Analysis
- max time kernel
87s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 19:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_5f46df2d08bab188be0a372ff1a5f0a3_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-22_5f46df2d08bab188be0a372ff1a5f0a3_elex_emotet_stop.exe
- Size 208KB
- Sample260722-ybkpeabe44
- SHA256 028f8099e51ea732a17db9fff82581140c57e7b64d030856db3f9131649a35fe
- MD5 5f46df2d08bab188be0a372ff1a5f0a3
- SHA1 ead089c5db0b5a1b991d001837e2bd24c0e00f8c
- SHA512 5efd12f18be401d51b04208244533831b8f2abbe95dcdf5c5e67fd607586c6bed97039cff48dd657fa7ec9c806fc53899205ca4d0dd1ff97d5016cc45f026680
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfV4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LONkEj1
- TLSH T15D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2604 GNEBHC.exe 6084 BTFM.exe 632 FBLU.exe 1784 URMLG.exe 732 EOAGW.exe 3720 NXCLZP.exe 1044 OSGPF.exe 3560 SIMPRXI.exe 2756 NVRY.exe 2488 LGU.exe 2432 PWBOO.exe 1120 TEP.exe 4200 ORMFL.exe 1080 DHV.exe 4816 HXCFD.exe 1160 CIK.exe 4348 AVJEOH.exe 1508 ZTUHJ.exe 5928 FHUIG.exe 4224 NUGPR.exe 4800 AFPNF.exe 468 MNVNRJQ.exe 1724 ATDZTU.exe 2420 POND.exe 2988 NJMMJ.exe 2304 ZRTM.exe 2960 BPYHCL.exe 5128 HPGU.exe 2788 NKFV.exe 2452 FGJ.exe 3128 SQZPSJ.exe 2768 TTDTX.exe 1772 MMK.exe 236 LHKFLC.exe 248 FUP.exe 4360 PSUJD.exe 4704 QVGM.exe 2504 UDNMVTC.exe 1740 SOPCDZ.exe 4424 EPFNVA.exe 1124 YCK.exe 5124 BPGG.exe 4948 KQILLX.exe 5168 ZTAX.exe 3124 UGXHG.exe 3016 DGZMRPD.exe 4900 SJQQ.exe 5816 TEU.exe 1400 TSMJ.exe 4232 OFRSUE.exe 1280 DAAW.exe 1920 YNFGPZ.exe 3748 AJKPZZR.exe 5352 VWPG.exe 1580 PJUQUY.exe 1664 PPUEVDP.exe 1828 VPBSEFZ.exe 5936 LFCJL.exe 2288 QGK.exe 2176 OGSLD.exe 4496 JTWUNXF.exe 1088 POODSAU.exe 1764 KCSM.exe 3372 EXXWEA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\SPXJN.exe.bat OZQBBMG.exe File opened for modification C:\windows\SysWOW64\YPFXWHV.exe SPXJN.exe File created C:\windows\SysWOW64\TTDTX.exe.bat SQZPSJ.exe File opened for modification C:\windows\SysWOW64\ZXOZ.exe QOMMW.exe File created C:\windows\SysWOW64\FXVN.exe ZXOZ.exe File created C:\windows\SysWOW64\SIMPRXI.exe.bat OSGPF.exe File created C:\windows\SysWOW64\HPGU.exe BPYHCL.exe File created C:\windows\SysWOW64\OIRMK.exe ZSQVDEN.exe File created C:\windows\SysWOW64\EAHXF.exe.bat PXXSTOK.exe File created C:\windows\SysWOW64\TQIWLXI.exe EAHXF.exe File created C:\windows\SysWOW64\FBLU.exe.bat BTFM.exe File created C:\windows\SysWOW64\NVRY.exe SIMPRXI.exe File created C:\windows\SysWOW64\NVRY.exe.bat SIMPRXI.exe File created C:\windows\SysWOW64\ZTUHJ.exe AVJEOH.exe File created C:\windows\SysWOW64\EPFNVA.exe SOPCDZ.exe File opened for modification C:\windows\SysWOW64\DGZMRPD.exe UGXHG.exe File opened for modification C:\windows\SysWOW64\PPUEVDP.exe PJUQUY.exe File created C:\windows\SysWOW64\TQIWLXI.exe.bat EAHXF.exe File opened for modification C:\windows\SysWOW64\FBLU.exe BTFM.exe File created C:\windows\SysWOW64\LGU.exe NVRY.exe File created C:\windows\SysWOW64\NJMMJ.exe.bat POND.exe File created C:\windows\SysWOW64\HPGU.exe.bat BPYHCL.exe File opened for modification C:\windows\SysWOW64\YCK.exe EPFNVA.exe File opened for modification C:\windows\SysWOW64\EXXWEA.exe KCSM.exe File opened for modification C:\windows\SysWOW64\EAHXF.exe PXXSTOK.exe File created C:\windows\SysWOW64\YPFXWHV.exe SPXJN.exe File created C:\windows\SysWOW64\YNFGPZ.exe DAAW.exe File opened for modification C:\windows\SysWOW64\HPGU.exe BPYHCL.exe File created