Analysis
- max time kernel
79s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 18:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe
- Size 208KB
- Sample260804-xna53afd93
- SHA256 db6fa678af55b7a9096b7c7e09d262c54425846f936b0f30a336ba5ad4376f12
- MD5 a198dc257443b4f230be63e5f546cc49
- SHA1 78e602f447348ef9ae281803ce3151f1c3fa30c8
- SHA512 e4e05d5233bc3ee149c51f67da131e1278806637a02ba1b3da0701609ec1847bf72cd3745dfeda2a28ab5b1ce0532518cf66d6a8c44edc4842664a0f42028f0d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOf/4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LOHkEj1
- TLSH T1C6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2812 ACQI.exe 5176 JVO.exe 2624 RIT.exe 1900 ELJUJV.exe 6044 SRJGLH.exe 4388 COXA.exe 3004 PZFZ.exe 3488 OKIHPG.exe 4576 WPVVA.exe 1260 GNAIH.exe 5108 MIMJV.exe 3324 WGSD.exe 1476 DWTUJFY.exe 4208 NUGPR.exe 2968 AFPNF.exe 2508 IKBUQ.exe 3344 GAPMX.exe 4468 VQCVNLU.exe 2604 PEBBSM.exe 6076 XROID.exe 5132 IKVTM.exe 2880 ZSKQZD.exe 3420 ELTADZG.exe 3504 BLVDPD.exe 2336 UELOYE.exe 4676 AZWGMS.exe 2428 TSERVT.exe 4308 VPR.exe 2064 FNX.exe 3808 LIJHYZN.exe 1760 MLMDDO.exe 2868 FOQ.exe 3476 DZTOZSU.exe 5136 LFGDCRQ.exe 1792 PVMD.exe 2712 OGP.exe 2776 SOETJ.exe 716 CLJOR.exe 5400 RBK.exe 4216 TZQZFU.exe 3464 JUHM.exe 1396 JXL.exe 4412 LVRCL.exe 5908 RQQ.exe 5160 WWISFD.exe 2384 OZMVL.exe 1660 EPNNSPW.exe 3220 TKWZD.exe 3068 RXWAHEU.exe 5976 UTN.exe 4772 UWRFG.exe 4392 WTWA.exe 3236 XOAVBM.exe 4752 QRERG.exe 6112 KFJIRCL.exe 4568 WVXI.exe 3312 YTDDKCI.exe 3424 ZOHYQS.exe 5320 XJGHVVH.exe 5036 MEPM.exe 5488 NHT.exe 3044 FKXLY.exe 5692 XKZQCTV.exe 4420 ZINKJC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\PVMD.exe LFGDCRQ.exe File created C:\windows\SysWOW64\RIT.exe.bat JVO.exe File opened for modification C:\windows\SysWOW64\BLVDPD.exe ELTADZG.exe File opened for modification C:\windows\SysWOW64\UELOYE.exe BLVDPD.exe File created C:\windows\SysWOW64\TSERVT.exe AZWGMS.exe File opened for modification C:\windows\SysWOW64\LIJHYZN.exe FNX.exe File created C:\windows\SysWOW64\EPNNSPW.exe OZMVL.exe File opened for modification C:\windows\SysWOW64\EPNNSPW.exe OZMVL.exe File created C:\windows\SysWOW64\ACQI.exe.bat 2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe File created C:\windows\SysWOW64\RIT.exe JVO.exe File opened for modification C:\windows\SysWOW64\WPVVA.exe OKIHPG.exe File opened for modification C:\windows\SysWOW64\MIMJV.exe GNAIH.exe File created C:\windows\SysWOW64\MIMJV.exe.bat GNAIH.exe File opened for modification C:\windows\SysWOW64\AZWGMS.exe UELOYE.exe File created C:\windows\SysWOW64\OZMVL.exe.bat WWISFD.exe File created C:\windows\SysWOW64\WTWA.exe UWRFG.exe File created C:\windows\SysWOW64\ACQI.exe 2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\SRJGLH.exe ELJUJV.exe File created C:\windows\SysWOW64\SRJGLH.exe.bat ELJUJV.exe File created C:\windows\SysWOW64\BLVDPD.exe ELTADZG.exe File created C:\windows\SysWOW64\MLMDDO.exe.bat LIJHYZN.exe File created C:\windows\SysWOW64\PVMD.exe.bat LFGDCRQ.exe File created C:\windows\SysWOW64\WWISFD.exe RQQ.exe File created C:\windows\SysWOW64\YTDDKCI.exe.bat WVXI.exe File created C:\windows\SysWOW64\ZSKQZD.exe IKVTM.exe File created C:\windows\SysWOW64\MLMDDO.exe LIJHYZN.exe File created C:\windows\SysWOW64\AHLOG.exe XZFOUY.exe File created C:\windows\SysWOW64\IGP.exe VDY.exe File created C:\windows\SysWOW64\IGP.exe.bat VDY.exe File created