Analysis
- max time kernel
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 17:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_ac51bfddad2d3bf4e8c3b61ba5ef763c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-03_ac51bfddad2d3bf4e8c3b61ba5ef763c_elex_emotet_stop.exe
- Size 208KB
- Sample260803-vrexbawwft
- SHA256 c29cf5306abac0e24eeeecc26207c09f000f38adc5224488119036a3f76b4967
- MD5 ac51bfddad2d3bf4e8c3b61ba5ef763c
- SHA1 dc43df0b565e2622a23f76fdaf67b3ea9e8a5c85
- SHA512 d3a6e263703246ba818944e358a8fb16fa08c052a006548edeffccbf0cc99d3529dc9312034ac05b646a5fb1bef516ae607d02c882f31233d16a69fca7ad25fd
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf94pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO1kEj1
- TLSH T136247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4420 GJDWHS.exe 4772 APEHWCW.exe 6032 QKNT.exe 3600 YPAA.exe 5852 LVA.exe 4152 ENPWLI.exe 1200 XQTS.exe 3588 YLXWEO.exe 3284 JMMHOP.exe 1356 XHQABD.exe 4376 DDB.exe 3196 CNERQGY.exe 4936 PQVHE.exe 1140 ZOAC.exe 5708 YHL.exe 1068 LJTQII.exe 4216 RFTRFLB.exe 3512 TCYLVTK.exe 5980 UGC.exe 2040 JBLULE.exe 2308 PWLU.exe 2888 KJPEAZ.exe 2640 EWU.exe 5360 TSERVT.exe 3088 TFEGXY.exe 4596 SVPJS.exe 5308 SAPXT.exe 5396 TDTTZGC.exe 1532 IYDFK.exe 4776 IED.exe 5744 XHMY.exe 4212 DULZJEE.exe 4548 YQQ.exe 4972 NLAVEQ.exe 2168 FOD.exe 2296 RWK.exe 1388 KZWU.exe 4572 ZPX.exe 5752 DXEUU.exe 4788 NFGZYAF.exe 3192 XDLTFI.exe 2240 MYVX.exe 3476 STUGV.exe 3976 WBAGHQA.exe 1960 QPFQ.exe 1980 GSPCCDY.exe 3060 YNAYQT.exe 1444 QVUDTYB.exe 3552 KIZM.exe 8 FWEEGY.exe 4320 FZIZTOO.exe 6048 DZPNC.exe 3444 VZRSGN.exe 3356 ZPYAS.exe 3580 IQAFVDI.exe 472 SNOZ.exe 4864 MJTJNL.exe 960 CECN.exe 1816 WRHXIG.exe 1760 ORJC.exe 5484 GUNFZT.exe 2560 KKT.exe 4624 FYYPW.exe 5704 WYA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JMMHOP.exe YLXWEO.exe File created C:\windows\SysWOW64\GSPCCDY.exe.bat QPFQ.exe File created C:\windows\SysWOW64\MYVX.exe.bat XDLTFI.exe File created C:\windows\SysWOW64\WBAGHQA.exe STUGV.exe File opened for modification C:\windows\SysWOW64\QPFQ.exe WBAGHQA.exe File created C:\windows\SysWOW64\QPFQ.exe.bat WBAGHQA.exe File created C:\windows\SysWOW64\FZIZTOO.exe.bat FWEEGY.exe File created C:\windows\SysWOW64\YLXWEO.exe XQTS.exe File opened for modification C:\windows\SysWOW64\KZWU.exe RWK.exe File created C:\windows\SysWOW64\KZWU.exe.bat RWK.exe File opened for modification C:\windows\SysWOW64\XDLTFI.exe NFGZYAF.exe File opened for modification C:\windows\SysWOW64\MYVX.exe XDLTFI.exe File created C:\windows\SysWOW64\QPFQ.exe WBAGHQA.exe File opened for modification C:\windows\SysWOW64\GSPCCDY.exe QPFQ.exe File created C:\windows\SysWOW64\FWEEGY.exe KIZM.exe File created C:\windows\SysWOW64\FWEEGY.exe.bat KIZM.exe File opened for modification C:\windows\SysWOW64\FZIZTOO.exe FWEEGY.exe File created C:\windows\SysWOW64\UVNLRS.exe.bat MQAFHU.exe File opened for modification C:\windows\SysWOW64\NWCW.exe UVNLRS.exe File created C:\windows\SysWOW64\ENPWLI.exe LVA.exe File created C:\windows\SysWOW64\RFTRFLB.exe.bat LJTQII.exe File opened for modification C:\windows\SysWOW64\TSERVT.exe EWU.exe File created C:\windows\SysWOW64\TFEGXY.exe.bat TSERVT.exe File created C:\windows\SysWOW64\WBAGHQA.exe.bat STUGV.exe File created C:\windows\SysWOW64\MJTJNL.exe.bat SNOZ.exe File created C:\windows\SysWOW64\KPPQPYC.exe LEM.exe File created C:\windows\SysWOW64\UVNLRS.exe MQAFHU.exe File created