Analysis
- max time kernel
84s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 01:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe
- Size 208KB
- Sample260720-bvr69sdz8w
- SHA256 67688f1ab409fe04d5645e32bddf6168fc41a9ecbf6b81808e5c0237e8e0d264
- MD5 59cbc33c4c665ea3ddf2a91e7e13a89e
- SHA1 9c57632910d7655c40ce45016c91d5427aee17d4
- SHA512 d0e2b762ba93fcc263b8e6c43716898b9cca8acda3e57815d8ea70c17e9bd44ebe7702a935613c2fe676f73d4409e9305de0559209dea50bd51b00d4d944117d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfw4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOIQEj6
- TLSH T127247D2235D2C073E4B7023188F6C7787BB6BD919B36928B7BC03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1076 EHMJZYC.exe 552 CSVFLZY.exe 5624 KYUMX.exe 3012 IIXU.exe 3828 SGLP.exe 1648 SUDD.exe 4676 IPVHIFV.exe 5508 ISYL.exe 2708 IXRAP.exe 2752 HNK.exe 1304 QVMINTJ.exe 3328 TJR.exe 4356 NWNAI.exe 6048 GZZWNIW.exe 3216 TKIVBLS.exe 3836 ZXH.exe 4760 AALZM.exe 5716 YYWCZ.exe 4556 TLBMJRF.exe 5724 IBCD.exe 4316 WMS.exe 1848 WSKQ.exe 5016 CSSE.exe 3840 CNE.exe 4644 ANDNLP.exe 3760 DJIFNPT.exe 2052 XWNO.exe 2384 XBNDZ.exe 1768 SPSMJTZ.exe 5340 HSBQU.exe 2848 INFUHE.exe 5900 IAFBJRE.exe 1464 RGQTZ.exe 5368 ZTIHAS.exe 2876 FUQ.exe 5084 FZQJ.exe 108 ZMVTV.exe 3156 DDB.exe 5668 JVJOQ.exe 5904 UNMH.exe 1956 PJRRJB.exe 1520 KWWAL.exe 4740 EJSJVBK.exe 5832 HXX.exe 3080 FXFH.exe 4104 ZSKQZD.exe 5908 FGJ.exe 5600 WTTR.exe 3008 WYTFV.exe 3932 OME.exe 1252 MHD.exe 2320 DUOQXM.exe 5024 JIFRCHK.exe 2720 BLRVHF.exe 4852 PVZL.exe 6116 JJEVGH.exe 4688 MWJEIHL.exe 2132 GJNV.exe 5632 ZMR.exe 4112 FNZ.exe 5864 AAEOZ.exe 4732 UVIYBZN.exe 2896 CBBML.exe 5704 XOFWNM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\QVMINTJ.exe.bat HNK.exe File created C:\windows\SysWOW64\FUQ.exe ZTIHAS.exe File opened for modification C:\windows\SysWOW64\AAEOZ.exe FNZ.exe File created C:\windows\SysWOW64\PSHHLX.exe.bat FVTMDOG.exe File created C:\windows\SysWOW64\HKZEZ.exe RUYE.exe File opened for modification C:\windows\SysWOW64\CSVFLZY.exe EHMJZYC.exe File created C:\windows\SysWOW64\SUDD.exe SGLP.exe File opened for modification C:\windows\SysWOW64\DUOQXM.exe MHD.exe File created C:\windows\SysWOW64\KVJNNTV.exe.bat IXETF.exe File created C:\windows\SysWOW64\MVBE.exe USXIUCW.exe File created C:\windows\SysWOW64\CNE.exe.bat CSSE.exe File created C:\windows\SysWOW64\ZALV.exe.bat RUT.exe File opened for modification C:\windows\SysWOW64\MVBE.exe USXIUCW.exe File opened for modification C:\windows\SysWOW64\RUYE.exe XHTVICE.exe File opened for modification C:\windows\SysWOW64\IXETF.exe ARDFWYJ.exe File created C:\windows\SysWOW64\ANDNLP.exe CNE.exe File created C:\windows\SysWOW64\FUQ.exe.bat ZTIHAS.exe File created C:\windows\SysWOW64\DONJEGG.exe.bat XOFWNM.exe File created C:\windows\SysWOW64\AYNELF.exe OGSLD.exe File created C:\windows\SysWOW64\IAZP.exe AMZ.exe File created C:\windows\SysWOW64\PJRRJB.exe UNMH.exe File created C:\windows\SysWOW64\PPUEVDP.exe EWRMN.exe File created C:\windows\SysWOW64\PVZL.exe BLRVHF.exe File created C:\windows\SysWOW64\CSVFLZY.exe.bat EHMJZYC.exe File created C:\windows\SysWOW64\GZZWNIW.exe.bat NWNAI.exe File opened for modification C:\windows\SysWOW64\IAZP.exe AMZ.exe File created C:\windows\SysWOW64\TWW.exe UJXBW.exe File opened for modification C:\windows\SysWOW64\TWW.exe UJXBW.exe File opened for modification C:\windows\SysWOW64\WURHA.exe