Analysis
- max time kernel
72s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 17:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe
- Size 208KB
- Sample260802-wcnrcade38
- SHA256 ac5b880d131ffe333b5ccedda8222b6ab61732f5901fc2522f4c968a31aafe10
- MD5 8a6172a53cc6d03dcef4f553e87887f7
- SHA1 c10649262ed77bc85a70b3870d6c38163020e92a
- SHA512 3bb815bf563daff1a6798a974a49a2f72f91b4d033c536dd4fdf3ed32f7048289dcede33db61cfe7815350aac9d896549901a73ec4534fb8a55bf76cdf702e43
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfJ4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOhQEj1
- TLSH T1A2247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3756 RVEQO.exe 3500 OGVUAAV.exe 6120 SWCUM.exe 3300 CMHPUBA.exe 2868 IHHQZ.exe 1728 HFA.exe 3732 CSFCW.exe 5040 GVD.exe 1912 AJAGG.exe 1520 ZGT.exe 1240 RJXFGXM.exe 2024 ZPJMRVI.exe 4784 CCOV.exe 3420 JSPVA.exe 5988 ZNZ.exe 3900 HBRN.exe 2824 ZWDJAGY.exe 3700 OZMVL.exe 3708 VMLWQW.exe 1668 KPVB.exe 2456 TQXOM.exe 4904 ILG.exe 5660 OGFTCE.exe 5752 JTK.exe 1596 CWOGS.exe 1528 XHWWG.exe 5720 PCAALUK.exe 1464 HKC.exe 4228 JIQAEIV.exe 5156 NQWAI.exe 2472 NTADWQT.exe 52 MEDTWW.exe 2268 BZM.exe 3776 UCQBVHZ.exe 1036 OPVL.exe 2008 UQDZ.exe 3924 IVLKQ.exe 4152 CJPUANN.exe 3332 FWM.exe 1084 JMBDXF.exe 2548 UFWWFMF.exe 3020 WCJQM.exe 1852 XYN.exe 5680 RTSDC.exe 5124 BRY.exe 3972 FZEYW.exe 4632 JPLYI.exe 4208 UHOR.exe 2716 PVTAT.exe 4532 KIYJDKQ.exe 5084 ZYZJKY.exe 2612 FYG.exe 1752 JGNWF.exe 5984 YWOW.exe 3048 JPRPM.exe 4072 ZSATFI.exe 2056 ZXAH.exe 4640 TLFRQ.exe 968 SIRU.exe 5756 JJTZH.exe 2196 EWXIRXX.exe 5100 IMEI.exe 2052 IHI.exe 480 DCNVT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\FACOCS.exe.bat BKWO.exe File created C:\windows\SysWOW64\HFA.exe IHHQZ.exe File created C:\windows\SysWOW64\TQXOM.exe.bat KPVB.exe File created C:\windows\SysWOW64\NTADWQT.exe.bat NQWAI.exe File created C:\windows\SysWOW64\YWOW.exe.bat JGNWF.exe File created C:\windows\SysWOW64\HKC.exe.bat PCAALUK.exe File created C:\windows\SysWOW64\JIQAEIV.exe.bat HKC.exe File created C:\windows\SysWOW64\NTADWQT.exe NQWAI.exe File created C:\windows\SysWOW64\AJPN.exe.bat IGMKKSX.exe File opened for modification C:\windows\SysWOW64\ZZB.exe ZVYEPFJ.exe File opened for modification C:\windows\SysWOW64\FACOCS.exe BKWO.exe File created C:\windows\SysWOW64\ZWDJAGY.exe HBRN.exe File opened for modification C:\windows\SysWOW64\JTK.exe OGFTCE.exe File created C:\windows\SysWOW64\JTK.exe.bat OGFTCE.exe File opened for modification C:\windows\SysWOW64\HKC.exe PCAALUK.exe File opened for modification C:\windows\SysWOW64\PCAALUK.exe XHWWG.exe File created C:\windows\SysWOW64\BZM.exe.bat MEDTWW.exe File created C:\windows\SysWOW64\CZTYH.exe BWP.exe File created C:\windows\SysWOW64\RVEQO.exe.bat 2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\HFA.exe IHHQZ.exe File created C:\windows\SysWOW64\JSPVA.exe.bat CCOV.exe File created C:\windows\SysWOW64\CWOGS.exe JTK.exe File opened for modification C:\windows\SysWOW64\UFWWFMF.exe JMBDXF.exe File created C:\windows\SysWOW64\ZYZJKY.exe KIYJDKQ.exe File opened for modification C:\windows\SysWOW64\ZYZJKY.exe KIYJDKQ.exe File opened for modification C:\windows\SysWOW64\JSPVA.exe CCOV.exe File created C:\windows\SysWOW64\ZNZ.exe JSPVA.exe File opened for modification C:\windows\SysWOW64\BZM.exe MEDTWW.exe File opened for modification C:\windows\SysWOW64\OPVL.exe UCQBVHZ.exe File created C:\windows\SysWOW64\UFWWFMF.exe.bat