Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe
- Size 208KB
- Sample261003-wpvenawses
- SHA256 ade01e204525f7d036c3f97d3f64bd217d87c39fd6da153aaebf2c318aff2ccf
- MD5 03faa1221ad3b248ba966409af55268c
- SHA1 3bbc11d00ef2a5c48f05c59607770459b313cc4a
- SHA512 2df22cc156a3b5c114f338787a3944bf7f2e398ac601623f70cb3f25edb93097c60d58fca29cfe518b6b5193a8825d2aa9a473e649189543a015fda6061af7b6
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfO4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOGkEj1
- TLSH T193247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 61 IoCs
pid Process 4956 UGC.exe 5772 KGFTRV.exe 4564 OWMB.exe 5564 UWTPMI.exe 2796 OKY.exe 6088 JXDIY.exe 3004 AFXNKN.exe 3116 VTC.exe 1324 KJDWTA.exe 4732 ORR.exe 4632 DUBAQF.exe 5144 YHG.exe 3752 RKJNG.exe 3636 IKL.exe 4896 TDGLR.exe 1044 ZDOZI.exe 5984 DLDH.exe 1232 WOGCAS.exe 1320 NXIIEQA.exe 2096 IKFR.exe 4600 OKNFXS.exe 1832 XKP.exe 3340 YNTNOFC.exe 4448 SBY.exe 5292 FMOWEQ.exe 3796 REJ.exe 3048 RHVK.exe 1948 GCEWLIL.exe 4516 FYDXI.exe 4704 QGK.exe 4224 UWRFG.exe 612 YEXFSGZ.exe 3352 IMZKWD.exe 2116 NMHYFG.exe 4728 IAM.exe 4568 QFE.exe 3760 BYHPZ.exe 1192 YDZEP.exe 2348 TQENZVT.exe 4532 ZMD.exe 124 IZOOMU.exe 4880 QFGDNH.exe 4740 ZSQVDEN.exe 1968 DVOID.exe 2904 BLI.exe 2696 EGMUI.exe 5148 EMF.exe 2912 PEIBKWW.exe 6004 YRSTA.exe 2840 QSUZDR.exe 2788 BKPRMGB.exe 5504 YQVG.exe 5868 MVBE.exe 5264 HJGNKR.exe 1904 CMOMYC.exe 3164 AHNMDF.exe 5524 DUS.exe 5432 BUAJW.exe 5288 BYDNCPW.exe 4068 WLIX.exe 4412 CLQKVR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\MVBE.exe YQVG.exe File created C:\windows\SysWOW64\IKL.exe RKJNG.exe File opened for modification C:\windows\SysWOW64\BYHPZ.exe QFE.exe File opened for modification C:\windows\SysWOW64\IZOOMU.exe ZMD.exe File created C:\windows\SysWOW64\IZOOMU.exe.bat ZMD.exe File opened for modification C:\windows\SysWOW64\YRSTA.exe PEIBKWW.exe File created C:\windows\SysWOW64\CMOMYC.exe.bat HJGNKR.exe File opened for modification C:\windows\SysWOW64\BYDNCPW.exe BUAJW.exe File opened for modification C:\windows\SysWOW64\VTC.exe AFXNKN.exe File created C:\windows\SysWOW64\KJDWTA.exe VTC.exe File created C:\windows\SysWOW64\IZOOMU.exe ZMD.exe File created C:\windows\SysWOW64\MVBE.exe.bat YQVG.exe File created C:\windows\SysWOW64\YRSTA.exe.bat PEIBKWW.exe File opened for modification C:\windows\SysWOW64\BUAJW.exe DUS.exe File opened for modification C:\windows\SysWOW64\YEXFSGZ.exe UWRFG.exe File created C:\windows\SysWOW64\QFGDNH.exe.bat IZOOMU.exe File created C:\windows\SysWOW64\DVOID.exe.bat ZSQVDEN.exe File created C:\windows\SysWOW64\VTC.exe AFXNKN.exe File created C:\windows\SysWOW64\QFGDNH.exe IZOOMU.exe File created C:\windows\SysWOW64\WLIX.exe.bat BYDNCPW.exe File opened for modification C:\windows\SysWOW64\YHG.exe DUBAQF.exe File opened for modification C:\windows\SysWOW64\IAM.exe NMHYFG.exe File created C:\windows\SysWOW64\IAM.exe.bat NMHYFG.exe File created C:\windows\SysWOW64\BYHPZ.exe.bat QFE.exe File created C:\windows\SysWOW64\DVOID.exe ZSQVDEN.exe File opened for modification C:\windows\SysWOW64\DVOID.exe ZSQVDEN.exe File opened for modification C:\windows\SysWOW64\CMOMYC.exe HJGNKR.exe File created C:\windows\SysWOW64\WLIX.exe BYDNCPW.exe File opened for modification C:\windows\SysWOW64\WLIX.exe BYDNCPW.exe File opened for modification C:\windows\SysWOW64\IKL.exe RKJNG.exe File created C:\windows\SysWOW64\KJDWTA.exe.bat VTC.exe File opened for modification C:\windows\SysWOW64\XKP.exe OKNFXS.exe File created C:\windows\SysWOW64\RHVK.exe REJ.exe File created C:\windows\SysWOW64\IAM.exe NMHYFG.exe File created C:\windows\SysWOW64\YRSTA.exe PEIBKWW.exe File created C:\windows\SysWOW64\CMOMYC.exe HJGNKR.exe File opened for modification C:\windows\SysWOW64\FMOWEQ.exe SBY.exe File opened for modification C:\windows\SysWOW64\RHVK.exe REJ.exe File created C:\windows\SysWOW64\RHVK.exe.bat REJ.exe File created