Analysis
- max time kernel
86s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 17:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe
- Size 208KB
- Sample260802-v8m91styft
- SHA256 93ff55868f6f2894d084048b7b50df93dc11f1a191af7d4d4363141e568afb81
- MD5 91056a4ad1d37ec122798b650ccc6416
- SHA1 6713a6ae3334bc78d916953ae7afbaafa8c2e62c
- SHA512 520d57bea83361f79bc05ba110e74c6ca3c72daf0299691cd15cf35a6fbd3f715e38a33b6e9e7d2d945cafce27584e83a84155a8ac11d58ca71e1c3602c366ef
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf64pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOikEj1
- TLSH T179247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6712 BPVF.exe 4784 MSUZAIL.exe 4788 DAOEE.exe 3232 HIDEQYB.exe 2444 UTLDE.exe 6508 TEOT.exe 552 CMQYQM.exe 6288 RHZ.exe 6368 DACVJ.exe 1940 XNHEMO.exe 1308 JDOM.exe 4200 CYR.exe 240 PEZUNI.exe 5128 QHD.exe 3552 FCNCEK.exe 988 ENQSM.exe 3300 NNSXYW.exe 7160 RDYF.exe 6572 GYQJVB.exe 3716 KBOE.exe 5200 ZEXJGPO.exe 4920 URCS.exe 3776 GZJSCZ.exe 3064 KDHN.exe 2184 WTAOYE.exe 1072 EGMUI.exe 3196 XBQQ.exe 5440 DWPZS.exe 3572 BMB.exe 6724 FXZPFT.exe 4268 ENKSA.exe 1632 KIWLGV.exe 5068 JTHBP.exe 2248 CMOMYC.exe 4148 XHTVICE.exe 3216 MXUU.exe 6664 FSY.exe 7116 LSF.exe 1372 DVJIRXF.exe 4800 NTXU.exe 7040 WBZ.exe 2872 QUUA.exe 1924 HUIX.exe 5804 JSORES.exe 2088 EDEISV.exe 3700 ODG.exe 3612 XLIA.exe 1796 MGSESSJ.exe 1148 NJVIYI.exe 3708 CAWAFWI.exe 6904 VVADKU.exe 4132 ZLH.exe 2884 HQT.exe 616 WTDWSX.exe 1880 RGI.exe 3364 XCHG.exe 704 DCOUQU.exe 3284 VXS.exe 5812 NFUDHQ.exe 2864 QNB.exe 6056 UDILXA.exe 6036 YLO.exe 2812 OCPKQGN.exe 4676 DXHP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WTZCD.exe.bat DYV.exe File opened for modification C:\windows\SysWOW64\UEZRML.exe RJIQBR.exe File created C:\windows\SysWOW64\UEZRML.exe.bat RJIQBR.exe File opened for modification C:\windows\SysWOW64\UTLDE.exe HIDEQYB.exe File opened for modification C:\windows\SysWOW64\CMQYQM.exe TEOT.exe File created C:\windows\SysWOW64\CMQYQM.exe.bat TEOT.exe File created C:\windows\SysWOW64\ENQSM.exe.bat FCNCEK.exe File opened for modification C:\windows\SysWOW64\KBOE.exe GYQJVB.exe File created C:\windows\SysWOW64\WBZ.exe.bat NTXU.exe File created C:\windows\SysWOW64\NJVIYI.exe MGSESSJ.exe File opened for modification C:\windows\SysWOW64\ZZB.exe FLFZKVE.exe File created C:\windows\SysWOW64\BPVF.exe.bat 2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe File created C:\windows\SysWOW64\ODG.exe EDEISV.exe File created C:\windows\SysWOW64\HQT.exe.bat ZLH.exe File created C:\windows\SysWOW64\RGI.exe WTDWSX.exe File opened for modification C:\windows\SysWOW64\HCPXUK.exe NPKN.exe File created C:\windows\SysWOW64\XOCTMA.exe DTXKK.exe File opened for modification C:\windows\SysWOW64\XIIVWN.exe XFES.exe File created C:\windows\SysWOW64\CJZQPD.exe JRJFGK.exe File created C:\windows\SysWOW64\WBZ.exe NTXU.exe File opened for modification C:\windows\SysWOW64\HUIX.exe QUUA.exe File created C:\windows\SysWOW64\HCPXUK.exe.bat NPKN.exe File created C:\windows\SysWOW64\IFB.exe.bat HCPXUK.exe File created C:\windows\SysWOW64\UEZRML.exe RJIQBR.exe File created C:\windows\SysWOW64\CMOMYC.exe JTHBP.exe File created C:\windows\SysWOW64\BPVF.exe 2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe File created C:\windows\SysWOW64\UTLDE.exe.bat HIDEQYB.exe File created C:\windows\SysWOW64\ENQSM.exe FCNCEK.exe File opened for modification C:\windows\SysWOW64\ENQSM.exe FCNCEK.exe File created C:\windows\SysWOW64\BMB.exe DWPZS.exe