JMBDXF.exe File created C:\windows\SysWOW64\ZYZJKY.exe.bat KIYJDKQ.exe File created C:\windows\SysWOW64\ZKEURKE.exe VHGH.exe File created C:\windows\SysWOW64\SWCUM.exe.bat OGVUAAV.exe File created C:\windows\SysWOW64\JSPVA.exe CCOV.exe File created C:\windows\SysWOW64\OZMVL.exe ZWDJAGY.exe File opened for modification C:\windows\SysWOW64\KPVB.exe VMLWQW.exe File created C:\windows\SysWOW64\OGFTCE.exe.bat ILG.exe File opened for modification C:\windows\SysWOW64\IMEI.exe EWXIRXX.exe File created C:\windows\SysWOW64\WTFVPMG.exe.bat BXAMM.exe File opened for modification C:\windows\SysWOW64\AJPN.exe IGMKKSX.exe File opened for modification C:\windows\SysWOW64\RVEQO.exe 2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe File created C:\windows\SysWOW64\CSFCW.exe HFA.exe File created C:\windows\SysWOW64\ZWDJAGY.exe.bat HBRN.exe File opened for modification C:\windows\SysWOW64\TQXOM.exe KPVB.exe File created C:\windows\SysWOW64\UFWWFMF.exe JMBDXF.exe File created C:\windows\SysWOW64\HFA.exe.bat IHHQZ.exe File created C:\windows\SysWOW64\OZMVL.exe.bat ZWDJAGY.exe File created C:\windows\SysWOW64\CWOGS.exe.bat JTK.exe File created C:\windows\SysWOW64\XYN.exe.bat WCJQM.exe File created C:\windows\SysWOW64\BRY.exe.bat RTSDC.exe File created C:\windows\SysWOW64\YWOW.exe JGNWF.exe File created C:\windows\SysWOW64\AJPN.exe IGMKKSX.exe File created C:\windows\SysWOW64\ZZB.exe.bat ZVYEPFJ.exe File opened for modification C:\windows\SysWOW64\ZWDJAGY.exe HBRN.exe File created C:\windows\SysWOW64\JIQAEIV.exe HKC.exe File opened for modification C:\windows\SysWOW64\JPLYI.exe FZEYW.exe File created C:\windows\SysWOW64\SWCUM.exe OGVUAAV.exe File opened for modification C:\windows\SysWOW64\CSFCW.exe HFA.exe File created C:\windows\SysWOW64\JTK.exe OGFTCE.exe File created C:\windows\SysWOW64\JPLYI.exe FZEYW.exe File opened for modification C:\windows\SysWOW64\YWOW.exe JGNWF.exe File created C:\windows\SysWOW64\WTFVPMG.exe BXAMM.exe File created C:\windows\SysWOW64\ZZB.exe ZVYEPFJ.exe File created C:\windows\SysWOW64\RVEQO.exe 2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\BKWO.exe CZTYH.exe File opened for modification C:\windows\system\CMHPUBA.exe SWCUM.exe File opened for modification C:\windows\RTSDC.exe XYN.exe File created C:\windows\system\JJTZH.exe.bat SIRU.exe File created C:\windows\ZVYEPFJ.exe MTPGBUO.exe File opened for modification C:\windows\ILG.exe TQXOM.exe File created C:\windows\ZSATFI.exe JPRPM.exe File created C:\windows\QTVJ.exe.bat HLTVFYY.exe File created C:\windows\system\MEDTWW.exe NTADWQT.exe File opened for modification C:\windows\QTVJ.exe HLTVFYY.exe File created C:\windows\system\IGMKKSX.exe QGKE.exe File opened for modification C:\windows\ZUS.exe AJPN.exe File created C:\windows\system\DLNEL.exe.bat FACOCS.exe File opened for modification C:\windows\CCOV.exe ZPJMRVI.exe File opened for modification C:\windows\system\MEDTWW.exe NTADWQT.exe File created C:\windows\JGNWF.exe.bat FYG.exe File created C:\windows\system\SIRU.exe.bat TLFRQ.exe File created C:\windows\system\EWXIRXX.exe JJTZH.exe File created C:\windows\system\IHHQZ.exe CMHPUBA.exe File created C:\windows\system\ZGT.exe AJAGG.exe File created C:\windows\IVLKQ.exe UQDZ.exe File opened for modification C:\windows\JGNWF.exe FYG.exe File created C:\windows\DCNVT.exe IHI.exe File opened for modification C:\windows\BKWO.exe CZTYH.exe File opened for modification C:\windows\system\OGVUAAV.exe