XCORRD.exe File opened for modification C:\windows\SysWOW64\QVMINTJ.exe HNK.exe File created C:\windows\SysWOW64\IAFBJRE.exe INFUHE.exe File opened for modification C:\windows\SysWOW64\IAFBJRE.exe INFUHE.exe File opened for modification C:\windows\SysWOW64\PJRRJB.exe UNMH.exe File opened for modification C:\windows\SysWOW64\ZALV.exe RUT.exe File created C:\windows\SysWOW64\WURHA.exe.bat XCORRD.exe File created C:\windows\SysWOW64\KVJNNTV.exe IXETF.exe File created C:\windows\SysWOW64\MVBE.exe.bat USXIUCW.exe File created C:\windows\SysWOW64\ISYL.exe IPVHIFV.exe File created C:\windows\SysWOW64\IBCD.exe.bat TLBMJRF.exe File opened for modification C:\windows\SysWOW64\INFUHE.exe HSBQU.exe File created C:\windows\SysWOW64\WYTFV.exe WTTR.exe File created C:\windows\SysWOW64\DUOQXM.exe.bat MHD.exe File opened for modification C:\windows\SysWOW64\RUT.exe DONJEGG.exe File created C:\windows\SysWOW64\BUSK.exe.bat UDRKCFN.exe File created C:\windows\SysWOW64\CSVFLZY.exe EHMJZYC.exe File created C:\windows\SysWOW64\KWWAL.exe.bat PJRRJB.exe File created C:\windows\SysWOW64\EJSJVBK.exe KWWAL.exe File created C:\windows\SysWOW64\WYTFV.exe.bat WTTR.exe File opened for modification C:\windows\SysWOW64\PVZL.exe BLRVHF.exe File created C:\windows\SysWOW64\TWW.exe.bat UJXBW.exe File created C:\windows\SysWOW64\INFUHE.exe HSBQU.exe File created C:\windows\SysWOW64\CMR.exe AYNELF.exe File created C:\windows\SysWOW64\WURHA.exe XCORRD.exe File created C:\windows\SysWOW64\OIMMQAS.exe.bat ZNCZ.exe File created C:\windows\SysWOW64\SUDD.exe.bat SGLP.exe File created C:\windows\SysWOW64\GZZWNIW.exe NWNAI.exe File opened for modification C:\windows\SysWOW64\IBCD.exe TLBMJRF.exe File created C:\windows\SysWOW64\ZSKQZD.exe.bat FXFH.exe File created C:\windows\SysWOW64\AYNELF.exe.bat OGSLD.exe File opened for modification C:\windows\SysWOW64\HKZEZ.exe RUYE.exe File created C:\windows\SysWOW64\HKZEZ.exe.bat RUYE.exe File opened for modification C:\windows\SysWOW64\KWWAL.exe PJRRJB.exe File created C:\windows\SysWOW64\IAFBJRE.exe.bat INFUHE.exe File created C:\windows\SysWOW64\BUSK.exe UDRKCFN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\GIW.exe VPBSEFZ.exe File created C:\windows\system\VCIO.exe.bat IAZP.exe File created C:\windows\XBNDZ.exe.bat XWNO.exe File created C:\windows\system\UDRKCFN.exe.bat YBBMOUR.exe File created C:\windows\system\KZURGQ.exe WOM.exe File created C:\windows\system\SPSMJTZ.exe XBNDZ.exe File created C:\windows\VPBSEFZ.exe.bat PPUEVDP.exe File created C:\windows\FTHTVBC.exe.bat GIW.exe File opened for modification C:\windows\system\ZXH.exe TKIVBLS.exe File created C:\windows\system\ZXH.exe.bat TKIVBLS.exe File opened for modification C:\windows\system\HXX.exe EJSJVBK.exe File created C:\windows\QYNXEW.exe VCIO.exe File created C:\windows\system\FVTMDOG.exe.bat WURHA.exe File created C:\windows\system\ARDFWYJ.exe BUSK.exe File created C:\windows\HJGNKR.exe MVBE.exe File opened for modification C:\windows\HJGNKR.exe MVBE.exe File opened for modification C:\windows\system\EHMJZYC.exe 2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe File created C:\windows\system\AALZM.exe.bat ZXH.exe File created C:\windows\ZTIHAS.exe.bat RGQTZ.exe File created C:\windows\FXFH.exe HXX.exe File opened for modification C:\windows\FGJ.exe ZSKQZD.exe File opened for modification C:\windows\BLRVHF.exe JIFRCHK.exe File opened for modification