Analysis
- max time kernel
73s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 19:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe
- Size 208KB
- Sample260817-yacmeayvbv
- SHA256 78e7254dbd76147d44189ede5be4a306628ff28b22dc8ff63b8fec6a9bd56080
- MD5 3d00174791ae5fcbec27a337d06dbe72
- SHA1 65ffcd55661fb8737427e4d55fc5a73cc7df1591
- SHA512 6b46214e957a1e2a79c8897cd4f05e81e87d9630af43db2f55c0b24aa2488d8f02aa5a90c482afebd4d3f74615d6cf564454525308769456358b28e7c8da49d3
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfK4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOykEj1
- TLSH T168247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2396 OAQIRJ.exe 120 GTBO.exe 5436 YOFKOI.exe 5200 VUD.exe 4104 PHHRF.exe 3436 KCMAPK.exe 1344 MSNCO.exe 2868 SSVQFBX.exe 5836 MOAZ.exe 4432 JLYWWL.exe 5564 UEBHWSV.exe 2040 URB.exe 4072 RPZTNPA.exe 5680 NVEQ.exe 3648 NNNR.exe 976 VTFYJ.exe 5016 BTNUSKM.exe 572 KTPZ.exe 1216 MRC.exe 5704 GKK.exe 1380 CKUGGUO.exe 1820 YVCXV.exe 5584 WQB.exe 4452 UGNBMNH.exe 3188 XTR.exe 2664 PWDOC.exe 5496 OHGE.exe 5188 LII.exe 5460 VFV.exe 3172 OIZWJ.exe 2760 IWEGML.exe 4252 JRIJZ.exe 3452 WCQ.exe 2608 LSRZMAV.exe 3148 KPLCH.exe 6112 HIMF.exe 4500 HLY.exe 1760 NLY.exe 4492 GOKSNRY.exe 4584 KWQAZ.exe 5536 BFSFDH.exe 4892 KFUK.exe 1700 SSZR.exe 3540 TNDUWB.exe 3040 SLWP.exe 3152 QZNQWJT.exe 1608 AWBKD.exe 1384 SZE.exe 3084 CXKIYQ.exe 4464 DAOEE.exe 4112 ZGG.exe 2488 AJKPZZR.exe 5932 JJMC.exe 1288 XUCTRHH.exe 6040 RHZ.exe 1132 HXICIUS.exe 2516 YXC.exe 1272 FAUTWM.exe 3304 VRVK.exe 5908 KMEXOVS.exe 4692 EZJG.exe 1652 WHLLC.exe 4488 APS.exe 4224 EXYTA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\KIJ.exe HVFJVC.exe File created C:\windows\SysWOW64\MVERKZK.exe.bat ANQRY.exe File opened for modification C:\windows\SysWOW64\WCQ.exe JRIJZ.exe File created C:\windows\SysWOW64\AJKPZZR.exe.bat ZGG.exe File created C:\windows\SysWOW64\VRVK.exe.bat FAUTWM.exe File created C:\windows\SysWOW64\UFWWFMF.exe MREH.exe File created C:\windows\SysWOW64\HVFJVC.exe.bat PSBF.exe File opened for modification C:\windows\SysWOW64\MOAZ.exe SSVQFBX.exe File opened for modification C:\windows\SysWOW64\KTPZ.exe BTNUSKM.exe File created C:\windows\SysWOW64\SZE.exe.bat AWBKD.exe File created C:\windows\SysWOW64\YXC.exe HXICIUS.exe File opened for modification C:\windows\SysWOW64\YTDDKCI.exe EXYTA.exe File opened for modification C:\windows\SysWOW64\PSBF.exe UFWWFMF.exe File opened for modification C:\windows\SysWOW64\IWDD.exe CWWQQEI.exe File created C:\windows\SysWOW64\MOAZ.exe SSVQFBX.exe File opened for modification C:\windows\SysWOW64\HIMF.exe KPLCH.exe File created C:\windows\SysWOW64\NLY.exe HLY.exe File created C:\windows\SysWOW64\GOKSNRY.exe.bat NLY.exe File created C:\windows\SysWOW64\AWBKD.exe.bat QZNQWJT.exe File created C:\windows\SysWOW64\KMEXOVS.exe VRVK.exe File created C:\windows\SysWOW64\YOFKOI.exe GTBO.exe File opened for modification C:\windows\SysWOW64\NLY.exe HLY.exe File created C:\windows\SysWOW64\AWBKD.exe QZNQWJT.exe File opened for modification C:\windows\SysWOW64\YXC.exe HXICIUS.exe File created C:\windows\SysWOW64\YTDDKCI.exe.bat EXYTA.exe File created C:\windows\SysWOW64\JJVJNS.exe FBPB.exe File opened for modification C:\windows\SysWOW64\KIJ.exe HVFJVC.exe File opened for modification C:\windows\SysWOW64\YOFKOI.exe GTBO.exe File created C:\windows\SysWOW64\URB.exe UEBHWSV.exe File created C:\windows\SysWOW64\KTPZ.exe.bat BTNUSKM.exe File created C:\windows\SysWOW64\WQB.exe YVCXV.exe File opened for modification C:\windows\SysWOW64\WQB.exe YVCXV.exe File created C:\windows\SysWOW64\VFV.exe LII.exe File created C:\windows\SysWOW64\KWQAZ.exe GOKSNRY.exe File created C:\windows\SysWOW64\AJKPZZR.exe ZGG.exe File opened for modification C:\windows\SysWOW64\CKUGGUO.exe GKK.exe File created C:\windows\SysWOW64\VFV.exe.bat LII.exe File