C:\windows\SysWOW64\DGZMRPD.exe.bat UGXHG.exe File opened for modification C:\windows\SysWOW64\SJQQ.exe DGZMRPD.exe File created C:\windows\SysWOW64\SJQQ.exe.bat DGZMRPD.exe File opened for modification C:\windows\SysWOW64\TQIWLXI.exe EAHXF.exe File created C:\windows\SysWOW64\NJMMJ.exe POND.exe File created C:\windows\SysWOW64\EOAGW.exe.bat URMLG.exe File created C:\windows\SysWOW64\NXCLZP.exe.bat EOAGW.exe File opened for modification C:\windows\SysWOW64\SIMPRXI.exe OSGPF.exe File opened for modification C:\windows\SysWOW64\NJMMJ.exe POND.exe File opened for modification C:\windows\SysWOW64\BPYHCL.exe ZRTM.exe File created C:\windows\SysWOW64\XZSYNR.exe.bat FWOC.exe File created C:\windows\SysWOW64\EAHXF.exe PXXSTOK.exe File created C:\windows\SysWOW64\EPFNVA.exe.bat SOPCDZ.exe File created C:\windows\SysWOW64\AJKPZZR.exe.bat YNFGPZ.exe File created C:\windows\SysWOW64\BYHPZ.exe HKC.exe File created C:\windows\SysWOW64\XZSYNR.exe FWOC.exe File created C:\windows\SysWOW64\GNEBHC.exe 2026-07-22_5f46df2d08bab188be0a372ff1a5f0a3_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\LGU.exe NVRY.exe File created C:\windows\SysWOW64\NUGPR.exe FHUIG.exe File created C:\windows\SysWOW64\BPYHCL.exe.bat ZRTM.exe File created C:\windows\SysWOW64\MMK.exe.bat TTDTX.exe File created C:\windows\SysWOW64\ZAPB.exe.bat JFGPSM.exe File created C:\windows\SysWOW64\SPXJN.exe OZQBBMG.exe File created C:\windows\SysWOW64\EOAGW.exe URMLG.exe File opened for modification C:\windows\SysWOW64\EOAGW.exe URMLG.exe File opened for modification C:\windows\SysWOW64\NVRY.exe SIMPRXI.exe File created C:\windows\SysWOW64\BPYHCL.exe ZRTM.exe File opened for modification C:\windows\SysWOW64\MMK.exe TTDTX.exe File opened for modification C:\windows\SysWOW64\HKC.exe EXXWEA.exe File opened for modification C:\windows\SysWOW64\FXVN.exe ZXOZ.exe File created C:\windows\SysWOW64\YPFXWHV.exe.bat SPXJN.exe File opened for modification C:\windows\SysWOW64\NXCLZP.exe EOAGW.exe File created C:\windows\SysWOW64\LGU.exe.bat NVRY.exe File opened for modification C:\windows\SysWOW64\EPFNVA.exe SOPCDZ.exe File created C:\windows\SysWOW64\AJKPZZR.exe YNFGPZ.exe File created C:\windows\SysWOW64\PPUEVDP.exe PJUQUY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\AUFS.exe.bat RUDNFTD.exe File opened for modification C:\windows\UGXHG.exe ZTAX.exe File created C:\windows\system\NKFV.exe HPGU.exe File opened for modification C:\windows\URMLG.exe FBLU.exe File opened for modification C:\windows\system\SOPCDZ.exe UDNMVTC.exe File created C:\windows\system\RGR.exe.bat RTQBKMK.exe File created C:\windows\system\LFCJL.exe VPBSEFZ.exe File created C:\windows\system\OGSLD.exe QGK.exe File opened for modification C:\windows\system\WXPL.exe YMEDG.exe File created C:\windows\URMLG.exe FBLU.exe File opened for modification C:\windows\POND.exe ATDZTU.exe File created C:\windows\QVGM.exe.bat PSUJD.exe File opened for modification C:\windows\TSMJ.exe TEU.exe File created C:\windows\system\JTWUNXF.exe OGSLD.exe File created C:\windows\system\POODSAU.exe JTWUNXF.exe File created C:\windows\AFEKOGH.exe QHYPZ.exe File created C:\windows\VBHD.exe.bat QBZ.exe File created C:\windows\system\WXPL.exe.bat YMEDG.exe File opened for modification C:\windows\QVGM.exe PSUJD.exe File created C:\windows\system\TEU.exe.bat SJQQ.exe File created C:\windows\XBUY.exe.bat OTSTWWI.exe File opened for modification C:\windows\system\OSGPF.exe NXCLZP.exe File created C:\windows\system\AMBABW.exe.bat RGR.exe File created