Analysis
- max time kernel
89s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe
- Size 208KB
- Sample260723-mx2dhaca39
- SHA256 72f9bd35a5dc81aa0cec607a04de26b9a44c891805923c4e145e7b629541e3f6
- MD5 b24c75674cd2ed21da981b818ea47d14
- SHA1 9dd1eec8efb4b3db75f645bd891ed692d3313659
- SHA512 fad84303088dc32417b7eb4ca66cc9a9190e8344a0b7eeb814b2d18008f89a3162ab0edd8c7b014364e51e2e2962d57ff6c414b69b272214d25890010f079ba5
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUWL+LOfT4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUu+LO7kEj1
- TLSH T1A3247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5476 HMXNDP.exe 2396 JDZIXQ.exe 1880 IOXG.exe 5932 GOXUFFF.exe 2428 XOZZJ.exe 6096 SCEITKE.exe 768 HFN.exe 1636 LNCVQPT.exe 4068 RIT.exe 2404 MVYNF.exe 1864 EYKI.exe 5832 ZBSHZLC.exe 2796 SEW.exe 3728 NRBMP.exe 5756 NVEQ.exe 3412 RLLQGR.exe 4532 VTSY.exe 5300 QGWHDB.exe 4884 BYZADQI.exe 2560 EMEK.exe 4108 ICLKZA.exe 3212 CPQ.exe 5768 IKPCGD.exe 4112 GLXPXF.exe 5780 JYB.exe 2536 DLGIKFB.exe 4996 WOK.exe 5860 CPSSGP.exe 4284 WCWJJPB.exe 3240 ASDJV.exe 4728 IYVYWU.exe 3480 XTN.exe 5116 WOEL.exe 4516 BOLYDMR.exe 4384 HOTM.exe 108 YZRC.exe 5456 EAZQVD.exe 2460 EDD.exe 5944 QVGM.exe 1040 KJDWTA.exe 5916 QJK.exe 700 LWPTM.exe 3056 PMW.exe 4456 YNYG.exe 1664 ZQC.exe 2144 VVURFD.exe 1920 LLVQE.exe 4672 DGZMRPD.exe 5048 PWFM.exe 5636 XCSB.exe 3256 SXXKR.exe 548 BXZP.exe 5896 WIHOIOH.exe 5996 GIJ.exe 1512 VDTXFG.exe 848 BZSY.exe 6052 UCWCPZ.exe 5216 ACD.exe 5552 BARKF.exe 5568 TATP.exe 3924 ZASD.exe 5272 KTIO.exe 2316 QOHOOFU.exe 5668 LCMY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\SPSL.exe JGQ.exe File created C:\windows\SysWOW64\PXLKMQP.exe VJGTCQ.exe File created C:\windows\SysWOW64\SEW.exe ZBSHZLC.exe File created C:\windows\SysWOW64\WOEL.exe XTN.exe File created C:\windows\SysWOW64\IDYHN.exe.bat YCWU.exe File created C:\windows\SysWOW64\VJGTCQ.exe LJEOZTY.exe File created C:\windows\SysWOW64\BNRKZ.exe.bat PXLKMQP.exe File opened for modification C:\windows\SysWOW64\VUYEEKC.exe GROA.exe File opened for modification C:\windows\SysWOW64\SEW.exe ZBSHZLC.exe File created C:\windows\SysWOW64\PMW.exe LWPTM.exe File created C:\windows\SysWOW64\RCTTHH.exe LCMY.exe File opened for modification C:\windows\SysWOW64\RCTTHH.exe LCMY.exe File created C:\windows\SysWOW64\OGCR.exe.bat IFUDVZ.exe File created C:\windows\SysWOW64\OFRIC.exe.bat LPCAQAY.exe File created C:\windows\SysWOW64\BNRKZ.exe PXLKMQP.exe File opened for modification C:\windows\SysWOW64\RLLQGR.exe NVEQ.exe File created C:\windows\SysWOW64\IYVYWU.exe.bat ASDJV.exe File created C:\windows\SysWOW64\SPSL.exe JGQ.exe File created C:\windows\SysWOW64\KVJNNTV.exe GFDFB.exe File opened for modification C:\windows\SysWOW64\KVJNNTV.exe GFDFB.exe File created C:\windows\SysWOW64\NEREG.exe DODKZBW.exe File created C:\windows\SysWOW64\VJGTCQ.exe.bat LJEOZTY.exe File created C:\windows\SysWOW64\EYKI.exe.bat MVYNF.exe File opened for modification C:\windows\SysWOW64\IYVYWU.exe ASDJV.exe File created C:\windows\SysWOW64\WOEL.exe.bat XTN.exe File created C:\windows\SysWOW64\KJDWTA.exe QVGM.exe File opened for modification C:\windows\SysWOW64\KJDWTA.exe QVGM.exe File opened for modification C:\windows\SysWOW64\SXXKR.exe XCSB.exe File created C:\windows\SysWOW64\SDOPJQ.exe.bat VXWZT.exe File created C:\windows\SysWOW64\BZXGA.exe CGUYAL.exe File created C:\windows\SysWOW64\VTSY.exe.bat