4404 WerFault.exe 175 3412 3060 WerFault.exe 180 4984 4312 WerFault.exe 185 1760 1616 WerFault.exe 190 1132 1688 WerFault.exe 195 940 3720 WerFault.exe 200 4100 3724 WerFault.exe 205 1032 2452 WerFault.exe 210 5260 1900 WerFault.exe 215 2492 4752 WerFault.exe 220 4116 5644 WerFault.exe 225 5348 6096 WerFault.exe 230 5720 6024 WerFault.exe 235 4568 2132 WerFault.exe 240 2864 5136 WerFault.exe 245 5096 5836 WerFault.exe 250 3580 4524 WerFault.exe 255 4180 4812 WerFault.exe 260 3040 5420 WerFault.exe 265 3636 1920 WerFault.exe 270 2884 2112 WerFault.exe 275 5264 1284 WerFault.exe 281 5344 2668 WerFault.exe 286 3396 2296 WerFault.exe 291 5328 4612 WerFault.exe 296 4388 1964 WerFault.exe 301 1032 2056 WerFault.exe 306 2476 2868 WerFault.exe 311 3084 2448 WerFault.exe 316 5244 4168 WerFault.exe 321 4596 5732 WerFault.exe 326 404 4760 WerFault.exe 331 4456 2784 WerFault.exe 336 1220 700 WerFault.exe 341 3880 776 WerFault.exe 346 2064 5980 WerFault.exe 351 2860 4588 WerFault.exe 356 4708 4940 WerFault.exe 361 6028 3984 WerFault.exe 366 4984 1320 WerFault.exe 371 4712 5164 WerFault.exe 376 2600 296 WerFault.exe 381 5880 1508 WerFault.exe 386 6052 5008 WerFault.exe 391 2524 3752 WerFault.exe 396 2196 6036 WerFault.exe 401 2140 2888 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWSYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTQNZHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUNGXWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBNIHGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVRNGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJVJNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKZAEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHENARM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXKEOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSIZJTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NITM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYZUWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYODXLB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBAUTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEEQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBCFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DACVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHLCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGCEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSBFTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJSIST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TAHNUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMNI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCKYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLNXV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSFBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJXHRHP.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1004 2026-08-16_38493b931e0d11d95c11bb4ba7bb9abb_elex_emotet_stop.exe 1004 2026-08-16_38493b931e0d11d95c11bb4ba7bb9abb_elex_emotet_stop.exe 2844 MPVHTWE.exe 2844 MPVHTWE.exe 2604 UPDB.exe 2604 UPDB.exe 3808 NITM.exe 3808 NITM.exe 4608 RYZUWA.exe 4608 RYZUWA.exe 2456 MLE.exe 2456 MLE.exe 4208 LWHTPOV.exe 4208 LWHTPOV.exe 1604 VUNGXWE.exe 1604 VUNGXWE.exe 5512 PHR.exe 5512 PHR.exe 2712 ZPTCK.exe 2712 ZPTCK.exe 5352 QPIZX.exe 5352 QPIZX.exe 1300 RSMD.exe 1300 RSMD.exe 5532 SQZPSJ.exe 5532 SQZPSJ.exe 1844 RBCFS.exe 1844 RBCFS.exe 4476 MWHPDWL.exe 4476 MWHPDWL.exe 2460 OKMY.exe 2460 OKMY.exe 6088 ACTR.exe 6088 ACTR.exe 4404 KAHDMY.exe 4404 KAHDMY.exe 3060 CDLHR.exe 3060 CDLHR.exe 4312 DYODXLB.exe 4312 DYODXLB.exe 1616 WBSHKB.exe 1616 WBSHKB.exe 1688 BBAUTV.exe 1688 BBAUTV.exe 3720 CEEQZ.exe 3720 CEEQZ.exe 3724 XSIZJTC.exe 3724 XSIZJTC.exe 2452 XXJ.exe 2452 XXJ.exe 1900 RLNXV.exe 1900 RLNXV.exe 4752 IYYPK.exe 4752 IYYPK.exe 5644 DLDH.exe 5644 DLDH.exe 6096 OEY.exe 6096 OEY.exe 6024 EUZRCXB.exe 6024 EUZRCXB.exe 2132 IKFR.exe 2132 IKFR.exe 5136 XFXDZCX.exe 5136 XFXDZCX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1004 2026-08-16_38493b931e0d11d95c11bb4ba7bb9abb_elex_emotet_stop.exe 1004 2026-08-16_38493b931e0d11d95c11bb4ba7bb9abb_elex_emotet_stop.exe 2844 MPVHTWE.exe 2844 MPVHTWE.exe 2604 UPDB.exe 2604 UPDB.exe 3808 NITM.exe 3808 NITM.exe 4608 RYZUWA.exe 4608 RYZUWA.exe 2456 MLE.exe 2456 MLE.exe 4208 LWHTPOV.exe 4208 LWHTPOV.exe 1604 VUNGXWE.exe 1604 VUNGXWE.exe 5512 PHR.exe 5512 PHR.exe 2712 ZPTCK.exe 2712 ZPTCK.exe 5352 QPIZX.exe 5352 QPIZX.exe 1300 RSMD.exe 1300 RSMD.exe 5532 SQZPSJ.exe 5532 SQZPSJ.exe 1844 RBCFS.exe 