C:\windows\SysWOW64\EMF.exe.bat EGMUI.exe File opened for modification C:\windows\SysWOW64\YQVG.exe BKPRMGB.exe File created C:\windows\SysWOW64\BUAJW.exe.bat DUS.exe File created C:\windows\SysWOW64\BYDNCPW.exe BUAJW.exe File created C:\windows\SysWOW64\KGFTRV.exe UGC.exe File created C:\windows\SysWOW64\IKFR.exe NXIIEQA.exe File created C:\windows\SysWOW64\FMOWEQ.exe SBY.exe File created C:\windows\SysWOW64\BYHPZ.exe QFE.exe File opened for modification C:\windows\SysWOW64\QFGDNH.exe IZOOMU.exe File created C:\windows\SysWOW64\YQVG.exe BKPRMGB.exe File created C:\windows\SysWOW64\BYDNCPW.exe.bat BUAJW.exe File created C:\windows\SysWOW64\YHG.exe DUBAQF.exe File created C:\windows\SysWOW64\XKP.exe OKNFXS.exe File opened for modification C:\windows\SysWOW64\EMF.exe EGMUI.exe File created C:\windows\SysWOW64\IKFR.exe.bat NXIIEQA.exe File created C:\windows\SysWOW64\XKP.exe.bat OKNFXS.exe File created C:\windows\SysWOW64\FMOWEQ.exe.bat SBY.exe File opened for modification C:\windows\SysWOW64\IKFR.exe NXIIEQA.exe File created C:\windows\SysWOW64\YEXFSGZ.exe.bat UWRFG.exe File created C:\windows\SysWOW64\YQVG.exe.bat BKPRMGB.exe File created C:\windows\SysWOW64\BUAJW.exe DUS.exe File opened for modification C:\windows\SysWOW64\KGFTRV.exe UGC.exe File created C:\windows\SysWOW64\VTC.exe.bat AFXNKN.exe File opened for modification C:\windows\SysWOW64\KJDWTA.exe VTC.exe File created C:\windows\SysWOW64\EMF.exe EGMUI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\AHNMDF.exe CMOMYC.exe File created C:\windows\CLQKVR.exe WLIX.exe File opened for modification C:\windows\system\TDGLR.exe IKL.exe File created C:\windows\system\WOGCAS.exe.bat DLDH.exe File created C:\windows\NXIIEQA.exe.bat WOGCAS.exe File created C:\windows\OKNFXS.exe.bat IKFR.exe File created C:\windows\system\QGK.exe FYDXI.exe File created C:\windows\ZSQVDEN.exe.bat QFGDNH.exe File created C:\windows\system\DUBAQF.exe.bat ORR.exe File created C:\windows\YDZEP.exe BYHPZ.exe File created C:\windows\system\TQENZVT.exe YDZEP.exe File created C:\windows\REJ.exe.bat FMOWEQ.exe File created C:\windows\system\QGK.exe.bat FYDXI.exe File created C:\windows\system\BKPRMGB.exe QSUZDR.exe File created C:\windows\system\WOGCAS.exe DLDH.exe File created C:\windows\FYDXI.exe GCEWLIL.exe File opened for modification C:\windows\system\PEIBKWW.exe EMF.exe File created C:\windows\CLQKVR.exe.bat WLIX.exe File opened for modification C:\windows\UWTPMI.exe OWMB.exe File opened for modification C:\windows\OKNFXS.exe IKFR.exe File created C:\windows\REJ.exe FMOWEQ.exe File opened for modification C:\windows\FYDXI.exe GCEWLIL.exe File created C:\windows\AFXNKN.exe.bat JXDIY.exe File opened for modification C:\windows\system\ORR.exe KJDWTA.exe File created C:\windows\ZDOZI.exe.bat TDGLR.exe File created C:\windows\system\DLDH.exe.bat ZDOZI.exe File opened for modification C:\windows\UWRFG.exe QGK.exe File opened for modification C:\windows\system\UGC.exe 2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe File opened for modification C:\windows\QFE.exe IAM.exe File created C:\windows\system\BKPRMGB.exe.bat QSUZDR.exe File created C:\windows\system\TQENZVT.exe.bat YDZEP.exe File opened for modification C:\windows\ZSQVDEN.exe QFGDNH.exe File opened for modification C:\windows\system\QSUZDR.exe YRSTA.exe File opened for modification C:\windows\OWMB.exe KGFTRV.exe File created C:\windows\UWRFG.exe.bat QGK.exe File created C:\windows\IMZKWD.exe YEXFSGZ.exe File created C:\windows\system\UGC.exe.bat 2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe File created C:\windows\system\ORR.exe KJDWTA.exe File created C:\windows\system\DLDH.exe ZDOZI.exe File created C:\windows\OKNFXS.exe IKFR.exe File created C:\windows\YNTNOFC.exe.bat XKP.exe File created C:\windows\EGMUI.exe BLI.exe File created C:\windows\OWMB.exe KGFTRV.exe File opened for modification C:\windows\YNTNOFC.exe XKP.exe File created C:\windows\SBY.exe