Analysis
- max time kernel
87s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 10:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_be7518058c273803b1f6d4bc2d10a22d_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-16_be7518058c273803b1f6d4bc2d10a22d_elex_emotet_stop.exe
- Size 208KB
- Sample260816-l2c12ace95
- SHA256 11db5a66e68d277d9ff643b0c14dd1e49b6faebccab12582a45fcd2d11bd903d
- MD5 be7518058c273803b1f6d4bc2d10a22d
- SHA1 5dd2c5c687d7c3025511b678ba25acd1472e0c08
- SHA512 28a8f473d5f6b44336256ca8b5a6ce194d05e68d9925f6c761852932f9c9e54e7decd5e7d4b2abb59792592812ac9b85a4bae185860f2a6dd2dadab7827c9711
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfV4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOdkEj1
- TLSH T192247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5868 HYMOGKT.exe 3592 UURO.exe 1084 APQXEJ.exe 4416 UCV.exe 2328 YLCGSB.exe 2416 UVKF.exe 2320 SRJGLH.exe 5740 HMTK.exe 1196 YUVXHZ.exe 1308 RPZTNPA.exe 3256 EAPRBRV.exe 3620 QIWRN.exe 5488 XYXRMF.exe 2720 HWCLBO.exe 3672 GONTK.exe 2536 ZJRXQKE.exe 5584 UUZWEUA.exe 3400 WSNI.exe 4492 PGMOQ.exe 5668 DQU.exe 2160 SGDELD.exe 252 FJMD.exe 3064 GMQ.exe 3756 TXGXTG.exe 4212 KXACWMJ.exe 3396 ONPCJ.exe 1984 NYRS.exe 4744 GBVWXAD.exe 2096 KJCWJ.exe 2492 EWHFLSG.exe 3360 SSSGZH.exe 5600 WIZG.exe 3024 GIBTPEM.exe 1968 GLFP.exe 1120 VGOTFHW.exe 1096 URZJON.exe 3112 YHG.exe 1532 ECFSFI.exe 3348 MIJZPH.exe 5088 HVOIAHG.exe 5140 UGXHG.exe 5304 CLJOR.exe 124 LULTCN.exe 2396 FMBELO.exe 4824 FPF.exe 6000 YKIDECS.exe 5764 PTK.exe 5212 DDTHWK.exe 5972 IEAU.exe 808 DRFEP.exe 1204 HUD.exe 5344 CHIIZ.exe 2376 EDZKLR.exe 4688 ILG.exe 4788 DYLBH.exe 2576 UGN.exe 4136 NJRKQ.exe 4344 XHWWG.exe 4264 VSHNGKF.exe 3676 HKPXYLN.exe 3508 FVRNGZ.exe 1504 EGCEP.exe 5540 XJGHVVH.exe 5496 FWLOFU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\KSE.exe VXUXAH.exe File created C:\windows\SysWOW64\UCV.exe APQXEJ.exe File opened for modification C:\windows\SysWOW64\HXA.exe NJVIYI.exe File created C:\windows\SysWOW64\RJLBI.exe.bat WZDLBKE.exe File opened for modification C:\windows\SysWOW64\YLCGSB.exe UCV.exe File opened for modification C:\windows\SysWOW64\NMQUXIH.exe DMO.exe File created C:\windows\SysWOW64\APQXEJ.exe UURO.exe File opened for modification C:\windows\SysWOW64\NYRS.exe ONPCJ.exe File opened for modification C:\windows\SysWOW64\GBVWXAD.exe NYRS.exe File opened for modification C:\windows\SysWOW64\WIZG.exe SSSGZH.exe File created C:\windows\SysWOW64\HUD.exe.bat DRFEP.exe File created C:\windows\SysWOW64\KSE.exe VXUXAH.exe File created C:\windows\SysWOW64\YLCGSB.exe UCV.exe File opened for modification C:\windows\SysWOW64\UUZWEUA.exe ZJRXQKE.exe File created C:\windows\SysWOW64\INGTWD.exe NCXUQS.exe File opened for modification C:\windows\SysWOW64\KBQNORU.exe GLJNC.exe File created C:\windows\SysWOW64\WZDLBKE.exe.bat HVPF.exe File opened for modification C:\windows\SysWOW64\LWSK.exe GWLWGIS.exe File created C:\windows\SysWOW64\HWCLBO.exe.bat XYXRMF.exe File opened for modification C:\windows\SysWOW64\FVRNGZ.exe HKPXYLN.exe File opened for modification C:\windows\SysWOW64\LIX.exe FMFCTAZ.exe File opened for modification C:\windows\SysWOW64\NJVIYI.exe MGSESSJ.exe File created C:\windows\SysWOW64\QSXH.exe.bat SSPU.exe File opened for modification C:\windows\SysWOW64\UCV.exe APQXEJ.exe File created C:\windows\SysWOW64\SRJGLH.exe.bat UVKF.exe File created C:\windows\SysWOW64\NJOA.exe YSNBMG.exe File created C:\windows\SysWOW64\BKNHTS.exe.bat RJLBI.exe File opened for modification C:\windows\SysWOW64\YHG.exe