Analysis
- max time kernel
83s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 17:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe
- Size 208KB
- Sample260729-vtxvxack5t
- SHA256 e289377ee5e51ff46be8430aabd4577e8ecb618d5d0263b0876c454eecb259dc
- MD5 a4bd1379c32e52e7d2abc4d90ae6f9a6
- SHA1 55f1f599c58a1d5be69e7366465cee48bf424598
- SHA512 de7ad39e50c15017b93bc1cb58a5814d2283488e1cfc4c2935bf1f4909db8eb68ed03d28c619ed0dda29f3b6a540b9544ebe568b0d6ee38a8616f1146a9d113d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfY4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LOQkEj1
- TLSH T130247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3440 HBFJRB.exe 2396 WHY.exe 2064 PKCAL.exe 4816 JXGJWKU.exe 4576 RLLQGR.exe 3436 HTMPN.exe 5268 LJTPZWA.exe 4824 UGGKH.exe 4612 RHIMKB.exe 2984 OMAB.exe 3164 NXD.exe 5452 VDQ.exe 4304 DQU.exe 5792 WJK.exe 5084 CEJ.exe 4108 VZNUYBZ.exe 4060 XUE.exe 3792 PVS.exe 4928 ELTADZG.exe 5668 GIZN.exe 5692 FTK.exe 5008 TPN.exe 4760 PUG.exe 4116 IXKPC.exe 5500 SVPJS.exe 2700 TYBNXBA.exe 4452 BDGTIA.exe 2264 TGJPN.exe 2400 SRUF.exe 5584 LKCQFXJ.exe 5028 TADPMS.exe 3704 TDGLR.exe 5504 MGSPFY.exe 4772 WEYBMG.exe 3484 EJCQX.exe 4688 XMOLCDO.exe 3452 FSTSNBK.exe 3780 KSBG.exe 5124 JDD.exe 3028 WOUUTM.exe 752 GLZPAV.exe 3596 URZS.exe 1208 PUQRYRI.exe 1580 GFTHZX.exe 2476 ZFISQY.exe 1856 YQL.exe 5104 XBOYISX.exe 3648 KMEXOVS.exe 2528 DZDVTW.exe 6120 CPWQ.exe 5980 ZPYAS.exe 5032 QYNXEW.exe 4292 AVA.exe 4092 EYYNUY.exe 3272 PRGYDZ.exe 5716 USQAH.exe 3656 WPVUW.exe 4376 BVN.exe 4608 HIZDS.exe 876 FBCT.exe 2068 VRDSI.exe 4988 HZWKVAW.exe 5984 QHYPZ.exe 2912 PSBF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\VZNUYBZ.exe CEJ.exe File opened for modification C:\windows\SysWOW64\XMOLCDO.exe EJCQX.exe File created C:\windows\SysWOW64\PRGYDZ.exe EYYNUY.exe File created C:\windows\SysWOW64\VRDSI.exe FBCT.exe File opened for modification C:\windows\SysWOW64\PSBF.exe QHYPZ.exe File created C:\windows\SysWOW64\EGJATH.exe AYUA.exe File created C:\windows\SysWOW64\VZNUYBZ.exe.bat CEJ.exe File created C:\windows\SysWOW64\PUG.exe TPN.exe File created C:\windows\SysWOW64\JDD.exe KSBG.exe File opened for modification C:\windows\SysWOW64\JDD.exe KSBG.exe File created C:\windows\SysWOW64\VRDSI.exe.bat FBCT.exe File created C:\windows\SysWOW64\KGAOYM.exe ULR.exe File created C:\windows\SysWOW64\HCA.exe.bat RRC.exe File created C:\windows\SysWOW64\ZPYI.exe VHRIOBH.exe File created C:\windows\SysWOW64\SRUF.exe TGJPN.exe File created C:\windows\SysWOW64\XMOLCDO.exe EJCQX.exe File created C:\windows\SysWOW64\EGJATH.exe.bat AYUA.exe File created C:\windows\SysWOW64\YBO.exe EGJATH.exe File opened for modification C:\windows\SysWOW64\SZVJ.exe TOKTG.exe File created C:\windows\SysWOW64\CPJ.exe MMASZM.exe File created C:\windows\SysWOW64\JXGJWKU.exe PKCAL.exe File opened for modification C:\windows\SysWOW64\JXGJWKU.exe PKCAL.exe File created C:\windows\SysWOW64\VDQ.exe.bat NXD.exe File created C:\windows\SysWOW64\PUG.exe.bat TPN.exe File opened for modification C:\windows\SysWOW64\QZG.exe SEHYQO.exe File created C:\windows\SysWOW64\KGAOYM.exe.bat ULR.exe File created C:\windows\SysWOW64\KJEK.exe KGAOYM.exe File created C:\windows\SysWOW64\NJVIYI.exe.bat DMQOQA.exe File created C:\windows\SysWOW64\FSTSNBK.exe.bat XMOLCDO.exe File opened for modification C:\windows\SysWOW64\PRGYDZ.exe EYYNUY.exe File opened