C:\windows\SysWOW64\NUGPR.exe.bat DWTUJFY.exe File created C:\windows\SysWOW64\AZWGMS.exe UELOYE.exe File opened for modification C:\windows\SysWOW64\VPR.exe TSERVT.exe File created C:\windows\SysWOW64\FOQ.exe MLMDDO.exe File created C:\windows\SysWOW64\FOQ.exe.bat MLMDDO.exe File opened for modification C:\windows\SysWOW64\ZOHYQS.exe YTDDKCI.exe File created C:\windows\SysWOW64\ZOHYQS.exe.bat YTDDKCI.exe File created C:\windows\SysWOW64\HFXJC.exe YFV.exe File opened for modification C:\windows\SysWOW64\PVMD.exe LFGDCRQ.exe File created C:\windows\SysWOW64\TZQZFU.exe RBK.exe File opened for modification C:\windows\SysWOW64\IGP.exe VDY.exe File created C:\windows\SysWOW64\KWSO.exe IJBE.exe File opened for modification C:\windows\SysWOW64\JVO.exe ACQI.exe File created C:\windows\SysWOW64\UELOYE.exe.bat BLVDPD.exe File created C:\windows\SysWOW64\JUHM.exe TZQZFU.exe File created C:\windows\SysWOW64\JUHM.exe.bat TZQZFU.exe File created C:\windows\SysWOW64\EPNNSPW.exe.bat OZMVL.exe File opened for modification C:\windows\SysWOW64\QRERG.exe XOAVBM.exe File created C:\windows\SysWOW64\HFXJC.exe.bat YFV.exe File opened for modification C:\windows\SysWOW64\RIT.exe JVO.exe File created C:\windows\SysWOW64\WPVVA.exe OKIHPG.exe File created C:\windows\SysWOW64\MEPM.exe XJGHVVH.exe File opened for modification C:\windows\SysWOW64\KWSO.exe IJBE.exe File created C:\windows\SysWOW64\JVO.exe ACQI.exe File created C:\windows\SysWOW64\SRJGLH.exe ELJUJV.exe File created C:\windows\SysWOW64\MIMJV.exe GNAIH.exe File created C:\windows\SysWOW64\WGSD.exe.bat MIMJV.exe File created C:\windows\SysWOW64\LIJHYZN.exe.bat FNX.exe File opened for modification C:\windows\SysWOW64\YTDDKCI.exe WVXI.exe File created C:\windows\SysWOW64\ZOHYQS.exe YTDDKCI.exe File created C:\windows\SysWOW64\RKOB.exe NHQGWV.exe File opened for modification C:\windows\SysWOW64\RQQ.exe LVRCL.exe File opened for modification C:\windows\SysWOW64\XOAVBM.exe WTWA.exe File created C:\windows\SysWOW64\KWSO.exe.bat IJBE.exe File created C:\windows\SysWOW64\WPVVA.exe.bat OKIHPG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\DWTUJFY.exe WGSD.exe File created C:\windows\system\KFJIRCL.exe.bat QRERG.exe File created C:\windows\ZWHHIS.exe.bat VOBH.exe File created C:\windows\YFV.exe.bat OHQJJE.exe File created C:\windows\LEWYIWI.exe.bat KBSCC.exe File created C:\windows\system\YZLRRE.exe NGIY.exe File created C:\windows\PMW.exe.bat YZLRRE.exe File opened for modification C:\windows\system\XJGHVVH.exe ZOHYQS.exe File created C:\windows\ZINKJC.exe.bat XKZQCTV.exe File opened for modification C:\windows\YFV.exe OHQJJE.exe File created C:\windows\system\KBSCC.exe KWSO.exe File created C:\windows\IKBUQ.exe.bat AFPNF.exe File created C:\windows\VQCVNLU.exe GAPMX.exe File created C:\windows\system\ELTADZG.exe.bat ZSKQZD.exe File opened for modification C:\windows\LFGDCRQ.exe DZTOZSU.exe File created C:\windows\WSC.exe AHLOG.exe File created C:\windows\system\UNBN.exe WSC.exe File opened for modification C:\windows\system\LLV.exe LIJDZPI.exe File created C:\windows\VDY.exe.bat LFTKGO.exe File opened for modification C:\windows\VQCVNLU.exe GAPMX.exe File created C:\windows\system\RBK.exe.bat CLJOR.exe File opened for modification C:\windows\RXWAHEU.exe TKWZD.exe File created C:\windows\NGIY.exe UNBN.exe File created C:\windows\NGIY.exe.bat UNBN.exe File created C:\windows\IJBE.exe.bat HFXJC.exe File opened for modification C:\windows\system\KBSCC.exe