URZJON.exe File created C:\windows\SysWOW64\QSXH.exe SSPU.exe File created C:\windows\SysWOW64\LWSK.exe GWLWGIS.exe File created C:\windows\SysWOW64\APQXEJ.exe.bat UURO.exe File created C:\windows\SysWOW64\KBQNORU.exe.bat GLJNC.exe File created C:\windows\SysWOW64\MGSESSJ.exe IYLE.exe File created C:\windows\SysWOW64\EAPRBRV.exe RPZTNPA.exe File created C:\windows\SysWOW64\YHG.exe URZJON.exe File opened for modification C:\windows\SysWOW64\QSXH.exe SSPU.exe File created C:\windows\SysWOW64\NYRS.exe ONPCJ.exe File created C:\windows\SysWOW64\WIZG.exe SSSGZH.exe File created C:\windows\SysWOW64\YHG.exe.bat URZJON.exe File opened for modification C:\windows\SysWOW64\EAPRBRV.exe RPZTNPA.exe File opened for modification C:\windows\SysWOW64\KJCWJ.exe GBVWXAD.exe File created C:\windows\SysWOW64\MIJZPH.exe.bat ECFSFI.exe File opened for modification C:\windows\SysWOW64\DDTHWK.exe PTK.exe File opened for modification C:\windows\SysWOW64\GONTK.exe HWCLBO.exe File created C:\windows\SysWOW64\UUZWEUA.exe ZJRXQKE.exe File opened for modification C:\windows\SysWOW64\HUD.exe DRFEP.exe File created C:\windows\SysWOW64\XAEI.exe IFUDVZ.exe File opened for modification C:\windows\SysWOW64\MGSESSJ.exe IYLE.exe File created C:\windows\SysWOW64\WIZG.exe.bat SSSGZH.exe File created C:\windows\SysWOW64\CHIIZ.exe.bat HUD.exe File created C:\windows\SysWOW64\DWUR.exe KBQNORU.exe File created C:\windows\SysWOW64\DWUR.exe.bat KBQNORU.exe File created C:\windows\SysWOW64\LIX.exe.bat FMFCTAZ.exe File created C:\windows\SysWOW64\GONTK.exe HWCLBO.exe File created C:\windows\SysWOW64\CHIIZ.exe HUD.exe File created C:\windows\SysWOW64\YSNBMG.exe.bat LIX.exe File created C:\windows\SysWOW64\UCV.exe.bat APQXEJ.exe File opened for modification C:\windows\SysWOW64\NJOA.exe YSNBMG.exe File created C:\windows\SysWOW64\NJVIYI.exe.bat MGSESSJ.exe File created C:\windows\SysWOW64\BKNHTS.exe RJLBI.exe File created C:\windows\SysWOW64\LWSK.exe.bat GWLWGIS.exe File opened for modification C:\windows\SysWOW64\DWUR.exe KBQNORU.exe File opened for modification C:\windows\SysWOW64\GES.exe NJOA.exe File created C:\windows\SysWOW64\NMQUXIH.exe.bat DMO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\ECFSFI.exe YHG.exe File created C:\windows\system\FWLOFU.exe XJGHVVH.exe File opened for modification C:\windows\system\FWLOFU.exe XJGHVVH.exe File created C:\windows\system\RCPLFQE.exe.bat TRM.exe File opened for modification C:\windows\system\EGCEP.exe FVRNGZ.exe File created C:\windows\QSSAH.exe INGTWD.exe File opened for modification C:\windows\HJGNKR.exe XAEI.exe File created C:\windows\RAGAZV.exe.bat RFCX.exe File opened for modification C:\windows\system\GIKPEV.exe HTZ.exe File created C:\windows\GWLWGIS.exe GIKPEV.exe File created C:\windows\system\WSNI.exe UUZWEUA.exe File created C:\windows\system\GIBTPEM.exe WIZG.exe File opened for modification C:\windows\ILG.exe EDZKLR.exe File created C:\windows\NTCC.exe.bat QSSAH.exe File created C:\windows\system\GLJNC.exe.bat NTCC.exe File created C:\windows\system\FMFCTAZ.exe RCPLFQE.exe File created C:\windows\QBXQG.exe GES.exe File created C:\windows\EIEWUIZ.exe EDEISV.exe File created C:\windows\HYMOGKT.exe 2026-08-16_be7518058c273803b1f6d4bc2d10a22d_elex_emotet_stop.exe File created C:\windows\system\YUVXHZ.exe.bat HMTK.exe File created C:\windows\system\WSNI.exe.bat UUZWEUA.exe File opened for modification C:\windows\system\SSSGZH.exe EWHFLSG.exe File created C:\windows\system\URZJON.exe VGOTFHW.exe File created C:\windows\LULTCN.exe.bat CLJOR.exe File opened for