created C:\windows\SysWOW64\HXICIUS.exe.bat RHZ.exe File created C:\windows\SysWOW64\YXC.exe.bat HXICIUS.exe File created C:\windows\SysWOW64\JJVJNS.exe.bat FBPB.exe File created C:\windows\SysWOW64\MREH.exe FWM.exe File opened for modification C:\windows\SysWOW64\MREH.exe FWM.exe File opened for modification C:\windows\SysWOW64\CWWQQEI.exe FWOC.exe File created C:\windows\SysWOW64\YOFKOI.exe.bat GTBO.exe File created C:\windows\SysWOW64\URB.exe.bat UEBHWSV.exe File opened for modification C:\windows\SysWOW64\SZE.exe AWBKD.exe File created C:\windows\SysWOW64\PSBF.exe.bat UFWWFMF.exe File created C:\windows\SysWOW64\IWDD.exe CWWQQEI.exe File created C:\windows\SysWOW64\IWDD.exe.bat CWWQQEI.exe File created C:\windows\SysWOW64\QCESJ.exe.bat IWDD.exe File created C:\windows\SysWOW64\HIMF.exe KPLCH.exe File opened for modification C:\windows\SysWOW64\AWBKD.exe QZNQWJT.exe File opened for modification C:\windows\SysWOW64\HXICIUS.exe RHZ.exe File created C:\windows\SysWOW64\YNJXNHW.exe.bat VFCX.exe File created C:\windows\SysWOW64\TOGV.exe IVLKQ.exe File created C:\windows\SysWOW64\HVFJVC.exe PSBF.exe File created C:\windows\SysWOW64\CWWQQEI.exe.bat FWOC.exe File opened for modification C:\windows\SysWOW64\QCESJ.exe IWDD.exe File opened for modification C:\windows\SysWOW64\URB.exe UEBHWSV.exe File created C:\windows\SysWOW64\YVCXV.exe CKUGGUO.exe File created C:\windows\SysWOW64\KWQAZ.exe.bat GOKSNRY.exe File created C:\windows\SysWOW64\KMEXOVS.exe.bat VRVK.exe File opened for modification C:\windows\SysWOW64\JJVJNS.exe FBPB.exe File created C:\windows\SysWOW64\UFWWFMF.exe.bat MREH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\JLYWWL.exe.bat MOAZ.exe File created C:\windows\system\MRC.exe.bat KTPZ.exe File created C:\windows\TNDUWB.exe.bat SSZR.exe File created C:\windows\system\SLWP.exe.bat TNDUWB.exe File opened for modification C:\windows\XUCTRHH.exe JJMC.exe File opened for modification C:\windows\EZJG.exe KMEXOVS.exe File created C:\windows\system\KIL.exe JFHNOBO.exe File created C:\windows\ANQRY.exe.bat TXPSRT.exe File created C:\windows\KFUK.exe BFSFDH.exe File opened for modification C:\windows\WHLLC.exe EZJG.exe File created C:\windows\system\FBPB.exe KGKRYIZ.exe File created C:\windows\FWOC.exe KIJ.exe File opened for modification C:\windows\FWOC.exe KIJ.exe File created C:\windows\system\HHIS.exe XGGNBWB.exe File created C:\windows\TXPSRT.exe HHIS.exe File opened for modification C:\windows\OAQIRJ.exe 2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe File opened for modification C:\windows\system\NVEQ.exe RPZTNPA.exe File created C:\windows\system\GKK.exe MRC.exe File created C:\windows\JPNXWFM.exe JJVJNS.exe File created C:\windows\system\HITFLT.exe KIL.exe File created C:\windows\OAQIRJ.exe.bat 2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe File created C:\windows\VTFYJ.exe.bat NNNR.exe File created C:\windows\system\GKK.exe.bat MRC.exe File created C:\windows\IWEGML.exe.bat OIZWJ.exe File opened for modification C:\windows\JFHNOBO.exe QCESJ.exe File created C:\windows\RHZ.exe.bat XUCTRHH.exe File opened for modification C:\windows\system\OHGE.exe PWDOC.exe File created C:\windows\HLY.exe.bat HIMF.exe File opened for modification C:\windows\FAUTWM.exe YXC.exe File opened for modification C:\windows\JPNXWFM.exe JJVJNS.exe File created C:\windows\IVLKQ.exe.bat YNJXNHW.exe File created C:\windows\RGYZS.exe.bat HITFLT.exe File created C:\windows\system\JLYWWL.exe MOAZ.exe File created C:\windows\system\MRC.exe KTPZ.exe File opened for modification C:\windows\system\JRIJZ.exe IWEGML.exe File opened for modification C:\windows\system\JJMC.exe AJKPZZR.exe File created C:\windows\XUCTRHH.exe JJMC.exe File created C:\windows\system\FWM.exe.bat TOGV.exe File created C:\windows\system\XTR.exe.bat UGNBMNH.exe File opened for modification