KWSO.exe File created C:\windows\system\TKWZD.exe EPNNSPW.exe File created C:\windows\RXWAHEU.exe.bat TKWZD.exe File opened for modification C:\windows\system\WVXI.exe KFJIRCL.exe File created C:\windows\system\EWBK.exe.bat OGASIM.exe File created C:\windows\system\UPUE.exe PMW.exe File created C:\windows\system\FNX.exe.bat VPR.exe File opened for modification C:\windows\SOETJ.exe OGP.exe File opened for modification C:\windows\system\EWBK.exe OGASIM.exe File opened for modification C:\windows\system\NHQGWV.exe ZWHHIS.exe File created C:\windows\LEWYIWI.exe KBSCC.exe File created C:\windows\system\DWTUJFY.exe.bat WGSD.exe File created C:\windows\GAPMX.exe.bat IKBUQ.exe File created C:\windows\system\UTN.exe RXWAHEU.exe File created C:\windows\system\UNBN.exe.bat WSC.exe File opened for modification C:\windows\VOBH.exe VLPDQKT.exe File created C:\windows\system\PEBBSM.exe.bat VQCVNLU.exe File created C:\windows\system\UTN.exe.bat RXWAHEU.exe File created C:\windows\system\XJGHVVH.exe.bat ZOHYQS.exe File created C:\windows\XZFOUY.exe EWBK.exe File created C:\windows\PMW.exe YZLRRE.exe File opened for modification C:\windows\system\ELJUJV.exe RIT.exe File created C:\windows\system\IKVTM.exe.bat XROID.exe File created C:\windows\UWRFG.exe UTN.exe File created C:\windows\LFTKGO.exe RKOB.exe File opened for modification C:\windows\MWVDOA.exe IGP.exe File created C:\windows\system\ZZU.exe MWVDOA.exe File opened for modification C:\windows\LEWYIWI.exe KBSCC.exe File opened for modification C:\windows\system\FNX.exe VPR.exe File created C:\windows\UWRFG.exe.bat UTN.exe File opened for modification C:\windows\system\KFJIRCL.exe QRERG.exe File created C:\windows\system\FKXLY.exe NHT.exe File created C:\windows\DZTOZSU.exe.bat FOQ.exe File created C:\windows\OGASIM.exe LYT.exe File opened for modification C:\windows\system\UNBN.exe WSC.exe File created C:\windows\system\XJGHVVH.exe ZOHYQS.exe File opened for modification C:\windows\LIJDZPI.exe SFFZT.exe File created C:\windows\LIJDZPI.exe.bat SFFZT.exe File opened for modification C:\windows\VDY.exe LFTKGO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5088 cmd.exe 5944 cmd.exe 2164 cmd.exe 2564 cmd.exe 4824 cmd.exe 5652 cmd.exe 1716 cmd.exe 5888 cmd.exe 4628 cmd.exe 1892 cmd.exe 3048 cmd.exe 5868 cmd.exe 4720 cmd.exe 3052 cmd.exe 2684 cmd.exe 2344 cmd.exe 4528 cmd.exe 2844 cmd.exe 4396 cmd.exe 1800 cmd.exe 5844 cmd.exe 236 cmd.exe 6068 cmd.exe 4912 cmd.exe 5480 cmd.exe 4360 cmd.exe 3804 cmd.exe 3904 cmd.exe 1356 cmd.exe 2976 cmd.exe 1952 cmd.exe 1188 cmd.exe 4520 cmd.exe 5668 cmd.exe 5820 cmd.exe 2828 cmd.exe 5784 cmd.exe 2140 cmd.exe 2488 cmd.exe 6140 cmd.exe 2608 cmd.exe 2260 cmd.exe 3528 cmd.exe 3060 cmd.exe 5280 cmd.exe 2524 cmd.exe 3916 cmd.exe 1280 cmd.exe 1612 cmd.exe 2304 cmd.exe 5288 cmd.exe 4852 cmd.exe 2420 cmd.exe 4524 cmd.exe 6048 cmd.exe 5204 cmd.exe 2248 cmd.exe 2368 cmd.exe 5708 cmd.exe 956 cmd.exe 4972 cmd.exe 4540 cmd.exe 4748 cmd.exe 3304 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4820 4932 WerFault.exe 87 2900 2812 WerFault.exe 93 5860 5176 WerFault.exe 99 5520 2624 WerFault.exe 104 1380 1900 WerFault.exe 109 2924 6044 WerFault.exe 114 1416 4388 WerFault.exe 119 716 3004 WerFault.exe 124 3380 3488 WerFault.exe 129 1624 4576 WerFault.exe 134 4992 1260 WerFault.exe 139 3416 5108 WerFault.exe 144 4400 3324 WerFault.exe 149 1360 1476 WerFault.exe 154 1268 4208 WerFault.exe 159 4760 2968 WerFault.exe 