modification C:\windows\NCXUQS.exe FWLOFU.exe File opened for modification C:\windows\DMO.exe QBXQG.exe File opened for modification C:\windows\system\PGMOQ.exe WSNI.exe File opened for modification C:\windows\system\TXGXTG.exe GMQ.exe File opened for modification C:\windows\UGN.exe DYLBH.exe File opened for modification C:\windows\XHWWG.exe NJRKQ.exe File created C:\windows\NCXUQS.exe.bat FWLOFU.exe File opened for modification C:\windows\IFUDVZ.exe LFKBKDA.exe File created C:\windows\system\VXUXAH.exe.bat LWSK.exe File created C:\windows\GMQ.exe FJMD.exe File opened for modification C:\windows\system\WSNI.exe UUZWEUA.exe File opened for modification C:\windows\system\SGDELD.exe DQU.exe File created C:\windows\system\YKIDECS.exe FPF.exe File created C:\windows\system\XJGHVVH.exe EGCEP.exe File created C:\windows\system\XJGHVVH.exe.bat EGCEP.exe File opened for modification C:\windows\system\VGOTFHW.exe GLFP.exe File created C:\windows\system\VGOTFHW.exe.bat GLFP.exe File created C:\windows\system\FMBELO.exe LULTCN.exe File created C:\windows\FPF.exe FMBELO.exe File created C:\windows\XHWWG.exe NJRKQ.exe File opened for modification C:\windows\EIEWUIZ.exe EDEISV.exe File opened for modification C:\windows\HVPF.exe RAGAZV.exe File created C:\windows\HVPF.exe.bat RAGAZV.exe File created C:\windows\system\QIWRN.exe.bat EAPRBRV.exe File created C:\windows\GMQ.exe.bat FJMD.exe File created C:\windows\system\GIBTPEM.exe.bat WIZG.exe File created C:\windows\system\VGOTFHW.exe GLFP.exe File created C:\windows\system\FMBELO.exe.bat LULTCN.exe File opened for modification C:\windows\system\EDZKLR.exe CHIIZ.exe File opened for modification C:\windows\SSPU.exe BKNHTS.exe File created C:\windows\system\EWHFLSG.exe KJCWJ.exe File created C:\windows\ECFSFI.exe YHG.exe File created C:\windows\system\NJRKQ.exe UGN.exe File created C:\windows\system\GIKPEV.exe.bat HTZ.exe File created C:\windows\system\DRFEP.exe.bat IEAU.exe File created C:\windows\ILG.exe.bat EDZKLR.exe File created C:\windows\system\NJRKQ.exe.bat UGN.exe File created C:\windows\system\GIKPEV.exe HTZ.exe File created C:\windows\system\PGMOQ.exe WSNI.exe File created C:\windows\system\HVOIAHG.exe MIJZPH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4960 cmd.exe 1680 cmd.exe 204 cmd.exe 1364 cmd.exe 6004 cmd.exe 3960 cmd.exe 2880 cmd.exe 4196 cmd.exe 5428 cmd.exe 2064 cmd.exe 4532 cmd.exe 1948 cmd.exe 4260 cmd.exe 1864 cmd.exe 4596 cmd.exe 5312 cmd.exe 4572 cmd.exe 2132 cmd.exe 1868 cmd.exe 3140 cmd.exe 2344 cmd.exe 4624 cmd.exe 1352 cmd.exe 3168 cmd.exe 4768 cmd.exe 3660 cmd.exe 2980 cmd.exe 4232 cmd.exe 1924 cmd.exe 6112 cmd.exe 1440 cmd.exe 3472 cmd.exe 4732 cmd.exe 824 cmd.exe 5936 cmd.exe 5484 cmd.exe 6116 cmd.exe 4428 cmd.exe 3432 cmd.exe 3136 cmd.exe 2488 cmd.exe 444 cmd.exe 2556 cmd.exe 4508 cmd.exe 4240 cmd.exe 6088 cmd.exe 4444 cmd.exe 2032 cmd.exe 2580 cmd.exe 1040 cmd.exe 5748 cmd.exe 5880 cmd.exe 4168 cmd.exe 916 cmd.exe 1712 cmd.exe 4884 cmd.exe 5824 cmd.exe 5756 cmd.exe 1100 cmd.exe 4992 cmd.exe 3488 cmd.exe 3324 cmd.exe 2004 cmd.exe 5744 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2836 4468 WerFault.exe 87 1200 5868 WerFault.exe 93 1768 3592 WerFault.exe 99 5736 1084 WerFault.exe 103 2536 4416 WerFault.exe 109 5372 2328 WerFault.exe 114 5940 2416 WerFault.exe 119 4492 2320 WerFault.exe 124 4868 5740 WerFault.exe 129 836 1196 WerFault.exe 134 4208 1308 WerFault.exe 139 3024 3256 WerFault.exe 144 1328 3620 WerFault.exe 148 1640 5488 WerFault.exe 154 4788 2720 WerFault.exe 159 1288 3672 WerFault.exe 