C:\windows\system\XOFWNM.exe CBBML.exe File created C:\windows\system\PWHTAWF.exe.bat EDMASP.exe File created C:\windows\KYUMX.exe.bat CSVFLZY.exe File created C:\windows\YYWCZ.exe AALZM.exe File opened for modification C:\windows\XWNO.exe DJIFNPT.exe File opened for modification C:\windows\HSBQU.exe SPSMJTZ.exe File created C:\windows\HSBQU.exe.bat SPSMJTZ.exe File created C:\windows\system\RGQTZ.exe.bat IAFBJRE.exe File created C:\windows\JIFRCHK.exe.bat DUOQXM.exe File opened for modification C:\windows\MWJEIHL.exe JJEVGH.exe File created C:\windows\system\EHMJZYC.exe 2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe File created C:\windows\CSSE.exe WSKQ.exe File created C:\windows\MWJEIHL.exe JJEVGH.exe File created C:\windows\FNZ.exe ZMR.exe File created C:\windows\system\EWRMN.exe.bat JJMC.exe File opened for modification C:\windows\VPBSEFZ.exe PPUEVDP.exe File created C:\windows\HJGNKR.exe.bat MVBE.exe File opened for modification C:\windows\system\DJIFNPT.exe ANDNLP.exe File created C:\windows\system\GJNV.exe.bat MWJEIHL.exe File created C:\windows\system\ZMR.exe.bat GJNV.exe File opened for modification C:\windows\CBBML.exe UVIYBZN.exe File created C:\windows\EDMASP.exe.bat OIV.exe File created C:\windows\WOM.exe.bat OIMMQAS.exe File created C:\windows\YYWCZ.exe.bat AALZM.exe File opened for modification C:\windows\system\TLBMJRF.exe YYWCZ.exe File opened for modification C:\windows\JJEVGH.exe PVZL.exe File opened for modification C:\windows\system\PWHTAWF.exe EDMASP.exe File created C:\windows\GIW.exe.bat VPBSEFZ.exe File created C:\windows\system\AMZ.exe.bat CMR.exe File opened for modification C:\windows\system\AMZ.exe CMR.exe File opened for modification C:\windows\system\UDRKCFN.exe YBBMOUR.exe File created C:\windows\WOM.exe OIMMQAS.exe File created C:\windows\IIXU.exe KYUMX.exe File created C:\windows\system\WSKQ.exe WMS.exe File created C:\windows\system\WSKQ.exe.bat WMS.exe File created C:\windows\XWNO.exe.bat DJIFNPT.exe File created C:\windows\CBBML.exe UVIYBZN.exe File created C:\windows\system\OVDZYPM.exe ZALV.exe File opened for modification C:\windows\system\OIV.exe OVDZYPM.exe File created C:\windows\system\EWRMN.exe JJMC.exe File created C:\windows\system\TKIVBLS.exe.bat GZZWNIW.exe File opened for modification C:\windows\YYWCZ.exe AALZM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4172 cmd.exe 3908 cmd.exe 4540 cmd.exe 1300 cmd.exe 3968 cmd.exe 1484 cmd.exe 3376 cmd.exe 1320 cmd.exe 4888 cmd.exe 5268 cmd.exe 2620 cmd.exe 3348 cmd.exe 2036 cmd.exe 4092 cmd.exe 352 cmd.exe 3960 cmd.exe 4444 cmd.exe 420 cmd.exe 3616 cmd.exe 968 cmd.exe 2716 cmd.exe 5192 cmd.exe 1824 cmd.exe 5744 cmd.exe 260 cmd.exe 1928 cmd.exe 4272 cmd.exe 2492 cmd.exe 2916 cmd.exe 6000 cmd.exe 4224 cmd.exe 2552 cmd.exe 4416 cmd.exe 4544 cmd.exe 1712 cmd.exe 1580 cmd.exe 1664 cmd.exe 4872 cmd.exe 2672 cmd.exe 940 cmd.exe 4612 cmd.exe 252 cmd.exe 5848 cmd.exe 5712 cmd.exe 720 cmd.exe 2352 cmd.exe 2840 cmd.exe 5344 cmd.exe 2000 cmd.exe 4788 cmd.exe 708 cmd.exe 1720 cmd.exe 5792 cmd.exe 3716 cmd.exe 2660 cmd.exe 1172 cmd.exe 4648 cmd.exe 3400 cmd.exe 2432 cmd.exe 1788 cmd.exe 4588 cmd.exe 696 cmd.exe 4796 cmd.exe 5920 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5124 2480 WerFault.exe 88 2828 1076 WerFault.exe 93 4904 552 WerFault.exe 99 240 5624 WerFault.exe 104 5668 3012 WerFault.exe 109 3408 3828 WerFault.exe 114 6084 1648 WerFault.exe 