C:\windows\SysWOW64\GSPCCDY.exe QPFQ.exe File created C:\windows\SysWOW64\QVUDTYB.exe.bat YNAYQT.exe File created C:\windows\SysWOW64\ENPWLI.exe.bat LVA.exe File opened for modification C:\windows\SysWOW64\IWFCE.exe XDQRN.exe File created C:\windows\SysWOW64\PUDG.exe.bat RRP.exe File created C:\windows\SysWOW64\RWK.exe FOD.exe File opened for modification C:\windows\SysWOW64\KPPQPYC.exe LEM.exe File created C:\windows\SysWOW64\HKMWSR.exe JZJGJLQ.exe File created C:\windows\SysWOW64\HKMWSR.exe.bat JZJGJLQ.exe File created C:\windows\SysWOW64\XQTS.exe ENPWLI.exe File created C:\windows\SysWOW64\RFTRFLB.exe LJTQII.exe File opened for modification C:\windows\SysWOW64\TDTTZGC.exe SAPXT.exe File opened for modification C:\windows\SysWOW64\RWK.exe FOD.exe File created C:\windows\SysWOW64\RWK.exe.bat FOD.exe File created C:\windows\SysWOW64\MJTJNL.exe SNOZ.exe File created C:\windows\SysWOW64\IWFCE.exe.bat XDQRN.exe File opened for modification C:\windows\SysWOW64\VNRE.exe RFKWQ.exe File opened for modification C:\windows\SysWOW64\DULZJEE.exe XHMY.exe File opened for modification C:\windows\SysWOW64\JMMHOP.exe YLXWEO.exe File created C:\windows\SysWOW64\JMMHOP.exe.bat YLXWEO.exe File opened for modification C:\windows\SysWOW64\TFEGXY.exe TSERVT.exe File created C:\windows\SysWOW64\SDOPJQ.exe.bat KPPQPYC.exe File created C:\windows\SysWOW64\CECN.exe MJTJNL.exe File created C:\windows\SysWOW64\CECN.exe.bat MJTJNL.exe File opened for modification C:\windows\SysWOW64\LEM.exe KJIWBC.exe File created C:\windows\SysWOW64\KPPQPYC.exe.bat LEM.exe File created C:\windows\SysWOW64\IWFCE.exe XDQRN.exe File opened for modification C:\windows\SysWOW64\UVNLRS.exe MQAFHU.exe File created C:\windows\SysWOW64\NWCW.exe UVNLRS.exe File created C:\windows\SysWOW64\NWCW.exe.bat UVNLRS.exe File opened for modification C:\windows\SysWOW64\XQTS.exe ENPWLI.exe File created C:\windows\SysWOW64\XQTS.exe.bat ENPWLI.exe File created C:\windows\SysWOW64\XDLTFI.exe.bat NFGZYAF.exe File created C:\windows\SysWOW64\KIZM.exe.bat QVUDTYB.exe File created C:\windows\SysWOW64\LEM.exe.bat KJIWBC.exe File opened for modification C:\windows\SysWOW64\SDOPJQ.exe KPPQPYC.exe File created C:\windows\SysWOW64\PUDG.exe RRP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\CNERQGY.exe DDB.exe File created C:\windows\SAPXT.exe.bat SVPJS.exe File opened for modification C:\windows\FYYPW.exe KKT.exe File opened for modification C:\windows\system\KJIWBC.exe ZJTLRB.exe File created C:\windows\MQAFHU.exe ZSATFI.exe File created C:\windows\system\HTKG.exe QTVJ.exe File opened for modification C:\windows\system\YDGBTWT.exe OFG.exe File opened for modification C:\windows\system\QKNT.exe APEHWCW.exe File opened for modification C:\windows\IYDFK.exe TDTTZGC.exe File created C:\windows\system\DXEUU.exe ZPX.exe File created C:\windows\system\DXEUU.exe.bat ZPX.exe File opened for modification C:\windows\GUNFZT.exe ORJC.exe File created C:\windows\UMK.exe VBHD.exe File created C:\windows\system\PQVHE.exe.bat CNERQGY.exe File created C:\windows\system\JBLULE.exe.bat UGC.exe File created C:\windows\SVPJS.exe TFEGXY.exe File opened for modification C:\windows\system\FOD.exe NLAVEQ.exe File opened for modification C:\windows\system\DXEUU.exe ZPX.exe File opened for modification C:\windows\NFGZYAF.exe DXEUU.exe File created C:\windows\FYYPW.exe.bat KKT.exe File created C:\windows\VBHD.exe NWCW.exe File created