164 2140 2508 WerFault.exe 169 4920 3344 WerFault.exe 174 3396 4468 WerFault.exe 179 908 2604 WerFault.exe 184 5976 6076 WerFault.exe 189 5052 5132 WerFault.exe 194 4632 2880 WerFault.exe 199 548 3420 WerFault.exe 204 5164 3504 WerFault.exe 209 1672 2336 WerFault.exe 214 1364 4676 WerFault.exe 219 5212 2428 WerFault.exe 224 720 4308 WerFault.exe 229 2768 2064 WerFault.exe 234 5876 3808 WerFault.exe 239 4960 1760 WerFault.exe 244 2900 2868 WerFault.exe 249 2608 3476 WerFault.exe 254 2848 5136 WerFault.exe 260 2616 1792 WerFault.exe 265 2852 2712 WerFault.exe 270 4516 2776 WerFault.exe 275 4488 716 WerFault.exe 280 2700 5400 WerFault.exe 285 5672 4216 WerFault.exe 289 2460 3464 WerFault.exe 295 4924 1396 WerFault.exe 300 4628 4412 WerFault.exe 305 2576 5908 WerFault.exe 310 2356 5160 WerFault.exe 315 5020 2384 WerFault.exe 320 2760 1660 WerFault.exe 325 3880 3220 WerFault.exe 330 2484 3068 WerFault.exe 335 5388 5976 WerFault.exe 340 5488 4772 WerFault.exe 345 5956 4392 WerFault.exe 350 5764 3236 WerFault.exe 355 432 4752 WerFault.exe 360 2780 6112 WerFault.exe 365 1972 4568 WerFault.exe 370 5468 3312 WerFault.exe 375 2800 3424 WerFault.exe 380 4436 5320 WerFault.exe 385 6128 5036 WerFault.exe 390 364 5488 WerFault.exe 395 2404 3044 WerFault.exe 400 2828 5692 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWHHIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZTOZSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLJOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEBBSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIJDZPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PZFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKBUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELJUJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WWISFD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNBN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZLRRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHQGWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KBSCC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZINKJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLPDQKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSKQZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOAVBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YTDDKCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHQJJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4932 2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe 4932 2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe 2812 ACQI.exe 2812 ACQI.exe 5176 JVO.exe 5176 JVO.exe 2624 RIT.exe 2624 RIT.exe 1900 ELJUJV.exe 1900 ELJUJV.exe 6044 SRJGLH.exe 6044 SRJGLH.exe 4388 COXA.exe 4388 COXA.exe 3004 PZFZ.exe 3004 PZFZ.exe 3488 OKIHPG.exe 3488 OKIHPG.exe 4576 WPVVA.exe 4576 WPVVA.exe 1260 GNAIH.exe 1260 GNAIH.exe 5108 MIMJV.exe 5108 MIMJV.exe 3324 WGSD.exe 3324 WGSD.exe 1476 DWTUJFY.exe 1476 DWTUJFY.exe 4208 NUGPR.exe 4208 NUGPR.exe 2968 AFPNF.exe 2968 AFPNF.exe 2508 IKBUQ.exe 2508 IKBUQ.exe 3344 GAPMX.exe 3344 GAPMX.exe 4468 VQCVNLU.exe 4468 VQCVNLU.exe 2604 PEBBSM.exe 2604 PEBBSM.exe 6076 XROID.exe 6076 XROID.exe 5132 IKVTM.exe 5132 IKVTM.exe 2880 ZSKQZD.exe 2880 ZSKQZD.exe 3420 ELTADZG.exe 3420 ELTADZG.exe 3504 BLVDPD.exe 3504 BLVDPD.exe 2336 UELOYE.exe 2336 UELOYE.exe 4676 AZWGMS.exe 4676 AZWGMS.exe 2428 TSERVT.exe 2428 TSERVT.exe 4308 VPR.exe 4308 VPR.exe 2064 FNX.exe 2064 FNX.exe 3808 