RLLQGR.exe File opened for modification C:\windows\SysWOW64\PMW.exe LWPTM.exe File created C:\windows\SysWOW64\PMW.exe.bat LWPTM.exe File opened for modification C:\windows\SysWOW64\DGZMRPD.exe LLVQE.exe File created C:\windows\SysWOW64\SXXKR.exe.bat XCSB.exe File created C:\windows\SysWOW64\USA.exe RCTTHH.exe File created C:\windows\SysWOW64\SDOPJQ.exe VXWZT.exe File created C:\windows\SysWOW64\AAEN.exe RRC.exe File created C:\windows\SysWOW64\VTSY.exe RLLQGR.exe File created C:\windows\SysWOW64\WCWJJPB.exe CPSSGP.exe File opened for modification C:\windows\SysWOW64\USA.exe RCTTHH.exe File opened for modification C:\windows\SysWOW64\BZXGA.exe CGUYAL.exe File opened for modification C:\windows\SysWOW64\OFRIC.exe LPCAQAY.exe File created C:\windows\SysWOW64\AAEN.exe.bat RRC.exe File created C:\windows\SysWOW64\RLLQGR.exe NVEQ.exe File opened for modification C:\windows\SysWOW64\WCWJJPB.exe CPSSGP.exe File created C:\windows\SysWOW64\WCWJJPB.exe.bat CPSSGP.exe File created C:\windows\SysWOW64\SXXKR.exe XCSB.exe File created C:\windows\SysWOW64\USA.exe.bat RCTTHH.exe File created C:\windows\SysWOW64\KVJNNTV.exe.bat GFDFB.exe File created C:\windows\SysWOW64\PXLKMQP.exe.bat VJGTCQ.exe File opened for modification C:\windows\SysWOW64\BNRKZ.exe PXLKMQP.exe File created C:\windows\SysWOW64\EYKI.exe MVYNF.exe File opened for modification C:\windows\SysWOW64\EYKI.exe MVYNF.exe File created C:\windows\SysWOW64\IYVYWU.exe ASDJV.exe File created C:\windows\SysWOW64\GFDFB.exe UMIV.exe File opened for modification C:\windows\SysWOW64\RIT.exe LNCVQPT.exe File created C:\windows\SysWOW64\DGZMRPD.exe.bat LLVQE.exe File created C:\windows\SysWOW64\RCTTHH.exe.bat LCMY.exe File opened for modification C:\windows\SysWOW64\AAEN.exe RRC.exe File created C:\windows\SysWOW64\VUYEEKC.exe.bat GROA.exe File created C:\windows\SysWOW64\SEW.exe.bat ZBSHZLC.exe File opened for modification C:\windows\SysWOW64\VTSY.exe RLLQGR.exe File created C:\windows\SysWOW64\SPSL.exe.bat JGQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\EAZQVD.exe.bat YZRC.exe File opened for modification C:\windows\system\VDTXFG.exe GIJ.exe File created C:\windows\system\TATP.exe BARKF.exe File created C:\windows\DLGIKFB.exe.bat JYB.exe File created C:\windows\FYKYQ.exe.bat ZDLXLAW.exe File opened for modification C:\windows\system\NRBMP.exe SEW.exe File opened for modification C:\windows\system\YZRC.exe HOTM.exe File created C:\windows\EAZQVD.exe YZRC.exe File created C:\windows\TGSKOGZ.exe.bat SDOPJQ.exe File created C:\windows\DLGIKFB.exe JYB.exe File created C:\windows\IFUDVZ.exe KVJNNTV.exe File opened for modification C:\windows\system\ICLKZA.exe EMEK.exe File created C:\windows\GIJ.exe WIHOIOH.exe File created C:\windows\system\KTIO.exe.bat ZASD.exe File created C:\windows\HMXNDP.exe 2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe File created C:\windows\EDD.exe.bat EAZQVD.exe File created C:\windows\system\VDTXFG.exe GIJ.exe File created C:\windows\MVYNF.exe RIT.exe File created C:\windows\system\ASDJV.exe.bat WCWJJPB.exe File created C:\windows\BZSY.exe.bat VDTXFG.exe File opened for modification C:\windows\system\ZDLXLAW.exe CXN.exe File opened for modification C:\windows\JGQ.exe FYKYQ.exe File created C:\windows\EPIN.exe.bat HKCPRNK.exe File opened for modification C:\windows\system\GBNMXO.exe BAGY.exe File created C:\windows\UMIV.exe.bat QETNOB.exe File created