for modification C:\windows\SysWOW64\VRDSI.exe FBCT.exe File created C:\windows\SysWOW64\HCA.exe RRC.exe File created C:\windows\SysWOW64\SZVJ.exe.bat TOKTG.exe File created C:\windows\SysWOW64\PSBF.exe.bat QHYPZ.exe File opened for modification C:\windows\SysWOW64\ULR.exe FUQL.exe File created C:\windows\SysWOW64\XMOLCDO.exe.bat EJCQX.exe File created C:\windows\SysWOW64\JXGJWKU.exe.bat PKCAL.exe File created C:\windows\SysWOW64\RLLQGR.exe JXGJWKU.exe File opened for modification C:\windows\SysWOW64\SRUF.exe TGJPN.exe File created C:\windows\SysWOW64\SZVJ.exe TOKTG.exe File opened for modification C:\windows\SysWOW64\HBFJRB.exe 2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe File created C:\windows\SysWOW64\JDD.exe.bat KSBG.exe File created C:\windows\SysWOW64\ZPYI.exe.bat VHRIOBH.exe File created C:\windows\SysWOW64\XKXRXOK.exe ZPYI.exe File created C:\windows\SysWOW64\CPJ.exe.bat MMASZM.exe File created C:\windows\SysWOW64\ULR.exe FUQL.exe File opened for modification C:\windows\SysWOW64\KJEK.exe KGAOYM.exe File opened for modification C:\windows\SysWOW64\DMQOQA.exe KJEK.exe File opened for modification C:\windows\SysWOW64\VHRIOBH.exe TMNZE.exe File opened for modification C:\windows\SysWOW64\ZPYI.exe VHRIOBH.exe File created C:\windows\SysWOW64\HBFJRB.exe 2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\FSTSNBK.exe XMOLCDO.exe File created C:\windows\SysWOW64\PSBF.exe QHYPZ.exe File created C:\windows\SysWOW64\HWSKD.exe ZRFDB.exe File created C:\windows\SysWOW64\RLLQGR.exe.bat JXGJWKU.exe File created C:\windows\SysWOW64\DMQOQA.exe KJEK.exe File created C:\windows\SysWOW64\SRUF.exe.bat TGJPN.exe File created C:\windows\SysWOW64\HWSKD.exe.bat ZRFDB.exe File created C:\windows\SysWOW64\KJEK.exe.bat KGAOYM.exe File created C:\windows\SysWOW64\DMQOQA.exe.bat KJEK.exe File created C:\windows\SysWOW64\PVS.exe XUE.exe File opened for modification C:\windows\SysWOW64\KMEXOVS.exe XBOYISX.exe File created C:\windows\SysWOW64\KMEXOVS.exe.bat XBOYISX.exe File opened for modification C:\windows\SysWOW64\HWSKD.exe ZRFDB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\JIEYH.exe.bat BUAJW.exe File opened for modification C:\windows\system\UQTYTQM.exe JIEYH.exe File opened for modification C:\windows\system\HTMPN.exe RLLQGR.exe File created C:\windows\MGSPFY.exe.bat TDGLR.exe File created C:\windows\WOUUTM.exe JDD.exe File created C:\windows\FBCT.exe HIZDS.exe File created C:\windows\SEHYQO.exe.bat RJDC.exe File created C:\windows\TMNZE.exe GJWAQRX.exe File opened for modification C:\windows\TMNZE.exe GJWAQRX.exe File created C:\windows\EITVF.exe UKNBP.exe File created C:\windows\system\WJK.exe.bat DQU.exe File created C:\windows\CEJ.exe.bat WJK.exe File created C:\windows\system\XUE.exe VZNUYBZ.exe File opened for modification C:\windows\HIZDS.exe BVN.exe File created C:\windows\ZRFDB.exe.bat MGXNMKT.exe File created C:\windows\system\MMASZM.exe.bat SZVJ.exe File created C:\windows\NXD.exe OMAB.exe File created C:\windows\system\WEYBMG.exe MGSPFY.exe File opened for modification C:\windows\system\EJCQX.exe WEYBMG.exe File created C:\windows\system\GLZPAV.exe.bat WOUUTM.exe File opened for modification C:\windows\URZS.exe GLZPAV.exe File created C:\windows\CPWQ.exe.bat DZDVTW.exe File opened for modification C:\windows\QYNXEW.exe ZPYAS.exe File created C:\windows\TDT.exe.bat CDREWPQ.exe File created