119 4556 4676 WerFault.exe 124 4252 5508 WerFault.exe 129 4472 2708 WerFault.exe 134 564 2752 WerFault.exe 139 3348 1304 WerFault.exe 144 1976 3328 WerFault.exe 149 708 4356 WerFault.exe 154 3940 6048 WerFault.exe 159 1204 3216 WerFault.exe 164 3244 3836 WerFault.exe 169 1888 4760 WerFault.exe 174 3444 5716 WerFault.exe 179 2168 4556 WerFault.exe 184 3960 5724 WerFault.exe 189 564 4316 WerFault.exe 194 4228 1848 WerFault.exe 199 5124 5016 WerFault.exe 204 4396 3840 WerFault.exe 209 4440 4644 WerFault.exe 214 2148 3760 WerFault.exe 219 2944 2052 WerFault.exe 224 5684 2384 WerFault.exe 229 4408 1768 WerFault.exe 234 2008 5340 WerFault.exe 239 3400 2848 WerFault.exe 244 720 5900 WerFault.exe 249 3804 1464 WerFault.exe 254 1976 5368 WerFault.exe 259 2900 2876 WerFault.exe 264 3148 5084 WerFault.exe 269 1684 108 WerFault.exe 274 2564 3156 WerFault.exe 279 1300 5668 WerFault.exe 285 4408 5904 WerFault.exe 290 3664 1956 WerFault.exe 295 5024 1520 WerFault.exe 300 3824 4740 WerFault.exe 305 4576 5832 WerFault.exe 310 1324 3080 WerFault.exe 315 4960 4104 WerFault.exe 320 2816 5908 WerFault.exe 325 1892 5600 WerFault.exe 330 1560 3008 WerFault.exe 335 2436 3932 WerFault.exe 340 2008 1252 WerFault.exe 345 5928 2320 WerFault.exe 350 4992 5024 WerFault.exe 355 4216 2720 WerFault.exe 360 4516 4852 WerFault.exe 365 3124 6116 WerFault.exe 370 5696 4688 WerFault.exe 375 1084 2132 WerFault.exe 380 3368 5632 WerFault.exe 385 2704 4112 WerFault.exe 390 5344 5864 WerFault.exe 395 4340 4732 WerFault.exe 400 3560 2896 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLRVHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBBML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVIYBZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKZEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYUMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPSMJTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGSLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBNDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVDZYPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DONJEGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYWCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDMASP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVTMDOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPVHIFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLBMJRF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWWAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2480 2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe 2480 2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe 1076 EHMJZYC.exe 1076 EHMJZYC.exe 552 CSVFLZY.exe 552 CSVFLZY.exe 5624 KYUMX.exe 5624 KYUMX.exe 3012 IIXU.exe 3012 IIXU.exe 3828 SGLP.exe 3828 SGLP.exe 1648 SUDD.exe 1648 SUDD.exe 4676 IPVHIFV.exe 4676 IPVHIFV.exe 5508 ISYL.exe 5508 ISYL.exe 2708 IXRAP.exe 2708 IXRAP.exe 2752 HNK.exe 2752 HNK.exe 1304 QVMINTJ.exe 1304 QVMINTJ.exe 3328 TJR.exe 3328 TJR.exe 4356 NWNAI.exe 4356 NWNAI.exe 6048 GZZWNIW.exe 6048 GZZWNIW.exe 3216 TKIVBLS.exe 3216 TKIVBLS.exe 3836 ZXH.exe 3836 ZXH.exe 4760 AALZM.exe 4760 AALZM.exe 5716 YYWCZ.exe 5716 YYWCZ.exe 4556 TLBMJRF.exe 4556 TLBMJRF.exe 5724 IBCD.exe 5724 IBCD.exe 4316 WMS.exe 4316 WMS.exe 1848 WSKQ.exe 1848 WSKQ.exe 5016 CSSE.exe 5016 CSSE.exe 3840 CNE.exe 3840 CNE.exe 4644 ANDNLP.exe 4644 ANDNLP.exe 3760 DJIFNPT.exe 3760 DJIFNPT.exe 