C:\windows\system\LSRZMAV.exe WCQ.exe File opened for modification C:\windows\system\SLWP.exe TNDUWB.exe File created C:\windows\system\HITFLT.exe.bat KIL.exe File created C:\windows\system\KCMAPK.exe PHHRF.exe File opened for modification C:\windows\system\XTR.exe UGNBMNH.exe File opened for modification C:\windows\system\PWDOC.exe XTR.exe File opened for modification C:\windows\system\BFSFDH.exe KWQAZ.exe File opened for modification C:\windows\SSZR.exe KFUK.exe File created C:\windows\XUCTRHH.exe.bat JJMC.exe File created C:\windows\system\TGIM.exe YTDDKCI.exe File opened for modification C:\windows\system\TGIM.exe YTDDKCI.exe File opened for modification C:\windows\KGKRYIZ.exe TGIM.exe File opened for modification C:\windows\VUD.exe YOFKOI.exe File created C:\windows\system\SSVQFBX.exe.bat MSNCO.exe File opened for modification C:\windows\system\BTNUSKM.exe VTFYJ.exe File created C:\windows\system\UGNBMNH.exe.bat WQB.exe File opened for modification C:\windows\OIZWJ.exe VFV.exe File created C:\windows\system\LSRZMAV.exe WCQ.exe File created C:\windows\system\SLWP.exe TNDUWB.exe File created C:\windows\system\SSVQFBX.exe MSNCO.exe File opened for modification C:\windows\VTFYJ.exe NNNR.exe File created C:\windows\system\XTR.exe UGNBMNH.exe File created C:\windows\LII.exe.bat OHGE.exe File created C:\windows\system\JRIJZ.exe IWEGML.exe File created C:\windows\SSZR.exe KFUK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2044 cmd.exe 5104 cmd.exe 1060 cmd.exe 4120 cmd.exe 1900 cmd.exe 4408 cmd.exe 4832 cmd.exe 5988 cmd.exe 1432 cmd.exe 5248 cmd.exe 3384 cmd.exe 5604 cmd.exe 4664 cmd.exe 1788 cmd.exe 1672 cmd.exe 4696 cmd.exe 4184 cmd.exe 4572 cmd.exe 108 cmd.exe 1012 cmd.exe 6136 cmd.exe 2928 cmd.exe 1540 cmd.exe 2056 cmd.exe 4732 cmd.exe 692 cmd.exe 5824 cmd.exe 4644 cmd.exe 5912 cmd.exe 1196 cmd.exe 1744 cmd.exe 3572 cmd.exe 2392 cmd.exe 4652 cmd.exe 4988 cmd.exe 1360 cmd.exe 1940 cmd.exe 1504 cmd.exe 3600 cmd.exe 4616 cmd.exe 4048 cmd.exe 5096 cmd.exe 1868 cmd.exe 1364 cmd.exe 5660 cmd.exe 4476 cmd.exe 3308 cmd.exe 2000 cmd.exe 1680 cmd.exe 2892 cmd.exe 5632 cmd.exe 4976 cmd.exe 1664 cmd.exe 1296 cmd.exe 5676 cmd.exe 2936 cmd.exe 5396 cmd.exe 3824 cmd.exe 2148 cmd.exe 1160 cmd.exe 3892 cmd.exe 2228 cmd.exe 4284 cmd.exe 3144 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1212 5900 WerFault.exe 87 760 2396 WerFault.exe 93 3540 120 WerFault.exe 99 3152 5436 WerFault.exe 103 976 5200 WerFault.exe 109 4496 4104 WerFault.exe 114 1832 3436 WerFault.exe 119 1248 1344 WerFault.exe 124 4484 2868 WerFault.exe 129 4424 5836 WerFault.exe 134 4552 4432 WerFault.exe 139 4152 5564 WerFault.exe 144 6140 2040 WerFault.exe 148 4988 4072 WerFault.exe 154 5004 5680 WerFault.exe 159 4440 3648 WerFault.exe 164 2832 976 WerFault.exe 168 1708 5016 WerFault.exe 173 5340 572 WerFault.exe 179 5164 1216 WerFault.exe 184 3248 5704 WerFault.exe 189 4356 1380 WerFault.exe 194 1652 1820 WerFault.exe 199 252 5584 WerFault.exe 204 260 4452 WerFault.exe 209 6012 3188 WerFault.exe 214 4460 2664 WerFault.exe 219 6092 5496 WerFault.exe 224 2412 5188 WerFault.exe 229 2524 5460 WerFault.exe 234 5908 3172 WerFault.exe 239 5592 2760 WerFault.exe 244 1908 4252 WerFault.exe 249 4636 3452 WerFault.exe 254 4428 2608 WerFault.exe 259 6012 3148 WerFault.exe 264 624 6112 WerFault.exe 269 4676 4500 WerFault.exe 274 3668 1760 WerFault.exe 280 1464 4492 WerFault.exe 285 4992 4584 WerFault.exe 290 3296 5536 WerFault.exe 295 2884 4892 WerFault.exe 300 2668 1700 WerFault.exe 305 4708 3540 WerFault.exe 310 5048 3040 WerFault.exe 315 4316 3152 WerFault.exe 320 1128 1608 WerFault.exe 325 4376 1384 WerFault.exe 330 4076 3084 WerFault.exe 335 5576 4464 WerFault.exe 340 2964 4112 WerFault.exe 345 4636 2488 WerFault.exe 350 4624 5932 WerFault.exe 355 5508 1288 WerFault.exe 360 1420 6040 WerFault.exe 365 4296 1132 