C:\windows\PWFM.exe.bat DGZMRPD.exe File created C:\windows\system\LPCAQAY.exe.bat BZXGA.exe File created C:\windows\system\GROA.exe PRM.exe File created C:\windows\SCEITKE.exe XOZZJ.exe File created C:\windows\system\ICLKZA.exe EMEK.exe File created C:\windows\system\YZRC.exe.bat HOTM.exe File created C:\windows\system\CXN.exe USA.exe File created C:\windows\system\ZDLXLAW.exe CXN.exe File opened for modification C:\windows\system\PCXZ.exe NEREG.exe File opened for modification C:\windows\system\VXWZT.exe PCXZ.exe File created C:\windows\system\BOLYDMR.exe.bat WOEL.exe File opened for modification C:\windows\QVGM.exe EDD.exe File created C:\windows\system\YNYG.exe.bat PMW.exe File created C:\windows\BZSY.exe VDTXFG.exe File created C:\windows\system\BARKF.exe ACD.exe File opened for modification C:\windows\system\IGCD.exe IDYHN.exe File created C:\windows\NFUDHQ.exe BNRKZ.exe File created C:\windows\system\BYZADQI.exe.bat QGWHDB.exe File opened for modification C:\windows\system\YNYG.exe PMW.exe File created C:\windows\system\XCSB.exe PWFM.exe File opened for modification C:\windows\WIHOIOH.exe BXZP.exe File created C:\windows\system\LVGY.exe.bat NFUDHQ.exe File created C:\windows\QGWHDB.exe VTSY.exe File created C:\windows\system\QJK.exe KJDWTA.exe File created C:\windows\system\VXWZT.exe PCXZ.exe File opened for modification C:\windows\system\HFN.exe SCEITKE.exe File created C:\windows\system\NVEQ.exe NRBMP.exe File opened for modification C:\windows\CPSSGP.exe WOK.exe File created C:\windows\UCWCPZ.exe BZSY.exe File created C:\windows\system\QJK.exe.bat KJDWTA.exe File opened for modification C:\windows\FYKYQ.exe ZDLXLAW.exe File created C:\windows\HKCPRNK.exe.bat SPSL.exe File created C:\windows\system\GBNMXO.exe.bat BAGY.exe File opened for modification C:\windows\MWJLFGV.exe IGCD.exe File created C:\windows\system\LPCAQAY.exe BZXGA.exe File created C:\windows\ZASD.exe.bat TATP.exe File opened for modification C:\windows\EPIN.exe HKCPRNK.exe File created C:\windows\system\BOS.exe GBNMXO.exe File created C:\windows\JTHBP.exe.bat OGCR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6060 cmd.exe 1720 cmd.exe 3168 cmd.exe 4804 cmd.exe 5108 cmd.exe 5608 cmd.exe 3008 cmd.exe 3492 cmd.exe 4076 cmd.exe 2756 cmd.exe 1136 cmd.exe 6040 cmd.exe 2332 cmd.exe 4304 cmd.exe 1568 cmd.exe 2892 cmd.exe 2788 cmd.exe 1992 cmd.exe 2696 cmd.exe 4104 cmd.exe 4132 cmd.exe 2740 cmd.exe 2200 cmd.exe 5844 cmd.exe 1888 cmd.exe 5020 cmd.exe 2952 cmd.exe 4700 cmd.exe 5708 cmd.exe 6116 cmd.exe 992 cmd.exe 236 cmd.exe 3112 cmd.exe 4756 cmd.exe 4588 cmd.exe 5344 cmd.exe 4184 cmd.exe 3416 cmd.exe 5804 cmd.exe 3524 cmd.exe 5796 cmd.exe 2224 cmd.exe 2736 cmd.exe 4244 cmd.exe 4412 cmd.exe 712 cmd.exe 6016 cmd.exe 2996 cmd.exe 5772 cmd.exe 5040 cmd.exe 5740 cmd.exe 4496 cmd.exe 2944 cmd.exe 4264 cmd.exe 5276 cmd.exe 6076 cmd.exe 2856 cmd.exe 1124 cmd.exe 4156 cmd.exe 4724 cmd.exe 5792 cmd.exe 5968 cmd.exe 5696 cmd.exe 2592 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2772 4900 WerFault.exe 87 108 5476 WerFault.exe 93 2908 2396 WerFault.exe 99 5564 1880 WerFault.exe 104 5968 5932 WerFault.exe 109 4052 2428 WerFault.exe 114 1048 6096 WerFault.exe 119 3492 768 WerFault.exe 124 1040 1636 WerFault.exe 129 5712 4068 WerFault.exe 134 2332 2404 WerFault.exe 138 4600 1864 WerFault.exe 144 4064 5832 WerFault.exe 149 3108 2796 WerFault.exe 154 2940 3728 