C:\windows\GJDWHS.exe 2026-08-03_ac51bfddad2d3bf4e8c3b61ba5ef763c_elex_emotet_stop.exe File created C:\windows\system\ORJC.exe.bat WRHXIG.exe File created C:\windows\system\PEIBKWW.exe AOHCLB.exe File created C:\windows\ZSATFI.exe HKMWSR.exe File created C:\windows\ZFP.exe.bat RRC.exe File created C:\windows\IFRU.exe.bat ZFP.exe File opened for modification C:\windows\QTVJ.exe IFRU.exe File created C:\windows\QGKE.exe YDGBTWT.exe File created C:\windows\system\DDB.exe XHQABD.exe File created C:\windows\YNAYQT.exe.bat GSPCCDY.exe File opened for modification C:\windows\system\SNOZ.exe IQAFVDI.exe File opened for modification C:\windows\NFEMO.exe DPQSYZR.exe File opened for modification C:\windows\system\JZJGJLQ.exe IWFCE.exe File created C:\windows\VBHD.exe.bat NWCW.exe File opened for modification C:\windows\system\XHMY.exe IED.exe File created C:\windows\system\NLAVEQ.exe YQQ.exe File created C:\windows\system\ORJC.exe WRHXIG.exe File created C:\windows\system\WNG.exe.bat NFEMO.exe File created C:\windows\XQKVX.exe.bat WNG.exe File created C:\windows\PLNRCTN.exe.bat XQKVX.exe File created C:\windows\DXHP.exe.bat XWZBSZN.exe File created C:\windows\system\TCYLVTK.exe.bat RFTRFLB.exe File created C:\windows\IYDFK.exe.bat TDTTZGC.exe File created C:\windows\YQQ.exe.bat DULZJEE.exe File opened for modification C:\windows\system\DPQSYZR.exe PEIBKWW.exe File created C:\windows\system\WNG.exe NFEMO.exe File opened for modification C:\windows\QGKE.exe YDGBTWT.exe File created C:\windows\RFKWQ.exe.bat JSYQG.exe File opened for modification C:\windows\system\KJPEAZ.exe PWLU.exe File created C:\windows\system\STUGV.exe MYVX.exe File created C:\windows\GUNFZT.exe ORJC.exe File created C:\windows\system\APEHWCW.exe GJDWHS.exe File created C:\windows\system\KJPEAZ.exe.bat PWLU.exe File created C:\windows\YQQ.exe DULZJEE.exe File created C:\windows\ZPX.exe KZWU.exe File created C:\windows\NFGZYAF.exe DXEUU.exe File opened for modification C:\windows\system\ORJC.exe WRHXIG.exe File created C:\windows\system\AOHCLB.exe.bat WYA.exe File created C:\windows\system\YDGBTWT.exe.bat OFG.exe File opened for modification C:\windows\system\NLAVEQ.exe YQQ.exe File created C:\windows\system\FOD.exe NLAVEQ.exe File created C:\windows\YNAYQT.exe GSPCCDY.exe File opened for modification C:\windows\system\AOHCLB.exe WYA.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5632 cmd.exe 5228 cmd.exe 4664 cmd.exe 2544 cmd.exe 4480 cmd.exe 5968 cmd.exe 2028 cmd.exe 5096 cmd.exe 4920 cmd.exe 2352 cmd.exe 4412 cmd.exe 4544 cmd.exe 4348 cmd.exe 6140 cmd.exe 5268 cmd.exe 4192 cmd.exe 3440 cmd.exe 2212 cmd.exe 5504 cmd.exe 2132 cmd.exe 2816 cmd.exe 2856 cmd.exe 5724 cmd.exe 5312 cmd.exe 5528 cmd.exe 4540 cmd.exe 1460 cmd.exe 3472 cmd.exe 2344 cmd.exe 5152 cmd.exe 4820 cmd.exe 3032 cmd.exe 3352 cmd.exe 4764 cmd.exe 1368 cmd.exe 1252 cmd.exe 5060 cmd.exe 4484 cmd.exe 1384 cmd.exe 3544 cmd.exe 4324 cmd.exe 6088 cmd.exe 5628 cmd.exe 5108 cmd.exe 124 cmd.exe 4512 cmd.exe 1232 cmd.exe 2060 cmd.exe 2676 cmd.exe 1744 cmd.exe 1164 cmd.exe 5264 cmd.exe 2500 cmd.exe 5832 cmd.exe 1812 cmd.exe 1848 cmd.exe 1300 cmd.exe 1652 cmd.exe 5412 cmd.exe 2972 cmd.exe 2036 cmd.exe 2912 cmd.exe 2524 cmd.exe 1592 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3500 3156 WerFault.exe 88 4368 4420 WerFault.exe 94 4848 4772 WerFault.exe 100 1956 6032 WerFault.exe 105 4532 3600 WerFault.exe 110 816 5852 WerFault.exe 115 5732 