WerFault.exe 370 2640 2516 WerFault.exe 375 3236 1272 WerFault.exe 380 4924 3304 WerFault.exe 385 5592 5908 WerFault.exe 390 3824 4692 WerFault.exe 395 4988 1652 WerFault.exe 400 3012 4488 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCESJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HITFLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPSRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MOAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAOEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXYTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MREH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSNCO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YVCXV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPLCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPZTNPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVLKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFSFDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOFKOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUCTRHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTNUSKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNDUWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGNBMNH.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5900 2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe 5900 2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe 2396 OAQIRJ.exe 2396 OAQIRJ.exe 120 GTBO.exe 120 GTBO.exe 5436 YOFKOI.exe 5436 YOFKOI.exe 5200 VUD.exe 5200 VUD.exe 4104 PHHRF.exe 4104 PHHRF.exe 3436 KCMAPK.exe 3436 KCMAPK.exe 1344 MSNCO.exe 1344 MSNCO.exe 2868 SSVQFBX.exe 2868 SSVQFBX.exe 5836 MOAZ.exe 5836 MOAZ.exe 4432 JLYWWL.exe 4432 JLYWWL.exe 5564 UEBHWSV.exe 5564 UEBHWSV.exe 2040 URB.exe 2040 URB.exe 4072 RPZTNPA.exe 4072 RPZTNPA.exe 5680 NVEQ.exe 5680 NVEQ.exe 3648 NNNR.exe 3648 NNNR.exe 976 VTFYJ.exe 976 VTFYJ.exe 5016 BTNUSKM.exe 5016 BTNUSKM.exe 572 KTPZ.exe 572 KTPZ.exe 1216 MRC.exe 1216 MRC.exe 5704 GKK.exe 5704 GKK.exe 1380 CKUGGUO.exe 1380 CKUGGUO.exe 1820 YVCXV.exe 1820 YVCXV.exe 5584 WQB.exe 5584 WQB.exe 4452 UGNBMNH.exe 4452 UGNBMNH.exe 3188 XTR.exe 3188 XTR.exe 2664 PWDOC.exe 2664 PWDOC.exe 5496 OHGE.exe 5496 OHGE.exe 5188 LII.exe 5188 LII.exe 5460 VFV.exe 5460 VFV.exe 3172 OIZWJ.exe 3172 OIZWJ.exe 2760 IWEGML.exe 2760 IWEGML.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5900 2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe 5900 2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe 2396 OAQIRJ.exe 2396 OAQIRJ.exe 120 GTBO.exe 120 GTBO.exe 5436 YOFKOI.exe 5436 YOFKOI.exe 5200 VUD.exe 5200 VUD.exe 4104 PHHRF.exe 4104 PHHRF.exe 3436 KCMAPK.exe 3436 KCMAPK.exe 1344 MSNCO.exe 1344 MSNCO.exe 2868 SSVQFBX.exe 2868 SSVQFBX.exe 5836 MOAZ.exe 5836 MOAZ.exe 4432 JLYWWL.exe 4432 JLYWWL.exe 5564 UEBHWSV.exe 5564 UEBHWSV.exe 2040 URB.exe 2040 URB.exe 4072 RPZTNPA.exe 4072 RPZTNPA.exe 5680 NVEQ.exe 5680 NVEQ.exe 3648 NNNR.exe 3648 NNNR.exe 976 VTFYJ.exe 976 VTFYJ.exe 5016 BTNUSKM.exe 5016 BTNUSKM.exe 572 KTPZ.exe 572 KTPZ.exe 1216 MRC.exe 1216 MRC.exe 5704 GKK.exe 5704 GKK.exe 1380 CKUGGUO.exe 1380 CKUGGUO.exe 1820 YVCXV.exe 1820 YVCXV.exe 5584 WQB.exe 5584 WQB.exe 4452 UGNBMNH.exe 4452 UGNBMNH.exe 3188 XTR.exe 3188 XTR.exe 2664 PWDOC.exe 2664 PWDOC.exe 5496 OHGE.exe 5496 OHGE.exe 5188 LII.exe 5188 LII.exe 5460 VFV.exe 5460 VFV.exe 3172 OIZWJ.exe 3172 OIZWJ.exe 2760 IWEGML.exe 2760 IWEGML.