WerFault.exe 159 5508 5756 WerFault.exe 164 5784 3412 WerFault.exe 169 1364 4532 WerFault.exe 174 1720 5300 WerFault.exe 179 3736 4884 WerFault.exe 184 4652 2560 WerFault.exe 189 3664 4108 WerFault.exe 194 5388 3212 WerFault.exe 199 2020 5768 WerFault.exe 204 2212 4112 WerFault.exe 209 5668 5780 WerFault.exe 214 5380 2536 WerFault.exe 219 1340 4996 WerFault.exe 224 712 5860 WerFault.exe 229 3068 4284 WerFault.exe 234 5548 3240 WerFault.exe 239 4156 4728 WerFault.exe 244 4364 3480 WerFault.exe 249 4536 5116 WerFault.exe 254 4980 4516 WerFault.exe 259 5080 4384 WerFault.exe 264 1652 108 WerFault.exe 269 1100 5456 WerFault.exe 274 2444 2460 WerFault.exe 279 5016 5944 WerFault.exe 285 5752 1040 WerFault.exe 290 2332 5916 WerFault.exe 295 1932 700 WerFault.exe 300 4216 3056 WerFault.exe 305 5620 4456 WerFault.exe 310 2256 1664 WerFault.exe 315 6132 2144 WerFault.exe 320 1796 1920 WerFault.exe 325 3492 4672 WerFault.exe 330 3008 5048 WerFault.exe 335 2752 5636 WerFault.exe 340 472 3256 WerFault.exe 345 1956 548 WerFault.exe 350 1216 5896 WerFault.exe 355 5384 5996 WerFault.exe 360 2820 1512 WerFault.exe 365 5056 848 WerFault.exe 370 4700 6052 WerFault.exe 375 704 5216 WerFault.exe 380 2804 5552 WerFault.exe 385 5816 5568 WerFault.exe 390 5532 3924 WerFault.exe 395 5948 5272 WerFault.exe 400 5696 2316 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOLYDMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVJNNTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVYNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAZQVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GROA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LLVQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UMIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZXGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGWHDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IFUDVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXLKMQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPSSGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZASD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGSKOGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBSHZLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCWJJPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAGAZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKCPRNK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4900 2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe 4900 2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe 5476 HMXNDP.exe 5476 HMXNDP.exe 2396 JDZIXQ.exe 2396 JDZIXQ.exe 1880 IOXG.exe 1880 IOXG.exe 5932 GOXUFFF.exe 5932 GOXUFFF.exe 2428 XOZZJ.exe 2428 XOZZJ.exe 6096 SCEITKE.exe 6096 SCEITKE.exe 768 HFN.exe 768 HFN.exe 1636 LNCVQPT.exe 1636 LNCVQPT.exe 4068 RIT.exe 4068 RIT.exe 2404 MVYNF.exe 2404 MVYNF.exe 1864 EYKI.exe 1864 EYKI.exe 5832 ZBSHZLC.exe 5832 ZBSHZLC.exe 2796 SEW.exe 2796 SEW.exe 3728 NRBMP.exe 3728 NRBMP.exe 5756 NVEQ.exe 5756 NVEQ.exe 3412 RLLQGR.exe 3412 RLLQGR.exe 4532 VTSY.exe 4532 VTSY.exe 5300 QGWHDB.exe 5300 QGWHDB.exe 4884 BYZADQI.exe 4884 BYZADQI.exe 2560 EMEK.exe 2560 EMEK.exe 4108 ICLKZA.exe 4108 ICLKZA.exe 3212 CPQ.exe 3212 CPQ.exe 5768 IKPCGD.exe 5768 IKPCGD.exe 4112 GLXPXF.exe 4112 GLXPXF.exe 5780 JYB.exe 5780 JYB.exe 2536 DLGIKFB.exe 2536 DLGIKFB.exe 4996 WOK.exe 4996 WOK.exe 5860 CPSSGP.exe 5860 CPSSGP.exe 4284 WCWJJPB.exe 4284 