Analysis
- max time kernel
95s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe
- Size 208KB
- Sample260719-tyfxhset4n
- SHA256 8d0203900a30ca151f7ab142a28b2625c3eae31a7ca3fcc29295cb15d8fdc3ff
- MD5 e74214781479be54112c3272c0abac69
- SHA1 a1aa74c4abdb73ab8e7031a997c33431e030c55f
- SHA512 f87646e936a23df5dd17d6f288c5ff153251b043256dd3ed5c0a21a38cc5dd048e41ad20b66f5cd9e9856f38a78de5814dd0e775b728f902882d7af0a746cd57
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfQ4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LOIkEj1
- TLSH T11A247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1948 KKBAA.exe 4996 JNASNA.exe 5476 TLGMD.exe 4632 XTN.exe 2556 KZVYRN.exe 5784 XCDWFQ.exe 4288 NSE.exe 252 ACN.exe 4336 MKBUE.exe 5108 VTDZIM.exe 2724 JEMY.exe 6848 NWNAI.exe 716 RMC.exe 4192 WXME.exe 2384 AALZM.exe 6516 WGDPC.exe 4240 ETHVM.exe 464 NZUCP.exe 4776 CPV.exe 3164 ENBWL.exe 6436 VVPTYZ.exe 3340 VVE.exe 6452 LGGGL.exe 6872 BWH.exe 1132 LUV.exe 1880 JNYIIGG.exe 5132 GSQXY.exe 6392 HNUB.exe 3740 ZQYXRP.exe 4792 HWCLBO.exe 5228 LMR.exe 5112 ZJRXQKE.exe 6608 SKYIZKU.exe 4256 CAMCOT.exe 7148 PGMOQ.exe 2348 FBV.exe 1232 URWS.exe 5124 JMOWTZD.exe 2616 HHFXY.exe 5040 LXUFKVO.exe 5840 ASDJV.exe 1980 WQD.exe 6644 JBLULE.exe 6536 PWLU.exe 1360 OME.exe 3156 XUGC.exe 4080 RHLMYJ.exe 6000 HXMD.exe 6012 WSVPQSG.exe 6880 HLY.exe 3396 LTFIDR.exe 4460 GOKSNRY.exe 3016 RHFK.exe 5600 ZMR.exe 4360 QVTW.exe 5760 GQDJUPL.exe 6852 NGEABL.exe 7104 OJH.exe 1064 DERIZ.exe 4856 SUSH.exe 1744 FXIYMLD.exe 5928 GKB.exe 1656 AXFW.exe 2016 PTXIJLV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\PTXIJLV.exe.bat AXFW.exe File opened for modification C:\windows\SysWOW64\QPFQ.exe HOD.exe File created C:\windows\SysWOW64\FPBYCB.exe JJVJNS.exe File created C:\windows\SysWOW64\FPBYCB.exe.bat JJVJNS.exe File opened for modification C:\windows\SysWOW64\BRFX.exe VRXKOXX.exe File opened for modification C:\windows\SysWOW64\KZVYRN.exe XTN.exe File created C:\windows\SysWOW64\WSVPQSG.exe.bat HXMD.exe File created C:\windows\SysWOW64\GSPCCDY.exe QPFQ.exe File opened for modification C:\windows\SysWOW64\WHGDQ.exe FUVL.exe File created C:\windows\SysWOW64\LTFIDR.exe HLY.exe File opened for modification C:\windows\SysWOW64\LTFIDR.exe HLY.exe File created C:\windows\SysWOW64\QPFQ.exe.bat HOD.exe File opened for modification C:\windows\SysWOW64\EJVFKA.exe JWRV.exe File created C:\windows\SysWOW64\CZJSOP.exe.bat NEZ.exe File created C:\windows\SysWOW64\DJOV.exe.bat TJM.exe File created C:\windows\SysWOW64\LIX.exe TZDXMY.exe File created C:\windows\SysWOW64\AIGDKD.exe FVBU.exe File created C:\windows\SysWOW64\AIGDKD.exe.bat FVBU.exe File opened for modification C:\windows\SysWOW64\EXETRBV.exe JCZJGB.exe File created C:\windows\SysWOW64\URWS.exe FBV.exe File created C:\windows\SysWOW64\GOKSNRY.exe LTFIDR.exe File created C:\windows\SysWOW64\FXIYMLD.exe SUSH.exe File created C:\windows\SysWOW64\PTXIJLV.exe AXFW.exe File created C:\windows\SysWOW64\EYG.exe NSWBP.exe File created C:\windows\SysWOW64\EJVFKA.exe.bat JWRV.exe File created C:\windows\SysWOW64\NEZ.exe.bat CMWVUNK.exe File opened for modification C:\windows\SysWOW64\CZJSOP.exe NEZ.exe File created C:\windows\SysWOW64\KZVYRN.exe.bat XTN.exe File created C:\windows\SysWOW64\URWS.exe.bat FBV.exe File opened for modification C:\windows\SysWOW64\HXMD.exe RHLMYJ.exe File opened for modification