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5900 wrote to memory of 5492 5900 2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe 89 PID 5492 wrote to memory of 2396 5492 cmd.exe 93 PID 2396 wrote to memory of 4976 2396 OAQIRJ.exe 95 PID 4976 wrote to memory of 120 4976 cmd.exe 99 PID 120 wrote to memory of 1664 120 GTBO.exe 100 PID 1664 wrote to memory of 5436 1664 cmd.exe 103 PID 5436 wrote to memory of 3044 5436 YOFKOI.exe 105 PID 3044 wrote to memory of 5200 3044 cmd.exe 109 PID 5200 wrote to memory of 4760 5200 VUD.exe 110 PID 4760 wrote to memory of 4104 4760 cmd.exe 114 PID 4104 wrote to memory of 2468 4104 PHHRF.exe 115 PID 2468 wrote to memory of 3436 2468 cmd.exe 119 PID 3436 wrote to memory of 1116 3436 KCMAPK.exe 120 PID 1116 wrote to memory of 1344 1116 cmd.exe 124 PID 1344 wrote to memory of 1196 1344 MSNCO.exe 125 PID 1196 wrote to memory of 2868 1196 cmd.exe 129 PID 2868 wrote to memory of 4124 2868 SSVQFBX.exe 130 PID 4124 wrote to memory of 5836 4124 cmd.exe 134 PID 5836 wrote to memory of 1912 5836 MOAZ.exe 135 PID 1912 wrote to memory of 4432 1912 cmd.exe 139 PID 4432 wrote to memory of 5364 4432 JLYWWL.exe 140 PID 5364 wrote to memory of 5564 5364 cmd.exe 144 PID 5564 wrote to memory of 4644 5564 UEBHWSV.exe 145 PID 4644 wrote to memory of 2040 4644 cmd.exe 148 PID 2040 wrote to memory of 5912 2040 URB.exe 150 PID 5912 wrote to memory of 4072 5912 cmd.exe 154 PID 4072 wrote to memory of 2588 4072 RPZTNPA.exe 155 PID 2588 wrote to memory of 5680 2588 cmd.exe 159 PID 5680 wrote to memory of 3944 5680 NVEQ.exe 160 PID 3944 wrote to memory of 3648 3944 cmd.exe 164 PID 3648 wrote to memory of 2480 3648 NNNR.exe 165 PID 2480 wrote to memory of 976 2480 cmd.exe 168 PID 976 wrote to memory of 4412 976 VTFYJ.exe 170 PID 4412 wrote to memory of 5016 4412 cmd.exe 173 PID 5016 wrote to memory of 3928 5016 BTNUSKM.exe 175 PID 3928 wrote to memory of 572 3928 cmd.exe 179 PID 572 wrote to memory of 5084 572 KTPZ.exe 180 PID 5084 wrote to memory of 1216 5084 cmd.exe 184 PID 1216 wrote to memory of 5740 1216 MRC.exe 185 PID 5740 wrote to memory of 5704 5740 cmd.exe 189 PID 5704 wrote to memory of 1672 5704 GKK.exe 190 PID 1672 wrote to memory of 1380 1672 cmd.exe 194 PID 1380 wrote to memory of 5892 1380 CKUGGUO.exe 195 PID 5892 wrote to memory of 1820 5892 cmd.exe 199 PID 1820 wrote to memory of 3272 1820 YVCXV.exe 200 PID 3272 wrote to memory of 5584 3272 cmd.exe 204 PID 5584 wrote to memory of 4696 5584 WQB.exe 205 PID 4696 wrote to memory of 4452 4696 cmd.exe 209 PID 4452 wrote to memory of 1724 4452 UGNBMNH.exe 210 PID 1724 wrote to memory of 3188 1724 cmd.exe 214 PID 3188 wrote to memory of 3008 3188 XTR.exe 215 PID 3008 wrote to memory of 2664 3008 cmd.exe 219 PID 2664 wrote to memory of 1432 2664 PWDOC.exe 220 PID 1432 wrote to memory of 5496 1432 cmd.exe 224 PID 5496 wrote to memory of 2392 5496 OHGE.exe 225 PID 2392 wrote to memory of 5188 2392 cmd.exe 229 PID 5188 wrote to memory of 4968 5188 LII.exe 230 PID 4968 wrote to memory of 5460 4968 cmd.exe 234 PID 5460 wrote to memory of 4148 5460 VFV.exe 235 PID 4148 wrote to memory of 3172 4148 cmd.exe 239 PID 3172 wrote to memory of 5248 3172 OIZWJ.exe 240 PID 5248 wrote to memory of 2760 5248 cmd.exe 244 PID 2760 wrote to memory of 2044 2760 IWEGML.exe 245 PID 2044 wrote to memory of 4252 2044 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_3d00174791ae5fcbec27a337d06dbe72_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OAQIRJ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\OAQIRJ.exeC:\windows\OAQIRJ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTBO.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\windows\GTBO.exeC:\windows\GTBO.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOFKOI.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\windows\SysWOW64\YOFKOI.exeC:\windows\system32\YOFKOI.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUD.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\windows\VUD.exeC:\windows\VUD.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHHRF.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\windows\system\PHHRF.exeC:\windows\system\PHHRF.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KCMAPK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\windows\system\KCMAPK.exeC:\windows\system\KCMAPK.