File opened for modification C:\windows\SysWOW64\ODG.exe EDEISV.exe File created C:\windows\SysWOW64\ODG.exe.bat EDEISV.exe File created C:\windows\SysWOW64\MGSESSJ.exe.bat XLIA.exe File created C:\windows\SysWOW64\XNHEMO.exe DACVJ.exe File created C:\windows\SysWOW64\KBOE.exe GYQJVB.exe File created C:\windows\SysWOW64\QUUA.exe WBZ.exe File created C:\windows\SysWOW64\HUIX.exe.bat QUUA.exe File created C:\windows\SysWOW64\FLFZKVE.exe.bat NDDMH.exe File created C:\windows\SysWOW64\ZNREODW.exe.bat YKNAB.exe File created C:\windows\SysWOW64\DSPSGZN.exe.bat SZAHWYF.exe File opened for modification C:\windows\SysWOW64\MGSESSJ.exe XLIA.exe File created C:\windows\SysWOW64\VXS.exe DCOUQU.exe File created C:\windows\SysWOW64\FLFZKVE.exe NDDMH.exe File opened for modification C:\windows\SysWOW64\FLFZKVE.exe NDDMH.exe File opened for modification C:\windows\SysWOW64\XOCTMA.exe DTXKK.exe File opened for modification C:\windows\SysWOW64\WTZCD.exe DYV.exe File created C:\windows\SysWOW64\ZNREODW.exe YKNAB.exe File created C:\windows\SysWOW64\HUIX.exe QUUA.exe File opened for modification C:\windows\SysWOW64\NJVIYI.exe MGSESSJ.exe File created C:\windows\SysWOW64\RGI.exe.bat WTDWSX.exe File created C:\windows\SysWOW64\ZZB.exe.bat FLFZKVE.exe File created C:\windows\SysWOW64\JRJFGK.exe.bat BLFYVM.exe File opened for modification C:\windows\SysWOW64\BPVF.exe 2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\WBZ.exe NTXU.exe File created C:\windows\SysWOW64\MGSESSJ.exe XLIA.exe File created C:\windows\SysWOW64\WTZCD.exe DYV.exe File opened for modification C:\windows\SysWOW64\MSUZAIL.exe BPVF.exe File opened for modification C:\windows\SysWOW64\XNHEMO.exe DACVJ.exe File opened for modification C:\windows\SysWOW64\CMOMYC.exe JTHBP.exe File created C:\windows\SysWOW64\NJVIYI.exe.bat MGSESSJ.exe File opened for modification C:\windows\SysWOW64\YOEMNCZ.exe WTZCD.exe File created C:\windows\SysWOW64\YOEMNCZ.exe.bat WTZCD.exe File opened for modification C:\windows\SysWOW64\CJZQPD.exe JRJFGK.exe File created C:\windows\SysWOW64\MSUZAIL.exe.bat BPVF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\AUA.exe.bat QTGAUS.exe File created C:\windows\system\RJIQBR.exe.bat YOEMNCZ.exe File created C:\windows\system\ERQS.exe.bat MRONUKP.exe File created C:\windows\system\DAOEE.exe.bat MSUZAIL.exe File created C:\windows\XBQQ.exe EGMUI.exe File opened for modification C:\windows\NFUDHQ.exe VXS.exe File opened for modification C:\windows\AQDKV.exe DSPSGZN.exe File created C:\windows\RHZ.exe CMQYQM.exe File opened for modification C:\windows\ZLH.exe VVADKU.exe File opened for modification C:\windows\system\CAWAFWI.exe NJVIYI.exe File created C:\windows\system\CAWAFWI.exe.bat NJVIYI.exe File opened for modification C:\windows\VVADKU.exe CAWAFWI.exe File created C:\windows\VVADKU.exe.bat CAWAFWI.exe File opened for modification C:\windows\DCOUQU.exe XCHG.exe File opened for modification C:\windows\UDILXA.exe QNB.exe File created C:\windows\system\QHD.exe.bat PEZUNI.exe File opened for modification C:\windows\system\DWPZS.exe XBQQ.exe File created C:\windows\KXWN.exe BJV.exe File opened for modification C:\windows\system\XCHG.exe RGI.exe File created C:\windows\system\SBH.exe.bat XOCTMA.exe File opened for modification C:\windows\FSY.exe MXUU.exe File created C:\windows\EDEISV.exe.bat JSORES.exe File created C:\windows\XFES.exe.bat VQZXC.exe File opened for modification C:\windows\system\TMAWIUS.exe ERQS.exe File created C:\windows\DCOUQU.exe XCHG.exe