C:\windows\SysWOW64\GSPCCDY.exe QPFQ.exe File created C:\windows\SysWOW64\WHGDQ.exe.bat FUVL.exe File created C:\windows\SysWOW64\EJVFKA.exe JWRV.exe File created C:\windows\SysWOW64\FOS.exe.bat UVXCKP.exe File opened for modification C:\windows\SysWOW64\VVPTYZ.exe ENBWL.exe File created C:\windows\SysWOW64\JEYL.exe.bat KTIO.exe File created C:\windows\SysWOW64\JJVJNS.exe DJOV.exe File created C:\windows\SysWOW64\ACY.exe FPBYCB.exe File created C:\windows\SysWOW64\FVBU.exe LIX.exe File created C:\windows\SysWOW64\NEZ.exe CMWVUNK.exe File created C:\windows\SysWOW64\JCZJGB.exe POUA.exe File created C:\windows\SysWOW64\HXMD.exe RHLMYJ.exe File opened for modification C:\windows\SysWOW64\GOKSNRY.exe LTFIDR.exe File created C:\windows\SysWOW64\GOKSNRY.exe.bat LTFIDR.exe File opened for modification C:\windows\SysWOW64\EYG.exe NSWBP.exe File created C:\windows\SysWOW64\WSVPQSG.exe HXMD.exe File opened for modification C:\windows\SysWOW64\RHFK.exe GOKSNRY.exe File created C:\windows\SysWOW64\OJH.exe NGEABL.exe File created C:\windows\SysWOW64\OJH.exe.bat NGEABL.exe File created C:\windows\SysWOW64\SUSH.exe.bat DERIZ.exe File created C:\windows\SysWOW64\FXIYMLD.exe.bat SUSH.exe File opened for modification C:\windows\SysWOW64\FPBYCB.exe JJVJNS.exe File opened for modification C:\windows\SysWOW64\FXIYMLD.exe SUSH.exe File created C:\windows\SysWOW64\QPFQ.exe HOD.exe File created C:\windows\SysWOW64\VYYJYP.exe.bat ALUA.exe File created C:\windows\SysWOW64\XJEAYG.exe JEYL.exe File created C:\windows\SysWOW64\YTDDKCI.exe.bat EXYTA.exe File created C:\windows\SysWOW64\JJVJNS.exe.bat DJOV.exe File opened for modification C:\windows\SysWOW64\FVBU.exe LIX.exe File created C:\windows\SysWOW64\FVBU.exe.bat LIX.exe File opened for modification C:\windows\SysWOW64\OJH.exe NGEABL.exe File opened for modification C:\windows\SysWOW64\YTDDKCI.exe EXYTA.exe File opened for modification C:\windows\SysWOW64\DJOV.exe TJM.exe File opened for modification C:\windows\SysWOW64\ACY.exe FPBYCB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\GSQXY.exe JNYIIGG.exe File opened for modification C:\windows\system\KKBAA.exe 2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe File opened for modification C:\windows\system\LXUFKVO.exe HHFXY.exe File created C:\windows\system\NGEABL.exe.bat GQDJUPL.exe File opened for modification C:\windows\system\KTIO.exe VYYJYP.exe File created C:\windows\ITNHTX.exe.bat NGIY.exe File opened for modification C:\windows\ACN.exe NSE.exe File created C:\windows\system\JBLULE.exe.bat WQD.exe File created C:\windows\GKB.exe.bat FXIYMLD.exe File opened for modification C:\windows\JKT.exe DKM.exe File opened for modification C:\windows\system\NWNAI.exe JEMY.exe File created C:\windows\ACN.exe NSE.exe File created C:\windows\system\FBV.exe PGMOQ.exe File opened for modification C:\windows\HLY.exe WSVPQSG.exe File created C:\windows\system\VFKHHZ.exe BRFX.exe File created C:\windows\system\NWNAI.exe.bat JEMY.exe File created C:\windows\WQD.exe ASDJV.exe File created C:\windows\OME.exe PWLU.exe File opened for modification C:\windows\QGPF.exe BAJQMCL.exe File opened for modification C:\windows\ZJRXQKE.exe LMR.exe File created C:\windows\system\NGEABL.exe GQDJUPL.exe File created C:\windows\BAJQMCL.exe VFKHHZ.exe File created C:\windows\system\WXME.exe RMC.exe File opened for modification C:\windows\system\SKYIZKU.exe ZJRXQKE.exe