RVEQO.exe File created C:\windows\system\CMHPUBA.exe SWCUM.exe File created C:\windows\system\UCQBVHZ.exe BZM.exe File created C:\windows\KIYJDKQ.exe.bat PVTAT.exe File opened for modification C:\windows\system\TLFRQ.exe ZXAH.exe File opened for modification C:\windows\system\XCHG.exe CGCXXAR.exe File created C:\windows\system\MTPGBUO.exe WDOOU.exe File created C:\windows\system\NQWAI.exe JIQAEIV.exe File created C:\windows\IVLKQ.exe.bat UQDZ.exe File created C:\windows\RTSDC.exe.bat XYN.exe File created C:\windows\FYG.exe.bat ZYZJKY.exe File opened for modification C:\windows\system\SIRU.exe TLFRQ.exe File created C:\windows\system\JJTZH.exe SIRU.exe File created C:\windows\system\IHI.exe.bat IMEI.exe File created C:\windows\QGKE.exe WTFVPMG.exe File created C:\windows\RJXFGXM.exe ZGT.exe File created C:\windows\system\ZPJMRVI.exe RJXFGXM.exe File opened for modification C:\windows\system\PVTAT.exe UHOR.exe File created C:\windows\system\JPRPM.exe YWOW.exe File created C:\windows\system\IHI.exe IMEI.exe File opened for modification C:\windows\WTDWSX.exe QTVJ.exe File opened for modification C:\windows\system\IGMKKSX.exe QGKE.exe File created C:\windows\ZUS.exe AJPN.exe File created C:\windows\system\CMHPUBA.exe.bat SWCUM.exe File created C:\windows\system\HBRN.exe ZNZ.exe File created C:\windows\JMBDXF.exe FWM.exe File created C:\windows\KIYJDKQ.exe PVTAT.exe File created C:\windows\system\DLNEL.exe FACOCS.exe File created C:\windows\RJXFGXM.exe.bat ZGT.exe File created C:\windows\system\ZPJMRVI.exe.bat RJXFGXM.exe File created C:\windows\VMLWQW.exe OZMVL.exe File created C:\windows\system\JPRPM.exe.bat YWOW.exe File created C:\windows\ZVYEPFJ.exe.bat MTPGBUO.exe File created C:\windows\BWP.exe.bat ZZB.exe File opened for modification C:\windows\system\DLNEL.exe FACOCS.exe File created C:\windows\system\ZGT.exe.bat AJAGG.exe File opened for modification C:\windows\RJXFGXM.exe ZGT.exe File opened for modification C:\windows\system\NQWAI.exe JIQAEIV.exe File opened for modification C:\windows\WCJQM.exe UFWWFMF.exe File created C:\windows\FZEYW.exe.bat BRY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1648 cmd.exe 6052 cmd.exe 3252 cmd.exe 1652 cmd.exe 4464 cmd.exe 2296 cmd.exe 3640 cmd.exe 6016 cmd.exe 4348 cmd.exe 1388 cmd.exe 2280 cmd.exe 1924 cmd.exe 4692 cmd.exe 2632 cmd.exe 5896 cmd.exe 1844 cmd.exe 6072 cmd.exe 3328 cmd.exe 240 cmd.exe 3464 cmd.exe 4320 cmd.exe 2860 cmd.exe 5228 cmd.exe 5596 cmd.exe 3728 cmd.exe 4924 cmd.exe 4936 cmd.exe 3292 cmd.exe 4344 cmd.exe 3516 cmd.exe 1420 cmd.exe 1944 cmd.exe 4792 cmd.exe 3024 cmd.exe 1448 cmd.exe 5300 cmd.exe 3840 cmd.exe 5128 cmd.exe 1200 cmd.exe 3092 cmd.exe 3608 cmd.exe 1664 cmd.exe 6076 cmd.exe 6092 cmd.exe 712 cmd.exe 3612 cmd.exe 5540 cmd.exe 5776 cmd.exe 716 cmd.exe 1856 cmd.exe 4124 cmd.exe 4128 cmd.exe 464 cmd.exe 4648 cmd.exe 3856 cmd.exe 3008 cmd.exe 4356 cmd.exe 5364 cmd.exe 2712 cmd.exe 2672 cmd.exe 428 cmd.exe 2792 cmd.exe 5728 cmd.exe 4172 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5616 3552 WerFault.exe 86 3656 3756 WerFault.exe 92 5728 3500 WerFault.exe 98 2936 6120 WerFault.exe 103 5984 3300 WerFault.exe 108 3924 2868 WerFault.exe 113 6080 1728 WerFault.exe 118 1600 3732 WerFault.exe 123 2904 5040 WerFault.exe 128 4244 1912 WerFault.exe 133 5792 1520 WerFault.exe 138 244 1240 WerFault.exe 143 1308 2024 WerFault.exe 148 2360 4784 WerFault.exe 153 3820 3420 WerFault.exe 158 