164 1516 2536 WerFault.exe 169 1580 5584 WerFault.exe 174 3544 3400 WerFault.exe 179 1204 4492 WerFault.exe 184 3676 5668 WerFault.exe 189 5112 2160 WerFault.exe 194 4444 252 WerFault.exe 199 1924 3064 WerFault.exe 204 5060 3756 WerFault.exe 209 6000 4212 WerFault.exe 214 5764 3396 WerFault.exe 219 1884 1984 WerFault.exe 224 4948 4744 WerFault.exe 229 4428 2096 WerFault.exe 234 3460 2492 WerFault.exe 239 4324 3360 WerFault.exe 244 852 5600 WerFault.exe 249 3100 3024 WerFault.exe 254 6092 1968 WerFault.exe 259 6000 1120 WerFault.exe 264 2620 1096 WerFault.exe 269 5116 3112 WerFault.exe 275 4948 1532 WerFault.exe 280 5452 3348 WerFault.exe 285 1868 5088 WerFault.exe 290 3392 5140 WerFault.exe 295 5136 5304 WerFault.exe 300 1852 124 WerFault.exe 305 1320 2396 WerFault.exe 310 3732 4824 WerFault.exe 315 1684 6000 WerFault.exe 320 5372 5764 WerFault.exe 325 4752 5212 WerFault.exe 330 6076 5972 WerFault.exe 335 2388 808 WerFault.exe 340 5492 1204 WerFault.exe 345 4932 5344 WerFault.exe 350 2840 2376 WerFault.exe 355 3200 4688 WerFault.exe 360 2100 4788 WerFault.exe 365 3804 2576 WerFault.exe 370 3960 4136 WerFault.exe 375 972 4344 WerFault.exe 380 4844 4264 WerFault.exe 385 5612 3676 WerFault.exe 390 5352 3508 WerFault.exe 395 4560 1504 WerFault.exe 400 1492 5540 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFKBKDA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBXQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWLWGIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMBELO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTCC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRJGLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMQUXIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWHFLSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSSGZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHIIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJRKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UURO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBVWXAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVOIAHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVRNGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APQXEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSSAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBQNORU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKNHTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXGXTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIBTPEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIWRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWCLBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4468 2026-08-16_be7518058c273803b1f6d4bc2d10a22d_elex_emotet_stop.exe 4468 2026-08-16_be7518058c273803b1f6d4bc2d10a22d_elex_emotet_stop.exe 5868 HYMOGKT.exe 5868 HYMOGKT.exe 3592 UURO.exe 3592 UURO.exe 1084 APQXEJ.exe 1084 APQXEJ.exe 4416 UCV.exe 4416 UCV.exe 2328 YLCGSB.exe 2328 YLCGSB.exe 2416 UVKF.exe 2416 UVKF.exe 2320 SRJGLH.exe 2320 SRJGLH.exe 5740 HMTK.exe 5740 HMTK.exe 1196 YUVXHZ.exe 1196 YUVXHZ.exe 1308 RPZTNPA.exe 1308 RPZTNPA.exe 3256 EAPRBRV.exe 3256 EAPRBRV.exe 3620 QIWRN.exe 3620 QIWRN.exe 5488 XYXRMF.exe 5488 XYXRMF.exe 2720 HWCLBO.exe 2720 HWCLBO.exe 3672 GONTK.exe 3672 GONTK.exe 2536 ZJRXQKE.exe 2536 ZJRXQKE.exe 5584 UUZWEUA.exe 5584 UUZWEUA.exe 3400 WSNI.exe 3400 WSNI.exe 4492 PGMOQ.exe 4492 PGMOQ.exe 5668 DQU.exe 5668 DQU.exe 2160 SGDELD.exe 2160 SGDELD.exe 252 FJMD.exe 252 FJMD.exe 3064 GMQ.exe 3064 GMQ.exe 3756 TXGXTG.exe 3756 TXGXTG.exe 4212 KXACWMJ.exe 4212 KXACWMJ.exe 3396 ONPCJ.exe 3396 ONPCJ.exe 1984 NYRS.exe 1984 NYRS.exe 4744 GBVWXAD.exe 4744 GBVWXAD.exe 2096 KJCWJ.exe 2096 KJCWJ.exe 2492 EWHFLSG.exe 2492 EWHFLSG.exe 3360 SSSGZH.exe 3360 SSSGZH.