LIJHYZN.exe 3808 LIJHYZN.exe 1760 MLMDDO.exe 1760 MLMDDO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4932 2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe 4932 2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe 2812 ACQI.exe 2812 ACQI.exe 5176 JVO.exe 5176 JVO.exe 2624 RIT.exe 2624 RIT.exe 1900 ELJUJV.exe 1900 ELJUJV.exe 6044 SRJGLH.exe 6044 SRJGLH.exe 4388 COXA.exe 4388 COXA.exe 3004 PZFZ.exe 3004 PZFZ.exe 3488 OKIHPG.exe 3488 OKIHPG.exe 4576 WPVVA.exe 4576 WPVVA.exe 1260 GNAIH.exe 1260 GNAIH.exe 5108 MIMJV.exe 5108 MIMJV.exe 3324 WGSD.exe 3324 WGSD.exe 1476 DWTUJFY.exe 1476 DWTUJFY.exe 4208 NUGPR.exe 4208 NUGPR.exe 2968 AFPNF.exe 2968 AFPNF.exe 2508 IKBUQ.exe 2508 IKBUQ.exe 3344 GAPMX.exe 3344 GAPMX.exe 4468 VQCVNLU.exe 4468 VQCVNLU.exe 2604 PEBBSM.exe 2604 PEBBSM.exe 6076 XROID.exe 6076 XROID.exe 5132 IKVTM.exe 5132 IKVTM.exe 2880 ZSKQZD.exe 2880 ZSKQZD.exe 3420 ELTADZG.exe 3420 ELTADZG.exe 3504 BLVDPD.exe 3504 BLVDPD.exe 2336 UELOYE.exe 2336 UELOYE.exe 4676 AZWGMS.exe 4676 AZWGMS.exe 2428 TSERVT.exe 2428 TSERVT.exe 4308 VPR.exe 4308 VPR.exe 2064 FNX.exe 2064 FNX.exe 3808 LIJHYZN.exe 3808 LIJHYZN.exe 1760 MLMDDO.exe 1760 MLMDDO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4932 wrote to memory of 4520 4932 2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe 89 PID 4520 wrote to memory of 2812 4520 cmd.exe 93 PID 2812 wrote to memory of 4720 2812 ACQI.exe 95 PID 4720 wrote to memory of 5176 4720 cmd.exe 99 PID 5176 wrote to memory of 2056 5176 JVO.exe 100 PID 2056 wrote to memory of 2624 2056 cmd.exe 104 PID 2624 wrote to memory of 5980 2624 RIT.exe 105 PID 5980 wrote to memory of 1900 5980 cmd.exe 109 PID 1900 wrote to memory of 5280 1900 ELJUJV.exe 110 PID 5280 wrote to memory of 6044 5280 cmd.exe 114 PID 6044 wrote to memory of 1288 6044 SRJGLH.exe 115 PID 1288 wrote to memory of 4388 1288 cmd.exe 119 PID 4388 wrote to memory of 3052 4388 COXA.exe 120 PID 3052 wrote to memory of 3004 3052 cmd.exe 124 PID 3004 wrote to memory of 2684 3004 PZFZ.exe 125 PID 2684 wrote to memory of 3488 2684 cmd.exe 129 PID 3488 wrote to memory of 4824 3488 OKIHPG.exe 130 PID 4824 wrote to memory of 4576 4824 cmd.exe 134 PID 4576 wrote to memory of 5248 4576 WPVVA.exe 135 PID 5248 wrote to memory of 1260 5248 cmd.exe 139 PID 1260 wrote to memory of 6120 1260 GNAIH.exe 140 PID 6120 wrote to memory of 5108 6120 cmd.exe 144 PID 5108 wrote to memory of 1588 5108 MIMJV.exe 145 PID 1588 wrote to memory of 3324 1588 cmd.exe 149 PID 3324 wrote to memory of 4480 3324 WGSD.exe 150 PID 4480 wrote to memory of 1476 4480 cmd.exe 154 PID 1476 wrote to memory of 4452 1476 DWTUJFY.exe 155 PID 4452 wrote to memory of 4208 4452 cmd.exe 159 PID 4208 wrote to memory of 2344 4208 NUGPR.exe 160 PID 2344 wrote to memory of 2968 2344 cmd.exe 164 PID 2968 wrote to memory of 1988 2968 AFPNF.exe 165 PID 1988 wrote to memory of 2508 1988 cmd.exe 169 PID 2508 wrote to memory of 6108 2508 IKBUQ.exe 170 PID 6108 wrote to memory of 3344 6108 cmd.exe 174 PID 3344 wrote to memory of 3604 3344 GAPMX.exe 175 PID 3604 wrote to memory of 4468 3604 cmd.exe 179 PID 4468 wrote to memory of 804 4468 VQCVNLU.exe 180 PID 804 wrote to memory of 2604 804 cmd.exe 184 PID 2604 wrote to memory of 4588 2604 PEBBSM.exe 185 PID 4588 wrote to memory of 6076 4588 cmd.exe 189 PID 6076 wrote to memory of 5288 6076 XROID.exe 190 PID 5288 wrote to memory of 5132 5288 cmd.exe 194 PID 5132 wrote to memory of 5088 