2052 XWNO.exe 2052 XWNO.exe 2384 XBNDZ.exe 2384 XBNDZ.exe 1768 SPSMJTZ.exe 1768 SPSMJTZ.exe 5340 HSBQU.exe 5340 HSBQU.exe 2848 INFUHE.exe 2848 INFUHE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2480 2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe 2480 2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe 1076 EHMJZYC.exe 1076 EHMJZYC.exe 552 CSVFLZY.exe 552 CSVFLZY.exe 5624 KYUMX.exe 5624 KYUMX.exe 3012 IIXU.exe 3012 IIXU.exe 3828 SGLP.exe 3828 SGLP.exe 1648 SUDD.exe 1648 SUDD.exe 4676 IPVHIFV.exe 4676 IPVHIFV.exe 5508 ISYL.exe 5508 ISYL.exe 2708 IXRAP.exe 2708 IXRAP.exe 2752 HNK.exe 2752 HNK.exe 1304 QVMINTJ.exe 1304 QVMINTJ.exe 3328 TJR.exe 3328 TJR.exe 4356 NWNAI.exe 4356 NWNAI.exe 6048 GZZWNIW.exe 6048 GZZWNIW.exe 3216 TKIVBLS.exe 3216 TKIVBLS.exe 3836 ZXH.exe 3836 ZXH.exe 4760 AALZM.exe 4760 AALZM.exe 5716 YYWCZ.exe 5716 YYWCZ.exe 4556 TLBMJRF.exe 4556 TLBMJRF.exe 5724 IBCD.exe 5724 IBCD.exe 4316 WMS.exe 4316 WMS.exe 1848 WSKQ.exe 1848 WSKQ.exe 5016 CSSE.exe 5016 CSSE.exe 3840 CNE.exe 3840 CNE.exe 4644 ANDNLP.exe 4644 ANDNLP.exe 3760 DJIFNPT.exe 3760 DJIFNPT.exe 2052 XWNO.exe 2052 XWNO.exe 2384 XBNDZ.exe 2384 XBNDZ.exe 1768 SPSMJTZ.exe 1768 SPSMJTZ.exe 5340 HSBQU.exe 5340 HSBQU.exe 2848 INFUHE.exe 2848 INFUHE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2480 wrote to memory of 4156 2480 2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe 89 PID 4156 wrote to memory of 1076 4156 cmd.exe 93 PID 1076 wrote to memory of 3916 1076 EHMJZYC.exe 95 PID 3916 wrote to memory of 552 3916 cmd.exe 99 PID 552 wrote to memory of 968 552 CSVFLZY.exe 100 PID 968 wrote to memory of 5624 968 cmd.exe 104 PID 5624 wrote to memory of 4272 5624 KYUMX.exe 105 PID 4272 wrote to memory of 3012 4272 cmd.exe 109 PID 3012 wrote to memory of 1776 3012 IIXU.exe 110 PID 1776 wrote to memory of 3828 1776 cmd.exe 114 PID 3828 wrote to memory of 4416 3828 SGLP.exe 115 PID 4416 wrote to memory of 1648 4416 cmd.exe 119 PID 1648 wrote to memory of 5772 1648 SUDD.exe 120 PID 5772 wrote to memory of 4676 5772 cmd.exe 124 PID 4676 wrote to memory of 1320 4676 IPVHIFV.exe 125 PID 1320 wrote to memory of 5508 1320 cmd.exe 129 PID 5508 wrote to memory of 1576 5508 ISYL.exe 130 PID 1576 wrote to memory of 2708 1576 cmd.exe 134 PID 2708 wrote to memory of 4544 2708 IXRAP.exe 135 PID 4544 wrote to memory of 2752 4544 cmd.exe 139 PID 2752 wrote to memory of 3776 2752 HNK.exe 140 PID 3776 wrote to memory of 1304 3776 cmd.exe 144 PID 1304 wrote to memory of 4888 1304 QVMINTJ.exe 145 PID 3328 wrote to memory of 2660 3328 TJR.exe 150 PID 2660 wrote to memory of 4356 2660 cmd.exe 154 PID 4356 wrote to memory of 2672 4356 NWNAI.exe 155 PID 2672 wrote to memory of 6048 2672 cmd.exe 159 PID 6048 wrote to memory of 5672 6048 GZZWNIW.exe 160 PID 5672 wrote to memory of 3216 5672 cmd.exe 164 PID 3216 wrote to memory of 940 3216 TKIVBLS.exe 165 PID 940 wrote to memory of 3836 940 cmd.exe 169 PID 3836 wrote to memory of 5268 3836 ZXH.exe 170 PID 5268 wrote to memory of 4760 5268 cmd.exe 174 PID 4760 wrote to memory of 5920 4760 AALZM.exe 175 PID 5920 wrote to memory of 5716 5920 cmd.exe 179 PID 5716 wrote to memory of 3364 5716 YYWCZ.exe 180 PID 3364 wrote to memory of 4556 3364 cmd.exe 184 PID 4556 wrote to memory of 1192 4556 TLBMJRF.exe 185 PID 1192 wrote to memory of 5724 1192 cmd.exe 189 PID 5724 wrote to memory of 4696 5724 IBCD.exe 190 PID 4696 wrote to