4152 WerFault.exe 120 1112 1200 WerFault.exe 125 5600 3588 WerFault.exe 130 2388 3284 WerFault.exe 135 1376 1356 WerFault.exe 140 5424 4376 WerFault.exe 145 5940 3196 WerFault.exe 150 3828 4936 WerFault.exe 155 572 1140 WerFault.exe 160 3860 5708 WerFault.exe 165 3456 1068 WerFault.exe 169 5892 4216 WerFault.exe 175 1636 3512 WerFault.exe 180 3372 5980 WerFault.exe 185 5868 2040 WerFault.exe 190 4520 2308 WerFault.exe 195 5940 2888 WerFault.exe 200 6140 2640 WerFault.exe 205 5824 5360 WerFault.exe 210 5532 3088 WerFault.exe 215 916 4596 WerFault.exe 220 2196 5308 WerFault.exe 225 4512 5396 WerFault.exe 230 2600 1532 WerFault.exe 235 1412 4776 WerFault.exe 240 5384 5744 WerFault.exe 245 3128 4212 WerFault.exe 250 3012 4548 WerFault.exe 255 2320 4972 WerFault.exe 260 5532 2168 WerFault.exe 265 2992 2296 WerFault.exe 270 2128 1388 WerFault.exe 275 4464 4572 WerFault.exe 280 5856 5752 WerFault.exe 285 5644 4788 WerFault.exe 290 1148 3192 WerFault.exe 295 4848 2240 WerFault.exe 300 5088 3476 WerFault.exe 305 952 3976 WerFault.exe 310 3416 1960 WerFault.exe 315 4400 1980 WerFault.exe 320 3520 3060 WerFault.exe 325 1592 1444 WerFault.exe 330 2968 3552 WerFault.exe 335 1880 8 WerFault.exe 340 2372 4320 WerFault.exe 345 3012 6048 WerFault.exe 350 2320 3444 WerFault.exe 355 3340 3356 WerFault.exe 360 5048 3580 WerFault.exe 365 2792 472 WerFault.exe 370 1584 4864 WerFault.exe 375 3044 960 WerFault.exe 380 5384 1816 WerFault.exe 385 2192 1760 WerFault.exe 390 2032 5484 WerFault.exe 395 952 2560 WerFault.exe 400 444 4624 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCYLVTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQAFVDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZJGJLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XWZBSZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDGBTWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNAYQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJTQII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFEGXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSATFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFTRFLB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFGZYAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVUDTYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APEHWCW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRHXIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQVHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3156 2026-08-03_ac51bfddad2d3bf4e8c3b61ba5ef763c_elex_emotet_stop.exe 3156 2026-08-03_ac51bfddad2d3bf4e8c3b61ba5ef763c_elex_emotet_stop.exe 4420 GJDWHS.exe 4420 GJDWHS.exe 4772 APEHWCW.exe 4772 APEHWCW.exe 6032 QKNT.exe 6032 QKNT.exe 3600 YPAA.exe 3600 YPAA.exe 5852 LVA.exe 5852 LVA.exe 4152 ENPWLI.exe 4152 ENPWLI.exe 1200 XQTS.exe 1200 XQTS.exe 3588 YLXWEO.exe 3588 YLXWEO.exe 3284 JMMHOP.exe 3284 JMMHOP.exe 1356 XHQABD.exe 1356 XHQABD.exe 4376 DDB.exe 4376 DDB.exe 3196 CNERQGY.exe 3196 CNERQGY.exe 4936 PQVHE.exe 4936 PQVHE.exe 1140 ZOAC.exe 1140 ZOAC.exe 5708 YHL.exe 5708 YHL.exe 1068 LJTQII.exe 1068 LJTQII.exe 4216 RFTRFLB.exe 4216 RFTRFLB.exe 3512 TCYLVTK.exe 3512 TCYLVTK.exe 5980 UGC.exe 5980 UGC.exe 2040 JBLULE.exe 2040 JBLULE.exe 2308 PWLU.exe 2308 PWLU.exe 2888 KJPEAZ.exe 2888 KJPEAZ.exe 2640 EWU.exe 2640 EWU.exe 5360 TSERVT.exe 5360 TSERVT.exe 3088 TFEGXY.exe 3088 TFEGXY.exe 4596 SVPJS.exe 4596 SVPJS.exe 5308 SAPXT.exe 5308 SAPXT.exe 5396 TDTTZGC.exe 5396 TDTTZGC.exe 1532 IYDFK.exe 1532 IYDFK.exe 4776 IED.exe 4776 IED.exe 5744 XHMY.exe 5744 XHMY.