WCWJJPB.exe 3240 ASDJV.exe 3240 ASDJV.exe 4728 IYVYWU.exe 4728 IYVYWU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4900 2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe 4900 2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe 5476 HMXNDP.exe 5476 HMXNDP.exe 2396 JDZIXQ.exe 2396 JDZIXQ.exe 1880 IOXG.exe 1880 IOXG.exe 5932 GOXUFFF.exe 5932 GOXUFFF.exe 2428 XOZZJ.exe 2428 XOZZJ.exe 6096 SCEITKE.exe 6096 SCEITKE.exe 768 HFN.exe 768 HFN.exe 1636 LNCVQPT.exe 1636 LNCVQPT.exe 4068 RIT.exe 4068 RIT.exe 2404 MVYNF.exe 2404 MVYNF.exe 1864 EYKI.exe 1864 EYKI.exe 5832 ZBSHZLC.exe 5832 ZBSHZLC.exe 2796 SEW.exe 2796 SEW.exe 3728 NRBMP.exe 3728 NRBMP.exe 5756 NVEQ.exe 5756 NVEQ.exe 3412 RLLQGR.exe 3412 RLLQGR.exe 4532 VTSY.exe 4532 VTSY.exe 5300 QGWHDB.exe 5300 QGWHDB.exe 4884 BYZADQI.exe 4884 BYZADQI.exe 2560 EMEK.exe 2560 EMEK.exe 4108 ICLKZA.exe 4108 ICLKZA.exe 3212 CPQ.exe 3212 CPQ.exe 5768 IKPCGD.exe 5768 IKPCGD.exe 4112 GLXPXF.exe 4112 GLXPXF.exe 5780 JYB.exe 5780 JYB.exe 2536 DLGIKFB.exe 2536 DLGIKFB.exe 4996 WOK.exe 4996 WOK.exe 5860 CPSSGP.exe 5860 CPSSGP.exe 4284 WCWJJPB.exe 4284 WCWJJPB.exe 3240 ASDJV.exe 3240 ASDJV.exe 4728 IYVYWU.exe 4728 IYVYWU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 4244 4900 2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe 89 PID 4244 wrote to memory of 5476 4244 cmd.exe 93 PID 5476 wrote to memory of 4464 5476 HMXNDP.exe 95 PID 4464 wrote to memory of 2396 4464 cmd.exe 99 PID 2396 wrote to memory of 4344 2396 JDZIXQ.exe 100 PID 4344 wrote to memory of 1880 4344 cmd.exe 104 PID 1880 wrote to memory of 6008 1880 IOXG.exe 105 PID 6008 wrote to memory of 5932 6008 cmd.exe 109 PID 5932 wrote to memory of 5844 5932 GOXUFFF.exe 110 PID 5844 wrote to memory of 2428 5844 cmd.exe 114 PID 2428 wrote to memory of 2644 2428 XOZZJ.exe 115 PID 2644 wrote to memory of 6096 2644 cmd.exe 119 PID 6096 wrote to memory of 4176 6096 SCEITKE.exe 120 PID 4176 wrote to memory of 768 4176 cmd.exe 124 PID 768 wrote to memory of 4076 768 HFN.exe 125 PID 4076 wrote to memory of 1636 4076 cmd.exe 129 PID 1636 wrote to memory of 4412 1636 LNCVQPT.exe 130 PID 4412 wrote to memory of 4068 4412 cmd.exe 134 PID 4068 wrote to memory of 4572 4068 RIT.exe 135 PID 4572 wrote to memory of 2404 4572 cmd.exe 138 PID 2404 wrote to memory of 2744 2404 MVYNF.exe 140 PID 2744 wrote to memory of 1864 2744 cmd.exe 144 PID 1864 wrote to memory of 1344 1864 EYKI.exe 145 PID 1344 wrote to memory of 5832 1344 cmd.exe 149 PID 5832 wrote to memory of 4432 5832 ZBSHZLC.exe 150 PID 4432 wrote to memory of 2796 4432 cmd.exe 154 PID 2796 wrote to memory of 6116 2796 SEW.exe 155 PID 6116 wrote to memory of 3728 6116 cmd.exe 159 PID 3728 wrote to memory of 5632 3728 NRBMP.exe 160 PID 5632 wrote to memory of 5756 5632 cmd.exe 164 PID 5756 wrote to memory of 2756 5756 NVEQ.exe 165 PID 2756 wrote to memory of 3412 2756 cmd.exe 169 PID 3412 wrote to memory of 3428 3412 RLLQGR.exe 170 PID 3428 wrote to memory of 4532 3428 cmd.exe 174 PID 4532 wrote to memory of 5236 4532 VTSY.exe 175 PID 5236 wrote to memory of 5300 5236 cmd.exe 179 PID 5300 wrote to memory of 4356 5300 QGWHDB.exe 180 PID 4356 wrote to memory of 4884 4356 cmd.exe 184 PID 4884 wrote to memory of 4724 4884 BYZADQI.exe 185 PID 4724 wrote to memory of 2560 4724 cmd.exe 189 PID 2560 wrote to memory of 5740 2560 EMEK.exe 190 PID 5740 wrote to memory of 4108 5740 cmd.exe 194 PID 