C:\windows\system\IXKPC.exe.bat PUG.exe File opened for modification C:\windows\TADPMS.exe LKCQFXJ.exe File opened for modification C:\windows\DZDVTW.exe KMEXOVS.exe File opened for modification C:\windows\CPWQ.exe DZDVTW.exe File created C:\windows\HZWKVAW.exe VRDSI.exe File opened for modification C:\windows\system\RJDC.exe CGUYAL.exe File opened for modification C:\windows\system\FUQL.exe QZG.exe File created C:\windows\system\RRC.exe.bat NJVIYI.exe File created C:\windows\system\XUE.exe.bat VZNUYBZ.exe File created C:\windows\SVPJS.exe IXKPC.exe File created C:\windows\system\GLZPAV.exe WOUUTM.exe File created C:\windows\HIZDS.exe.bat BVN.exe File created C:\windows\system\ELTADZG.exe PVS.exe File created C:\windows\system\ELTADZG.exe.bat PVS.exe File created C:\windows\PUQRYRI.exe.bat URZS.exe File created C:\windows\GFTHZX.exe PUQRYRI.exe File opened for modification C:\windows\system\AYUA.exe XKXRXOK.exe File created C:\windows\system\TOKTG.exe YBO.exe File opened for modification C:\windows\system\TOKTG.exe YBO.exe File created C:\windows\system\UKNBP.exe.bat CPJ.exe File opened for modification C:\windows\RHIMKB.exe UGGKH.exe File created C:\windows\GIZN.exe.bat ELTADZG.exe File opened for modification C:\windows\system\MGXNMKT.exe TDT.exe File created C:\windows\system\FUQL.exe QZG.exe File opened for modification C:\windows\system\RRC.exe NJVIYI.exe File created C:\windows\RAGAZV.exe.bat HCA.exe File opened for modification C:\windows\OMAB.exe RHIMKB.exe File created C:\windows\system\USQAH.exe.bat PRGYDZ.exe File created C:\windows\system\TOKTG.exe.bat YBO.exe File created C:\windows\TADPMS.exe LKCQFXJ.exe File created C:\windows\system\TDGLR.exe TADPMS.exe File created C:\windows\WPVUW.exe.bat USQAH.exe File created C:\windows\CGUYAL.exe UQTYTQM.exe File opened for modification C:\windows\SEHYQO.exe RJDC.exe File opened for modification C:\windows\EITVF.exe UKNBP.exe File opened for modification C:\windows\system\TPN.exe FTK.exe File created C:\windows\URZS.exe.bat GLZPAV.exe File created C:\windows\DZDVTW.exe.bat KMEXOVS.exe File created C:\windows\TDT.exe CDREWPQ.exe File created C:\windows\system\AYUA.exe.bat XKXRXOK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1368 cmd.exe 2236 cmd.exe 5256 cmd.exe 3456 cmd.exe 3800 cmd.exe 2000 cmd.exe 3664 cmd.exe 4492 cmd.exe 4704 cmd.exe 2960 cmd.exe 2660 cmd.exe 3496 cmd.exe 4396 cmd.exe 5816 cmd.exe 3284 cmd.exe 3720 cmd.exe 5940 cmd.exe 2328 cmd.exe 1484 cmd.exe 5680 cmd.exe 968 cmd.exe 1244 cmd.exe 4540 cmd.exe 5880 cmd.exe 2036 cmd.exe 5852 cmd.exe 1348 cmd.exe 5352 cmd.exe 2744 cmd.exe 1316 cmd.exe 2872 cmd.exe 2456 cmd.exe 4656 cmd.exe 5712 cmd.exe 3088 cmd.exe 3008 cmd.exe 5260 cmd.exe 4804 cmd.exe 4088 cmd.exe 5172 cmd.exe 4248 cmd.exe 4920 cmd.exe 5796 cmd.exe 1224 cmd.exe 5316 cmd.exe 428 cmd.exe 2436 cmd.exe 5344 cmd.exe 4696 cmd.exe 3700 cmd.exe 5932 cmd.exe 4960 cmd.exe 824 cmd.exe 5952 cmd.exe 5540 cmd.exe 1296 cmd.exe 5400 cmd.exe 2876 cmd.exe 4424 cmd.exe 1888 cmd.exe 6036 cmd.exe 2524 cmd.exe 5168 cmd.exe 1308 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1084 5164 WerFault.exe 87 2024 3440 WerFault.exe 93 3196 2396 WerFault.exe 99 1296 2064 WerFault.exe 104 2604 4816 WerFault.exe 109 1212 4576 WerFault.exe 114 5256 3436 WerFault.exe 119 4624 5268 WerFault.exe 124 3112 4824 WerFault.exe 129 5196 4612 WerFault.exe 133 3816 2984 WerFault.exe 