File created C:\windows\OME.exe.bat PWLU.exe File created C:\windows\GKB.exe FXIYMLD.exe File created C:\windows\XYP.exe.bat PTXIJLV.exe File created C:\windows\NGIY.exe EYG.exe File opened for modification C:\windows\system\KZBSJ.exe EZT.exe File created C:\windows\QGPF.exe BAJQMCL.exe File created C:\windows\system\RKS.exe.bat GSPCCDY.exe File opened for modification C:\windows\system\TJM.exe EGCEP.exe File created C:\windows\CMWVUNK.exe.bat WMPHDTJ.exe File created C:\windows\system\ETHVM.exe WGDPC.exe File created C:\windows\system\VVE.exe VVPTYZ.exe File created C:\windows\ZJRXQKE.exe.bat LMR.exe File opened for modification C:\windows\system\ASDJV.exe LXUFKVO.exe File created C:\windows\JMOWTZD.exe.bat URWS.exe File created C:\windows\system\RKS.exe GSPCCDY.exe File created C:\windows\JEMY.exe VTDZIM.exe File created C:\windows\system\ZQYXRP.exe.bat HNUB.exe File opened for modification C:\windows\system\CPV.exe NZUCP.exe File created C:\windows\LUV.exe.bat BWH.exe File created C:\windows\system\XUGC.exe OME.exe File created C:\windows\HLY.exe WSVPQSG.exe File created C:\windows\system\AALZM.exe.bat WXME.exe File created C:\windows\GSQXY.exe.bat JNYIIGG.exe File opened for modification C:\windows\system\FBV.exe PGMOQ.exe File created C:\windows\XYP.exe PTXIJLV.exe File opened for modification C:\windows\system\DKM.exe XJEAYG.exe File opened for modification C:\windows\system\IJXHRHP.exe CJPUANN.exe File created C:\windows\system\VFKHHZ.exe.bat BRFX.exe File created C:\windows\OVQO.exe NSMLOXQ.exe File created C:\windows\system\NWNAI.exe JEMY.exe File opened for modification C:\windows\system\NGEABL.exe GQDJUPL.exe File opened for modification C:\windows\system\XRY.exe XYP.exe File created C:\windows\system\DKM.exe.bat XJEAYG.exe File created C:\windows\VTG.exe.bat JLAUPH.exe File created C:\windows\system\QPP.exe IJXHRHP.exe File created C:\windows\XTN.exe TLGMD.exe File created C:\windows\HNUB.exe.bat GSQXY.exe File created C:\windows\system\FBV.exe.bat PGMOQ.exe File created C:\windows\system\LXUFKVO.exe HHFXY.exe File opened for modification C:\windows\system\ZMR.exe RHFK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1276 cmd.exe 2100 cmd.exe 4968 cmd.exe 1196 cmd.exe 8 cmd.exe 1096 cmd.exe 4148 cmd.exe 3284 cmd.exe 4760 cmd.exe 6292 cmd.exe 4916 cmd.exe 4828 cmd.exe 956 cmd.exe 3040 cmd.exe 5616 cmd.exe 2548 cmd.exe 6976 cmd.exe 4392 cmd.exe 2268 cmd.exe 5988 cmd.exe 3724 cmd.exe 3120 cmd.exe 6472 cmd.exe 4560 cmd.exe 3628 cmd.exe 1552 cmd.exe 6220 cmd.exe 2584 cmd.exe 1668 cmd.exe 4380 cmd.exe 592 cmd.exe 4500 cmd.exe 6948 cmd.exe 2340 cmd.exe 3356 cmd.exe 6684 cmd.exe 968 cmd.exe 6816 cmd.exe 4496 cmd.exe 3720 cmd.exe 1204 cmd.exe 1376 cmd.exe 6468 cmd.exe 5156 cmd.exe 3404 cmd.exe 2656 cmd.exe 4932 cmd.exe 3864 cmd.exe 908 cmd.exe 1432 cmd.exe 940 cmd.exe 1208 cmd.exe 6244 cmd.exe 2276 cmd.exe 2696 cmd.exe 3308 cmd.exe 4264 cmd.exe 6592 cmd.exe 7056 cmd.exe 6636 cmd.exe 2908 cmd.exe 4200 cmd.exe 1364 cmd.exe 5820 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5116 4308 WerFault.exe 88 5512 1948 WerFault.exe 94 3116 4996 WerFault.exe 100 6836 5476 WerFault.exe 105 5916 4632 WerFault.exe 110 3340 2556 WerFault.exe 115 3300 5784 WerFault.exe 120 6872 4288 WerFault.exe 125 712 252 WerFault.exe 130 4128 4336 WerFault.exe 135 6964 5108 WerFault.exe 140 3548 2724 WerFault.exe 145 1144 6848 