File opened for modification C:\windows\system\AUA.exe QTGAUS.exe File created C:\windows\system\TAQM.exe AXMJLNR.exe File created C:\windows\CKMYXJ.exe UEZRML.exe File opened for modification C:\windows\system\CYR.exe JDOM.exe File created C:\windows\UDILXA.exe QNB.exe File opened for modification C:\windows\system\YLO.exe UDILXA.exe File created C:\windows\system\TQYC.exe DXHP.exe File opened for modification C:\windows\system\DYV.exe TAQM.exe File created C:\windows\system\ACBWP.exe TMAWIUS.exe File opened for modification C:\windows\system\QHD.exe PEZUNI.exe File created C:\windows\system\NDDMH.exe TQYC.exe File created C:\windows\system\NPKN.exe.bat SCNEALU.exe File created C:\windows\EDEISV.exe JSORES.exe File created C:\windows\VVADKU.exe CAWAFWI.exe File opened for modification C:\windows\system\ERQS.exe MRONUKP.exe File opened for modification C:\windows\YBPQG.exe SBH.exe File created C:\windows\BLFYVM.exe ZNREODW.exe File opened for modification C:\windows\GYQJVB.exe RDYF.exe File created C:\windows\OCPKQGN.exe YLO.exe File opened for modification C:\windows\system\TQYC.exe DXHP.exe File created C:\windows\system\DTXKK.exe.bat IFB.exe File created C:\windows\AQDKV.exe DSPSGZN.exe File opened for modification C:\windows\system\JSORES.exe HUIX.exe File opened for modification C:\windows\SCNEALU.exe ZZB.exe File created C:\windows\system\DTXKK.exe IFB.exe File created C:\windows\YBPQG.exe.bat SBH.exe File opened for modification C:\windows\YKNAB.exe CKMYXJ.exe File created C:\windows\system\NNSXYW.exe ENQSM.exe File created C:\windows\URCS.exe ZEXJGPO.exe File opened for modification C:\windows\system\QTGAUS.exe NDRA.exe File opened for modification C:\windows\XBNN.exe KQXPZE.exe File created C:\windows\system\QHD.exe PEZUNI.exe File created C:\windows\system\MXUU.exe.bat XHTVICE.exe File created C:\windows\WTAOYE.exe.bat KDHN.exe File created C:\windows\UDILXA.exe.bat QNB.exe File opened for modification C:\windows\system\SZAHWYF.exe CJZQPD.exe File opened for modification C:\windows\system\DAOEE.exe MSUZAIL.exe File opened for modification C:\windows\HIDEQYB.exe DAOEE.exe File created C:\windows\GYQJVB.exe.bat RDYF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4680 cmd.exe 1788 cmd.exe 3380 cmd.exe 3772 cmd.exe 4892 cmd.exe 848 cmd.exe 5652 cmd.exe 6900 cmd.exe 6344 cmd.exe 1404 cmd.exe 3456 cmd.exe 3516 cmd.exe 7104 cmd.exe 2728 cmd.exe 4276 cmd.exe 6172 cmd.exe 6872 cmd.exe 6612 cmd.exe 7080 cmd.exe 2908 cmd.exe 6916 cmd.exe 2036 cmd.exe 460 cmd.exe 4328 cmd.exe 5864 cmd.exe 1412 cmd.exe 1140 cmd.exe 3420 cmd.exe 1596 cmd.exe 5976 cmd.exe 6868 cmd.exe 4264 cmd.exe 4736 cmd.exe 4372 cmd.exe 980 cmd.exe 2836 cmd.exe 6964 cmd.exe 2988 cmd.exe 2112 cmd.exe 932 cmd.exe 6480 cmd.exe 2708 cmd.exe 5012 cmd.exe 1332 cmd.exe 5576 cmd.exe 5700 cmd.exe 6564 cmd.exe 4740 cmd.exe 1996 cmd.exe 2100 cmd.exe 4564 cmd.exe 6588 cmd.exe 4732 cmd.exe 4708 cmd.exe 3736 cmd.exe 1816 cmd.exe 4932 cmd.exe 5876 cmd.exe 3696 cmd.exe 4648 cmd.exe 3392 cmd.exe 4156 cmd.exe 3472 cmd.exe 5080 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3008 1212 WerFault.exe 86 3828 6712 WerFault.exe 92 3260 4784 WerFault.exe 98 4496 4788 WerFault.exe 103 2208 3232 WerFault.exe 108 4792 2444 WerFault.exe 113 4528 6508 WerFault.exe 118 6300 552 WerFault.exe 123 2184 6288 WerFault.exe 128 1720 6368 WerFault.exe 133 5108 1940 WerFault.exe 138 6684 1308 WerFault.exe 143 2864 4200 WerFault.exe 148 6056 240 WerFault.exe 153 4272 5128 WerFault.exe 158 3436 