C:\windows\CTE.exe EGMUI.exe File opened for modification C:\windows\system\PWBOO.exe LGU.exe File opened for modification C:\windows\system\AMBABW.exe RGR.exe File created C:\windows\system\FUP.exe LHKFLC.exe File created C:\windows\system\TEU.exe SJQQ.exe File created C:\windows\system\DAAW.exe.bat OFRSUE.exe File created C:\windows\system\YMEDG.exe.bat MUJK.exe File created C:\windows\system\MAZXIUV.exe.bat WXPL.exe File created C:\windows\HXCFD.exe DHV.exe File created C:\windows\ZTAX.exe KQILLX.exe File created C:\windows\VWPG.exe.bat AJKPZZR.exe File created C:\windows\system\QHYPZ.exe VUT.exe File opened for modification C:\windows\system\MNVNRJQ.exe AFPNF.exe File opened for modification C:\windows\system\PXXSTOK.exe FXVN.exe File created C:\windows\POND.exe.bat ATDZTU.exe File created C:\windows\system\ZRTM.exe NJMMJ.exe File opened for modification C:\windows\system\DAAW.exe OFRSUE.exe File created C:\windows\RTQBKMK.exe BYHPZ.exe File created C:\windows\system\MNVNRJQ.exe AFPNF.exe File opened for modification C:\windows\system\LFCJL.exe VPBSEFZ.exe File created C:\windows\VOVGSPA.exe PSVF.exe File opened for modification C:\windows\BPGG.exe YCK.exe File opened for modification C:\windows\system\KQILLX.exe BPGG.exe File opened for modification C:\windows\QBZ.exe VOVGSPA.exe File opened for modification C:\windows\system\QGK.exe LFCJL.exe File opened for modification C:\windows\DMO.exe JZJGJLQ.exe File created C:\windows\QOMMW.exe.bat VBHD.exe File opened for modification C:\windows\ZTAX.exe KQILLX.exe File opened for modification C:\windows\system\ZRTM.exe NJMMJ.exe File created C:\windows\ORMFL.exe TEP.exe File created C:\windows\system\AVJEOH.exe.bat CIK.exe File opened for modification C:\windows\FHUIG.exe ZTUHJ.exe File created C:\windows\system\SQZPSJ.exe FGJ.exe File created C:\windows\system\OGSLD.exe.bat QGK.exe File created C:\windows\system\JZJGJLQ.exe DZBSAJ.exe File created C:\windows\system\KQILLX.exe BPGG.exe File created C:\windows\system\BTFM.exe GNEBHC.exe File created C:\windows\CIK.exe.bat HXCFD.exe File opened for modification C:\windows\system\PSUJD.exe FUP.exe File created C:\windows\TSMJ.exe TEU.exe File created C:\windows\ZSQVDEN.exe AUFS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2696 cmd.exe 4924 cmd.exe 2600 cmd.exe 5560 cmd.exe 4160 cmd.exe 2596 cmd.exe 6012 cmd.exe 4664 cmd.exe 5664 cmd.exe 1532 cmd.exe 4804 cmd.exe 4132 cmd.exe 1252 cmd.exe 3680 cmd.exe 2648 cmd.exe 4356 cmd.exe 6064 cmd.exe 5528 cmd.exe 4124 cmd.exe 2780 cmd.exe 2164 cmd.exe 5516 cmd.exe 1912 cmd.exe 1340 cmd.exe 2348 cmd.exe 4476 cmd.exe 5840 cmd.exe 4152 cmd.exe 3056 cmd.exe 5328 cmd.exe 5732 cmd.exe 4724 cmd.exe 4304 cmd.exe 4564 cmd.exe 6124 cmd.exe 4636 cmd.exe 4256 cmd.exe 1204 cmd.exe 2624 cmd.exe 3012 cmd.exe 2512 cmd.exe 4320 cmd.exe 5464 cmd.exe 4736 cmd.exe 1984 cmd.exe 1468 cmd.exe 3316 cmd.exe 4412 cmd.exe 824 cmd.exe 5864 cmd.exe 5624 cmd.exe 5944 cmd.exe 6048 cmd.exe 256 cmd.exe 2240 cmd.exe 4364 cmd.exe 5176 cmd.exe 3288 cmd.exe 2844 cmd.exe 5956 cmd.exe 5704 cmd.exe 3376 cmd.exe 4368 cmd.exe 2644 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2876 3868 WerFault.exe 87 5244 2604 WerFault.exe 93 5636 6084 WerFault.exe 99 3012 632 WerFault.exe 104 1840 1784 WerFault.exe 109 5176 732 WerFault.exe 114 5904 3720 WerFault.exe 119 5928 1044 WerFault.exe 124 4580 3560 WerFault.exe 129 4956 2756 WerFault.exe 134 4320 2488 WerFault.exe 139 1900 2432 WerFault.exe 144 1696 1120 WerFault.exe 