WerFault.exe 150 6656 716 WerFault.exe 155 6776 4192 WerFault.exe 160 5348 2384 WerFault.exe 165 5548 6516 WerFault.exe 170 6728 4240 WerFault.exe 175 4668 464 WerFault.exe 180 2872 4776 WerFault.exe 185 1268 3164 WerFault.exe 190 6568 6436 WerFault.exe 195 2516 3340 WerFault.exe 200 264 6452 WerFault.exe 205 4248 6872 WerFault.exe 210 4172 1132 WerFault.exe 215 6520 1880 WerFault.exe 220 692 5132 WerFault.exe 225 2436 6392 WerFault.exe 230 1292 3740 WerFault.exe 235 6528 4792 WerFault.exe 240 1224 5228 WerFault.exe 245 4556 5112 WerFault.exe 250 2696 6608 WerFault.exe 255 4820 4256 WerFault.exe 261 5732 7148 WerFault.exe 266 3128 2348 WerFault.exe 271 6736 1232 WerFault.exe 276 4124 5124 WerFault.exe 281 112 2616 WerFault.exe 286 4228 5040 WerFault.exe 291 4292 5840 WerFault.exe 296 4844 1980 WerFault.exe 301 6304 6644 WerFault.exe 306 6532 6536 WerFault.exe 311 2068 1360 WerFault.exe 316 3200 3156 WerFault.exe 321 2936 4080 WerFault.exe 326 6512 6000 WerFault.exe 331 3492 6012 WerFault.exe 336 3720 6880 WerFault.exe 341 5604 3396 WerFault.exe 346 6736 4460 WerFault.exe 351 1000 3016 WerFault.exe 356 3300 5600 WerFault.exe 361 468 4360 WerFault.exe 366 4444 5760 WerFault.exe 371 2592 6852 WerFault.exe 376 2448 7104 WerFault.exe 381 6128 1064 WerFault.exe 386 6468 4856 WerFault.exe 391 3256 1744 WerFault.exe 396 2468 5928 WerFault.exe 401 2160 1656 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJRXQKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASDJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNYIIGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOKSNRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTFIDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCDWFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JBLULE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZJSOP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKYIZKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETHVM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BWH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGCEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTXIJLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTDZIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKBUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHFXY.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4308 2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe 4308 2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe 1948 KKBAA.exe 1948 KKBAA.exe 4996 JNASNA.exe 4996 JNASNA.exe 5476 TLGMD.exe 5476 TLGMD.exe 4632 XTN.exe 4632 XTN.exe 2556 KZVYRN.exe 2556 KZVYRN.exe 5784 XCDWFQ.exe 5784 XCDWFQ.exe 4288 NSE.exe 4288 NSE.exe 252 ACN.exe 252 ACN.exe 4336 MKBUE.exe 4336 MKBUE.exe 5108 VTDZIM.exe 5108 VTDZIM.exe 2724 JEMY.exe 2724 JEMY.exe 6848 NWNAI.exe 6848 NWNAI.exe 716 RMC.exe 716 RMC.exe 4192 WXME.exe 4192 WXME.exe 2384 AALZM.exe 2384 AALZM.exe 6516 WGDPC.exe 6516 WGDPC.exe 4240 ETHVM.exe 4240 ETHVM.exe 464 NZUCP.exe 464 NZUCP.exe 4776 CPV.exe 4776 CPV.exe 3164 ENBWL.exe 3164 ENBWL.exe 6436 VVPTYZ.exe 6436 VVPTYZ.exe 3340 VVE.exe 3340 VVE.exe 6452 LGGGL.exe 6452 LGGGL.exe 6872 BWH.exe 6872 BWH.exe 1132 LUV.exe 1132 LUV.exe 1880 JNYIIGG.exe 1880 JNYIIGG.exe 5132 GSQXY.exe 5132 GSQXY.exe 6392 HNUB.exe 6392 HNUB.exe 3740 ZQYXRP.exe 3740 ZQYXRP.exe 4792 HWCLBO.exe 4792 HWCLBO.exe 5228 LMR.exe 5228 