memory of 4316 4696 cmd.exe 194 PID 4316 wrote to memory of 6072 4316 WMS.exe 195 PID 6072 wrote to memory of 1848 6072 cmd.exe 199 PID 1848 wrote to memory of 1680 1848 WSKQ.exe 200 PID 1680 wrote to memory of 5016 1680 cmd.exe 204 PID 5016 wrote to memory of 5092 5016 CSSE.exe 205 PID 5092 wrote to memory of 3840 5092 cmd.exe 209 PID 3840 wrote to memory of 5176 3840 CNE.exe 210 PID 5176 wrote to memory of 4644 5176 cmd.exe 214 PID 4644 wrote to memory of 2716 4644 ANDNLP.exe 215 PID 2716 wrote to memory of 3760 2716 cmd.exe 219 PID 3760 wrote to memory of 5828 3760 DJIFNPT.exe 220 PID 5828 wrote to memory of 2052 5828 cmd.exe 224 PID 2052 wrote to memory of 5560 2052 XWNO.exe 225 PID 5560 wrote to memory of 2384 5560 cmd.exe 229 PID 2384 wrote to memory of 3784 2384 XBNDZ.exe 230 PID 3784 wrote to memory of 1768 3784 cmd.exe 234 PID 1768 wrote to memory of 3268 1768 SPSMJTZ.exe 235 PID 3268 wrote to memory of 5340 3268 cmd.exe 239 PID 5340 wrote to memory of 2104 5340 HSBQU.exe 240 PID 2104 wrote to memory of 2848 2104 cmd.exe 244 PID 2848 wrote to memory of 1952 2848 INFUHE.exe 245 PID 1952 wrote to memory of 5900 1952 cmd.exe 249 PID 5900 wrote to memory of 800 5900 IAFBJRE.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_59cbc33c4c665ea3ddf2a91e7e13a89e_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EHMJZYC.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\windows\system\EHMJZYC.exeC:\windows\system\EHMJZYC.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSVFLZY.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\windows\SysWOW64\CSVFLZY.exeC:\windows\system32\CSVFLZY.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KYUMX.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:968 -
C:\windows\KYUMX.exeC:\windows\KYUMX.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIXU.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\windows\IIXU.exeC:\windows\IIXU.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGLP.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\windows\system\SGLP.exeC:\windows\system\SGLP.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUDD.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\windows\SysWOW64\SUDD.exeC:\windows\system32\SUDD.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IPVHIFV.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\SysWOW64\IPVHIFV.exeC:\windows\system32\IPVHIFV.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ISYL.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\windows\SysWOW64\ISYL.exeC:\windows\system32\ISYL.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXRAP.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\windows\IXRAP.exeC:\windows\IXRAP.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNK.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\HNK.exeC:\windows\HNK.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVMINTJ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\windows\SysWOW64\QVMINTJ.exeC:\windows\system32\QVMINTJ.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJR.exe.bat" "24⤵
- Executes a command shell one-liner
PID:4888 -