139 4184 3164 WerFault.exe 144 4760 5452 WerFault.exe 149 5000 4304 WerFault.exe 154 3936 5792 WerFault.exe 159 2432 5084 WerFault.exe 164 2816 4108 WerFault.exe 169 3268 4060 WerFault.exe 174 2748 3792 WerFault.exe 179 3380 4928 WerFault.exe 184 1472 5668 WerFault.exe 189 1136 5692 WerFault.exe 194 784 5008 WerFault.exe 199 1948 4760 WerFault.exe 204 4120 4116 WerFault.exe 209 3232 5500 WerFault.exe 214 1332 2700 WerFault.exe 219 5168 4452 WerFault.exe 223 5260 2264 WerFault.exe 229 1012 2400 WerFault.exe 234 1104 5584 WerFault.exe 239 2004 5028 WerFault.exe 244 4552 3704 WerFault.exe 249 3420 5504 WerFault.exe 254 5116 4772 WerFault.exe 259 2768 3484 WerFault.exe 264 4104 4688 WerFault.exe 270 2628 3452 WerFault.exe 275 2748 3780 WerFault.exe 280 1012 5124 WerFault.exe 285 5576 3028 WerFault.exe 290 2416 752 WerFault.exe 295 6012 3596 WerFault.exe 300 5660 1208 WerFault.exe 305 4620 1580 WerFault.exe 310 2432 2476 WerFault.exe 315 5908 1856 WerFault.exe 320 2628 5104 WerFault.exe 325 5804 3648 WerFault.exe 330 5700 2528 WerFault.exe 335 1268 6120 WerFault.exe 340 5712 5980 WerFault.exe 345 3304 5032 WerFault.exe 350 820 4292 WerFault.exe 355 700 4092 WerFault.exe 360 436 3272 WerFault.exe 365 5624 5716 WerFault.exe 370 3088 3656 WerFault.exe 375 2944 4376 WerFault.exe 380 2868 4608 WerFault.exe 385 4552 876 WerFault.exe 390 264 2068 WerFault.exe 395 5024 4988 WerFault.exe 400 5096 5984 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ULR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJWAQRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZNUYBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFISQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRFDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDGTIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TYBNXBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USQAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHYPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWSKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJVIYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGAOYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGJATH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXD.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5164 2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe 5164 2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe 3440 HBFJRB.exe 3440 HBFJRB.exe 2396 WHY.exe 2396 WHY.exe 2064 PKCAL.exe 2064 PKCAL.exe 4816 JXGJWKU.exe 4816 JXGJWKU.exe 4576 RLLQGR.exe 4576 RLLQGR.exe 3436 HTMPN.exe 3436 HTMPN.exe 5268 LJTPZWA.exe 5268 LJTPZWA.exe 4824 UGGKH.exe 4824 UGGKH.exe 4612 RHIMKB.exe 4612 RHIMKB.exe 2984 OMAB.exe 2984 OMAB.exe 3164 NXD.exe 3164 NXD.exe 5452 VDQ.exe 5452 VDQ.exe 4304 DQU.exe 4304 DQU.exe 5792 WJK.exe 5792 WJK.exe 5084 CEJ.exe 5084 CEJ.exe 4108 VZNUYBZ.exe 4108 VZNUYBZ.exe 4060 XUE.exe 4060 XUE.exe 3792 PVS.exe 3792 PVS.exe 4928 ELTADZG.exe 4928 ELTADZG.exe 5668 GIZN.exe 5668 GIZN.exe 5692 FTK.exe 5692 FTK.exe 5008 TPN.exe 5008 TPN.exe 4760 PUG.exe 4760 PUG.exe 4116 IXKPC.exe 4116 IXKPC.exe 5500 SVPJS.exe 5500 SVPJS.exe 2700 TYBNXBA.exe 2700 TYBNXBA.exe 4452 BDGTIA.exe 4452 BDGTIA.exe 2264 TGJPN.exe 2264 TGJPN.exe 2400 SRUF.exe 2400 SRUF.exe 5584 LKCQFXJ.exe 5584 LKCQFXJ.exe 5028 TADPMS.exe 5028 TADPMS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5164 