Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 20:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe
- Size 208KB
- Sample260804-zqmb8agg76
- SHA256 813851331f27e2de72f4b4159ff72109d896c8a587a6b9f5749abaf769be2b18
- MD5 24a052cd440b9cd3a2d908b2b4c003e3
- SHA1 d3e8c5184997418ec6bf9d711e65f59c1b92ba29
- SHA512 73cdc91ab2d9d16fc1338ed6f3a5a976706a0c7d428c17a4a0dfe1289b76659aef4c8212894d41928dfe667363eaedd52f446c52158a151e96976fe61dbe49c1
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf/4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO3QEj1
- TLSH T1CD247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4912 MNRPKWX.exe 4520 INH.exe 4800 SLHTI.exe 3004 SGLP.exe 3652 YBKXS.exe 540 AZQK.exe 5504 KXVE.exe 1528 ASFI.exe 2112 EVLDAFK.exe 4588 RGTCOQX.exe 2632 QRWSXW.exe 5732 DBNJ.exe 3168 NZSD.exe 5028 TVREX.exe 3940 XDYMJLB.exe 2076 WNBCSR.exe 6100 YLOOZ.exe 1952 TWX.exe 4252 VUD.exe 2408 KKMZ.exe 2252 UHRT.exe 684 DQTYV.exe 5320 ANDNLP.exe 2364 PDMNJCT.exe 4628 DOVLYNO.exe 3620 SEW.exe 6088 THAHKZN.exe 916 RSCXSF.exe 4860 VARX.exe 4664 XYXRMF.exe 5204 HWCLBO.exe 2800 LMR.exe 1780 ZHVMU.exe 2844 WZEP.exe 2956 NITM.exe 4156 ATDZTU.exe 3112 CQJ.exe 2972 LGP.exe 4500 FHE.exe 5052 OHGE.exe 5480 HANP.exe 2284 PQW.exe 716 OIZWJ.exe 1308 JLIVQ.exe 1320 NBOVCHE.exe 3176 WCQ.exe 1636 NKSNR.exe 3120 GFW.exe 2296 KVDRJS.exe 2208 ZQUV.exe 5892 OGVUAAV.exe 6140 SWCUM.exe 4160 KWEAQQ.exe 4340 MUJUX.exe 4056 WSX.exe 2628 LIYGTC.exe 1612 NGEABL.exe 5720 CBNM.exe 936 IWMN.exe 3860 CPCY.exe 2496 EMHSPKP.exe 4188 TCIKO.exe 1796 IXS.exe 2288 HIDEQYB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\AZQK.exe YBKXS.exe File opened for modification C:\windows\SysWOW64\ASFI.exe KXVE.exe File created C:\windows\SysWOW64\ASFI.exe.bat KXVE.exe File created C:\windows\SysWOW64\DBNJ.exe.bat QRWSXW.exe File created C:\windows\SysWOW64\PDMNJCT.exe ANDNLP.exe File created C:\windows\SysWOW64\CQJ.exe ATDZTU.exe File created C:\windows\SysWOW64\WCQ.exe.bat NBOVCHE.exe File opened for modification C:\windows\SysWOW64\ZQUV.exe KVDRJS.exe File created C:\windows\SysWOW64\YBKXS.exe SGLP.exe File created C:\windows\SysWOW64\XDYMJLB.exe.bat TVREX.exe File opened for modification C:\windows\SysWOW64\CQJ.exe ATDZTU.exe File created C:\windows\SysWOW64\SWCUM.exe.bat OGVUAAV.exe File opened for modification C:\windows\SysWOW64\TCIKO.exe EMHSPKP.exe File created C:\windows\SysWOW64\YBKXS.exe.bat SGLP.exe File created C:\windows\SysWOW64\HWCLBO.exe XYXRMF.exe File opened for modification C:\windows\SysWOW64\HANP.exe OHGE.exe File opened for modification C:\windows\SysWOW64\WCQ.exe NBOVCHE.exe File opened for modification C:\windows\SysWOW64\KVDRJS.exe GFW.exe File opened for modification C:\windows\SysWOW64\MUJUX.exe KWEAQQ.exe File created C:\windows\SysWOW64\JYS.exe UIRAW.exe File created C:\windows\SysWOW64\KKMZ.exe VUD.exe File opened for modification C:\windows\SysWOW64\SEW.exe DOVLYNO.exe File created C:\windows\SysWOW64\HANP.exe.bat OHGE.exe File created C:\windows\SysWOW64\WCQ.exe NBOVCHE.exe File created C:\windows\SysWOW64\XDYMJLB.exe TVREX.exe File opened for modification C:\windows\SysWOW64\NBOVCHE.exe JLIVQ.exe File created C:\windows\SysWOW64\NKSNR.exe.bat WCQ.exe File opened for modification C:\windows\SysWOW64\YBKXS.exe SGLP.exe File opened for modification C:\windows\SysWOW64\EVLDAFK.exe ASFI.exe File created C:\windows\SysWOW64\ANDNLP.exe DQTYV.exe File created C:\windows\SysWOW64\GFW.exe.bat NKSNR.exe File opened for modification C:\windows\SysWOW64\SWCUM.exe OGVUAAV.exe File created C:\windows\SysWOW64\DBNJ.exe QRWSXW.exe File created C:\windows\SysWOW64\MUJUX.exe KWEAQQ.exe File created C:\windows\SysWOW64\WSX.exe.bat MUJUX.exe File created C:\windows\SysWOW64\JYS.exe.bat UIRAW.exe File opened for modification C:\windows\SysWOW64\AZQK.exe YBKXS.exe File opened for modification C:\windows\SysWOW64\DBNJ.exe QRWSXW.exe File opened for modification C:\windows\SysWOW64\XDYMJLB.exe TVREX.exe