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSNCO.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\SysWOW64\MSNCO.exeC:\windows\system32\MSNCO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSVQFBX.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\windows\system\SSVQFBX.exeC:\windows\system\SSVQFBX.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOAZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\windows\SysWOW64\MOAZ.exeC:\windows\system32\MOAZ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLYWWL.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\windows\system\JLYWWL.exeC:\windows\system\JLYWWL.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEBHWSV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\UEBHWSV.exeC:\windows\UEBHWSV.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URB.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\SysWOW64\URB.exeC:\windows\system32\URB.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPZTNPA.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\SysWOW64\RPZTNPA.exeC:\windows\system32\RPZTNPA.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVEQ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\windows\system\NVEQ.exeC:\windows\system\NVEQ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNNR.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\windows\system\NNNR.exeC:\windows\system\NNNR.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTFYJ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\windows\VTFYJ.exeC:\windows\VTFYJ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTNUSKM.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\system\BTNUSKM.exeC:\windows\system\BTNUSKM.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KTPZ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\windows\SysWOW64\KTPZ.exeC:\windows\system32\KTPZ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRC.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\windows\system\MRC.exeC:\windows\system\MRC.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKK.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\windows\system\GKK.exeC:\windows\system\GKK.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKUGGUO.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\windows\SysWOW64\CKUGGUO.exeC:\windows\system32\CKUGGUO.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVCXV.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\SysWOW64\YVCXV.exeC:\windows\system32\YVCXV.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\windows\SysWOW64\WQB.exeC:\windows\system32\WQB.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGNBMNH.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\windows\system\UGNBMNH.exeC:\windows\system\UGNBMNH.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XTR.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\windows\system\XTR.exeC:\windows\system\XTR.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWDOC.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\system\PWDOC.exeC:\windows\system\PWDOC.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHGE.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\system\OHGE.exeC:\windows\system\OHGE.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LII.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\windows\LII.exeC:\windows\LII.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFV.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\SysWOW64\VFV.exeC:\windows\system32\VFV.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIZWJ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\OIZWJ.exeC:\windows\OIZWJ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\windows\IWEGML.exeC:\windows\IWEGML.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCQ.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1296 -