2044 5988 WerFault.exe 163 4312 3900 WerFault.exe 168 1884 2824 WerFault.exe 173 1984 3700 WerFault.exe 178 4252 3708 WerFault.exe 183 436 1668 WerFault.exe 188 3856 2456 WerFault.exe 193 2196 4904 WerFault.exe 198 4396 5660 WerFault.exe 203 708 5752 WerFault.exe 208 3252 1596 WerFault.exe 213 3976 1528 WerFault.exe 218 4868 5720 WerFault.exe 223 1468 1464 WerFault.exe 228 5112 4228 WerFault.exe 233 2912 5156 WerFault.exe 238 5260 2472 WerFault.exe 243 6124 52 WerFault.exe 248 5708 2268 WerFault.exe 253 4324 3776 WerFault.exe 258 5416 1036 WerFault.exe 263 3152 2008 WerFault.exe 268 5712 3924 WerFault.exe 273 4752 4152 WerFault.exe 279 5576 3332 WerFault.exe 284 4372 1084 WerFault.exe 289 5472 2548 WerFault.exe 294 3636 3020 WerFault.exe 299 5104 1852 WerFault.exe 304 1420 5680 WerFault.exe 309 2380 5124 WerFault.exe 314 1640 3972 WerFault.exe 319 3188 4632 WerFault.exe 324 1376 4208 WerFault.exe 329 2648 2716 WerFault.exe 334 5656 4532 WerFault.exe 339 1308 5084 WerFault.exe 344 4880 2612 WerFault.exe 349 4076 1752 WerFault.exe 354 480 5984 WerFault.exe 359 5304 3048 WerFault.exe 364 5036 4072 WerFault.exe 369 4752 2056 WerFault.exe 374 2096 4640 WerFault.exe 379 712 968 WerFault.exe 384 4484 5756 WerFault.exe 389 4468 2196 WerFault.exe 394 2296 5100 WerFault.exe 399 2764 2052 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTPGBUO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPJMRVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGVUAAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BXAMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSPVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FACOCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQWAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPLYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCNVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTSDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLTVFYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJAGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIQAEIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQXOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCAALUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJPUANN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZEYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGFTCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZTYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3552 2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe 3552 2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe 3756 RVEQO.exe 3756 RVEQO.exe 3500 OGVUAAV.exe 3500 OGVUAAV.exe 6120 SWCUM.exe 6120 SWCUM.exe 3300 CMHPUBA.exe 3300 CMHPUBA.exe 2868 IHHQZ.exe 2868 IHHQZ.exe 1728 HFA.exe 1728 HFA.exe 3732 CSFCW.exe 3732 CSFCW.exe 5040 GVD.exe 5040 GVD.exe 1912 AJAGG.exe 1912 AJAGG.exe 1520 ZGT.exe 1520 ZGT.exe 1240 RJXFGXM.exe 1240 RJXFGXM.exe 2024 ZPJMRVI.exe 2024 ZPJMRVI.exe 4784 CCOV.exe 4784 CCOV.exe 3420 JSPVA.exe 3420 JSPVA.exe 5988 ZNZ.exe 5988 ZNZ.exe 3900 HBRN.exe 3900 HBRN.exe 2824 ZWDJAGY.exe 2824 ZWDJAGY.exe 3700 OZMVL.exe 3700 OZMVL.exe 3708 VMLWQW.exe 3708 VMLWQW.exe 1668 KPVB.exe 1668 KPVB.exe 2456 TQXOM.exe 2456 TQXOM.exe 4904 ILG.exe 4904 ILG.exe 5660 OGFTCE.exe 5660 OGFTCE.exe 5752 JTK.exe 5752 JTK.exe 1596 CWOGS.exe 1596 CWOGS.exe 1528 XHWWG.exe 1528 XHWWG.exe 5720 PCAALUK.exe 5720 PCAALUK.exe 1464 HKC.exe 1464 HKC.exe 4228 JIQAEIV.exe 4228 JIQAEIV.exe 