File opened for modification C:\windows\SysWOW64\KKMZ.exe VUD.exe File created C:\windows\SysWOW64\HWCLBO.exe.bat XYXRMF.exe File created C:\windows\SysWOW64\CQJ.exe.bat ATDZTU.exe File opened for modification C:\windows\SysWOW64\NKSNR.exe WCQ.exe File opened for modification C:\windows\SysWOW64\GFW.exe NKSNR.exe File created C:\windows\SysWOW64\SWCUM.exe OGVUAAV.exe File created C:\windows\SysWOW64\WSX.exe MUJUX.exe File created C:\windows\SysWOW64\AZQK.exe.bat YBKXS.exe File created C:\windows\SysWOW64\SEW.exe.bat DOVLYNO.exe File created C:\windows\SysWOW64\MUJUX.exe.bat KWEAQQ.exe File opened for modification C:\windows\SysWOW64\JYS.exe UIRAW.exe File created C:\windows\SysWOW64\KKMZ.exe.bat VUD.exe File created C:\windows\SysWOW64\NBOVCHE.exe JLIVQ.exe File created C:\windows\SysWOW64\EVLDAFK.exe ASFI.exe File created C:\windows\SysWOW64\PDMNJCT.exe.bat ANDNLP.exe File opened for modification C:\windows\SysWOW64\HWCLBO.exe XYXRMF.exe File created C:\windows\SysWOW64\CPCY.exe IWMN.exe File opened for modification C:\windows\SysWOW64\CPCY.exe IWMN.exe File created C:\windows\SysWOW64\TCIKO.exe.bat EMHSPKP.exe File created C:\windows\SysWOW64\ZQUV.exe KVDRJS.exe File created C:\windows\SysWOW64\KVDRJS.exe.bat GFW.exe File created C:\windows\SysWOW64\SEW.exe DOVLYNO.exe File created C:\windows\SysWOW64\ASFI.exe KXVE.exe File created C:\windows\SysWOW64\ANDNLP.exe.bat DQTYV.exe File opened for modification C:\windows\SysWOW64\PDMNJCT.exe ANDNLP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\ZHVMU.exe LMR.exe File opened for modification C:\windows\system\WZEP.exe ZHVMU.exe File created C:\windows\JLIVQ.exe OIZWJ.exe File opened for modification C:\windows\system\OGVUAAV.exe ZQUV.exe File created C:\windows\system\LIYGTC.exe WSX.exe File opened for modification C:\windows\UHRT.exe KKMZ.exe File created C:\windows\system\CBNM.exe NGEABL.exe File created C:\windows\system\CBNM.exe.bat NGEABL.exe File created C:\windows\system\SGLP.exe SLHTI.exe File opened for modification C:\windows\NZSD.exe DBNJ.exe File opened for modification C:\windows\system\TWX.exe YLOOZ.exe File created C:\windows\VUD.exe.bat TWX.exe File created C:\windows\system\WZEP.exe.bat ZHVMU.exe File created C:\windows\system\ATDZTU.exe NITM.exe File opened for modification C:\windows\KXVE.exe AZQK.exe File opened for modification C:\windows\system\DOVLYNO.exe PDMNJCT.exe File created C:\windows\XYXRMF.exe.bat VARX.exe File opened for modification C:\windows\system\NGEABL.exe LIYGTC.exe File created C:\windows\system\SGLP.exe.bat SLHTI.exe File created C:\windows\NZSD.exe.bat DBNJ.exe File created C:\windows\VUD.exe TWX.exe File created C:\windows\FHE.exe LGP.exe File created C:\windows\FHE.exe.bat LGP.exe File created C:\windows\system\PQW.exe HANP.exe File created C:\windows\IXS.exe TCIKO.exe File created C:\windows\WNBCSR.exe XDYMJLB.exe File created C:\windows\system\INH.exe MNRPKWX.exe File created C:\windows\system\TWX.exe YLOOZ.exe File created C:\windows\system\DOVLYNO.exe PDMNJCT.exe File created C:\windows\system\RSCXSF.exe.bat THAHKZN.exe File created C:\windows\system\LIYGTC.exe.bat WSX.exe File created C:\windows\DQTYV.exe UHRT.exe File created C:\windows\system\LMR.exe HWCLBO.exe File opened for modification C:\windows\LGP.exe CQJ.exe File created C:\windows\system\ZLGI.exe HIDEQYB.exe File created C:\windows\system\ZLGI.exe.bat HIDEQYB.exe File created C:\windows\UIRAW.exe MUEUL.exe File opened for modification C:\windows\system\MNRPKWX.exe 2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe File created C:\windows\system\SLHTI.exe INH.exe File created C:\windows\THAHKZN.exe.bat SEW.exe File opened for modification C:\windows\system\CBNM.exe NGEABL.exe File created C:\windows\system\EMHSPKP.exe.bat CPCY.exe File created C:\windows\DQTYV.exe.bat UHRT.exe File opened for modification C:\windows\system\VARX.exe RSCXSF.exe File opened for modification C:\windows\HIDEQYB.exe IXS.exe File created