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4468 2026-08-16_be7518058c273803b1f6d4bc2d10a22d_elex_emotet_stop.exe 4468 2026-08-16_be7518058c273803b1f6d4bc2d10a22d_elex_emotet_stop.exe 5868 HYMOGKT.exe 5868 HYMOGKT.exe 3592 UURO.exe 3592 UURO.exe 1084 APQXEJ.exe 1084 APQXEJ.exe 4416 UCV.exe 4416 UCV.exe 2328 YLCGSB.exe 2328 YLCGSB.exe 2416 UVKF.exe 2416 UVKF.exe 2320 SRJGLH.exe 2320 SRJGLH.exe 5740 HMTK.exe 5740 HMTK.exe 1196 YUVXHZ.exe 1196 YUVXHZ.exe 1308 RPZTNPA.exe 1308 RPZTNPA.exe 3256 EAPRBRV.exe 3256 EAPRBRV.exe 3620 QIWRN.exe 3620 QIWRN.exe 5488 XYXRMF.exe 5488 XYXRMF.exe 2720 HWCLBO.exe 2720 HWCLBO.exe 3672 GONTK.exe 3672 GONTK.exe 2536 ZJRXQKE.exe 2536 ZJRXQKE.exe 5584 UUZWEUA.exe 5584 UUZWEUA.exe 3400 WSNI.exe 3400 WSNI.exe 4492 PGMOQ.exe 4492 PGMOQ.exe 5668 DQU.exe 5668 DQU.exe 2160 SGDELD.exe 2160 SGDELD.exe 252 FJMD.exe 252 FJMD.exe 3064 GMQ.exe 3064 GMQ.exe 3756 TXGXTG.exe 3756 TXGXTG.exe 4212 KXACWMJ.exe 4212 KXACWMJ.exe 3396 ONPCJ.exe 3396 ONPCJ.exe 1984 NYRS.exe 1984 NYRS.exe 4744 GBVWXAD.exe 4744 GBVWXAD.exe 2096 KJCWJ.exe 2096 KJCWJ.exe 2492 EWHFLSG.exe 2492 EWHFLSG.exe 3360 SSSGZH.exe 3360 SSSGZH.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4468 wrote to memory of 5384 4468 2026-08-16_be7518058c273803b1f6d4bc2d10a22d_elex_emotet_stop.exe 89 PID 5384 wrote to memory of 5868 5384 cmd.exe 93 PID 5868 wrote to memory of 5340 5868 HYMOGKT.exe 95 PID 5340 wrote to memory of 3592 5340 cmd.exe 99 PID 3592 wrote to memory of 2548 3592 UURO.exe 100 PID 2548 wrote to memory of 1084 2548 cmd.exe 103 PID 1084 wrote to memory of 2488 1084 APQXEJ.exe 105 PID 2488 wrote to memory of 4416 2488 cmd.exe 109 PID 4416 wrote to memory of 3160 4416 UCV.exe 110 PID 3160 wrote to memory of 2328 3160 cmd.exe 114 PID 2328 wrote to memory of 4596 2328 YLCGSB.exe 115 PID 4596 wrote to memory of 2416 4596 cmd.exe 119 PID 2416 wrote to memory of 5824 2416 UVKF.exe 120 PID 5824 wrote to memory of 2320 5824 cmd.exe 124 PID 2320 wrote to memory of 4780 2320 SRJGLH.exe 125 PID 4780 wrote to memory of 5740 4780 cmd.exe 129 PID 5740 wrote to memory of 2232 5740 HMTK.exe 130 PID 2232 wrote to memory of 1196 2232 cmd.exe 134 PID 1196 wrote to memory of 444 1196 YUVXHZ.exe 135 PID 444 wrote to memory of 1308 444 cmd.exe 139 PID 1308 wrote to memory of 5220 1308 RPZTNPA.exe 140 PID 5220 wrote to memory of 3256 5220 cmd.exe 144 PID 3256 wrote to memory of 3536 3256 EAPRBRV.exe 145 PID 3536 wrote to memory of 3620 3536 cmd.exe 148 PID 3620 wrote to memory of 4228 3620 QIWRN.exe 150 PID 4228 wrote to memory of 5488 4228 cmd.exe 154 PID 5488 wrote to memory of 3628 5488 XYXRMF.exe 155 PID 3628 wrote to memory of 2720 3628 cmd.exe 159 PID 2720 wrote to memory of 3236 2720 HWCLBO.exe 160 PID 3236 wrote to memory of 3672 3236 cmd.exe 164 PID 3672 wrote to memory of 5936 3672 GONTK.exe 165 PID 5936 wrote to memory of 2536 5936 cmd.exe 169 PID 2536 wrote to memory of 1604 2536 ZJRXQKE.exe 170 PID 1604 wrote to memory of 5584 1604 cmd.exe 174 PID 5584 wrote to memory of 1352 5584 UUZWEUA.exe 175 PID 1352 wrote to memory of 3400 1352 cmd.exe 179 PID 3400 wrote to memory of 5484 3400 WSNI.exe 180 PID 5484 wrote to memory of 4492 5484 cmd.exe 184 PID 4492 wrote to memory of 640 4492 PGMOQ.exe 185 PID 640 wrote to memory of 5668 640 cmd.exe 189 PID 5668 wrote to memory of 6068 5668 DQU.exe 