5156 NQWAI.exe 5156 NQWAI.exe 2472 NTADWQT.exe 2472 NTADWQT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3552 2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe 3552 2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe 3756 RVEQO.exe 3756 RVEQO.exe 3500 OGVUAAV.exe 3500 OGVUAAV.exe 6120 SWCUM.exe 6120 SWCUM.exe 3300 CMHPUBA.exe 3300 CMHPUBA.exe 2868 IHHQZ.exe 2868 IHHQZ.exe 1728 HFA.exe 1728 HFA.exe 3732 CSFCW.exe 3732 CSFCW.exe 5040 GVD.exe 5040 GVD.exe 1912 AJAGG.exe 1912 AJAGG.exe 1520 ZGT.exe 1520 ZGT.exe 1240 RJXFGXM.exe 1240 RJXFGXM.exe 2024 ZPJMRVI.exe 2024 ZPJMRVI.exe 4784 CCOV.exe 4784 CCOV.exe 3420 JSPVA.exe 3420 JSPVA.exe 5988 ZNZ.exe 5988 ZNZ.exe 3900 HBRN.exe 3900 HBRN.exe 2824 ZWDJAGY.exe 2824 ZWDJAGY.exe 3700 OZMVL.exe 3700 OZMVL.exe 3708 VMLWQW.exe 3708 VMLWQW.exe 1668 KPVB.exe 1668 KPVB.exe 2456 TQXOM.exe 2456 TQXOM.exe 4904 ILG.exe 4904 ILG.exe 5660 OGFTCE.exe 5660 OGFTCE.exe 5752 JTK.exe 5752 JTK.exe 1596 CWOGS.exe 1596 CWOGS.exe 1528 XHWWG.exe 1528 XHWWG.exe 5720 PCAALUK.exe 5720 PCAALUK.exe 1464 HKC.exe 1464 HKC.exe 4228 JIQAEIV.exe 4228 JIQAEIV.exe 5156 NQWAI.exe 5156 NQWAI.exe 2472 NTADWQT.exe 2472 NTADWQT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3552 wrote to memory of 2076 3552 2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe 88 PID 2076 wrote to memory of 3756 2076 cmd.exe 92 PID 3756 wrote to memory of 4688 3756 RVEQO.exe 94 PID 4688 wrote to memory of 3500 4688 cmd.exe 98 PID 3500 wrote to memory of 1172 3500 OGVUAAV.exe 99 PID 1172 wrote to memory of 6120 1172 cmd.exe 103 PID 6120 wrote to memory of 428 6120 SWCUM.exe 104 PID 428 wrote to memory of 3300 428 cmd.exe 108 PID 3300 wrote to memory of 3884 3300 CMHPUBA.exe 109 PID 3884 wrote to memory of 2868 3884 cmd.exe 113 PID 2868 wrote to memory of 4648 2868 IHHQZ.exe 114 PID 4648 wrote to memory of 1728 4648 cmd.exe 118 PID 1728 wrote to memory of 2256 1728 HFA.exe 119 PID 2256 wrote to memory of 3732 2256 cmd.exe 123 PID 3732 wrote to memory of 6016 3732 CSFCW.exe 124 PID 6016 wrote to memory of 5040 6016 cmd.exe 128 PID 5040 wrote to memory of 2700 5040 GVD.exe 129 PID 2700 wrote to memory of 1912 2700 cmd.exe 133 PID 1912 wrote to memory of 5920 1912 AJAGG.exe 134 PID 5920 wrote to memory of 1520 5920 cmd.exe 138 PID 1520 wrote to memory of 3200 1520 ZGT.exe 139 PID 3200 wrote to memory of 1240 3200 cmd.exe 143 PID 1240 wrote to memory of 3440 1240 RJXFGXM.exe 144 PID 3440 wrote to memory of 2024 3440 cmd.exe 148 PID 2024 wrote to memory of 2792 2024 ZPJMRVI.exe 149 PID 2792 wrote to memory of 4784 2792 cmd.exe 153 PID 4784 wrote to memory of 3292 4784 CCOV.exe 154 PID 3292 wrote to memory of 3420 3292 cmd.exe 158 PID 3420 wrote to memory of 3524 3420 JSPVA.exe 159 PID 3524 wrote to memory of 5988 3524 cmd.exe 163 PID 5988 wrote to memory of 1648 5988 ZNZ.exe 164 PID 1648 wrote to memory of 3900 1648 cmd.exe 168 PID 3900 wrote to memory of 3464 3900 HBRN.exe 169 PID 3464 wrote to memory of 2824 3464 cmd.exe 173 PID 2824 wrote to memory of 5044 2824 ZWDJAGY.exe 174 PID 5044 wrote to memory of 3700 5044 cmd.exe 178 PID 3700 wrote to memory of 5776 3700 OZMVL.exe 179 PID 5776 wrote to memory of 3708 5776 cmd.exe 183 PID 3708 wrote to memory of 4792 3708 VMLWQW.exe 184 PID 4792 wrote to memory of 1668 4792 cmd.exe 188 PID 1668 wrote to memory of 4924 1668 KPVB.exe 189 PID 4924 wrote to memory of 2456 4924 cmd.exe 193 PID 2456 wrote to memory of 5648 