2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe 5164 2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe 3440 HBFJRB.exe 3440 HBFJRB.exe 2396 WHY.exe 2396 WHY.exe 2064 PKCAL.exe 2064 PKCAL.exe 4816 JXGJWKU.exe 4816 JXGJWKU.exe 4576 RLLQGR.exe 4576 RLLQGR.exe 3436 HTMPN.exe 3436 HTMPN.exe 5268 LJTPZWA.exe 5268 LJTPZWA.exe 4824 UGGKH.exe 4824 UGGKH.exe 4612 RHIMKB.exe 4612 RHIMKB.exe 2984 OMAB.exe 2984 OMAB.exe 3164 NXD.exe 3164 NXD.exe 5452 VDQ.exe 5452 VDQ.exe 4304 DQU.exe 4304 DQU.exe 5792 WJK.exe 5792 WJK.exe 5084 CEJ.exe 5084 CEJ.exe 4108 VZNUYBZ.exe 4108 VZNUYBZ.exe 4060 XUE.exe 4060 XUE.exe 3792 PVS.exe 3792 PVS.exe 4928 ELTADZG.exe 4928 ELTADZG.exe 5668 GIZN.exe 5668 GIZN.exe 5692 FTK.exe 5692 FTK.exe 5008 TPN.exe 5008 TPN.exe 4760 PUG.exe 4760 PUG.exe 4116 IXKPC.exe 4116 IXKPC.exe 5500 SVPJS.exe 5500 SVPJS.exe 2700 TYBNXBA.exe 2700 TYBNXBA.exe 4452 BDGTIA.exe 4452 BDGTIA.exe 2264 TGJPN.exe 2264 TGJPN.exe 2400 SRUF.exe 2400 SRUF.exe 5584 LKCQFXJ.exe 5584 LKCQFXJ.exe 5028 TADPMS.exe 5028 TADPMS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5164 wrote to memory of 5952 5164 2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe 89 PID 5952 wrote to memory of 3440 5952 cmd.exe 93 PID 3440 wrote to memory of 256 3440 HBFJRB.exe 95 PID 256 wrote to memory of 2396 256 cmd.exe 99 PID 2396 wrote to memory of 1116 2396 WHY.exe 100 PID 1116 wrote to memory of 2064 1116 cmd.exe 104 PID 2064 wrote to memory of 5540 2064 PKCAL.exe 105 PID 5540 wrote to memory of 4816 5540 cmd.exe 109 PID 4816 wrote to memory of 1324 4816 JXGJWKU.exe 110 PID 1324 wrote to memory of 4576 1324 cmd.exe 114 PID 4576 wrote to memory of 1536 4576 RLLQGR.exe 115 PID 1536 wrote to memory of 3436 1536 cmd.exe 119 PID 3436 wrote to memory of 3696 3436 HTMPN.exe 120 PID 3696 wrote to memory of 5268 3696 cmd.exe 124 PID 5268 wrote to memory of 1816 5268 LJTPZWA.exe 125 PID 1816 wrote to memory of 4824 1816 cmd.exe 129 PID 4824 wrote to memory of 2088 4824 UGGKH.exe 130 PID 2088 wrote to memory of 4612 2088 cmd.exe 133 PID 4612 wrote to memory of 3764 4612 RHIMKB.exe 135 PID 3764 wrote to memory of 2984 3764 cmd.exe 139 PID 2984 wrote to memory of 1308 2984 OMAB.exe 140 PID 1308 wrote to memory of 3164 1308 cmd.exe 144 PID 3164 wrote to memory of 5368 3164 NXD.exe 145 PID 5368 wrote to memory of 5452 5368 cmd.exe 149 PID 5452 wrote to memory of 3672 5452 VDQ.exe 150 PID 3672 wrote to memory of 4304 3672 cmd.exe 154 PID 4304 wrote to memory of 1068 4304 DQU.exe 155 PID 1068 wrote to memory of 5792 1068 cmd.exe 159 PID 5792 wrote to memory of 1316 5792 WJK.exe 160 PID 1316 wrote to memory of 5084 1316 cmd.exe 164 PID 5084 wrote to memory of 1140 5084 CEJ.exe 165 PID 1140 wrote to memory of 4108 1140 cmd.exe 169 PID 4108 wrote to memory of 2436 4108 VZNUYBZ.exe 170 PID 2436 wrote to memory of 4060 2436 cmd.exe 174 PID 4060 wrote to memory of 2324 4060 XUE.exe 175 PID 2324 wrote to memory of 3792 2324 cmd.exe 179 PID 3792 wrote to memory of 5816 3792 PVS.exe 180 PID 5816 wrote to memory of 4928 5816 cmd.exe 184 PID 4928 wrote to memory of 5356 4928 ELTADZG.exe 185 PID 5356 wrote to memory of 5668 5356 cmd.exe 189 PID 5668 wrote to memory of 5344 5668 GIZN.exe 190 PID 5344 wrote to memory of 5692 5344 cmd.exe 194 PID 5692 wrote to memory of 4492 5692 FTK.exe 195 PID 4492 wrote to memory of 5008 4492 cmd.exe 199 PID 5008 wrote to memory of 1244 5008 TPN.exe 200 