C:\windows\system\MUEUL.exe FZVHSMJ.exe File created C:\windows\YLOOZ.exe WNBCSR.exe File opened for modification C:\windows\YLOOZ.exe WNBCSR.exe File opened for modification C:\windows\XYXRMF.exe VARX.exe File created C:\windows\system\IWMN.exe.bat CBNM.exe File opened for modification C:\windows\VUD.exe TWX.exe File created C:\windows\system\NITM.exe.bat WZEP.exe File created C:\windows\OIZWJ.exe.bat PQW.exe File opened for modification C:\windows\system\LBNIHGY.exe ZLGI.exe File opened for modification C:\windows\TVREX.exe NZSD.exe File created C:\windows\system\PQW.exe.bat HANP.exe File opened for modification C:\windows\IXS.exe TCIKO.exe File created C:\windows\WNBCSR.exe.bat XDYMJLB.exe File created C:\windows\LGP.exe.bat CQJ.exe File created C:\windows\KWEAQQ.exe.bat SWCUM.exe File created C:\windows\system\NGEABL.exe LIYGTC.exe File created C:\windows\system\MNRPKWX.exe 2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe File created C:\windows\system\LMR.exe.bat HWCLBO.exe File created C:\windows\JLIVQ.exe.bat OIZWJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3180 cmd.exe 4784 cmd.exe 2924 cmd.exe 4484 cmd.exe 4820 cmd.exe 4548 cmd.exe 5604 cmd.exe 4428 cmd.exe 2476 cmd.exe 2676 cmd.exe 5996 cmd.exe 4088 cmd.exe 1436 cmd.exe 6080 cmd.exe 3188 cmd.exe 2508 cmd.exe 5032 cmd.exe 3172 cmd.exe 5020 cmd.exe 5496 cmd.exe 3144 cmd.exe 3336 cmd.exe 6032 cmd.exe 8 cmd.exe 2400 cmd.exe 1312 cmd.exe 4304 cmd.exe 2004 cmd.exe 4372 cmd.exe 2560 cmd.exe 3376 cmd.exe 3208 cmd.exe 3888 cmd.exe 1088 cmd.exe 3216 cmd.exe 2976 cmd.exe 4240 cmd.exe 2200 cmd.exe 1176 cmd.exe 4888 cmd.exe 4736 cmd.exe 5660 cmd.exe 3564 cmd.exe 4644 cmd.exe 2308 cmd.exe 5772 cmd.exe 2096 cmd.exe 4152 cmd.exe 5576 cmd.exe 2592 cmd.exe 5440 cmd.exe 2980 cmd.exe 5704 cmd.exe 1064 cmd.exe 3020 cmd.exe 2468 cmd.exe 4828 cmd.exe 3200 cmd.exe 2056 cmd.exe 4136 cmd.exe 5140 cmd.exe 3312 cmd.exe 4296 cmd.exe 3516 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2140 4140 WerFault.exe 88 3080 4912 WerFault.exe 93 3620 4520 WerFault.exe 99 2080 4800 WerFault.exe 104 1084 3004 WerFault.exe 109 4896 3652 WerFault.exe 114 3164 540 WerFault.exe 119 3000 5504 WerFault.exe 124 908 1528 WerFault.exe 129 5072 2112 WerFault.exe 134 1364 4588 WerFault.exe 139 2684 2632 WerFault.exe 144 2140 5732 WerFault.exe 149 5140 3168 WerFault.exe 154 4636 5028 WerFault.exe 159 2236 3940 WerFault.exe 164 4896 2076 WerFault.exe 169 5712 6100 WerFault.exe 174 4944 1952 WerFault.exe 179 1260 4252 WerFault.exe 184 5608 2408 WerFault.exe 189 3256 2252 WerFault.exe 194 5348 684 WerFault.exe 199 1512 5320 WerFault.exe 204 4156 2364 WerFault.exe 209 2552 4628 WerFault.exe 214 6048 3620 WerFault.exe 219 4352 6088 WerFault.exe 224 688 916 WerFault.exe 229 3000 4860 WerFault.exe 234 5144 4664 WerFault.exe 239 1332 5204 WerFault.exe 244 3672 2800 WerFault.exe 249 6124 1780 WerFault.exe 254 2140 2844 WerFault.exe 259 4584 2956 WerFault.exe 264 2280 4156 WerFault.exe 270 6048 3112 WerFault.exe 274 1376 2972 WerFault.exe 280 2932 4500 WerFault.exe 285 4928 5052 WerFault.exe 290 3536 5480 WerFault.exe 295 2832 2284 WerFault.exe 300 4920 716 WerFault.exe 305 4632 1308 WerFault.exe 310 4560 1320 WerFault.exe 315 3372 3176 WerFault.exe 320 6052 1636 WerFault.exe 325 4488 3120 WerFault.exe 330 4748 2296 WerFault.exe 335 2348 2208 WerFault.exe 340 4596 5892 WerFault.exe 345 1860 6140 WerFault.exe 350 6056 4160 WerFault.exe 355 5276 4340 WerFault.exe 360 5056 4056 WerFault.exe 365 2384 2628 WerFault.exe 370 1664 1612 WerFault.exe 375 4948 5720 WerFault.exe 380 4928 936 WerFault.exe 385 432 3860 WerFault.exe 390 5376 2496 WerFault.exe 395 3488 4188 WerFault.exe 400 1144 1796 