3552 WerFault.exe 163 1840 988 WerFault.exe 168 3172 3300 WerFault.exe 173 6324 7160 WerFault.exe 178 6892 6572 WerFault.exe 183 1584 3716 WerFault.exe 188 3412 5200 WerFault.exe 193 4392 4920 WerFault.exe 198 4800 3776 WerFault.exe 203 2060 3064 WerFault.exe 208 3372 2184 WerFault.exe 213 3384 1072 WerFault.exe 218 5300 3196 WerFault.exe 223 4524 5440 WerFault.exe 228 7096 3572 WerFault.exe 233 5424 6724 WerFault.exe 238 7044 4268 WerFault.exe 243 4724 1632 WerFault.exe 248 4216 5068 WerFault.exe 253 5832 2248 WerFault.exe 258 5436 4148 WerFault.exe 263 5628 3216 WerFault.exe 268 2380 6664 WerFault.exe 273 4528 7116 WerFault.exe 278 4904 1372 WerFault.exe 283 7148 4800 WerFault.exe 288 6804 7040 WerFault.exe 293 2572 2872 WerFault.exe 298 2820 1924 WerFault.exe 303 848 5804 WerFault.exe 308 5936 2088 WerFault.exe 313 6404 3700 WerFault.exe 318 6604 3612 WerFault.exe 323 1368 1796 WerFault.exe 328 4652 1148 WerFault.exe 333 3948 3708 WerFault.exe 338 3824 6904 WerFault.exe 343 6260 4132 WerFault.exe 348 4384 2884 WerFault.exe 353 6296 616 WerFault.exe 358 5472 1880 WerFault.exe 363 2824 3364 WerFault.exe 368 2944 704 WerFault.exe 373 1952 3284 WerFault.exe 378 6580 5812 WerFault.exe 383 4184 2864 WerFault.exe 388 2356 6056 WerFault.exe 393 4336 6036 WerFault.exe 398 1328 2812 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAOEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJVIYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCPKQGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DSPSGZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXZPFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCPXUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDRA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJZQPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGMUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCNEALU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFES.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMAWIUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTLDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWPZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENKSA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLFZKVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKNAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEZUNI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKMYXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLFYVM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRJFGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVADKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1212 2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe 1212 2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe 6712 BPVF.exe 6712 BPVF.exe 4784 MSUZAIL.exe 4784 MSUZAIL.exe 4788 DAOEE.exe 4788 DAOEE.exe 3232 HIDEQYB.exe 3232 HIDEQYB.exe 2444 UTLDE.exe 2444 UTLDE.exe 6508 TEOT.exe 6508 TEOT.exe 552 CMQYQM.exe 552 CMQYQM.exe 6288 RHZ.exe 6288 RHZ.exe 6368 DACVJ.exe 6368 DACVJ.exe 1940 XNHEMO.exe 1940 XNHEMO.exe 1308 JDOM.exe 1308 JDOM.exe 4200 CYR.exe 4200 CYR.exe 240 PEZUNI.exe 240 PEZUNI.exe 5128 QHD.exe 5128 QHD.exe 3552 FCNCEK.exe 3552 FCNCEK.exe 988 ENQSM.exe 988 ENQSM.exe 3300 NNSXYW.exe 3300 NNSXYW.exe 7160 RDYF.exe 7160 RDYF.exe 6572 GYQJVB.exe 6572 GYQJVB.exe 3716 KBOE.exe 3716 KBOE.exe 5200 ZEXJGPO.exe 5200 ZEXJGPO.exe 4920 URCS.exe 4920 URCS.exe 3776 GZJSCZ.exe 3776 GZJSCZ.exe 3064 KDHN.exe 3064 KDHN.exe 2184 WTAOYE.exe 2184 WTAOYE.exe 1072 EGMUI.exe 