LMR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4308 2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe 4308 2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe 1948 KKBAA.exe 1948 KKBAA.exe 4996 JNASNA.exe 4996 JNASNA.exe 5476 TLGMD.exe 5476 TLGMD.exe 4632 XTN.exe 4632 XTN.exe 2556 KZVYRN.exe 2556 KZVYRN.exe 5784 XCDWFQ.exe 5784 XCDWFQ.exe 4288 NSE.exe 4288 NSE.exe 252 ACN.exe 252 ACN.exe 4336 MKBUE.exe 4336 MKBUE.exe 5108 VTDZIM.exe 5108 VTDZIM.exe 2724 JEMY.exe 2724 JEMY.exe 6848 NWNAI.exe 6848 NWNAI.exe 716 RMC.exe 716 RMC.exe 4192 WXME.exe 4192 WXME.exe 2384 AALZM.exe 2384 AALZM.exe 6516 WGDPC.exe 6516 WGDPC.exe 4240 ETHVM.exe 4240 ETHVM.exe 464 NZUCP.exe 464 NZUCP.exe 4776 CPV.exe 4776 CPV.exe 3164 ENBWL.exe 3164 ENBWL.exe 6436 VVPTYZ.exe 6436 VVPTYZ.exe 3340 VVE.exe 3340 VVE.exe 6452 LGGGL.exe 6452 LGGGL.exe 6872 BWH.exe 6872 BWH.exe 1132 LUV.exe 1132 LUV.exe 1880 JNYIIGG.exe 1880 JNYIIGG.exe 5132 GSQXY.exe 5132 GSQXY.exe 6392 HNUB.exe 6392 HNUB.exe 3740 ZQYXRP.exe 3740 ZQYXRP.exe 4792 HWCLBO.exe 4792 HWCLBO.exe 5228 LMR.exe 5228 LMR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4308 wrote to memory of 4264 4308 2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe 90 PID 4264 wrote to memory of 1948 4264 cmd.exe 94 PID 1948 wrote to memory of 6832 1948 KKBAA.exe 96 PID 6832 wrote to memory of 4996 6832 cmd.exe 100 PID 4996 wrote to memory of 1100 4996 JNASNA.exe 101 PID 1100 wrote to memory of 5476 1100 cmd.exe 105 PID 5476 wrote to memory of 1548 5476 TLGMD.exe 106 PID 1548 wrote to memory of 4632 1548 cmd.exe 110 PID 4632 wrote to memory of 2848 4632 XTN.exe 111 PID 2848 wrote to memory of 2556 2848 cmd.exe 115 PID 2556 wrote to memory of 5504 2556 KZVYRN.exe 116 PID 5504 wrote to memory of 5784 5504 cmd.exe 120 PID 5784 wrote to memory of 4912 5784 XCDWFQ.exe 121 PID 4912 wrote to memory of 4288 4912 cmd.exe 125 PID 4288 wrote to memory of 5680 4288 NSE.exe 126 PID 5680 wrote to memory of 252 5680 cmd.exe 130 PID 252 wrote to memory of 6388 252 ACN.exe 131 PID 6388 wrote to memory of 4336 6388 cmd.exe 135 PID 4336 wrote to memory of 1896 4336 MKBUE.exe 136 PID 1896 wrote to memory of 5108 1896 cmd.exe 140 PID 5108 wrote to memory of 2908 5108 VTDZIM.exe 141 PID 2908 wrote to memory of 2724 2908 cmd.exe 145 PID 2724 wrote to memory of 2584 2724 JEMY.exe 146 PID 2584 wrote to memory of 6848 2584 cmd.exe 150 PID 6848 wrote to memory of 6684 6848 NWNAI.exe 151 PID 6684 wrote to memory of 716 6684 cmd.exe 155 PID 716 wrote to memory of 4932 716 RMC.exe 156 PID 4932 wrote to memory of 4192 4932 cmd.exe 160 PID 4192 wrote to memory of 3048 4192 WXME.exe 161 PID 3048 wrote to memory of 2384 3048 cmd.exe 165 PID 2384 wrote to memory of 5964 2384 AALZM.exe 166 PID 5964 wrote to memory of 6516 5964 cmd.exe 170 PID 6516 wrote to memory of 4388 6516 WGDPC.exe 171 PID 4388 wrote to memory of 4240 4388 cmd.exe 175 PID 4240 wrote to memory of 6232 4240 ETHVM.exe 176 PID 6232 wrote to memory of 464 6232 cmd.exe 180 PID 464 wrote to memory of 4200 464 NZUCP.exe 181 PID 4200 wrote to memory of 4776 4200 cmd.exe 185 PID 4776 wrote to memory of 7136 4776 CPV.exe 186 PID 7136 wrote to memory of 3164 7136 cmd.exe 190 PID 3164 wrote to memory of 4760 3164 ENBWL.exe 191 PID 4760 wrote to memory of 6436 4760 cmd.exe 195 PID 6436 wrote to memory of 1276 6436 VVPTYZ.exe 196 PID 1276 wrote to memory of 3340 1276 cmd.exe 200 