YNTNOFC.exe File created C:\windows\FYDXI.exe.bat GCEWLIL.exe File created C:\windows\QFE.exe IAM.exe File opened for modification C:\windows\YDZEP.exe BYHPZ.exe File created C:\windows\system\ORR.exe.bat KJDWTA.exe File opened for modification C:\windows\system\DLDH.exe ZDOZI.exe File opened for modification C:\windows\NMHYFG.exe IMZKWD.exe File opened for modification C:\windows\system\DUS.exe AHNMDF.exe File opened for modification C:\windows\system\TQENZVT.exe YDZEP.exe File created C:\windows\system\QSUZDR.exe YRSTA.exe File created C:\windows\HJGNKR.exe.bat MVBE.exe File created C:\windows\system\DUS.exe.bat AHNMDF.exe File opened for modification C:\windows\CLQKVR.exe WLIX.exe File opened for modification C:\windows\system\BLI.exe DVOID.exe File created C:\windows\AHNMDF.exe.bat CMOMYC.exe File created C:\windows\UWTPMI.exe.bat OWMB.exe File created C:\windows\system\OKY.exe UWTPMI.exe File created C:\windows\RKJNG.exe.bat YHG.exe File created C:\windows\YNTNOFC.exe XKP.exe File opened for modification C:\windows\system\ZMD.exe TQENZVT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 61 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4736 cmd.exe 4056 cmd.exe 2868 cmd.exe 4892 cmd.exe 4796 cmd.exe 4172 cmd.exe 2556 cmd.exe 1076 cmd.exe 3400 cmd.exe 2456 cmd.exe 2356 cmd.exe 5428 cmd.exe 1424 cmd.exe 5580 cmd.exe 2408 cmd.exe 4288 cmd.exe 6104 cmd.exe 3596 cmd.exe 4308 cmd.exe 5380 cmd.exe 3032 cmd.exe 5788 cmd.exe 4952 cmd.exe 3156 cmd.exe 1172 cmd.exe 2972 cmd.exe 1772 cmd.exe 3060 cmd.exe 5084 cmd.exe 6068 cmd.exe 4084 cmd.exe 6100 cmd.exe 4052 cmd.exe 3776 cmd.exe 1100 cmd.exe 2312 cmd.exe 4928 cmd.exe 4440 cmd.exe 464 cmd.exe 2452 cmd.exe 3092 cmd.exe 4912 cmd.exe 5864 cmd.exe 2216 cmd.exe 1352 cmd.exe 1348 cmd.exe 1612 cmd.exe 1380 cmd.exe 2900 cmd.exe 3536 cmd.exe 4696 cmd.exe 2328 cmd.exe 4072 cmd.exe 6116 cmd.exe 6016 cmd.exe 952 cmd.exe 2612 cmd.exe 6020 cmd.exe 1516 cmd.exe 5612 cmd.exe 4392 cmd.exe - Program crash 62 IoCs
pid pid_target Process procid_target 3932 1700 WerFault.exe 88 5880 4956 WerFault.exe 93 5520 5772 WerFault.exe 99 3448 4564 WerFault.exe 104 5292 5564 WerFault.exe 109 2768 2796 WerFault.exe 114 3164 6088 WerFault.exe 119 1624 3004 WerFault.exe 124 1388 3116 WerFault.exe 129 5508 1324 WerFault.exe 134 5932 4732 WerFault.exe 139 3192 4632 WerFault.exe 144 6048 5144 WerFault.exe 149 5272 3752 WerFault.exe 154 2704 3636 WerFault.exe 159 4076 4896 WerFault.exe 164 2104 1044 WerFault.exe 169 3820 5984 WerFault.exe 174 2452 1232 WerFault.exe 179 1620 1320 WerFault.exe 184 124 2096 WerFault.exe 189 3088 4600 WerFault.exe 194 3084 1832 WerFault.exe 199 5464 3340 WerFault.exe 204 896 4448 WerFault.exe 209 3536 5292 WerFault.exe 214 1268 3796 WerFault.exe 219 2500 3048 WerFault.exe 224 712 1948 WerFault.exe 229 5248 4516 WerFault.exe 234 4604 4704 WerFault.exe 239 4204 4224 WerFault.exe 244 4912 612 WerFault.exe 249 4904 3352 WerFault.exe 254 5352 2116 WerFault.exe 259 4832 4728 WerFault.exe 264 2312 4568 WerFault.exe 269 1136 3760 WerFault.exe 274 3388 1192 WerFault.exe 279 6116 2348 WerFault.exe 285 1076 4532 WerFault.exe 290 1440 124 WerFault.exe 295 820 4880 WerFault.exe 300 3384 4740 WerFault.exe 305 3268 1968 WerFault.exe 310 6104 2904 WerFault.exe 315 2760 2696 WerFault.exe 320 2648 5148 WerFault.exe 325 4360 2912 WerFault.exe 330 4656 6004 WerFault.exe 335 2880 2840 WerFault.exe 340 5888 2788 WerFault.exe 345 780 5504 WerFault.exe 350 5500 5868 WerFault.exe 355 2496 5264 WerFault.exe 360 2804 1904 WerFault.exe 365 2152 3164 WerFault.exe 370 3028 5524 WerFault.exe 375 2908 5432 WerFault.exe 380 1620 5288 WerFault.exe 385 4636 4068 WerFault.exe 390 4312 4412 WerFault.exe 395 