1072 EGMUI.exe 3196 XBQQ.exe 3196 XBQQ.exe 5440 DWPZS.exe 5440 DWPZS.exe 3572 BMB.exe 3572 BMB.exe 6724 FXZPFT.exe 6724 FXZPFT.exe 4268 ENKSA.exe 4268 ENKSA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1212 2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe 1212 2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe 6712 BPVF.exe 6712 BPVF.exe 4784 MSUZAIL.exe 4784 MSUZAIL.exe 4788 DAOEE.exe 4788 DAOEE.exe 3232 HIDEQYB.exe 3232 HIDEQYB.exe 2444 UTLDE.exe 2444 UTLDE.exe 6508 TEOT.exe 6508 TEOT.exe 552 CMQYQM.exe 552 CMQYQM.exe 6288 RHZ.exe 6288 RHZ.exe 6368 DACVJ.exe 6368 DACVJ.exe 1940 XNHEMO.exe 1940 XNHEMO.exe 1308 JDOM.exe 1308 JDOM.exe 4200 CYR.exe 4200 CYR.exe 240 PEZUNI.exe 240 PEZUNI.exe 5128 QHD.exe 5128 QHD.exe 3552 FCNCEK.exe 3552 FCNCEK.exe 988 ENQSM.exe 988 ENQSM.exe 3300 NNSXYW.exe 3300 NNSXYW.exe 7160 RDYF.exe 7160 RDYF.exe 6572 GYQJVB.exe 6572 GYQJVB.exe 3716 KBOE.exe 3716 KBOE.exe 5200 ZEXJGPO.exe 5200 ZEXJGPO.exe 4920 URCS.exe 4920 URCS.exe 3776 GZJSCZ.exe 3776 GZJSCZ.exe 3064 KDHN.exe 3064 KDHN.exe 2184 WTAOYE.exe 2184 WTAOYE.exe 1072 EGMUI.exe 1072 EGMUI.exe 3196 XBQQ.exe 3196 XBQQ.exe 5440 DWPZS.exe 5440 DWPZS.exe 3572 BMB.exe 3572 BMB.exe 6724 FXZPFT.exe 6724 FXZPFT.exe 4268 ENKSA.exe 4268 ENKSA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1212 wrote to memory of 1140 1212 2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe 88 PID 1140 wrote to memory of 6712 1140 cmd.exe 92 PID 6712 wrote to memory of 6888 6712 BPVF.exe 94 PID 6888 wrote to memory of 4784 6888 cmd.exe 98 PID 4784 wrote to memory of 6564 4784 MSUZAIL.exe 99 PID 6564 wrote to memory of 4788 6564 cmd.exe 103 PID 4788 wrote to memory of 5976 4788 DAOEE.exe 104 PID 5976 wrote to memory of 3232 5976 cmd.exe 108 PID 3232 wrote to memory of 3324 3232 HIDEQYB.exe 109 PID 3324 wrote to memory of 2444 3324 cmd.exe 113 PID 2444 wrote to memory of 4764 2444 UTLDE.exe 114 PID 4764 wrote to memory of 6508 4764 cmd.exe 118 PID 6508 wrote to memory of 6520 6508 TEOT.exe 119 PID 6520 wrote to memory of 552 6520 cmd.exe 123 PID 552 wrote to memory of 7052 552 CMQYQM.exe 124 PID 7052 wrote to memory of 6288 7052 cmd.exe 128 PID 6288 wrote to memory of 2320 6288 RHZ.exe 129 PID 2320 wrote to memory of 6368 2320 cmd.exe 133 PID 6368 wrote to memory of 4408 6368 DACVJ.exe 134 PID 4408 wrote to memory of 1940 4408 cmd.exe 138 PID 1940 wrote to memory of 6172 1940 XNHEMO.exe 139 PID 6172 wrote to memory of 1308 6172 cmd.exe 143 PID 1308 wrote to memory of 4580 1308 JDOM.exe 144 PID 4580 wrote to memory of 4200 4580 cmd.exe 148 PID 4200 wrote to memory of 6868 4200 CYR.exe 149 PID 6868 wrote to memory of 240 6868 cmd.exe 153 PID 240 wrote to memory of 5704 240 PEZUNI.exe 154 PID 5704 wrote to memory of 5128 5704 cmd.exe 158 PID 5128 wrote to memory of 2480 5128 QHD.exe 159 PID 2480 wrote to memory of 3552 2480 cmd.exe 163 PID 3552 wrote to memory of 3940 3552 FCNCEK.exe 164 PID 3940 wrote to memory of 988 3940 cmd.exe 168 PID 988 wrote to memory of 932 988 ENQSM.exe 169 PID 932 wrote to memory of 3300 932 cmd.exe 173 PID 3300 wrote to memory of 2420 3300 NNSXYW.exe 174 PID 2420 wrote to memory of 7160 2420 cmd.exe 178 PID 7160 wrote to memory of 6900 7160 RDYF.exe 179 PID 6900 wrote to memory of 6572 6900 cmd.exe 183 PID 6572 wrote to memory of 748 6572 GYQJVB.exe 184 PID 748 wrote to memory of 3716 748 cmd.exe 188 PID 3716 wrote to memory of 3388 3716 KBOE.exe 189 PID 3388 wrote to memory of 5200 3388 cmd.exe 193 PID 5200 wrote to