PID 3340 wrote to memory of 4560 3340 VVE.exe 201 PID 4560 wrote to memory of 6452 4560 cmd.exe 205 PID 6452 wrote to memory of 52 6452 LGGGL.exe 206 PID 52 wrote to memory of 6872 52 cmd.exe 210 PID 6872 wrote to memory of 2788 6872 BWH.exe 211 PID 2788 wrote to memory of 1132 2788 cmd.exe 215 PID 1132 wrote to memory of 1760 1132 LUV.exe 216 PID 1760 wrote to memory of 1880 1760 cmd.exe 220 PID 1880 wrote to memory of 7112 1880 JNYIIGG.exe 221 PID 7112 wrote to memory of 5132 7112 cmd.exe 225 PID 5132 wrote to memory of 4348 5132 GSQXY.exe 226 PID 4348 wrote to memory of 6392 4348 cmd.exe 230 PID 6392 wrote to memory of 1104 6392 HNUB.exe 231 PID 1104 wrote to memory of 3740 1104 cmd.exe 235 PID 3740 wrote to memory of 6428 3740 ZQYXRP.exe 236 PID 6428 wrote to memory of 4792 6428 cmd.exe 240 PID 4792 wrote to memory of 5560 4792 HWCLBO.exe 241 PID 5560 wrote to memory of 5228 5560 cmd.exe 245 PID 5228 wrote to memory of 1668 5228 LMR.exe 246 PID 1668 wrote to memory of 5112 1668 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_e74214781479be54112c3272c0abac69_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKBAA.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\windows\system\KKBAA.exeC:\windows\system\KKBAA.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JNASNA.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:6832 -
C:\windows\system\JNASNA.exeC:\windows\system\JNASNA.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TLGMD.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\TLGMD.exeC:\windows\TLGMD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\XTN.exeC:\windows\XTN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZVYRN.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\windows\SysWOW64\KZVYRN.exeC:\windows\system32\KZVYRN.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCDWFQ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\windows\system\XCDWFQ.exeC:\windows\system\XCDWFQ.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSE.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\windows\system\NSE.exeC:\windows\system\NSE.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACN.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\windows\ACN.exeC:\windows\ACN.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKBUE.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:6388 -
C:\windows\system\MKBUE.exeC:\windows\system\MKBUE.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTDZIM.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\windows\VTDZIM.exeC:\windows\VTDZIM.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JEMY.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\JEMY.exeC:\windows\JEMY.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWNAI.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\system\NWNAI.exeC:\windows\system\NWNAI.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMC.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6684 -
C:\windows\SysWOW64\RMC.exeC:\windows\system32\RMC.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXME.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\windows\system\WXME.exeC:\windows\system\WXME.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AALZM.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\system\AALZM.exeC:\windows\system\AALZM.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WGDPC.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\WGDPC.exeC:\windows\WGDPC.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ETHVM.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\windows\system\ETHVM.exeC:\windows\system\ETHVM.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NZUCP.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6232 -