190 PID 6068 wrote to memory of 2160 6068 cmd.exe 194 PID 2160 wrote to memory of 5312 2160 SGDELD.exe 195 PID 5312 wrote to memory of 252 5312 cmd.exe 199 PID 252 wrote to memory of 5744 252 FJMD.exe 200 PID 5744 wrote to memory of 3064 5744 cmd.exe 204 PID 3064 wrote to memory of 2412 3064 GMQ.exe 205 PID 2412 wrote to memory of 3756 2412 cmd.exe 209 PID 3756 wrote to memory of 2896 3756 TXGXTG.exe 210 PID 2896 wrote to memory of 4212 2896 cmd.exe 214 PID 4212 wrote to memory of 2580 4212 KXACWMJ.exe 215 PID 2580 wrote to memory of 3396 2580 cmd.exe 219 PID 3396 wrote to memory of 1636 3396 ONPCJ.exe 220 PID 1636 wrote to memory of 1984 1636 cmd.exe 224 PID 1984 wrote to memory of 5544 1984 NYRS.exe 225 PID 5544 wrote to memory of 4744 5544 cmd.exe 229 PID 4744 wrote to memory of 1040 4744 GBVWXAD.exe 230 PID 1040 wrote to memory of 2096 1040 cmd.exe 234 PID 2096 wrote to memory of 2880 2096 KJCWJ.exe 235 PID 2880 wrote to memory of 2492 2880 cmd.exe 239 PID 2492 wrote to memory of 3944 2492 EWHFLSG.exe 240 PID 3944 wrote to memory of 3360 3944 cmd.exe 244 PID 3360 wrote to memory of 4976 3360 SSSGZH.exe 245 PID 4976 wrote to memory of 5600 4976 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_be7518058c273803b1f6d4bc2d10a22d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_be7518058c273803b1f6d4bc2d10a22d_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYMOGKT.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\windows\HYMOGKT.exeC:\windows\HYMOGKT.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UURO.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\windows\SysWOW64\UURO.exeC:\windows\system32\UURO.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APQXEJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\SysWOW64\APQXEJ.exeC:\windows\system32\APQXEJ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCV.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\windows\SysWOW64\UCV.exeC:\windows\system32\UCV.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YLCGSB.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\SysWOW64\YLCGSB.exeC:\windows\system32\YLCGSB.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVKF.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\system\UVKF.exeC:\windows\system\UVKF.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRJGLH.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\SysWOW64\SRJGLH.exeC:\windows\system32\SRJGLH.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMTK.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\HMTK.exeC:\windows\HMTK.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUVXHZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\windows\system\YUVXHZ.exeC:\windows\system\YUVXHZ.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:444 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAPRBRV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\SysWOW64\EAPRBRV.exeC:\windows\system32\EAPRBRV.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIWRN.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\windows\system\QIWRN.exeC:\windows\system\QIWRN.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYXRMF.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\XYXRMF.exeC:\windows\XYXRMF.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWCLBO.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\SysWOW64\HWCLBO.exeC:\windows\system32\HWCLBO.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GONTK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\windows\SysWOW64\GONTK.exeC:\windows\system32\GONTK.