memory of 4372 5200 ZEXJGPO.exe 194 PID 4372 wrote to memory of 4920 4372 cmd.exe 198 PID 4920 wrote to memory of 2376 4920 URCS.exe 199 PID 2376 wrote to memory of 3776 2376 cmd.exe 203 PID 3776 wrote to memory of 2800 3776 GZJSCZ.exe 204 PID 2800 wrote to memory of 3064 2800 cmd.exe 208 PID 3064 wrote to memory of 3696 3064 KDHN.exe 209 PID 3696 wrote to memory of 2184 3696 cmd.exe 213 PID 2184 wrote to memory of 5864 2184 WTAOYE.exe 214 PID 5864 wrote to memory of 1072 5864 cmd.exe 218 PID 1072 wrote to memory of 3448 1072 EGMUI.exe 219 PID 3448 wrote to memory of 3196 3448 cmd.exe 223 PID 3196 wrote to memory of 1412 3196 XBQQ.exe 224 PID 1412 wrote to memory of 5440 1412 cmd.exe 228 PID 5440 wrote to memory of 3080 5440 DWPZS.exe 229 PID 3080 wrote to memory of 3572 3080 cmd.exe 233 PID 3572 wrote to memory of 460 3572 BMB.exe 234 PID 460 wrote to memory of 6724 460 cmd.exe 238 PID 6724 wrote to memory of 6856 6724 FXZPFT.exe 239 PID 6856 wrote to memory of 4268 6856 cmd.exe 243 PID 4268 wrote to memory of 1032 4268 ENKSA.exe 244 PID 1032 wrote to memory of 1632 1032 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_91056a4ad1d37ec122798b650ccc6416_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPVF.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\windows\SysWOW64\BPVF.exeC:\windows\system32\BPVF.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSUZAIL.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:6888 -
C:\windows\SysWOW64\MSUZAIL.exeC:\windows\system32\MSUZAIL.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6564 -
C:\windows\system\DAOEE.exeC:\windows\system\DAOEE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIDEQYB.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\HIDEQYB.exeC:\windows\HIDEQYB.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTLDE.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\SysWOW64\UTLDE.exeC:\windows\system32\UTLDE.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEOT.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\system\TEOT.exeC:\windows\system\TEOT.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMQYQM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:6520 -
C:\windows\SysWOW64\CMQYQM.exeC:\windows\system32\CMQYQM.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHZ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:7052 -
C:\windows\RHZ.exeC:\windows\RHZ.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DACVJ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\windows\DACVJ.exeC:\windows\DACVJ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNHEMO.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\SysWOW64\XNHEMO.exeC:\windows\system32\XNHEMO.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDOM.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6172 -
C:\windows\JDOM.exeC:\windows\JDOM.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYR.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\system\CYR.exeC:\windows\system\CYR.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEZUNI.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6868 -
C:\windows\system\PEZUNI.exeC:\windows\system\PEZUNI.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHD.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\windows\system\QHD.exeC:\windows\system\QHD.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCNCEK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\windows\FCNCEK.exeC:\windows\FCNCEK.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENQSM.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\windows\SysWOW64\ENQSM.exeC:\windows\system32\ENQSM.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNSXYW.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:932 -