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3156 2026-08-03_ac51bfddad2d3bf4e8c3b61ba5ef763c_elex_emotet_stop.exe 3156 2026-08-03_ac51bfddad2d3bf4e8c3b61ba5ef763c_elex_emotet_stop.exe 4420 GJDWHS.exe 4420 GJDWHS.exe 4772 APEHWCW.exe 4772 APEHWCW.exe 6032 QKNT.exe 6032 QKNT.exe 3600 YPAA.exe 3600 YPAA.exe 5852 LVA.exe 5852 LVA.exe 4152 ENPWLI.exe 4152 ENPWLI.exe 1200 XQTS.exe 1200 XQTS.exe 3588 YLXWEO.exe 3588 YLXWEO.exe 3284 JMMHOP.exe 3284 JMMHOP.exe 1356 XHQABD.exe 1356 XHQABD.exe 4376 DDB.exe 4376 DDB.exe 3196 CNERQGY.exe 3196 CNERQGY.exe 4936 PQVHE.exe 4936 PQVHE.exe 1140 ZOAC.exe 1140 ZOAC.exe 5708 YHL.exe 5708 YHL.exe 1068 LJTQII.exe 1068 LJTQII.exe 4216 RFTRFLB.exe 4216 RFTRFLB.exe 3512 TCYLVTK.exe 3512 TCYLVTK.exe 5980 UGC.exe 5980 UGC.exe 2040 JBLULE.exe 2040 JBLULE.exe 2308 PWLU.exe 2308 PWLU.exe 2888 KJPEAZ.exe 2888 KJPEAZ.exe 2640 EWU.exe 2640 EWU.exe 5360 TSERVT.exe 5360 TSERVT.exe 3088 TFEGXY.exe 3088 TFEGXY.exe 4596 SVPJS.exe 4596 SVPJS.exe 5308 SAPXT.exe 5308 SAPXT.exe 5396 TDTTZGC.exe 5396 TDTTZGC.exe 1532 IYDFK.exe 1532 IYDFK.exe 4776 IED.exe 4776 IED.exe 5744 XHMY.exe 5744 XHMY.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 2676 3156 2026-08-03_ac51bfddad2d3bf4e8c3b61ba5ef763c_elex_emotet_stop.exe 90 PID 2676 wrote to memory of 4420 2676 cmd.exe 94 PID 4420 wrote to memory of 5328 4420 GJDWHS.exe 96 PID 5328 wrote to memory of 4772 5328 cmd.exe 100 PID 4772 wrote to memory of 5612 4772 APEHWCW.exe 101 PID 5612 wrote to memory of 6032 5612 cmd.exe 105 PID 6032 wrote to memory of 1604 6032 QKNT.exe 106 PID 1604 wrote to memory of 3600 1604 cmd.exe 110 PID 3600 wrote to memory of 4612 3600 YPAA.exe 111 PID 4612 wrote to memory of 5852 4612 cmd.exe 115 PID 5852 wrote to memory of 3440 5852 LVA.exe 116 PID 3440 wrote to memory of 4152 3440 cmd.exe 120 PID 4152 wrote to memory of 5724 4152 ENPWLI.exe 121 PID 5724 wrote to memory of 1200 5724 cmd.exe 125 PID 1200 wrote to memory of 4920 1200 XQTS.exe 126 PID 4920 wrote to memory of 3588 4920 cmd.exe 130 PID 3588 wrote to memory of 2352 3588 YLXWEO.exe 131 PID 2352 wrote to memory of 3284 2352 cmd.exe 135 PID 3284 wrote to memory of 1144 3284 JMMHOP.exe 136 PID 1144 wrote to memory of 1356 1144 cmd.exe 140 PID 1356 wrote to memory of 1252 1356 XHQABD.exe 141 PID 1252 wrote to memory of 4376 1252 cmd.exe 145 PID 4376 wrote to memory of 2524 4376 DDB.exe 146 PID 2524 wrote to memory of 3196 2524 cmd.exe 150 PID 3196 wrote to memory of 4372 3196 CNERQGY.exe 151 PID 4372 wrote to memory of 4936 4372 cmd.exe 155 PID 4936 wrote to memory of 1536 4936 PQVHE.exe 156 PID 1536 wrote to memory of 1140 1536 cmd.exe 160 PID 1140 wrote to memory of 1744 1140 ZOAC.exe 161 PID 1744 wrote to memory of 5708 1744 cmd.exe 165 PID 5708 wrote to memory of 4412 5708 YHL.exe 166 PID 4412 wrote to memory of 1068 4412 cmd.exe 169 PID 1068 wrote to memory of 5312 1068 LJTQII.exe 171 PID 5312 wrote to memory of 4216 5312 cmd.exe 175 PID 4216 wrote to memory of 2344 4216 RFTRFLB.exe 176 PID 2344 wrote to memory of 3512 2344 cmd.exe 180 PID 3512 wrote to memory of 4324 3512 TCYLVTK.exe 181 PID 4324 wrote to memory of 5980 4324 cmd.exe 185 PID 5980 wrote to memory of 5888 5980 UGC.exe 186 PID 5888 wrote to memory of 2040 5888 cmd.exe 190 PID 2040 wrote to memory of 5636 2040 JBLULE.exe 191 PID 