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJRXQKE.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\ZJRXQKE.exeC:\windows\ZJRXQKE.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUZWEUA.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\SysWOW64\UUZWEUA.exeC:\windows\system32\UUZWEUA.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSNI.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\windows\system\WSNI.exeC:\windows\system\WSNI.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGMOQ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\system\PGMOQ.exeC:\windows\system\PGMOQ.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQU.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\windows\system\DQU.exeC:\windows\system\DQU.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGDELD.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\system\SGDELD.exeC:\windows\system\SGDELD.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJMD.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\windows\FJMD.exeC:\windows\FJMD.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMQ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\GMQ.exeC:\windows\GMQ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TXGXTG.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\system\TXGXTG.exeC:\windows\system\TXGXTG.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KXACWMJ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\windows\system\KXACWMJ.exeC:\windows\system\KXACWMJ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ONPCJ.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\windows\ONPCJ.exeC:\windows\ONPCJ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYRS.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\windows\SysWOW64\NYRS.exeC:\windows\system32\NYRS.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBVWXAD.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\SysWOW64\GBVWXAD.exeC:\windows\system32\GBVWXAD.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCWJ.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\windows\SysWOW64\KJCWJ.exeC:\windows\system32\KJCWJ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWHFLSG.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\system\EWHFLSG.exeC:\windows\system\EWHFLSG.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSSGZH.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\windows\system\SSSGZH.exeC:\windows\system\SSSGZH.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIZG.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\windows\SysWOW64\WIZG.exeC:\windows\system32\WIZG.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIBTPEM.exe.bat" "66⤵PID:3632
-
C:\windows\system\GIBTPEM.exeC:\windows\system\GIBTPEM.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLFP.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5756 -
C:\windows\GLFP.exeC:\windows\GLFP.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VGOTFHW.exe.bat" "70⤵PID:4124
-
C:\windows\system\VGOTFHW.exeC:\windows\system\VGOTFHW.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URZJON.exe.bat" "72⤵PID:1792
-
C:\windows\system\URZJON.exeC:\windows\system\URZJON.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YHG.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1396 -
C:\windows\SysWOW64\YHG.exeC:\windows\system32\YHG.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECFSFI.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5064 -