C:\windows\system\NNSXYW.exeC:\windows\system\NNSXYW.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDYF.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\windows\RDYF.exeC:\windows\RDYF.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYQJVB.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6900 -
C:\windows\GYQJVB.exeC:\windows\GYQJVB.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KBOE.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\windows\SysWOW64\KBOE.exeC:\windows\system32\KBOE.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZEXJGPO.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\ZEXJGPO.exeC:\windows\ZEXJGPO.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URCS.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\URCS.exeC:\windows\URCS.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJSCZ.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\windows\GZJSCZ.exeC:\windows\GZJSCZ.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDHN.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\system\KDHN.exeC:\windows\system\KDHN.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTAOYE.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\windows\WTAOYE.exeC:\windows\WTAOYE.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGMUI.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\EGMUI.exeC:\windows\EGMUI.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBQQ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\XBQQ.exeC:\windows\XBQQ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWPZS.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\system\DWPZS.exeC:\windows\system\DWPZS.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMB.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\windows\SysWOW64\BMB.exeC:\windows\system32\BMB.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXZPFT.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460 -
C:\windows\FXZPFT.exeC:\windows\FXZPFT.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENKSA.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6856 -
C:\windows\ENKSA.exeC:\windows\ENKSA.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIWLGV.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\windows\KIWLGV.exeC:\windows\KIWLGV.exe65⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JTHBP.exe.bat" "66⤵PID:5232
-
C:\windows\JTHBP.exeC:\windows\JTHBP.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMOMYC.exe.bat" "68⤵PID:3108
-
C:\windows\SysWOW64\CMOMYC.exeC:\windows\system32\CMOMYC.exe69⤵
- Executes dropped EXE
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHTVICE.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1812 -
C:\windows\XHTVICE.exeC:\windows\XHTVICE.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXUU.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4680 -
C:\windows\system\MXUU.exeC:\windows\system\MXUU.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FSY.exe.bat" "74⤵PID:4964
-
C:\windows\FSY.exeC:\windows\FSY.exe75⤵
- Executes dropped EXE
PID:6664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LSF.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4648 -
C:\windows\SysWOW64\LSF.exeC:\windows\system32\LSF.exe77⤵