5636 wrote to memory of 2308 5636 cmd.exe 195 PID 2308 wrote to memory of 1892 2308 PWLU.exe 196 PID 1892 wrote to memory of 2888 1892 cmd.exe 200 PID 2888 wrote to memory of 5632 2888 KJPEAZ.exe 201 PID 5632 wrote to memory of 2640 5632 cmd.exe 205 PID 2640 wrote to memory of 1300 2640 EWU.exe 206 PID 1300 wrote to memory of 5360 1300 cmd.exe 210 PID 5360 wrote to memory of 5528 5360 TSERVT.exe 211 PID 5528 wrote to memory of 3088 5528 cmd.exe 215 PID 3088 wrote to memory of 5152 3088 TFEGXY.exe 216 PID 5152 wrote to memory of 4596 5152 cmd.exe 220 PID 4596 wrote to memory of 3456 4596 SVPJS.exe 221 PID 3456 wrote to memory of 5308 3456 cmd.exe 225 PID 5308 wrote to memory of 5892 5308 SAPXT.exe 226 PID 5892 wrote to memory of 5396 5892 cmd.exe 230 PID 5396 wrote to memory of 6088 5396 TDTTZGC.exe 231 PID 6088 wrote to memory of 1532 6088 cmd.exe 235 PID 1532 wrote to memory of 5368 1532 IYDFK.exe 236 PID 5368 wrote to memory of 4776 5368 cmd.exe 240 PID 4776 wrote to memory of 5868 4776 IED.exe 241 PID 5868 wrote to memory of 5744 5868 cmd.exe 245 PID 5744 wrote to memory of 1448 5744 XHMY.exe 246 PID 1448 wrote to memory of 4212 1448 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_ac51bfddad2d3bf4e8c3b61ba5ef763c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ac51bfddad2d3bf4e8c3b61ba5ef763c_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJDWHS.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\GJDWHS.exeC:\windows\GJDWHS.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APEHWCW.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\windows\system\APEHWCW.exeC:\windows\system\APEHWCW.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QKNT.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\system\QKNT.exeC:\windows\system\QKNT.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPAA.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\system\YPAA.exeC:\windows\system\YPAA.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVA.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\system\LVA.exeC:\windows\system\LVA.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENPWLI.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\SysWOW64\ENPWLI.exeC:\windows\system32\ENPWLI.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQTS.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\SysWOW64\XQTS.exeC:\windows\system32\XQTS.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YLXWEO.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\SysWOW64\YLXWEO.exeC:\windows\system32\YLXWEO.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMMHOP.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\SysWOW64\JMMHOP.exeC:\windows\system32\JMMHOP.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHQABD.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\windows\XHQABD.exeC:\windows\XHQABD.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDB.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\system\DDB.exeC:\windows\system\DDB.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CNERQGY.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\windows\system\CNERQGY.exeC:\windows\system\CNERQGY.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQVHE.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\system\PQVHE.exeC:\windows\system\PQVHE.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOAC.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\ZOAC.exeC:\windows\ZOAC.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHL.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\windows\YHL.exeC:\windows\YHL.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJTQII.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\LJTQII.exeC:\windows\LJTQII.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFTRFLB.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\windows\SysWOW64\RFTRFLB.exeC:\windows\system32\RFTRFLB.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TCYLVTK.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\windows\system\TCYLVTK.exeC:\windows\system\TCYLVTK.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\system\UGC.exeC:\windows\system\UGC.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBLULE.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\system\JBLULE.exeC:\windows\system\JBLULE.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWLU.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\windows\PWLU.exeC:\windows\PWLU.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJPEAZ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\windows\system\KJPEAZ.exeC:\windows\system\KJPEAZ.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWU.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\EWU.exeC:\windows\EWU.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TSERVT.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\SysWOW64\TSERVT.exeC:\windows\system32\TSERVT.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFEGXY.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\windows\SysWOW64\TFEGXY.exeC:\windows\system32\TFEGXY.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVPJS.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\windows\SVPJS.exeC:\windows\SVPJS.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAPXT.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\windows\SAPXT.exeC:\windows\SAPXT.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDTTZGC.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\SysWOW64\TDTTZGC.exeC:\windows\system32\TDTTZGC.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\windows\IYDFK.exeC:\windows\IYDFK.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IED.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\windows\IED.exeC:\windows\IED.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DULZJEE.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\windows\SysWOW64\DULZJEE.exeC:\windows\system32\DULZJEE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "66⤵PID:4636
-
C:\windows\YQQ.exeC:\windows\YQQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4552 -
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOD.exe.bat" "70⤵PID:3488
-
C:\windows\system\FOD.exeC:\windows\system\FOD.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWK.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:804 -
C:\windows\SysWOW64\RWK.exeC:\windows\system32\RWK.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWU.exe.bat" "74⤵PID:5732
-
C:\windows\SysWOW64\KZWU.exeC:\windows\system32\KZWU.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPX.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4544 -
C:\windows\ZPX.exeC:\windows\ZPX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DXEUU.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5060 -