2456 TQXOM.exe 194 PID 5648 wrote to memory of 4904 5648 cmd.exe 198 PID 4904 wrote to memory of 820 4904 ILG.exe 199 PID 820 wrote to memory of 5660 820 cmd.exe 203 PID 5660 wrote to memory of 5728 5660 OGFTCE.exe 204 PID 5728 wrote to memory of 5752 5728 cmd.exe 208 PID 5752 wrote to memory of 1736 5752 JTK.exe 209 PID 1736 wrote to memory of 1596 1736 cmd.exe 213 PID 1596 wrote to memory of 3024 1596 CWOGS.exe 214 PID 3024 wrote to memory of 1528 3024 cmd.exe 218 PID 1528 wrote to memory of 2092 1528 XHWWG.exe 219 PID 2092 wrote to memory of 5720 2092 cmd.exe 223 PID 5720 wrote to memory of 3032 5720 PCAALUK.exe 224 PID 3032 wrote to memory of 1464 3032 cmd.exe 228 PID 1464 wrote to memory of 1696 1464 HKC.exe 229 PID 1696 wrote to memory of 4228 1696 cmd.exe 233 PID 4228 wrote to memory of 5376 4228 JIQAEIV.exe 234 PID 5376 wrote to memory of 5156 5376 cmd.exe 238 PID 5156 wrote to memory of 4172 5156 NQWAI.exe 239 PID 4172 wrote to memory of 2472 4172 cmd.exe 243 PID 2472 wrote to memory of 5616 2472 NTADWQT.exe 244 PID 5616 wrote to memory of 52 5616 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8a6172a53cc6d03dcef4f553e87887f7_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVEQO.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\windows\SysWOW64\RVEQO.exeC:\windows\system32\RVEQO.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\windows\system\OGVUAAV.exeC:\windows\system\OGVUAAV.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWCUM.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\windows\SysWOW64\SWCUM.exeC:\windows\system32\SWCUM.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMHPUBA.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:428 -
C:\windows\system\CMHPUBA.exeC:\windows\system\CMHPUBA.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHHQZ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\windows\system\IHHQZ.exeC:\windows\system\IHHQZ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFA.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\SysWOW64\HFA.exeC:\windows\system32\HFA.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSFCW.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\windows\SysWOW64\CSFCW.exeC:\windows\system32\CSFCW.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVD.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\windows\GVD.exeC:\windows\GVD.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJAGG.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\windows\AJAGG.exeC:\windows\AJAGG.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGT.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\system\ZGT.exeC:\windows\system\ZGT.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJXFGXM.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\windows\RJXFGXM.exeC:\windows\RJXFGXM.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPJMRVI.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\system\ZPJMRVI.exeC:\windows\system\ZPJMRVI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCOV.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\windows\CCOV.exeC:\windows\CCOV.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNZ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\windows\SysWOW64\ZNZ.exeC:\windows\system32\ZNZ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBRN.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\windows\system\HBRN.exeC:\windows\system\HBRN.