C:\windows\NZUCP.exeC:\windows\NZUCP.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPV.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\windows\system\CPV.exeC:\windows\system\CPV.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ENBWL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:7136 -
C:\windows\system\ENBWL.exeC:\windows\system\ENBWL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVPTYZ.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\windows\SysWOW64\VVPTYZ.exeC:\windows\system32\VVPTYZ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVE.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\windows\system\VVE.exeC:\windows\system\VVE.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LGGGL.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\system\LGGGL.exeC:\windows\system\LGGGL.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BWH.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:52 -
C:\windows\system\BWH.exeC:\windows\system\BWH.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUV.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\windows\LUV.exeC:\windows\LUV.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JNYIIGG.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\windows\system\JNYIIGG.exeC:\windows\system\JNYIIGG.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSQXY.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7112 -
C:\windows\GSQXY.exeC:\windows\GSQXY.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNUB.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\HNUB.exeC:\windows\HNUB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZQYXRP.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\system\ZQYXRP.exeC:\windows\system\ZQYXRP.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWCLBO.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:6428 -
C:\windows\SysWOW64\HWCLBO.exeC:\windows\system32\HWCLBO.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJRXQKE.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\windows\ZJRXQKE.exeC:\windows\ZJRXQKE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKYIZKU.exe.bat" "66⤵PID:6960
-
C:\windows\system\SKYIZKU.exeC:\windows\system\SKYIZKU.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAMCOT.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1952 -
C:\windows\system\CAMCOT.exeC:\windows\system\CAMCOT.exe69⤵
- Executes dropped EXE
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGMOQ.exe.bat" "70⤵
- Executes a command shell one-liner
PID:6816 -
C:\windows\system\PGMOQ.exeC:\windows\system\PGMOQ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:7148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBV.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:6928 -
C:\windows\system\FBV.exeC:\windows\system\FBV.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URWS.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1364 -