4108 wrote to memory of 4764 4108 ICLKZA.exe 195 PID 4764 wrote to memory of 3212 4764 cmd.exe 199 PID 3212 wrote to memory of 3180 3212 CPQ.exe 200 PID 3180 wrote to memory of 5768 3180 cmd.exe 204 PID 5768 wrote to memory of 4688 5768 IKPCGD.exe 205 PID 4688 wrote to memory of 4112 4688 cmd.exe 209 PID 4112 wrote to memory of 1828 4112 GLXPXF.exe 210 PID 1828 wrote to memory of 5780 1828 cmd.exe 214 PID 5780 wrote to memory of 6060 5780 JYB.exe 215 PID 6060 wrote to memory of 2536 6060 cmd.exe 219 PID 2536 wrote to memory of 1136 2536 DLGIKFB.exe 220 PID 1136 wrote to memory of 4996 1136 cmd.exe 224 PID 4996 wrote to memory of 2096 4996 WOK.exe 225 PID 2096 wrote to memory of 5860 2096 cmd.exe 229 PID 5860 wrote to memory of 992 5860 CPSSGP.exe 230 PID 992 wrote to memory of 4284 992 cmd.exe 234 PID 4284 wrote to memory of 1720 4284 WCWJJPB.exe 235 PID 1720 wrote to memory of 3240 1720 cmd.exe 239 PID 3240 wrote to memory of 3556 3240 ASDJV.exe 240 PID 3556 wrote to memory of 4728 3556 cmd.exe 244 PID 4728 wrote to memory of 6040 4728 IYVYWU.exe 245 PID 6040 wrote to memory of 3480 6040 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_b24c75674cd2ed21da981b818ea47d14_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMXNDP.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\HMXNDP.exeC:\windows\HMXNDP.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDZIXQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\windows\SysWOW64\JDZIXQ.exeC:\windows\system32\JDZIXQ.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOXG.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\system\IOXG.exeC:\windows\system\IOXG.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GOXUFFF.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\system\GOXUFFF.exeC:\windows\system\GOXUFFF.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOZZJ.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\system\XOZZJ.exeC:\windows\system\XOZZJ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCEITKE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\SCEITKE.exeC:\windows\SCEITKE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HFN.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\windows\system\HFN.exeC:\windows\system\HFN.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNCVQPT.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\LNCVQPT.exeC:\windows\LNCVQPT.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIT.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\SysWOW64\RIT.exeC:\windows\system32\RIT.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MVYNF.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\MVYNF.exeC:\windows\MVYNF.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYKI.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\windows\SysWOW64\EYKI.exeC:\windows\system32\EYKI.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBSHZLC.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\windows\ZBSHZLC.exeC:\windows\ZBSHZLC.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEW.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\SysWOW64\SEW.exeC:\windows\system32\SEW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRBMP.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\windows\system\NRBMP.exeC:\windows\system\NRBMP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVEQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\system\NVEQ.exeC:\windows\system\NVEQ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLLQGR.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\windows\SysWOW64\RLLQGR.exeC:\windows\system32\RLLQGR.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTSY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\windows\SysWOW64\VTSY.exeC:\windows\system32\VTSY.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGWHDB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\windows\QGWHDB.exeC:\windows\QGWHDB.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYZADQI.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\system\BYZADQI.exeC:\windows\system\BYZADQI.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EMEK.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\EMEK.exeC:\windows\EMEK.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ICLKZA.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\windows\system\ICLKZA.exeC:\windows\system\ICLKZA.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\system\CPQ.exeC:\windows\system\CPQ.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKPCGD.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\windows\IKPCGD.exeC:\windows\IKPCGD.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLXPXF.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\windows\GLXPXF.exeC:\windows\GLXPXF.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYB.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\windows\JYB.exeC:\windows\JYB.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLGIKFB.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\DLGIKFB.exeC:\windows\DLGIKFB.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOK.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\windows\system\WOK.exeC:\windows\system\WOK.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPSSGP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\windows\CPSSGP.exeC:\windows\CPSSGP.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCWJJPB.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:992 -
C:\windows\SysWOW64\WCWJJPB.exeC:\windows\system32\WCWJJPB.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASDJV.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\windows\system\ASDJV.exeC:\windows\system\ASDJV.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYVYWU.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\windows\SysWOW64\IYVYWU.exeC:\windows\system32\IYVYWU.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTN.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\XTN.exeC:\windows\XTN.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOEL.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2788 -
C:\windows\SysWOW64\WOEL.exeC:\windows\system32\WOEL.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOLYDMR.exe.bat" "68⤵PID:2356
-
C:\windows\system\BOLYDMR.exeC:\windows\system\BOLYDMR.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOTM.exe.bat" "70⤵
- Executes a command shell one-liner
PID:236 -
C:\windows\system\HOTM.exeC:\windows\system\HOTM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "72⤵PID:2116
-
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EAZQVD.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5508 -
C:\windows\EAZQVD.exeC:\windows\EAZQVD.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDD.exe.bat" "76⤵PID:5732