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VARX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGEABL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVLDAFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIZWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWCLBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBOVCHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUJUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIYGTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCIKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZVHSMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HANP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBNIHGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUEUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGVUAAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLOOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UHRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NZSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVREX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANDNLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZHVMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLIVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NKSNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWEAQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQTYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4140 2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe 4140 2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe 4912 MNRPKWX.exe 4912 MNRPKWX.exe 4520 INH.exe 4520 INH.exe 4800 SLHTI.exe 4800 SLHTI.exe 3004 SGLP.exe 3004 SGLP.exe 3652 YBKXS.exe 3652 YBKXS.exe 540 AZQK.exe 540 AZQK.exe 5504 KXVE.exe 5504 KXVE.exe 1528 ASFI.exe 1528 ASFI.exe 2112 EVLDAFK.exe 2112 EVLDAFK.exe 4588 RGTCOQX.exe 4588 RGTCOQX.exe 2632 QRWSXW.exe 2632 QRWSXW.exe 5732 DBNJ.exe 5732 DBNJ.exe 3168 NZSD.exe 3168 NZSD.exe 5028 TVREX.exe 5028 TVREX.exe 3940 XDYMJLB.exe 3940 XDYMJLB.exe 2076 WNBCSR.exe 2076 WNBCSR.exe 6100 YLOOZ.exe 6100 YLOOZ.exe 1952 TWX.exe 1952 TWX.exe 4252 VUD.exe 4252 VUD.exe 2408 KKMZ.exe 2408 KKMZ.exe 2252 UHRT.exe 2252 UHRT.exe 684 DQTYV.exe 684 DQTYV.exe 5320 ANDNLP.exe 5320 ANDNLP.exe 2364 PDMNJCT.exe 2364 PDMNJCT.exe 4628 DOVLYNO.exe 4628 DOVLYNO.exe 3620 SEW.exe 3620 SEW.exe 6088 THAHKZN.exe 6088 THAHKZN.exe 916 RSCXSF.exe 916 RSCXSF.exe 4860 VARX.exe 4860 VARX.exe 4664 XYXRMF.exe 4664 XYXRMF.exe 5204 HWCLBO.exe 5204 HWCLBO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4140 2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe 4140 2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe 4912 MNRPKWX.exe 4912 MNRPKWX.exe 4520 INH.exe 4520 INH.exe 4800 SLHTI.exe 4800 SLHTI.exe 3004 SGLP.exe 3004 SGLP.exe 3652 YBKXS.exe 3652 YBKXS.exe 540 AZQK.exe 540 AZQK.exe 5504 KXVE.exe 5504 KXVE.exe 1528 ASFI.exe 1528 ASFI.exe 2112 EVLDAFK.exe 2112 EVLDAFK.exe 4588 RGTCOQX.exe 4588 RGTCOQX.exe 2632 QRWSXW.exe 2632 QRWSXW.exe 5732 DBNJ.exe 5732 DBNJ.exe 3168 NZSD.exe 3168 NZSD.exe 5028 TVREX.exe 5028 TVREX.exe 3940 XDYMJLB.exe 3940 XDYMJLB.exe 2076 WNBCSR.exe 2076 WNBCSR.exe 6100 YLOOZ.exe 6100 YLOOZ.exe 1952 TWX.exe 1952 TWX.exe 4252 VUD.exe 4252 VUD.exe 2408 KKMZ.exe 2408 KKMZ.exe 2252 UHRT.exe 2252 UHRT.exe 684 DQTYV.exe 684 DQTYV.exe 5320 ANDNLP.exe 5320 ANDNLP.exe 2364 PDMNJCT.exe 2364 PDMNJCT.exe 4628 DOVLYNO.exe 4628 DOVLYNO.exe 3620 SEW.exe 3620 SEW.exe 6088 THAHKZN.exe 6088 THAHKZN.exe 916 RSCXSF.exe 916 RSCXSF.exe 4860 VARX.exe 4860 VARX.exe 4664 XYXRMF.exe 4664 XYXRMF.exe 5204 HWCLBO.exe 5204 HWCLBO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 4736 4140 2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe 89 PID 4736 wrote to memory of 4912 4736 cmd.exe 93 PID 4912 wrote to memory of 1064 4912 MNRPKWX.exe 95 PID 1064 wrote to memory of 4520 1064 cmd.exe 99 PID 4520 wrote to memory of 2676 4520 INH.exe 100 PID 2676 wrote to memory of 4800 2676 cmd.exe 104 PID 4800 wrote to memory of 3312 4800 SLHTI.exe 105 PID 3312 wrote to memory of 3004 3312 cmd.exe 109 PID 3004 wrote to memory of 1088 3004 SGLP.exe 110 PID 1088 wrote to memory of 3652 1088 cmd.exe 114 PID 3652 wrote to memory of 4484 3652 YBKXS.exe 115 PID 4484 wrote to memory of 540 