1844 RBCFS.exe 4476 MWHPDWL.exe 4476 MWHPDWL.exe 2460 OKMY.exe 2460 OKMY.exe 6088 ACTR.exe 6088 ACTR.exe 4404 KAHDMY.exe 4404 KAHDMY.exe 3060 CDLHR.exe 3060 CDLHR.exe 4312 DYODXLB.exe 4312 DYODXLB.exe 1616 WBSHKB.exe 1616 WBSHKB.exe 1688 BBAUTV.exe 1688 BBAUTV.exe 3720 CEEQZ.exe 3720 CEEQZ.exe 3724 XSIZJTC.exe 3724 XSIZJTC.exe 2452 XXJ.exe 2452 XXJ.exe 1900 RLNXV.exe 1900 RLNXV.exe 4752 IYYPK.exe 4752 IYYPK.exe 5644 DLDH.exe 5644 DLDH.exe 6096 OEY.exe 6096 OEY.exe 6024 EUZRCXB.exe 6024 EUZRCXB.exe 2132 IKFR.exe 2132 IKFR.exe 5136 XFXDZCX.exe 5136 XFXDZCX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1004 wrote to memory of 6060 1004 2026-08-16_38493b931e0d11d95c11bb4ba7bb9abb_elex_emotet_stop.exe 90 PID 6060 wrote to memory of 2844 6060 cmd.exe 94 PID 2844 wrote to memory of 5492 2844 MPVHTWE.exe 96 PID 5492 wrote to memory of 2604 5492 cmd.exe 100 PID 2604 wrote to memory of 4948 2604 UPDB.exe 101 PID 4948 wrote to memory of 3808 4948 cmd.exe 105 PID 3808 wrote to memory of 4376 3808 NITM.exe 106 PID 4376 wrote to memory of 4608 4376 cmd.exe 110 PID 4608 wrote to memory of 3160 4608 RYZUWA.exe 111 PID 3160 wrote to memory of 2456 3160 cmd.exe 115 PID 2456 wrote to memory of 1996 2456 MLE.exe 116 PID 1996 wrote to memory of 4208 1996 cmd.exe 120 PID 4208 wrote to memory of 2108 4208 LWHTPOV.exe 121 PID 2108 wrote to memory of 1604 2108 cmd.exe 125 PID 1604 wrote to memory of 4884 1604 VUNGXWE.exe 126 PID 4884 wrote to memory of 5512 4884 cmd.exe 130 PID 5512 wrote to memory of 2392 5512 PHR.exe 131 PID 2392 wrote to memory of 2712 2392 cmd.exe 135 PID 2712 wrote to memory of 4924 2712 ZPTCK.exe 136 PID 4924 wrote to memory of 5352 4924 cmd.exe 140 PID 5352 wrote to memory of 3976 5352 QPIZX.exe 141 PID 3976 wrote to memory of 1300 3976 cmd.exe 145 PID 1300 wrote to memory of 2508 1300 RSMD.exe 146 PID 2508 wrote to memory of 5532 2508 cmd.exe 150 PID 5532 wrote to memory of 2752 5532 SQZPSJ.exe 151 PID 2752 wrote to memory of 1844 2752 cmd.exe 155 PID 1844 wrote to memory of 1196 1844 RBCFS.exe 156 PID 1196 wrote to memory of 4476 1196 cmd.exe 160 PID 4476 wrote to memory of 2544 4476 MWHPDWL.exe 161 PID 2544 wrote to memory of 2460 2544 cmd.exe 165 PID 2460 wrote to memory of 5744 2460 OKMY.exe 166 PID 5744 wrote to memory of 6088 5744 cmd.exe 170 PID 6088 wrote to memory of 5056 6088 ACTR.exe 171 PID 5056 wrote to memory of 4404 5056 cmd.exe 175 PID 4404 wrote to memory of 4880 4404 KAHDMY.exe 176 PID 4880 wrote to memory of 3060 4880 cmd.exe 180 PID 3060 wrote to memory of 3404 3060 CDLHR.exe 181 PID 3404 wrote to memory of 4312 3404 cmd.exe 185 PID 4312 wrote to memory of 3928 4312 DYODXLB.exe 186 PID 3928 wrote to memory of 1616 3928 cmd.exe 190 PID 1616 wrote to memory of 6056 1616 WBSHKB.exe 191 PID 6056 wrote to memory of 1688 6056 cmd.exe 195 PID 1688 wrote to memory of 2116 1688 BBAUTV.exe 196 PID 2116 wrote to memory of 3720 2116 cmd.exe 200 PID 3720 wrote to memory of 4544 3720 CEEQZ.exe 201 PID 4544 wrote to memory of 3724 4544 cmd.exe 205 PID 3724 wrote to memory of 4972 3724 XSIZJTC.exe 206 PID 4972 wrote to memory of 2452 4972 cmd.exe 210 PID 2452 wrote to memory of 5820 2452 XXJ.exe 211 PID 5820 wrote to memory of 1900 5820 cmd.exe 215 PID 1900 wrote to memory of 5848 1900 RLNXV.exe 216 PID 5848 wrote to memory of 4752 5848 cmd.exe 220 PID 4752 wrote to memory of 2100 4752 IYYPK.exe 221 PID 2100 wrote to memory of 5644 2100 cmd.exe 225 PID 5644 wrote to memory of 1280 5644 DLDH.exe 226 PID 1280 wrote to memory of 6096 1280 cmd.exe 230 PID 6096 wrote to memory of 5296 6096 OEY.exe 231 PID 5296 wrote to memory of 6024 5296 cmd.exe 235 PID 6024 wrote to memory of 5888 6024 EUZRCXB.exe 236 PID 5888 wrote to memory of 2132 5888 cmd.exe 240 PID 2132 wrote to memory of 1472 2132 IKFR.exe 241 PID 1472 wrote to memory of 5136 1472 cmd.exe 245 PID 5136 wrote to memory of 3628 5136 XFXDZCX.exe 246 PID 3628 wrote to memory of 5836 3628 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_38493b931e0d11d95c11bb4ba7bb9abb_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_38493b931e0d11d95c11bb4ba7bb9abb_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPVHTWE.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\system\MPVHTWE.exeC:\windows\system\MPVHTWE.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPDB.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\UPDB.exeC:\windows\UPDB.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NITM.