C:\windows\SysWOW64\WCQ.exeC:\windows\system32\WCQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSRZMAV.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5104 -
C:\windows\system\LSRZMAV.exeC:\windows\system\LSRZMAV.exe69⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4616 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HIMF.exe.bat" "72⤵PID:3752
-
C:\windows\SysWOW64\HIMF.exeC:\windows\system32\HIMF.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLY.exe.bat" "74⤵PID:4532
-
C:\windows\HLY.exeC:\windows\HLY.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NLY.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1060 -
C:\windows\SysWOW64\NLY.exeC:\windows\system32\NLY.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "78⤵PID:2412
-
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWQAZ.exe.bat" "80⤵PID:3664
-
C:\windows\SysWOW64\KWQAZ.exeC:\windows\system32\KWQAZ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFSFDH.exe.bat" "82⤵
- Executes a command shell one-liner
PID:3384 -
C:\windows\system\BFSFDH.exeC:\windows\system\BFSFDH.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KFUK.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2928 -
C:\windows\KFUK.exeC:\windows\KFUK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSZR.exe.bat" "86⤵PID:6088
-
C:\windows\SSZR.exeC:\windows\SSZR.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNDUWB.exe.bat" "88⤵PID:3424
-
C:\windows\TNDUWB.exeC:\windows\TNDUWB.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SLWP.exe.bat" "90⤵PID:5552
-
C:\windows\system\SLWP.exeC:\windows\system\SLWP.exe91⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QZNQWJT.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5676 -
C:\windows\QZNQWJT.exeC:\windows\QZNQWJT.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AWBKD.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4416 -
C:\windows\SysWOW64\AWBKD.exeC:\windows\system32\AWBKD.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZE.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4652 -
C:\windows\SysWOW64\SZE.exeC:\windows\system32\SZE.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXKIYQ.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4120 -
C:\windows\system\CXKIYQ.exeC:\windows\system\CXKIYQ.exe99⤵
- Executes dropped EXE
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:6100 -
C:\windows\system\DAOEE.exeC:\windows\system\DAOEE.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4508 -
C:\windows\system\ZGG.exeC:\windows\system\ZGG.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJKPZZR.exe.bat" "104⤵
- Executes a command shell one-liner
PID:692 -
C:\windows\SysWOW64\AJKPZZR.exeC:\windows\system32\AJKPZZR.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2884 -
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUCTRHH.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1900 -
C:\windows\XUCTRHH.exeC:\windows\XUCTRHH.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHZ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5824 -
C:\windows\RHZ.exeC:\windows\RHZ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:520 -
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXC.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4320 -
C:\windows\SysWOW64\YXC.exeC:\windows\system32\YXC.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "116⤵PID:4332
-
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRVK.exe.bat" "118⤵PID:460
-
C:\windows\SysWOW64\VRVK.exeC:\windows\system32\VRVK.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMEXOVS.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:1872 -
C:\windows\SysWOW64\KMEXOVS.exeC:\windows\system32\KMEXOVS.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-