149 1536 4200 WerFault.exe 154 4776 1080 WerFault.exe 159 1284 4816 WerFault.exe 164 5980 1160 WerFault.exe 169 3972 4348 WerFault.exe 174 2648 1508 WerFault.exe 179 5520 5928 WerFault.exe 184 2328 4224 WerFault.exe 189 4320 4800 WerFault.exe 194 5416 468 WerFault.exe 199 2388 1724 WerFault.exe 204 4532 2420 WerFault.exe 209 5580 2988 WerFault.exe 214 1304 2304 WerFault.exe 219 3060 2960 WerFault.exe 224 5864 5128 WerFault.exe 229 2564 2788 WerFault.exe 234 3312 2452 WerFault.exe 239 1932 3128 WerFault.exe 244 1920 2768 WerFault.exe 249 4612 1772 WerFault.exe 254 1760 236 WerFault.exe 259 5088 248 WerFault.exe 264 5108 4360 WerFault.exe 269 4220 4704 WerFault.exe 275 2648 2504 WerFault.exe 280 5632 1740 WerFault.exe 285 2176 4424 WerFault.exe 290 4516 1124 WerFault.exe 295 2160 5124 WerFault.exe 300 4588 4948 WerFault.exe 305 3056 5168 WerFault.exe 310 4672 3124 WerFault.exe 315 2476 3016 WerFault.exe 320 5808 4900 WerFault.exe 325 5176 5816 WerFault.exe 330 4664 1400 WerFault.exe 335 5204 4232 WerFault.exe 340 3308 1280 WerFault.exe 345 4392 1920 WerFault.exe 350 5532 3748 WerFault.exe 355 3372 5352 WerFault.exe 360 5980 1580 WerFault.exe 365 5132 1664 WerFault.exe 370 2652 1828 WerFault.exe 375 5588 5936 WerFault.exe 380 3940 2288 WerFault.exe 385 5516 2176 WerFault.exe 390 4552 4496 WerFault.exe 395 4588 1088 WerFault.exe 400 4356 1764 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZJGJLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZQBBMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPXJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ATDZTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUGPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTDTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YMEDG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVKUDRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQILLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOVGSPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXXSTOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNVNRJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHKFLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZBSAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGZMRPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAHXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAZXIUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHUIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3868 2026-07-22_5f46df2d08bab188be0a372ff1a5f0a3_elex_emotet_stop.exe 3868 2026-07-22_5f46df2d08bab188be0a372ff1a5f0a3_elex_emotet_stop.exe 2604 GNEBHC.exe 2604 GNEBHC.exe 6084 BTFM.exe 6084 BTFM.exe 632 FBLU.exe 632 FBLU.exe 1784 URMLG.exe 1784 URMLG.exe 732 EOAGW.exe 732 EOAGW.exe 3720 NXCLZP.exe 3720 NXCLZP.exe 1044 OSGPF.exe 1044 OSGPF.exe 3560 SIMPRXI.exe 3560 SIMPRXI.exe 2756 NVRY.exe 2756 NVRY.exe 2488 LGU.exe 2488 LGU.exe 2432 PWBOO.exe 2432 PWBOO.exe 1120 TEP.exe 1120 TEP.exe 4200 ORMFL.exe 4200 ORMFL.exe 1080 DHV.exe 1080 DHV.exe 4816 HXCFD.exe 4816 HXCFD.exe 1160 CIK.exe 1160 CIK.exe 4348 AVJEOH.exe 4348 AVJEOH.exe 1508 ZTUHJ.exe 1508 ZTUHJ.exe 5928 FHUIG.exe 5928 FHUIG.exe 4224 NUGPR.exe 4224 NUGPR.exe 4800 AFPNF.exe 4800 AFPNF.exe 468 MNVNRJQ.exe 468 MNVNRJQ.exe 1724 ATDZTU.exe 1724 ATDZTU.exe 2420 POND.exe 2420 POND.exe 2988 NJMMJ.exe 2988 NJMMJ.exe 2304 ZRTM.exe 2304 ZRTM.exe 2960 BPYHCL.exe 2960 BPYHCL.exe 5128 HPGU.exe 5128 HPGU.exe 2788 NKFV.exe 2788 NKFV.exe 2452 FGJ.exe 2452 FGJ.exe 3128 SQZPSJ.exe 