4484 cmd.exe 119 PID 540 wrote to memory of 5996 540 AZQK.exe 120 PID 5996 wrote to memory of 5504 5996 cmd.exe 124 PID 5504 wrote to memory of 3180 5504 KXVE.exe 125 PID 3180 wrote to memory of 1528 3180 cmd.exe 129 PID 1528 wrote to memory of 2096 1528 ASFI.exe 130 PID 2096 wrote to memory of 2112 2096 cmd.exe 134 PID 2112 wrote to memory of 5976 2112 EVLDAFK.exe 135 PID 5976 wrote to memory of 4588 5976 cmd.exe 139 PID 4588 wrote to memory of 5524 4588 RGTCOQX.exe 140 PID 5524 wrote to memory of 2632 5524 cmd.exe 144 PID 2632 wrote to memory of 4296 2632 QRWSXW.exe 145 PID 4296 wrote to memory of 5732 4296 cmd.exe 149 PID 5732 wrote to memory of 3020 5732 DBNJ.exe 150 PID 3020 wrote to memory of 3168 3020 cmd.exe 154 PID 3168 wrote to memory of 3172 3168 NZSD.exe 155 PID 3172 wrote to memory of 5028 3172 cmd.exe 159 PID 5028 wrote to memory of 3516 5028 TVREX.exe 160 PID 3516 wrote to memory of 3940 3516 cmd.exe 164 PID 3940 wrote to memory of 2560 3940 XDYMJLB.exe 165 PID 2560 wrote to memory of 2076 2560 cmd.exe 169 PID 2076 wrote to memory of 4088 2076 WNBCSR.exe 170 PID 4088 wrote to memory of 6100 4088 cmd.exe 174 PID 6100 wrote to memory of 4820 6100 YLOOZ.exe 175 PID 4820 wrote to memory of 1952 4820 cmd.exe 179 PID 1952 wrote to memory of 5660 1952 TWX.exe 180 PID 5660 wrote to memory of 4252 5660 cmd.exe 184 PID 4252 wrote to memory of 3216 4252 VUD.exe 185 PID 3216 wrote to memory of 2408 3216 cmd.exe 189 PID 2408 wrote to memory of 3564 2408 KKMZ.exe 190 PID 3564 wrote to memory of 2252 3564 cmd.exe 194 PID 2252 wrote to memory of 1112 2252 UHRT.exe 195 PID 1112 wrote to memory of 684 1112 cmd.exe 199 PID 684 wrote to memory of 4548 684 DQTYV.exe 200 PID 4548 wrote to memory of 5320 4548 cmd.exe 204 PID 5320 wrote to memory of 2980 5320 ANDNLP.exe 205 PID 2980 wrote to memory of 2364 2980 cmd.exe 209 PID 2364 wrote to memory of 1436 2364 PDMNJCT.exe 210 PID 1436 wrote to memory of 4628 1436 cmd.exe 214 PID 4628 wrote to memory of 2468 4628 DOVLYNO.exe 215 PID 2468 wrote to memory of 3620 2468 cmd.exe 219 PID 3620 wrote to memory of 6080 3620 SEW.exe 220 PID 6080 wrote to memory of 6088 6080 cmd.exe 224 PID 6088 wrote to memory of 3188 6088 THAHKZN.exe 225 PID 3188 wrote to memory of 916 3188 cmd.exe 229 PID 916 wrote to memory of 3376 916 RSCXSF.exe 230 PID 3376 wrote to memory of 4860 3376 cmd.exe 234 PID 4860 wrote to memory of 2976 4860 VARX.exe 235 PID 2976 wrote to memory of 4664 2976 cmd.exe 239 PID 4664 wrote to memory of 5020 4664 XYXRMF.exe 240 PID 5020 wrote to memory of 5204 5020 cmd.exe 244 PID 5204 wrote to memory of 6032 5204 HWCLBO.exe 245 PID 6032 wrote to memory of 2800 6032 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_24a052cd440b9cd3a2d908b2b4c003e3_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNRPKWX.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\system\MNRPKWX.exeC:\windows\system\MNRPKWX.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INH.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\windows\system\INH.exeC:\windows\system\INH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SLHTI.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\system\SLHTI.exeC:\windows\system\SLHTI.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGLP.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\windows\system\SGLP.exeC:\windows\system\SGLP.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBKXS.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\windows\SysWOW64\YBKXS.exeC:\windows\system32\YBKXS.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZQK.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\SysWOW64\AZQK.exeC:\windows\system32\AZQK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXVE.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\KXVE.exeC:\windows\KXVE.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASFI.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\windows\SysWOW64\ASFI.exeC:\windows\system32\ASFI.