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYDXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJGNKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRSTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEIBKWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFXNKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNTNOFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGFTRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMOWEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOGCAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDOZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXIIEQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJDWTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUBAQF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLQKVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKNFXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AHNMDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUAJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWTPMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQENZVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1700 2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe 1700 2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe 4956 UGC.exe 4956 UGC.exe 5772 KGFTRV.exe 5772 KGFTRV.exe 4564 OWMB.exe 4564 OWMB.exe 5564 UWTPMI.exe 5564 UWTPMI.exe 2796 OKY.exe 2796 OKY.exe 6088 JXDIY.exe 6088 JXDIY.exe 3004 AFXNKN.exe 3004 AFXNKN.exe 3116 VTC.exe 3116 VTC.exe 1324 KJDWTA.exe 1324 KJDWTA.exe 4732 ORR.exe 4732 ORR.exe 4632 DUBAQF.exe 4632 DUBAQF.exe 5144 YHG.exe 5144 YHG.exe 3752 RKJNG.exe 3752 RKJNG.exe 3636 IKL.exe 3636 IKL.exe 4896 TDGLR.exe 4896 TDGLR.exe 1044 ZDOZI.exe 1044 ZDOZI.exe 5984 DLDH.exe 5984 DLDH.exe 1232 WOGCAS.exe 1232 WOGCAS.exe 1320 NXIIEQA.exe 1320 NXIIEQA.exe 2096 IKFR.exe 2096 IKFR.exe 4600 OKNFXS.exe 4600 OKNFXS.exe 1832 XKP.exe 1832 XKP.exe 3340 YNTNOFC.exe 3340 YNTNOFC.exe 4448 SBY.exe 4448 SBY.exe 5292 FMOWEQ.exe 5292 FMOWEQ.exe 3796 REJ.exe 3796 REJ.exe 3048 RHVK.exe 3048 RHVK.exe 1948 GCEWLIL.exe 1948 GCEWLIL.exe 4516 FYDXI.exe 4516 FYDXI.exe 4704 QGK.exe 4704 QGK.exe 4224 UWRFG.exe 4224 UWRFG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1700 2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe 1700 2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe 4956 UGC.exe 4956 UGC.exe 5772 KGFTRV.exe 5772 KGFTRV.exe 4564 OWMB.exe 4564 OWMB.exe 5564 UWTPMI.exe 5564 UWTPMI.exe 2796 OKY.exe 2796 OKY.exe 6088 JXDIY.exe 6088 JXDIY.exe 3004 AFXNKN.exe 3004 AFXNKN.exe 3116 VTC.exe 3116 VTC.exe 1324 KJDWTA.exe 1324 KJDWTA.exe 4732 ORR.exe 4732 ORR.exe 4632 DUBAQF.exe 4632 DUBAQF.exe 5144 YHG.exe 5144 YHG.exe 3752 RKJNG.exe 3752 RKJNG.exe 3636 IKL.exe 3636 IKL.exe 4896 TDGLR.exe 4896 TDGLR.exe 1044 ZDOZI.exe 1044 ZDOZI.exe 5984 DLDH.exe 5984 DLDH.exe 1232 WOGCAS.exe 1232 WOGCAS.exe 1320 NXIIEQA.exe 1320 NXIIEQA.exe 2096 IKFR.exe 2096 IKFR.exe 4600 OKNFXS.exe 4600 OKNFXS.exe 1832 XKP.exe 1832 XKP.exe 3340 YNTNOFC.exe 3340 YNTNOFC.exe 4448 SBY.exe 4448 SBY.exe 5292 FMOWEQ.exe 5292 FMOWEQ.exe 3796 REJ.exe 3796 REJ.exe 3048 RHVK.exe 3048 RHVK.exe 1948 GCEWLIL.exe 1948 GCEWLIL.exe 4516 FYDXI.exe 4516 FYDXI.exe 4704 QGK.exe 4704 QGK.exe 4224 UWRFG.exe 4224 UWRFG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1700 wrote to memory of 4696 1700 2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe 89 PID 4696 wrote to memory of 4956 4696 cmd.exe 93 PID 4956 wrote to memory of 4440 4956 UGC.exe 95 PID 4440 wrote to memory of 5772 4440 cmd.exe 99 PID 5772 wrote to memory of 2456 5772 KGFTRV.exe 100 PID 2456 wrote to memory of 4564 2456 cmd.exe 104 PID 4564 wrote to memory of 2356 4564 OWMB.exe 105 PID 2356 wrote to memory of 5564 2356 cmd.exe 109 PID 5564 wrote to memory of 5864 5564 UWTPMI.exe 110 PID 5864 wrote to memory of 2796 5864 cmd.exe 114 PID 2796 wrote to memory of 4308 2796 OKY.exe 115 PID 4308 wrote to memory of 6088 4308 cmd.exe 119 PID 6088 wrote to memory of 6016 6088 JXDIY.exe 120 PID 6016 wrote to memory of 3004 6016 cmd.exe 124 PID 3004 wrote to memory of 5380 3004 AFXNKN.exe 125 PID 5380 wrote