5132 IKVTM.exe 195 PID 5088 wrote to memory of 2880 5088 cmd.exe 199 PID 2880 wrote to memory of 3784 2880 ZSKQZD.exe 200 PID 3784 wrote to memory of 3420 3784 cmd.exe 204 PID 3420 wrote to memory of 1800 3420 ELTADZG.exe 205 PID 1800 wrote to memory of 3504 1800 cmd.exe 209 PID 3504 wrote to memory of 3816 3504 BLVDPD.exe 210 PID 3816 wrote to memory of 2336 3816 cmd.exe 214 PID 2336 wrote to memory of 2252 2336 UELOYE.exe 215 PID 2252 wrote to memory of 4676 2252 cmd.exe 219 PID 4676 wrote to memory of 5868 4676 AZWGMS.exe 220 PID 5868 wrote to memory of 2428 5868 cmd.exe 224 PID 2428 wrote to memory of 3000 2428 TSERVT.exe 225 PID 3000 wrote to memory of 4308 3000 cmd.exe 229 PID 4308 wrote to memory of 5652 4308 VPR.exe 230 PID 5652 wrote to memory of 2064 5652 cmd.exe 234 PID 2064 wrote to memory of 4852 2064 FNX.exe 235 PID 4852 wrote to memory of 3808 4852 cmd.exe 239 PID 3808 wrote to memory of 1868 3808 LIJHYZN.exe 240 PID 1868 wrote to memory of 1760 1868 cmd.exe 244 PID 1760 wrote to memory of 5668 1760 MLMDDO.exe 245 PID 5668 wrote to memory of 2868 5668 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a198dc257443b4f230be63e5f546cc49_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACQI.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\SysWOW64\ACQI.exeC:\windows\system32\ACQI.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JVO.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\windows\SysWOW64\JVO.exeC:\windows\system32\JVO.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIT.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\windows\SysWOW64\RIT.exeC:\windows\system32\RIT.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELJUJV.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\windows\system\ELJUJV.exeC:\windows\system\ELJUJV.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRJGLH.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\windows\SysWOW64\SRJGLH.exeC:\windows\system32\SRJGLH.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COXA.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\SysWOW64\COXA.exeC:\windows\system32\COXA.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZFZ.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\windows\PZFZ.exeC:\windows\PZFZ.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKIHPG.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\windows\system\OKIHPG.exeC:\windows\system\OKIHPG.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPVVA.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SysWOW64\WPVVA.exeC:\windows\system32\WPVVA.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GNAIH.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\windows\GNAIH.exeC:\windows\GNAIH.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIMJV.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\windows\SysWOW64\MIMJV.exeC:\windows\system32\MIMJV.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGSD.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\windows\SysWOW64\WGSD.exeC:\windows\system32\WGSD.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWTUJFY.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\windows\system\DWTUJFY.exeC:\windows\system\DWTUJFY.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUGPR.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\SysWOW64\NUGPR.exeC:\windows\system32\NUGPR.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AFPNF.