C:\windows\system\TJR.exeC:\windows\system\TJR.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWNAI.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\windows\system\NWNAI.exeC:\windows\system\NWNAI.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GZZWNIW.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\SysWOW64\GZZWNIW.exeC:\windows\system32\GZZWNIW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKIVBLS.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\windows\system\TKIVBLS.exeC:\windows\system\TKIVBLS.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXH.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\system\ZXH.exeC:\windows\system\ZXH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AALZM.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\windows\system\AALZM.exeC:\windows\system\AALZM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YYWCZ.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\YYWCZ.exeC:\windows\YYWCZ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TLBMJRF.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\system\TLBMJRF.exeC:\windows\system\TLBMJRF.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IBCD.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\windows\SysWOW64\IBCD.exeC:\windows\system32\IBCD.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMS.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\windows\system\WMS.exeC:\windows\system\WMS.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSKQ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\windows\system\WSKQ.exeC:\windows\system\WSKQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CSSE.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\windows\CSSE.exeC:\windows\CSSE.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\windows\SysWOW64\CNE.exeC:\windows\system32\CNE.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANDNLP.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\SysWOW64\ANDNLP.exeC:\windows\system32\ANDNLP.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJIFNPT.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\windows\system\DJIFNPT.exeC:\windows\system\DJIFNPT.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XWNO.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\windows\XWNO.exeC:\windows\XWNO.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBNDZ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\XBNDZ.exeC:\windows\XBNDZ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPSMJTZ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\windows\system\SPSMJTZ.exeC:\windows\system\SPSMJTZ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HSBQU.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\HSBQU.exeC:\windows\HSBQU.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INFUHE.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\windows\SysWOW64\INFUHE.exeC:\windows\system32\INFUHE.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAFBJRE.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\windows\SysWOW64\IAFBJRE.exeC:\windows\system32\IAFBJRE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGQTZ.exe.bat" "66⤵PID:800
-
C:\windows\system\RGQTZ.exeC:\windows\system\RGQTZ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTIHAS.exe.bat" "68⤵PID:3868
-
C:\windows\ZTIHAS.exeC:\windows\ZTIHAS.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUQ.exe.bat" "70⤵PID:5852
-
C:\windows\SysWOW64\FUQ.exeC:\windows\system32\FUQ.exe71⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZQJ.exe.bat" "72⤵PID:2828
-
C:\windows\FZQJ.exeC:\windows\FZQJ.exe73⤵
- Executes dropped EXE