3128 SQZPSJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3868 2026-07-22_5f46df2d08bab188be0a372ff1a5f0a3_elex_emotet_stop.exe 3868 2026-07-22_5f46df2d08bab188be0a372ff1a5f0a3_elex_emotet_stop.exe 2604 GNEBHC.exe 2604 GNEBHC.exe 6084 BTFM.exe 6084 BTFM.exe 632 FBLU.exe 632 FBLU.exe 1784 URMLG.exe 1784 URMLG.exe 732 EOAGW.exe 732 EOAGW.exe 3720 NXCLZP.exe 3720 NXCLZP.exe 1044 OSGPF.exe 1044 OSGPF.exe 3560 SIMPRXI.exe 3560 SIMPRXI.exe 2756 NVRY.exe 2756 NVRY.exe 2488 LGU.exe 2488 LGU.exe 2432 PWBOO.exe 2432 PWBOO.exe 1120 TEP.exe 1120 TEP.exe 4200 ORMFL.exe 4200 ORMFL.exe 1080 DHV.exe 1080 DHV.exe 4816 HXCFD.exe 4816 HXCFD.exe 1160 CIK.exe 1160 CIK.exe 4348 AVJEOH.exe 4348 AVJEOH.exe 1508 ZTUHJ.exe 1508 ZTUHJ.exe 5928 FHUIG.exe 5928 FHUIG.exe 4224 NUGPR.exe 4224 NUGPR.exe 4800 AFPNF.exe 4800 AFPNF.exe 468 MNVNRJQ.exe 468 MNVNRJQ.exe 1724 ATDZTU.exe 1724 ATDZTU.exe 2420 POND.exe 2420 POND.exe 2988 NJMMJ.exe 2988 NJMMJ.exe 2304 ZRTM.exe 2304 ZRTM.exe 2960 BPYHCL.exe 2960 BPYHCL.exe 5128 HPGU.exe 5128 HPGU.exe 2788 NKFV.exe 2788 NKFV.exe 2452 FGJ.exe 2452 FGJ.exe 3128 SQZPSJ.exe 3128 SQZPSJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3868 wrote to memory of 4452 3868 2026-07-22_5f46df2d08bab188be0a372ff1a5f0a3_elex_emotet_stop.exe 89 PID 4452 wrote to memory of 2604 4452 cmd.exe 93 PID 2604 wrote to memory of 2220 2604 GNEBHC.exe 95 PID 2220 wrote to memory of 6084 2220 cmd.exe 99 PID 6084 wrote to memory of 1936 6084 BTFM.exe 100 PID 1936 wrote to memory of 632 1936 cmd.exe 104 PID 632 wrote to memory of 2784 632 FBLU.exe 105 PID 2784 wrote to memory of 1784 2784 cmd.exe 109 PID 1784 wrote to memory of 4636 1784 URMLG.exe 110 PID 4636 wrote to memory of 732 4636 cmd.exe 114 PID 732 wrote to memory of 5944 732 EOAGW.exe 115 PID 5944 wrote to memory of 3720 5944 cmd.exe 119 PID 3720 wrote to memory of 4584 3720 NXCLZP.exe 120 PID 4584 wrote to memory of 1044 4584 cmd.exe 124 PID 1044 wrote to memory of 2888 1044 OSGPF.exe 125 PID 2888 wrote to memory of 3560 2888 cmd.exe 129 PID 3560 wrote to memory of 4180 3560 SIMPRXI.exe 130 PID 4180 wrote to memory of 2756 4180 cmd.exe 134 PID 2756 wrote to memory of 1180 2756 NVRY.exe 135 PID 1180 wrote to memory of 2488 1180 cmd.exe 139 PID 2488 wrote to memory of 1968 2488 LGU.exe 140 PID 1968 wrote to memory of 2432 1968 cmd.exe 144 PID 2432 wrote to memory of 4736 2432 PWBOO.exe 145 PID 4736 wrote to memory of 1120 4736 cmd.exe 149 PID 1120 wrote to memory of 5544 1120 TEP.exe 150 PID 5544 wrote to memory of 4200 5544 cmd.exe 154 PID 4200 wrote to memory of 1984 4200 ORMFL.exe 155 PID 1984 wrote to memory of 1080 1984 cmd.exe 159 PID 1080 wrote to memory of 1452 1080 DHV.exe 160 PID 1452 wrote to memory of 4816 1452 cmd.exe 164 PID 4816 wrote to memory of 2780 4816 HXCFD.exe 165 PID 2780 wrote to memory of 1160 2780 cmd.exe 169 PID 1160 wrote to memory of 4464 1160 CIK.exe 170 PID 4464 wrote to memory of 4348 4464 cmd.exe 174 PID 4348 wrote to memory of 4132 4348 AVJEOH.exe 175 PID 4132 wrote to memory of 1508 4132 cmd.exe 179 PID 1508 wrote to memory of 4732 1508 ZTUHJ.exe 180 PID 4732 wrote to memory of 5928 4732 cmd.exe 184 PID 5928 wrote to memory of 2448 5928 FHUIG.exe 185 PID 2448 wrote to memory of 4224 2448 cmd.exe 189 PID 4224 wrote to memory of 2844 4224 NUGPR.exe 190 PID 2844 wrote to memory of 4800 2844 cmd.exe 194 PID 4800 wrote to memory of 2312 4800 AFPNF.exe 195 PID 2312 wrote to memory of 468 2312 cmd.exe 199 PID 468 wrote to memory of 4936 468 