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\windows\system\AFPNF.exeC:\windows\system\AFPNF.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKBUQ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\windows\IKBUQ.exeC:\windows\IKBUQ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAPMX.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\windows\GAPMX.exeC:\windows\GAPMX.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQCVNLU.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\windows\VQCVNLU.exeC:\windows\VQCVNLU.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEBBSM.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:804 -
C:\windows\system\PEBBSM.exeC:\windows\system\PEBBSM.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XROID.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\system\XROID.exeC:\windows\system\XROID.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IKVTM.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\windows\system\IKVTM.exeC:\windows\system\IKVTM.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELTADZG.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\windows\system\ELTADZG.exeC:\windows\system\ELTADZG.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLVDPD.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\windows\SysWOW64\BLVDPD.exeC:\windows\system32\BLVDPD.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UELOYE.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\windows\SysWOW64\UELOYE.exeC:\windows\system32\UELOYE.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZWGMS.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\windows\SysWOW64\AZWGMS.exeC:\windows\system32\AZWGMS.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TSERVT.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\SysWOW64\TSERVT.exeC:\windows\system32\TSERVT.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPR.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\windows\SysWOW64\VPR.exeC:\windows\system32\VPR.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNX.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\system\FNX.exeC:\windows\system\FNX.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LIJHYZN.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\windows\SysWOW64\LIJHYZN.exeC:\windows\system32\LIJHYZN.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLMDDO.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\windows\SysWOW64\MLMDDO.exeC:\windows\system32\MLMDDO.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOQ.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\windows\SysWOW64\FOQ.exeC:\windows\system32\FOQ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZTOZSU.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3904 -
C:\windows\DZTOZSU.exeC:\windows\DZTOZSU.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "68⤵PID:1160
-
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVMD.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5944 -
C:\windows\SysWOW64\PVMD.exeC:\windows\system32\PVMD.exe71⤵
- Executes dropped EXE
PID:1792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4760 -
C:\windows\OGP.exeC:\windows\OGP.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOETJ.exe.bat" "74⤵PID:1872
-
C:\windows\SOETJ.exeC:\windows\SOETJ.exe75⤵
- Executes dropped EXE
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLJOR.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5844 -