PID 1244 wrote to memory of 4760 1244 cmd.exe 204 PID 4760 wrote to memory of 4540 4760 PUG.exe 205 PID 4540 wrote to memory of 4116 4540 cmd.exe 209 PID 4116 wrote to memory of 1296 4116 IXKPC.exe 210 PID 1296 wrote to memory of 5500 1296 cmd.exe 214 PID 5500 wrote to memory of 4324 5500 SVPJS.exe 215 PID 4324 wrote to memory of 2700 4324 cmd.exe 219 PID 2700 wrote to memory of 6036 2700 TYBNXBA.exe 220 PID 6036 wrote to memory of 4452 6036 cmd.exe 223 PID 4452 wrote to memory of 4068 4452 BDGTIA.exe 225 PID 4068 wrote to memory of 2264 4068 cmd.exe 229 PID 2264 wrote to memory of 5620 2264 TGJPN.exe 230 PID 5620 wrote to memory of 2400 5620 cmd.exe 234 PID 2400 wrote to memory of 1724 2400 SRUF.exe 235 PID 1724 wrote to memory of 5584 1724 cmd.exe 239 PID 5584 wrote to memory of 2524 5584 LKCQFXJ.exe 240 PID 2524 wrote to memory of 5028 2524 cmd.exe 244 PID 5028 wrote to memory of 3056 5028 TADPMS.exe 245 PID 3056 wrote to memory of 3704 3056 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_a4bd1379c32e52e7d2abc4d90ae6f9a6_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBFJRB.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\SysWOW64\HBFJRB.exeC:\windows\system32\HBFJRB.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WHY.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\system\WHY.exeC:\windows\system\WHY.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKCAL.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\PKCAL.exeC:\windows\PKCAL.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXGJWKU.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\SysWOW64\JXGJWKU.exeC:\windows\system32\JXGJWKU.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLLQGR.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\windows\SysWOW64\RLLQGR.exeC:\windows\system32\RLLQGR.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HTMPN.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\system\HTMPN.exeC:\windows\system\HTMPN.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJTPZWA.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\windows\LJTPZWA.exeC:\windows\LJTPZWA.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGGKH.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\system\UGGKH.exeC:\windows\system\UGGKH.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHIMKB.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\windows\RHIMKB.exeC:\windows\RHIMKB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMAB.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\OMAB.exeC:\windows\OMAB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXD.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\windows\NXD.exeC:\windows\NXD.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\windows\SysWOW64\VDQ.exeC:\windows\system32\VDQ.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQU.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\windows\system\DQU.exeC:\windows\system\DQU.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WJK.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\windows\system\WJK.exeC:\windows\system\WJK.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEJ.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\windows\CEJ.exeC:\windows\CEJ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZNUYBZ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\windows\SysWOW64\VZNUYBZ.exeC:\windows\system32\VZNUYBZ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUE.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\windows\system\XUE.exeC:\windows\system\XUE.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVS.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\windows\SysWOW64\PVS.exeC:\windows\system32\PVS.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELTADZG.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\system\ELTADZG.exeC:\windows\system\ELTADZG.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIZN.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\GIZN.exeC:\windows\GIZN.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTK.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\FTK.exeC:\windows\FTK.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TPN.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\system\TPN.exeC:\windows\system\TPN.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUG.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\SysWOW64\PUG.exeC:\windows\system32\PUG.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXKPC.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\system\IXKPC.exeC:\windows\system\IXKPC.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVPJS.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\windows\SVPJS.exeC:\windows\SVPJS.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYBNXBA.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\TYBNXBA.exeC:\windows\TYBNXBA.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGTIA.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\BDGTIA.exeC:\windows\BDGTIA.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGJPN.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\windows\system\TGJPN.exeC:\windows\system\TGJPN.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRUF.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\windows\SysWOW64\SRUF.exeC:\windows\system32\SRUF.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKCQFXJ.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\windows\system\LKCQFXJ.exeC:\windows\system\LKCQFXJ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TADPMS.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\windows\TADPMS.exeC:\windows\TADPMS.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDGLR.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\windows\system\TDGLR.exeC:\windows\system\TDGLR.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGSPFY.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4704 -
C:\windows\MGSPFY.exeC:\windows\MGSPFY.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEYBMG.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4232 -
C:\windows\system\WEYBMG.exeC:\windows\system\WEYBMG.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5880 -
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XMOLCDO.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2872 -
C:\windows\SysWOW64\XMOLCDO.exeC:\windows\system32\XMOLCDO.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSTSNBK.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2924 -
C:\windows\SysWOW64\FSTSNBK.exeC:\windows\system32\FSTSNBK.exe75⤵
- Executes dropped EXE
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSBG.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4896 -