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVLDAFK.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\windows\SysWOW64\EVLDAFK.exeC:\windows\system32\EVLDAFK.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGTCOQX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\system\RGTCOQX.exeC:\windows\system\RGTCOQX.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRWSXW.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\windows\QRWSXW.exeC:\windows\QRWSXW.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBNJ.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\SysWOW64\DBNJ.exeC:\windows\system32\DBNJ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NZSD.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\windows\NZSD.exeC:\windows\NZSD.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TVREX.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\windows\TVREX.exeC:\windows\TVREX.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDYMJLB.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\windows\SysWOW64\XDYMJLB.exeC:\windows\system32\XDYMJLB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WNBCSR.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\windows\WNBCSR.exeC:\windows\WNBCSR.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLOOZ.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\windows\YLOOZ.exeC:\windows\YLOOZ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWX.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\system\TWX.exeC:\windows\system\TWX.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUD.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\VUD.exeC:\windows\VUD.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKMZ.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\windows\SysWOW64\KKMZ.exeC:\windows\system32\KKMZ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHRT.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\windows\UHRT.exeC:\windows\UHRT.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DQTYV.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\windows\DQTYV.exeC:\windows\DQTYV.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANDNLP.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\SysWOW64\ANDNLP.exeC:\windows\system32\ANDNLP.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDMNJCT.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\SysWOW64\PDMNJCT.exeC:\windows\system32\PDMNJCT.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOVLYNO.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\windows\system\DOVLYNO.exeC:\windows\system\DOVLYNO.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEW.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\windows\SysWOW64\SEW.exeC:\windows\system32\SEW.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THAHKZN.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\THAHKZN.exeC:\windows\THAHKZN.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSCXSF.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\windows\system\RSCXSF.exeC:\windows\system\RSCXSF.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VARX.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\system\VARX.exeC:\windows\system\VARX.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYXRMF.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\XYXRMF.exeC:\windows\XYXRMF.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWCLBO.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\SysWOW64\HWCLBO.exeC:\windows\system32\HWCLBO.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZHVMU.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5604 -
C:\windows\ZHVMU.exeC:\windows\ZHVMU.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZEP.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4784 -
C:\windows\system\WZEP.exeC:\windows\system\WZEP.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NITM.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4428 -