C:\windows\ECFSFI.exeC:\windows\ECFSFI.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIJZPH.exe.bat" "78⤵PID:2640
-
C:\windows\SysWOW64\MIJZPH.exeC:\windows\system32\MIJZPH.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVOIAHG.exe.bat" "80⤵PID:4712
-
C:\windows\system\HVOIAHG.exeC:\windows\system\HVOIAHG.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGXHG.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3716 -
C:\windows\UGXHG.exeC:\windows\UGXHG.exe83⤵
- Executes dropped EXE
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLJOR.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4196 -
C:\windows\system\CLJOR.exeC:\windows\system\CLJOR.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LULTCN.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3168 -
C:\windows\LULTCN.exeC:\windows\LULTCN.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMBELO.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1924 -
C:\windows\system\FMBELO.exeC:\windows\system\FMBELO.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPF.exe.bat" "90⤵PID:5816
-
C:\windows\FPF.exeC:\windows\FPF.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YKIDECS.exe.bat" "92⤵PID:3312
-
C:\windows\system\YKIDECS.exeC:\windows\system\YKIDECS.exe93⤵
- Executes dropped EXE
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTK.exe.bat" "94⤵PID:2976
-
C:\windows\PTK.exeC:\windows\PTK.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDTHWK.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4584 -
C:\windows\SysWOW64\DDTHWK.exeC:\windows\system32\DDTHWK.exe97⤵
- Executes dropped EXE
PID:5212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEAU.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4572 -
C:\windows\system\IEAU.exeC:\windows\system\IEAU.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRFEP.exe.bat" "100⤵
- Executes a command shell one-liner
PID:2556 -
C:\windows\system\DRFEP.exeC:\windows\system\DRFEP.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUD.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5028 -
C:\windows\SysWOW64\HUD.exeC:\windows\system32\HUD.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5748 -
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EDZKLR.exe.bat" "106⤵
- Executes a command shell one-liner
PID:824 -
C:\windows\system\EDZKLR.exeC:\windows\system\EDZKLR.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILG.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4960 -
C:\windows\ILG.exeC:\windows\ILG.exe109⤵
- Executes dropped EXE
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYLBH.exe.bat" "110⤵PID:1952
-
C:\windows\system\DYLBH.exeC:\windows\system\DYLBH.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGN.exe.bat" "112⤵
- Executes a command shell one-liner
PID:4508 -
C:\windows\UGN.exeC:\windows\UGN.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJRKQ.exe.bat" "114⤵PID:1684
-
C:\windows\system\NJRKQ.exeC:\windows\system\NJRKQ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHWWG.exe.bat" "116⤵PID:5932
-
C:\windows\XHWWG.exeC:\windows\XHWWG.exe117⤵
- Executes dropped EXE
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSHNGKF.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5428 -
C:\windows\system\VSHNGKF.exeC:\windows\system\VSHNGKF.exe119⤵
- Executes dropped EXE
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKPXYLN.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2132 -
C:\windows\SysWOW64\HKPXYLN.exeC:\windows\system32\HKPXYLN.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-