- Executes dropped EXE
PID:7116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DVJIRXF.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4564 -
C:\windows\system\DVJIRXF.exeC:\windows\system\DVJIRXF.exe79⤵
- Executes dropped EXE
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTXU.exe.bat" "80⤵PID:4752
-
C:\windows\NTXU.exeC:\windows\NTXU.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBZ.exe.bat" "82⤵
- Executes a command shell one-liner
PID:980 -
C:\windows\SysWOW64\WBZ.exeC:\windows\system32\WBZ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:7040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUUA.exe.bat" "84⤵
- Executes a command shell one-liner
PID:6344 -
C:\windows\SysWOW64\QUUA.exeC:\windows\system32\QUUA.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUIX.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3404 -
C:\windows\SysWOW64\HUIX.exeC:\windows\system32\HUIX.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JSORES.exe.bat" "88⤵PID:2624
-
C:\windows\system\JSORES.exeC:\windows\system\JSORES.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDEISV.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:6200 -
C:\windows\EDEISV.exeC:\windows\EDEISV.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ODG.exe.bat" "92⤵PID:1344
-
C:\windows\SysWOW64\ODG.exeC:\windows\system32\ODG.exe93⤵
- Executes dropped EXE
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XLIA.exe.bat" "94⤵PID:6880
-
C:\windows\system\XLIA.exeC:\windows\system\XLIA.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MGSESSJ.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4328 -
C:\windows\SysWOW64\MGSESSJ.exeC:\windows\system32\MGSESSJ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJVIYI.exe.bat" "98⤵PID:3544
-
C:\windows\SysWOW64\NJVIYI.exeC:\windows\system32\NJVIYI.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAWAFWI.exe.bat" "100⤵PID:1436
-
C:\windows\system\CAWAFWI.exeC:\windows\system\CAWAFWI.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VVADKU.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6872 -
C:\windows\VVADKU.exeC:\windows\VVADKU.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLH.exe.bat" "104⤵PID:6248
-
C:\windows\ZLH.exeC:\windows\ZLH.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HQT.exe.bat" "106⤵
- Executes a command shell one-liner
PID:3392 -
C:\windows\SysWOW64\HQT.exeC:\windows\system32\HQT.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTDWSX.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4360 -
C:\windows\WTDWSX.exeC:\windows\WTDWSX.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RGI.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4528 -
C:\windows\SysWOW64\RGI.exeC:\windows\system32\RGI.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCHG.exe.bat" "112⤵PID:6280
-
C:\windows\system\XCHG.exeC:\windows\system\XCHG.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCOUQU.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\windows\DCOUQU.exeC:\windows\DCOUQU.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VXS.exe.bat" "116⤵PID:7008
-
C:\windows\SysWOW64\VXS.exeC:\windows\system32\VXS.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFUDHQ.exe.bat" "118⤵PID:1528
-
C:\windows\NFUDHQ.exeC:\windows\NFUDHQ.exe119⤵
- Executes dropped EXE
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QNB.exe.bat" "120⤵PID:5448
-
C:\windows\QNB.exeC:\windows\QNB.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-