C:\windows\system\NITM.exeC:\windows\system\NITM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATDZTU.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5704 -
C:\windows\system\ATDZTU.exeC:\windows\system\ATDZTU.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQJ.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4828 -
C:\windows\SysWOW64\CQJ.exeC:\windows\system32\CQJ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGP.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2508 -
C:\windows\LGP.exeC:\windows\LGP.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4644 -
C:\windows\FHE.exeC:\windows\FHE.exe79⤵
- Executes dropped EXE
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHGE.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5496 -
C:\windows\system\OHGE.exeC:\windows\system\OHGE.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HANP.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4152 -
C:\windows\SysWOW64\HANP.exeC:\windows\system32\HANP.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQW.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1880 -
C:\windows\system\PQW.exeC:\windows\system\PQW.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIZWJ.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2308 -
C:\windows\OIZWJ.exeC:\windows\OIZWJ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLIVQ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5772 -
C:\windows\JLIVQ.exeC:\windows\JLIVQ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NBOVCHE.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4240 -
C:\windows\SysWOW64\NBOVCHE.exeC:\windows\system32\NBOVCHE.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCQ.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2004 -
C:\windows\SysWOW64\WCQ.exeC:\windows\system32\WCQ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NKSNR.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5032 -
C:\windows\SysWOW64\NKSNR.exeC:\windows\system32\NKSNR.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFW.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4684 -
C:\windows\SysWOW64\GFW.exeC:\windows\system32\GFW.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3208 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQUV.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3332 -
C:\windows\SysWOW64\ZQUV.exeC:\windows\system32\ZQUV.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4372 -
C:\windows\system\OGVUAAV.exeC:\windows\system\OGVUAAV.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWCUM.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2200 -
C:\windows\SysWOW64\SWCUM.exeC:\windows\system32\SWCUM.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWEAQQ.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2056 -
C:\windows\KWEAQQ.exeC:\windows\KWEAQQ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUJUX.exe.bat" "108⤵PID:6124
-
C:\windows\SysWOW64\MUJUX.exeC:\windows\system32\MUJUX.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4888 -
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIYGTC.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3888 -
C:\windows\system\LIYGTC.exeC:\windows\system\LIYGTC.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NGEABL.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:8 -
C:\windows\system\NGEABL.exeC:\windows\system\NGEABL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CBNM.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5576 -
C:\windows\system\CBNM.exeC:\windows\system\CBNM.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWMN.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2400 -
C:\windows\system\IWMN.exeC:\windows\system\IWMN.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CPCY.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2592 -
C:\windows\SysWOW64\CPCY.exeC:\windows\system32\CPCY.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-