-
C:\windows\EDD.exeC:\windows\EDD.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVGM.exe.bat" "78⤵PID:5800
-
C:\windows\QVGM.exeC:\windows\QVGM.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "80⤵PID:2036
-
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJK.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3168 -
C:\windows\system\QJK.exeC:\windows\system\QJK.exe83⤵
- Executes dropped EXE
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWPTM.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5956 -
C:\windows\system\LWPTM.exeC:\windows\system\LWPTM.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMW.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4496 -
C:\windows\SysWOW64\PMW.exeC:\windows\system32\PMW.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNYG.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:464 -
C:\windows\system\YNYG.exeC:\windows\system\YNYG.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQC.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1992 -
C:\windows\ZQC.exeC:\windows\ZQC.exe91⤵
- Executes dropped EXE
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVURFD.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:2196 -
C:\windows\system\VVURFD.exeC:\windows\system\VVURFD.exe93⤵
- Executes dropped EXE
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLVQE.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2204 -
C:\windows\system\LLVQE.exeC:\windows\system\LLVQE.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DGZMRPD.exe.bat" "96⤵PID:3584
-
C:\windows\SysWOW64\DGZMRPD.exeC:\windows\system32\DGZMRPD.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWFM.exe.bat" "98⤵PID:4372
-
C:\windows\PWFM.exeC:\windows\PWFM.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCSB.exe.bat" "100⤵PID:4044
-
C:\windows\system\XCSB.exeC:\windows\system\XCSB.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SXXKR.exe.bat" "102⤵PID:5628
-
C:\windows\SysWOW64\SXXKR.exeC:\windows\system32\SXXKR.exe103⤵
- Executes dropped EXE
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BXZP.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2332 -
C:\windows\BXZP.exeC:\windows\BXZP.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIHOIOH.exe.bat" "106⤵PID:5268
-
C:\windows\WIHOIOH.exeC:\windows\WIHOIOH.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIJ.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4804 -
C:\windows\GIJ.exeC:\windows\GIJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VDTXFG.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4980 -
C:\windows\system\VDTXFG.exeC:\windows\system\VDTXFG.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZSY.exe.bat" "112⤵PID:5624
-
C:\windows\BZSY.exeC:\windows\BZSY.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCWCPZ.exe.bat" "114⤵PID:1100
-
C:\windows\UCWCPZ.exeC:\windows\UCWCPZ.exe115⤵
- Executes dropped EXE
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACD.exe.bat" "116⤵PID:3900
-
C:\windows\system\ACD.exeC:\windows\system\ACD.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BARKF.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2944 -
C:\windows\system\BARKF.exeC:\windows\system\BARKF.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TATP.exe.bat" "120⤵PID:4380
-
C:\windows\system\TATP.exeC:\windows\system\TATP.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-