to memory of 3116 5380 cmd.exe 129 PID 3116 wrote to memory of 4952 3116 VTC.exe 130 PID 4952 wrote to memory of 1324 4952 cmd.exe 134 PID 1324 wrote to memory of 6068 1324 KJDWTA.exe 135 PID 6068 wrote to memory of 4732 6068 cmd.exe 139 PID 4732 wrote to memory of 2216 4732 ORR.exe 140 PID 2216 wrote to memory of 4632 2216 cmd.exe 144 PID 4632 wrote to memory of 1612 4632 DUBAQF.exe 145 PID 1612 wrote to memory of 5144 1612 cmd.exe 149 PID 5144 wrote to memory of 2328 5144 YHG.exe 150 PID 2328 wrote to memory of 3752 2328 cmd.exe 154 PID 3752 wrote to memory of 5428 3752 RKJNG.exe 155 PID 5428 wrote to memory of 3636 5428 cmd.exe 159 PID 3636 wrote to memory of 952 3636 IKL.exe 160 PID 952 wrote to memory of 4896 952 cmd.exe 164 PID 4896 wrote to memory of 3776 4896 TDGLR.exe 165 PID 3776 wrote to memory of 1044 3776 cmd.exe 169 PID 1044 wrote to memory of 1352 1044 ZDOZI.exe 170 PID 1352 wrote to memory of 5984 1352 cmd.exe 174 PID 5984 wrote to memory of 2612 5984 DLDH.exe 175 PID 2612 wrote to memory of 1232 2612 cmd.exe 179 PID 1232 wrote to memory of 4736 1232 WOGCAS.exe 180 PID 4736 wrote to memory of 1320 4736 cmd.exe 184 PID 1320 wrote to memory of 4084 1320 NXIIEQA.exe 185 PID 4084 wrote to memory of 2096 4084 cmd.exe 189 PID 2096 wrote to memory of 3032 2096 IKFR.exe 190 PID 3032 wrote to memory of 4600 3032 cmd.exe 194 PID 4600 wrote to memory of 1424 4600 OKNFXS.exe 195 PID 1424 wrote to memory of 1832 1424 cmd.exe 199 PID 1832 wrote to memory of 5084 1832 XKP.exe 200 PID 5084 wrote to memory of 3340 5084 cmd.exe 204 PID 3340 wrote to memory of 1380 3340 YNTNOFC.exe 205 PID 1380 wrote to memory of 4448 1380 cmd.exe 209 PID 4448 wrote to memory of 2868 4448 SBY.exe 210 PID 2868 wrote to memory of 5292 2868 cmd.exe 214 PID 5292 wrote to memory of 3156 5292 FMOWEQ.exe 215 PID 3156 wrote to memory of 3796 3156 cmd.exe 219 PID 3796 wrote to memory of 1348 3796 REJ.exe 220 PID 1348 wrote to memory of 3048 1348 cmd.exe 224 PID 3048 wrote to memory of 2900 3048 RHVK.exe 225 PID 2900 wrote to memory of 1948 2900 cmd.exe 229 PID 1948 wrote to memory of 5580 1948 GCEWLIL.exe 230 PID 5580 wrote to memory of 4516 5580 cmd.exe 234 PID 4516 wrote to memory of 5788 4516 FYDXI.exe 235 PID 5788 wrote to memory of 4704 5788 cmd.exe 239 PID 4704 wrote to memory of 6020 4704 QGK.exe 240 PID 6020 wrote to memory of 4224 6020 cmd.exe 244 PID 4224 wrote to memory of 3596 4224 UWRFG.exe 245 PID 3596 wrote to memory of 612 3596 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_03faa1221ad3b248ba966409af55268c_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\windows\system\UGC.exeC:\windows\system\UGC.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGFTRV.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\windows\SysWOW64\KGFTRV.exeC:\windows\system32\KGFTRV.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OWMB.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\windows\OWMB.exeC:\windows\OWMB.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWTPMI.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\UWTPMI.exeC:\windows\UWTPMI.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKY.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\system\OKY.exeC:\windows\system\OKY.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXDIY.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\windows\JXDIY.exeC:\windows\JXDIY.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFXNKN.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\windows\AFXNKN.exeC:\windows\AFXNKN.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTC.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\SysWOW64\VTC.exeC:\windows\system32\VTC.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORR.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\system\ORR.exeC:\windows\system\ORR.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DUBAQF.