C:\windows\SysWOW64\URWS.exeC:\windows\system32\URWS.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMOWTZD.exe.bat" "76⤵PID:5860
-
C:\windows\JMOWTZD.exeC:\windows\JMOWTZD.exe77⤵
- Executes dropped EXE
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HHFXY.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:3188 -
C:\windows\HHFXY.exeC:\windows\HHFXY.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXUFKVO.exe.bat" "80⤵PID:6844
-
C:\windows\system\LXUFKVO.exeC:\windows\system\LXUFKVO.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASDJV.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:6276 -
C:\windows\system\ASDJV.exeC:\windows\system\ASDJV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQD.exe.bat" "84⤵PID:6760
-
C:\windows\WQD.exeC:\windows\WQD.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBLULE.exe.bat" "86⤵PID:6968
-
C:\windows\system\JBLULE.exeC:\windows\system\JBLULE.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWLU.exe.bat" "88⤵PID:3288
-
C:\windows\PWLU.exeC:\windows\PWLU.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OME.exe.bat" "90⤵PID:5188
-
C:\windows\OME.exeC:\windows\OME.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5156 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHLMYJ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:6292 -
C:\windows\system\RHLMYJ.exeC:\windows\system\RHLMYJ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXMD.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4328 -
C:\windows\SysWOW64\HXMD.exeC:\windows\system32\HXMD.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSVPQSG.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2060 -
C:\windows\SysWOW64\WSVPQSG.exeC:\windows\system32\WSVPQSG.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLY.exe.bat" "100⤵PID:3332
-
C:\windows\HLY.exeC:\windows\HLY.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LTFIDR.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4380 -
C:\windows\SysWOW64\LTFIDR.exeC:\windows\system32\LTFIDR.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "104⤵PID:4552
-
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHFK.exe.bat" "106⤵PID:6920
-
C:\windows\SysWOW64\RHFK.exeC:\windows\system32\RHFK.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMR.exe.bat" "108⤵
- Executes a command shell one-liner
PID:592 -
C:\windows\system\ZMR.exeC:\windows\system\ZMR.exe109⤵
- Executes dropped EXE
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVTW.exe.bat" "110⤵PID:3344
-
C:\windows\QVTW.exeC:\windows\QVTW.exe111⤵
- Executes dropped EXE
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GQDJUPL.exe.bat" "112⤵PID:3732
-
C:\windows\GQDJUPL.exeC:\windows\GQDJUPL.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NGEABL.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:6432 -
C:\windows\system\NGEABL.exeC:\windows\system\NGEABL.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJH.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6976 -
C:\windows\SysWOW64\OJH.exeC:\windows\system32\OJH.exe117⤵
- Executes dropped EXE
PID:7104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DERIZ.exe.bat" "118⤵PID:3168
-
C:\windows\system\DERIZ.exeC:\windows\system\DERIZ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUSH.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2100 -
C:\windows\SysWOW64\SUSH.exeC:\windows\system32\SUSH.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-