MNVNRJQ.exe 200 PID 4936 wrote to memory of 1724 4936 cmd.exe 204 PID 1724 wrote to memory of 3936 1724 ATDZTU.exe 205 PID 3936 wrote to memory of 2420 3936 cmd.exe 209 PID 2420 wrote to memory of 5288 2420 POND.exe 210 PID 5288 wrote to memory of 2988 5288 cmd.exe 214 PID 2988 wrote to memory of 5560 2988 NJMMJ.exe 215 PID 5560 wrote to memory of 2304 5560 cmd.exe 219 PID 2304 wrote to memory of 4256 2304 ZRTM.exe 220 PID 4256 wrote to memory of 2960 4256 cmd.exe 224 PID 2960 wrote to memory of 3996 2960 BPYHCL.exe 225 PID 3996 wrote to memory of 5128 3996 cmd.exe 229 PID 5128 wrote to memory of 1632 5128 HPGU.exe 230 PID 1632 wrote to memory of 2788 1632 cmd.exe 234 PID 2788 wrote to memory of 1252 2788 NKFV.exe 235 PID 1252 wrote to memory of 2452 1252 cmd.exe 239 PID 2452 wrote to memory of 2656 2452 FGJ.exe 240 PID 2656 wrote to memory of 3128 2656 cmd.exe 244 PID 3128 wrote to memory of 4160 3128 SQZPSJ.exe 245 PID 4160 wrote to memory of 2768 4160 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_5f46df2d08bab188be0a372ff1a5f0a3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_5f46df2d08bab188be0a372ff1a5f0a3_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GNEBHC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\SysWOW64\GNEBHC.exeC:\windows\system32\GNEBHC.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTFM.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\windows\system\BTFM.exeC:\windows\system\BTFM.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBLU.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\windows\SysWOW64\FBLU.exeC:\windows\system32\FBLU.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URMLG.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\windows\URMLG.exeC:\windows\URMLG.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EOAGW.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\windows\SysWOW64\EOAGW.exeC:\windows\system32\EOAGW.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NXCLZP.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\SysWOW64\NXCLZP.exeC:\windows\system32\NXCLZP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OSGPF.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\system\OSGPF.exeC:\windows\system\OSGPF.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SIMPRXI.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\windows\SysWOW64\SIMPRXI.exeC:\windows\system32\SIMPRXI.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVRY.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\SysWOW64\NVRY.exeC:\windows\system32\NVRY.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGU.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\windows\SysWOW64\LGU.exeC:\windows\system32\LGU.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWBOO.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\system\PWBOO.exeC:\windows\system\PWBOO.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEP.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\TEP.exeC:\windows\TEP.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ORMFL.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\ORMFL.exeC:\windows\ORMFL.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DHV.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\windows\system\DHV.exeC:\windows\system\DHV.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HXCFD.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\windows\HXCFD.exeC:\windows\HXCFD.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CIK.