C:\windows\KSBG.exeC:\windows\KSBG.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDD.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2036 -
C:\windows\SysWOW64\JDD.exeC:\windows\system32\JDD.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUUTM.exe.bat" "80⤵PID:2044
-
C:\windows\WOUUTM.exeC:\windows\WOUUTM.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLZPAV.exe.bat" "82⤵PID:4252
-
C:\windows\system\GLZPAV.exeC:\windows\system\GLZPAV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URZS.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4808 -
C:\windows\URZS.exeC:\windows\URZS.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUQRYRI.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3284 -
C:\windows\PUQRYRI.exeC:\windows\PUQRYRI.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GFTHZX.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4748 -
C:\windows\GFTHZX.exeC:\windows\GFTHZX.exe89⤵
- Executes dropped EXE
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFISQY.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3720 -
C:\windows\ZFISQY.exeC:\windows\ZFISQY.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQL.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4696 -
C:\windows\system\YQL.exeC:\windows\system\YQL.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBOYISX.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4536 -
C:\windows\XBOYISX.exeC:\windows\XBOYISX.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMEXOVS.exe.bat" "96⤵PID:576
-
C:\windows\SysWOW64\KMEXOVS.exeC:\windows\system32\KMEXOVS.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZDVTW.exe.bat" "98⤵PID:2564
-
C:\windows\DZDVTW.exeC:\windows\DZDVTW.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPWQ.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2960 -
C:\windows\CPWQ.exeC:\windows\CPWQ.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPYAS.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1104 -
C:\windows\system\ZPYAS.exeC:\windows\system\ZPYAS.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2456 -
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe105⤵
- Executes dropped EXE
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AVA.exe.bat" "106⤵PID:5868
-
C:\windows\AVA.exeC:\windows\AVA.exe107⤵
- Executes dropped EXE
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYYNUY.exe.bat" "108⤵PID:2508
-
C:\windows\EYYNUY.exeC:\windows\EYYNUY.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRGYDZ.exe.bat" "110⤵PID:5048
-
C:\windows\SysWOW64\PRGYDZ.exeC:\windows\system32\PRGYDZ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USQAH.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:1212 -
C:\windows\system\USQAH.exeC:\windows\system\USQAH.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPVUW.exe.bat" "114⤵
- Executes a command shell one-liner
PID:1368 -
C:\windows\WPVUW.exeC:\windows\WPVUW.exe115⤵
- Executes dropped EXE
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BVN.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\windows\BVN.exeC:\windows\BVN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIZDS.exe.bat" "118⤵PID:4716
-
C:\windows\HIZDS.exeC:\windows\HIZDS.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBCT.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5360 -
C:\windows\FBCT.exeC:\windows\FBCT.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-