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\windows\system\NITM.exeC:\windows\system\NITM.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYZUWA.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\windows\system\RYZUWA.exeC:\windows\system\RYZUWA.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLE.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\system\MLE.exeC:\windows\system\MLE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWHTPOV.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\system\LWHTPOV.exeC:\windows\system\LWHTPOV.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUNGXWE.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\windows\system\VUNGXWE.exeC:\windows\system\VUNGXWE.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHR.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\windows\system\PHR.exeC:\windows\system\PHR.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTCK.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\windows\ZPTCK.exeC:\windows\ZPTCK.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPIZX.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\QPIZX.exeC:\windows\QPIZX.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RSMD.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\windows\RSMD.exeC:\windows\RSMD.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQZPSJ.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\system\SQZPSJ.exeC:\windows\system\SQZPSJ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RBCFS.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\windows\SysWOW64\RBCFS.exeC:\windows\system32\RBCFS.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MWHPDWL.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\windows\SysWOW64\MWHPDWL.exeC:\windows\system32\MWHPDWL.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKMY.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\windows\system\OKMY.exeC:\windows\system\OKMY.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACTR.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\SysWOW64\ACTR.exeC:\windows\system32\ACTR.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KAHDMY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\windows\SysWOW64\KAHDMY.exeC:\windows\system32\KAHDMY.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDLHR.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\system\CDLHR.exeC:\windows\system\CDLHR.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYODXLB.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\windows\system\DYODXLB.exeC:\windows\system\DYODXLB.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBSHKB.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\windows\SysWOW64\WBSHKB.exeC:\windows\system32\WBSHKB.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBAUTV.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\windows\BBAUTV.exeC:\windows\BBAUTV.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CEEQZ.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\windows\system\CEEQZ.exeC:\windows\system\CEEQZ.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSIZJTC.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\system\XSIZJTC.exeC:\windows\system\XSIZJTC.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXJ.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\system\XXJ.exeC:\windows\system\XXJ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLNXV.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\windows\system\RLNXV.exeC:\windows\system\RLNXV.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYYPK.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\windows\IYYPK.exeC:\windows\IYYPK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDH.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\windows\system\DLDH.exeC:\windows\system\DLDH.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEY.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\windows\system\OEY.exeC:\windows\system\OEY.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUZRCXB.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\windows\EUZRCXB.exeC:\windows\EUZRCXB.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKFR.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\SysWOW64\IKFR.exeC:\windows\system32\IKFR.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFXDZCX.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\windows\XFXDZCX.exeC:\windows\XFXDZCX.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\system\DAOEE.exeC:\windows\system\DAOEE.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYCYLOW.exe.bat" "66⤵PID:1112