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\windows\CIK.exeC:\windows\CIK.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVJEOH.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\windows\system\AVJEOH.exeC:\windows\system\AVJEOH.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTUHJ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\SysWOW64\ZTUHJ.exeC:\windows\system32\ZTUHJ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHUIG.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\windows\FHUIG.exeC:\windows\FHUIG.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUGPR.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\SysWOW64\NUGPR.exeC:\windows\system32\NUGPR.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AFPNF.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\system\AFPNF.exeC:\windows\system\AFPNF.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNVNRJQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\windows\system\MNVNRJQ.exeC:\windows\system\MNVNRJQ.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATDZTU.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\windows\system\ATDZTU.exeC:\windows\system\ATDZTU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\POND.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\windows\POND.exeC:\windows\POND.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJMMJ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\windows\SysWOW64\NJMMJ.exeC:\windows\system32\NJMMJ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRTM.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\system\ZRTM.exeC:\windows\system\ZRTM.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPYHCL.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\windows\SysWOW64\BPYHCL.exeC:\windows\system32\BPYHCL.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPGU.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\windows\SysWOW64\HPGU.exeC:\windows\system32\HPGU.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NKFV.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\windows\system\NKFV.exeC:\windows\system\NKFV.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FGJ.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\FGJ.exeC:\windows\FGJ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQZPSJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\windows\system\SQZPSJ.exeC:\windows\system\SQZPSJ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTDTX.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\SysWOW64\TTDTX.exeC:\windows\system32\TTDTX.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMK.exe.bat" "66⤵PID:5404
-
C:\windows\SysWOW64\MMK.exeC:\windows\system32\MMK.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHKFLC.exe.bat" "68⤵
- Executes a command shell one-liner
PID:1204 -
C:\windows\LHKFLC.exeC:\windows\LHKFLC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUP.exe.bat" "70⤵PID:408
-
C:\windows\system\FUP.exeC:\windows\system\FUP.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSUJD.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2596 -
C:\windows\system\PSUJD.exeC:\windows\system\PSUJD.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVGM.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2692 -
C:\windows\QVGM.exeC:\windows\QVGM.exe75⤵
- Executes dropped EXE
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDNMVTC.exe.bat" "76⤵PID:4568
-