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\windows\system\DUBAQF.exeC:\windows\system\DUBAQF.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YHG.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\windows\SysWOW64\YHG.exeC:\windows\system32\YHG.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKJNG.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\RKJNG.exeC:\windows\RKJNG.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKL.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\SysWOW64\IKL.exeC:\windows\system32\IKL.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDGLR.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:952 -
C:\windows\system\TDGLR.exeC:\windows\system\TDGLR.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDOZI.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\windows\ZDOZI.exeC:\windows\ZDOZI.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDH.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\windows\system\DLDH.exeC:\windows\system\DLDH.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOGCAS.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\windows\system\WOGCAS.exeC:\windows\system\WOGCAS.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXIIEQA.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\NXIIEQA.exeC:\windows\NXIIEQA.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKFR.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\windows\SysWOW64\IKFR.exeC:\windows\system32\IKFR.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKNFXS.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\OKNFXS.exeC:\windows\OKNFXS.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKP.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\windows\SysWOW64\XKP.exeC:\windows\system32\XKP.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNTNOFC.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\windows\YNTNOFC.exeC:\windows\YNTNOFC.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBY.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\windows\SBY.exeC:\windows\SBY.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMOWEQ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\SysWOW64\FMOWEQ.exeC:\windows\system32\FMOWEQ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REJ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\windows\REJ.exeC:\windows\REJ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHVK.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\windows\SysWOW64\RHVK.exeC:\windows\system32\RHVK.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\FYDXI.exeC:\windows\FYDXI.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGK.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\system\QGK.exeC:\windows\system\QGK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWRFG.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\UWRFG.exeC:\windows\UWRFG.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEXFSGZ.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\windows\SysWOW64\YEXFSGZ.exeC:\windows\system32\YEXFSGZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMZKWD.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1172 -
C:\windows\IMZKWD.exeC:\windows\IMZKWD.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NMHYFG.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3092 -
C:\windows\NMHYFG.exeC:\windows\NMHYFG.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAM.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6100 -
C:\windows\SysWOW64\IAM.exeC:\windows\system32\IAM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFE.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1516 -
C:\windows\QFE.exeC:\windows\QFE.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYHPZ.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2408 -
C:\windows\SysWOW64\BYHPZ.exeC:\windows\system32\BYHPZ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDZEP.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2972 -