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZWDJAGY.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\windows\SysWOW64\ZWDJAGY.exeC:\windows\system32\ZWDJAGY.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VMLWQW.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\windows\VMLWQW.exeC:\windows\VMLWQW.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KPVB.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\windows\SysWOW64\KPVB.exeC:\windows\system32\KPVB.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQXOM.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\SysWOW64\TQXOM.exeC:\windows\system32\TQXOM.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILG.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\windows\ILG.exeC:\windows\ILG.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGFTCE.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820 -
C:\windows\SysWOW64\OGFTCE.exeC:\windows\system32\OGFTCE.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JTK.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\SysWOW64\JTK.exeC:\windows\system32\JTK.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWOGS.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\SysWOW64\CWOGS.exeC:\windows\system32\CWOGS.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHWWG.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\XHWWG.exeC:\windows\XHWWG.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCAALUK.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\windows\SysWOW64\PCAALUK.exeC:\windows\system32\PCAALUK.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKC.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\SysWOW64\HKC.exeC:\windows\system32\HKC.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIQAEIV.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\windows\SysWOW64\JIQAEIV.exeC:\windows\system32\JIQAEIV.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NQWAI.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\windows\system\NQWAI.exeC:\windows\system\NQWAI.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NTADWQT.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\SysWOW64\NTADWQT.exeC:\windows\system32\NTADWQT.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEDTWW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\system\MEDTWW.exeC:\windows\system\MEDTWW.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZM.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4424 -
C:\windows\SysWOW64\BZM.exeC:\windows\system32\BZM.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UCQBVHZ.exe.bat" "68⤵PID:5968
-
C:\windows\system\UCQBVHZ.exeC:\windows\system\UCQBVHZ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OPVL.exe.bat" "70⤵PID:2876
-
C:\windows\SysWOW64\OPVL.exeC:\windows\system32\OPVL.exe71⤵
- Executes dropped EXE
PID:1036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQDZ.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:976 -
C:\windows\system\UQDZ.exeC:\windows\system\UQDZ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVLKQ.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6052 -
C:\windows\IVLKQ.exeC:\windows\IVLKQ.exe75⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CJPUANN.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:3556 -
C:\windows\system\CJPUANN.exeC:\windows\system\CJPUANN.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWM.exe.bat" "78⤵PID:236