C:\windows\system\CLJOR.exeC:\windows\system\CLJOR.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBK.exe.bat" "78⤵PID:3428
-
C:\windows\system\RBK.exeC:\windows\system\RBK.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZQZFU.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1556 -
C:\windows\SysWOW64\TZQZFU.exeC:\windows\system32\TZQZFU.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUHM.exe.bat" "82⤵PID:5876
-
C:\windows\SysWOW64\JUHM.exeC:\windows\system32\JUHM.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXL.exe.bat" "84⤵PID:4544
-
C:\windows\JXL.exeC:\windows\JXL.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVRCL.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2368 -
C:\windows\LVRCL.exeC:\windows\LVRCL.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQQ.exe.bat" "88⤵PID:1604
-
C:\windows\SysWOW64\RQQ.exeC:\windows\system32\RQQ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWISFD.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5164 -
C:\windows\SysWOW64\WWISFD.exeC:\windows\system32\WWISFD.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5708 -
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPNNSPW.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4640 -
C:\windows\SysWOW64\EPNNSPW.exeC:\windows\system32\EPNNSPW.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKWZD.exe.bat" "96⤵PID:4272
-
C:\windows\system\TKWZD.exeC:\windows\system\TKWZD.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RXWAHEU.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5336 -
C:\windows\RXWAHEU.exeC:\windows\RXWAHEU.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTN.exe.bat" "100⤵PID:1328
-
C:\windows\system\UTN.exeC:\windows\system\UTN.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWRFG.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1716 -
C:\windows\UWRFG.exeC:\windows\UWRFG.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTWA.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5888 -
C:\windows\SysWOW64\WTWA.exeC:\windows\system32\WTWA.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOAVBM.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4528 -
C:\windows\SysWOW64\XOAVBM.exeC:\windows\system32\XOAVBM.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QRERG.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4628 -
C:\windows\SysWOW64\QRERG.exeC:\windows\system32\QRERG.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KFJIRCL.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2420 -
C:\windows\system\KFJIRCL.exeC:\windows\system\KFJIRCL.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVXI.exe.bat" "112⤵PID:3896
-
C:\windows\system\WVXI.exeC:\windows\system\WVXI.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTDDKCI.exe.bat" "114⤵PID:5060
-
C:\windows\SysWOW64\YTDDKCI.exeC:\windows\system32\YTDDKCI.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOHYQS.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2772 -
C:\windows\SysWOW64\ZOHYQS.exeC:\windows\system32\ZOHYQS.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJGHVVH.exe.bat" "118⤵PID:2768
-
C:\windows\system\XJGHVVH.exeC:\windows\system\XJGHVVH.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MEPM.exe.bat" "120⤵PID:4132
-
C:\windows\SysWOW64\MEPM.exeC:\windows\system32\MEPM.exe121⤵
- Executes dropped EXE
PID:5036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-