C:\windows\YDZEP.exeC:\windows\YDZEP.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQENZVT.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4892 -
C:\windows\system\TQENZVT.exeC:\windows\system\TQENZVT.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMD.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4288 -
C:\windows\system\ZMD.exeC:\windows\system\ZMD.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZOOMU.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4072 -
C:\windows\SysWOW64\IZOOMU.exeC:\windows\system32\IZOOMU.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFGDNH.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1100 -
C:\windows\SysWOW64\QFGDNH.exeC:\windows\system32\QFGDNH.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSQVDEN.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4912 -
C:\windows\ZSQVDEN.exeC:\windows\ZSQVDEN.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DVOID.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2556 -
C:\windows\SysWOW64\DVOID.exeC:\windows\system32\DVOID.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLI.exe.bat" "90⤵
- Executes a command shell one-liner
PID:464 -
C:\windows\system\BLI.exeC:\windows\system\BLI.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGMUI.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3536 -
C:\windows\EGMUI.exeC:\windows\EGMUI.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EMF.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4056 -
C:\windows\SysWOW64\EMF.exeC:\windows\system32\EMF.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEIBKWW.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4052 -
C:\windows\system\PEIBKWW.exeC:\windows\system\PEIBKWW.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRSTA.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2452 -
C:\windows\SysWOW64\YRSTA.exeC:\windows\system32\YRSTA.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSUZDR.exe.bat" "100⤵
- Executes a command shell one-liner
PID:6116 -
C:\windows\system\QSUZDR.exeC:\windows\system\QSUZDR.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BKPRMGB.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1076 -
C:\windows\system\BKPRMGB.exeC:\windows\system\BKPRMGB.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YQVG.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1772 -
C:\windows\SysWOW64\YQVG.exeC:\windows\system32\YQVG.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVBE.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5612 -
C:\windows\SysWOW64\MVBE.exeC:\windows\system32\MVBE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HJGNKR.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3060 -
C:\windows\HJGNKR.exeC:\windows\HJGNKR.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMOMYC.exe.bat" "110⤵
- Executes a command shell one-liner
PID:3400 -
C:\windows\SysWOW64\CMOMYC.exeC:\windows\system32\CMOMYC.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AHNMDF.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6104 -
C:\windows\AHNMDF.exeC:\windows\AHNMDF.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DUS.exe.bat" "114⤵
- Executes a command shell one-liner
PID:2312 -
C:\windows\system\DUS.exeC:\windows\system\DUS.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUAJW.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4796 -
C:\windows\SysWOW64\BUAJW.exeC:\windows\system32\BUAJW.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYDNCPW.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4172 -
C:\windows\SysWOW64\BYDNCPW.exeC:\windows\system32\BYDNCPW.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLIX.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4392 -
C:\windows\SysWOW64\WLIX.exeC:\windows\system32\WLIX.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-