-
C:\windows\system\FWM.exeC:\windows\system\FWM.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMBDXF.exe.bat" "80⤵PID:2492
-
C:\windows\JMBDXF.exeC:\windows\JMBDXF.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFWWFMF.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4948 -
C:\windows\SysWOW64\UFWWFMF.exeC:\windows\system32\UFWWFMF.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WCJQM.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3856 -
C:\windows\WCJQM.exeC:\windows\WCJQM.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYN.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2632 -
C:\windows\SysWOW64\XYN.exeC:\windows\system32\XYN.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTSDC.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3008 -
C:\windows\RTSDC.exeC:\windows\RTSDC.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRY.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:852 -
C:\windows\SysWOW64\BRY.exeC:\windows\system32\BRY.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZEYW.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5324 -
C:\windows\FZEYW.exeC:\windows\FZEYW.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JPLYI.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4320 -
C:\windows\SysWOW64\JPLYI.exeC:\windows\system32\JPLYI.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UHOR.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1860 -
C:\windows\system\UHOR.exeC:\windows\system\UHOR.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PVTAT.exe.bat" "98⤵PID:3444
-
C:\windows\system\PVTAT.exeC:\windows\system\PVTAT.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIYJDKQ.exe.bat" "100⤵PID:1864
-
C:\windows\KIYJDKQ.exeC:\windows\KIYJDKQ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYZJKY.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4348 -
C:\windows\SysWOW64\ZYZJKY.exeC:\windows\system32\ZYZJKY.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYG.exe.bat" "104⤵PID:3000
-
C:\windows\FYG.exeC:\windows\FYG.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JGNWF.exe.bat" "106⤵PID:4824
-
C:\windows\JGNWF.exeC:\windows\JGNWF.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWOW.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5896 -
C:\windows\SysWOW64\YWOW.exeC:\windows\system32\YWOW.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JPRPM.exe.bat" "110⤵
- Executes a command shell one-liner
PID:6076 -
C:\windows\system\JPRPM.exeC:\windows\system\JPRPM.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSATFI.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4344 -
C:\windows\ZSATFI.exeC:\windows\ZSATFI.exe113⤵
- Executes dropped EXE
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXAH.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3396 -
C:\windows\ZXAH.exeC:\windows\ZXAH.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TLFRQ.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2860 -
C:\windows\system\TLFRQ.exeC:\windows\system\TLFRQ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIRU.exe.bat" "118⤵
- Executes a command shell one-liner
PID:6092 -
C:\windows\system\SIRU.exeC:\windows\system\SIRU.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJTZH.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1388 -
C:\windows\system\JJTZH.exeC:\windows\system\JJTZH.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-