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMVTV.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\windows\system\ZMVTV.exeC:\windows\system\ZMVTV.exe75⤵
- Executes dropped EXE
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDB.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4172 -
C:\windows\system\DDB.exeC:\windows\system\DDB.exe77⤵
- Executes dropped EXE
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVJOQ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5192 -
C:\windows\JVJOQ.exeC:\windows\JVJOQ.exe79⤵
- Executes dropped EXE
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNMH.exe.bat" "80⤵PID:4772
-
C:\windows\system\UNMH.exeC:\windows\system\UNMH.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJRRJB.exe.bat" "82⤵PID:4868
-
C:\windows\SysWOW64\PJRRJB.exeC:\windows\system32\PJRRJB.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWWAL.exe.bat" "84⤵PID:1344
-
C:\windows\SysWOW64\KWWAL.exeC:\windows\system32\KWWAL.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJSJVBK.exe.bat" "86⤵PID:2864
-
C:\windows\SysWOW64\EJSJVBK.exeC:\windows\system32\EJSJVBK.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXX.exe.bat" "88⤵PID:792
-
C:\windows\system\HXX.exeC:\windows\system\HXX.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXFH.exe.bat" "90⤵PID:2724
-
C:\windows\FXFH.exeC:\windows\FXFH.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2432 -
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FGJ.exe.bat" "94⤵PID:4396
-
C:\windows\FGJ.exeC:\windows\FGJ.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTTR.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2036 -
C:\windows\WTTR.exeC:\windows\WTTR.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYTFV.exe.bat" "98⤵PID:980
-
C:\windows\SysWOW64\WYTFV.exeC:\windows\system32\WYTFV.exe99⤵
- Executes dropped EXE
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OME.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4092 -
C:\windows\OME.exeC:\windows\OME.exe101⤵
- Executes dropped EXE
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHD.exe.bat" "102⤵PID:2412
-
C:\windows\MHD.exeC:\windows\MHD.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DUOQXM.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4252 -
C:\windows\SysWOW64\DUOQXM.exeC:\windows\system32\DUOQXM.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIFRCHK.exe.bat" "106⤵PID:1716
-
C:\windows\JIFRCHK.exeC:\windows\JIFRCHK.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BLRVHF.exe.bat" "108⤵PID:3396
-
C:\windows\BLRVHF.exeC:\windows\BLRVHF.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVZL.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4796 -
C:\windows\SysWOW64\PVZL.exeC:\windows\system32\PVZL.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JJEVGH.exe.bat" "112⤵PID:5040
-
C:\windows\JJEVGH.exeC:\windows\JJEVGH.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWJEIHL.exe.bat" "114⤵PID:360
-
C:\windows\MWJEIHL.exeC:\windows\MWJEIHL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJNV.exe.bat" "116⤵PID:6024
-
C:\windows\system\GJNV.exeC:\windows\system\GJNV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMR.exe.bat" "118⤵PID:2988
-
C:\windows\system\ZMR.exeC:\windows\system\ZMR.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FNZ.exe.bat" "120⤵PID:3876
-
C:\windows\FNZ.exeC:\windows\FNZ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-