C:\windows\system\DXEUU.exeC:\windows\system\DXEUU.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "80⤵PID:5400
-
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDLTFI.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4348 -
C:\windows\SysWOW64\XDLTFI.exeC:\windows\system32\XDLTFI.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYVX.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5828 -
C:\windows\SysWOW64\MYVX.exeC:\windows\system32\MYVX.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STUGV.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5628 -
C:\windows\system\STUGV.exeC:\windows\system\STUGV.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WBAGHQA.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4540 -
C:\windows\SysWOW64\WBAGHQA.exeC:\windows\system32\WBAGHQA.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QPFQ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5972 -
C:\windows\SysWOW64\QPFQ.exeC:\windows\system32\QPFQ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSPCCDY.exe.bat" "92⤵PID:3860
-
C:\windows\SysWOW64\GSPCCDY.exeC:\windows\system32\GSPCCDY.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNAYQT.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4884 -
C:\windows\YNAYQT.exeC:\windows\YNAYQT.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVUDTYB.exe.bat" "96⤵PID:2176
-
C:\windows\SysWOW64\QVUDTYB.exeC:\windows\system32\QVUDTYB.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIZM.exe.bat" "98⤵PID:5976
-
C:\windows\SysWOW64\KIZM.exeC:\windows\system32\KIZM.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FWEEGY.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4960 -
C:\windows\SysWOW64\FWEEGY.exeC:\windows\system32\FWEEGY.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZIZTOO.exe.bat" "102⤵PID:1336
-
C:\windows\SysWOW64\FZIZTOO.exeC:\windows\system32\FZIZTOO.exe103⤵
- Executes dropped EXE
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DZPNC.exe.bat" "104⤵PID:4360
-
C:\windows\system\DZPNC.exeC:\windows\system\DZPNC.exe105⤵
- Executes dropped EXE
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZRSGN.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1164 -
C:\windows\SysWOW64\VZRSGN.exeC:\windows\system32\VZRSGN.exe107⤵
- Executes dropped EXE
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPYAS.exe.bat" "108⤵PID:4816
-
C:\windows\system\ZPYAS.exeC:\windows\system\ZPYAS.exe109⤵
- Executes dropped EXE
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQAFVDI.exe.bat" "110⤵PID:6016
-
C:\windows\IQAFVDI.exeC:\windows\IQAFVDI.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SNOZ.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:800 -
C:\windows\system\SNOZ.exeC:\windows\system\SNOZ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJTJNL.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:2148 -
C:\windows\SysWOW64\MJTJNL.exeC:\windows\system32\MJTJNL.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CECN.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3672 -
C:\windows\SysWOW64\CECN.exeC:\windows\system32\CECN.exe117⤵
- Executes dropped EXE
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRHXIG.exe.bat" "118⤵PID:4760
-
C:\windows\system\WRHXIG.exeC:\windows\system\WRHXIG.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORJC.exe.bat" "120⤵PID:5992
-
C:\windows\system\ORJC.exeC:\windows\system\ORJC.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-