C:\windows\system\UDNMVTC.exeC:\windows\system\UDNMVTC.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SOPCDZ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3680 -
C:\windows\system\SOPCDZ.exeC:\windows\system\SOPCDZ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPFNVA.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4184 -
C:\windows\SysWOW64\EPFNVA.exeC:\windows\system32\EPFNVA.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCK.exe.bat" "82⤵PID:2024
-
C:\windows\SysWOW64\YCK.exeC:\windows\system32\YCK.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPGG.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2624 -
C:\windows\BPGG.exeC:\windows\BPGG.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQILLX.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4152 -
C:\windows\system\KQILLX.exeC:\windows\system\KQILLX.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTAX.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1468 -
C:\windows\ZTAX.exeC:\windows\ZTAX.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGXHG.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5052 -
C:\windows\UGXHG.exeC:\windows\UGXHG.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DGZMRPD.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4544 -
C:\windows\SysWOW64\DGZMRPD.exeC:\windows\system32\DGZMRPD.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJQQ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2164 -
C:\windows\SysWOW64\SJQQ.exeC:\windows\system32\SJQQ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEU.exe.bat" "96⤵
- Executes a command shell one-liner
PID:2696 -
C:\windows\system\TEU.exeC:\windows\system\TEU.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSMJ.exe.bat" "98⤵PID:1300
-
C:\windows\TSMJ.exeC:\windows\TSMJ.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OFRSUE.exe.bat" "100⤵PID:1600
-
C:\windows\OFRSUE.exeC:\windows\OFRSUE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAAW.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3816 -
C:\windows\system\DAAW.exeC:\windows\system\DAAW.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNFGPZ.exe.bat" "104⤵
- Executes a command shell one-liner
PID:6012 -
C:\windows\SysWOW64\YNFGPZ.exeC:\windows\system32\YNFGPZ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJKPZZR.exe.bat" "106⤵PID:1696
-
C:\windows\SysWOW64\AJKPZZR.exeC:\windows\system32\AJKPZZR.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWPG.exe.bat" "108⤵PID:4912
-
C:\windows\VWPG.exeC:\windows\VWPG.exe109⤵
- Executes dropped EXE
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJUQUY.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5956 -
C:\windows\PJUQUY.exeC:\windows\PJUQUY.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3012 -
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe113⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPBSEFZ.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5648 -
C:\windows\VPBSEFZ.exeC:\windows\VPBSEFZ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFCJL.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:5076 -
C:\windows\system\LFCJL.exeC:\windows\system\LFCJL.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGK.exe.bat" "118⤵PID:2244
-
C:\windows\system\QGK.exeC:\windows\system\QGK.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGSLD.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6048 -
C:\windows\system\OGSLD.exeC:\windows\system\OGSLD.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-