-
C:\windows\SysWOW64\FYCYLOW.exeC:\windows\system32\FYCYLOW.exe67⤵
- Executes dropped EXE
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGIYX.exe.bat" "68⤵PID:5916
-
C:\windows\system\JGIYX.exeC:\windows\system\JGIYX.exe69⤵
- Executes dropped EXE
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LBNIHGY.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5012 -
C:\windows\system\LBNIHGY.exeC:\windows\system\LBNIHGY.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPS.exe.bat" "72⤵PID:3500
-
C:\windows\SysWOW64\GPS.exeC:\windows\system32\GPS.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZKWVXWX.exe.bat" "74⤵PID:3624
-
C:\windows\SysWOW64\ZKWVXWX.exeC:\windows\system32\ZKWVXWX.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DACVJ.exe.bat" "76⤵PID:5476
-
C:\windows\DACVJ.exeC:\windows\DACVJ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFCJL.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4444 -
C:\windows\system\LFCJL.exeC:\windows\system\LFCJL.exe79⤵
- Executes dropped EXE
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AAM.exe.bat" "80⤵PID:4300
-
C:\windows\AAM.exeC:\windows\AAM.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EQSWIG.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5828 -
C:\windows\SysWOW64\EQSWIG.exeC:\windows\system32\EQSWIG.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRUB.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1940 -
C:\windows\SysWOW64\NRUB.exeC:\windows\system32\NRUB.exe85⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZWGP.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4960 -
C:\windows\EZWGP.exeC:\windows\EZWGP.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHD.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4592 -
C:\windows\IHD.exeC:\windows\IHD.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLCS.exe.bat" "90⤵
- Executes a command shell one-liner
PID:1672 -
C:\windows\OHLCS.exeC:\windows\OHLCS.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXMTRR.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3132 -
C:\windows\system\WXMTRR.exeC:\windows\system\WXMTRR.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVRNGZ.exe.bat" "94⤵PID:1532
-
C:\windows\SysWOW64\FVRNGZ.exeC:\windows\system32\FVRNGZ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGCEP.exe.bat" "96⤵PID:4364
-
C:\windows\system\EGCEP.exeC:\windows\system\EGCEP.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGKRYIZ.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5956 -
C:\windows\KGKRYIZ.exeC:\windows\KGKRYIZ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OWQZ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3248 -
C:\windows\system\OWQZ.exeC:\windows\system\OWQZ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJVJNS.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5824 -
C:\windows\SysWOW64\JJVJNS.exeC:\windows\system32\JJVJNS.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASXOYXM.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5648 -
C:\windows\system\ASXOYXM.exeC:\windows\system\ASXOYXM.exe105⤵
- Executes dropped EXE
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSFBH.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5628 -
C:\windows\system\YSFBH.exeC:\windows\system\YSFBH.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AFKLRRC.exe.bat" "108⤵PID:5260
-
C:\windows\system\AFKLRRC.exeC:\windows\system\AFKLRRC.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBBMOUR.exe.bat" "110⤵PID:2068
-
C:\windows\system\YBBMOUR.exeC:\windows\system\YBBMOUR.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OWSYH.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5252 -
C:\windows\system\OWSYH.exeC:\windows\system\OWSYH.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJXHRHP.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3412 -
C:\windows\system\IJXHRHP.exeC:\windows\system\IJXHRHP.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPP.exe.bat" "116⤵PID:404
-
C:\windows\system\QPP.exeC:\windows\system\QPP.exe117⤵
- Executes dropped EXE
PID:296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XKZAEG.exe.bat" "118⤵PID:5344
-
C:\windows\XKZAEG.exeC:\windows\XKZAEG.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSBF.exe.bat" "120⤵PID:1220
-
C:\windows\SysWOW64\PSBF.exeC:\windows\system32\PSBF.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-