Analysis
- max time kernel
79s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 17:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe
- Size 208KB
- Sample260808-vjdz2sam5v
- SHA256 60b44d89f9ffc290bea9a55add55c1db845e2429598a3a9953b75b89f1a86833
- MD5 fc900a5619bd8ed981fdc0bf6bb9f9eb
- SHA1 d047cfee0e7909d1647c7c5140d0aa5be688b8c8
- SHA512 69916b4de5ee4b1c308c6dbe5c8864bfae54d17a20cb647763d03dd328520bda41adf55e62566aa8f5dbd69325d7e2755a1aaa862e0b6521b8dea60e91a073d0
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfW4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOOQEjK
- TLSH T101247D2235D2C073E4B7023188F6C7787BB6BD919B36928B7BC03B4D6E315A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2116 IYDIW.exe 1140 QWXJH.exe 1128 CERJDO.exe 3704 TXTZL.exe 5588 FFI.exe 2928 EQLPYAH.exe 564 WTPTMQ.exe 4488 ABV.exe 2856 VWACA.exe 1612 BJZDF.exe 552 HKH.exe 5740 JHMLVOT.exe 4632 AQOQ.exe 3724 CNU.exe 1116 RILXZP.exe 4388 SLP.exe 2884 HCQSLA.exe 4700 VEZJ.exe 4536 ENBWL.exe 2316 VNDB.exe 1940 KQMFA.exe 4092 AGN.exe 4336 HBFJRB.exe 1132 CZFU.exe 2352 UHTSO.exe 3548 RIVCSH.exe 4684 TVMEDT.exe 4936 HTMPN.exe 4752 LJTPZWA.exe 2324 TOFWCVW.exe 4964 GZOVQ.exe 4068 XHQABD.exe 6012 WSBQC.exe 3196 OVET.exe 2304 YLKGXQA.exe 6064 AJYAEY.exe 2320 ZBAQN.exe 368 UEJ.exe 4800 LXUFKVO.exe 5612 XFAF.exe 1272 EVB.exe 2260 QDIEH.exe 2820 UTO.exe 732 WRCZBUK.exe 4504 IZJH.exe 3832 BCNCAC.exe 4640 VPR.exe 4768 DDKA.exe 716 BDROVJ.exe 2244 TDTTZGC.exe 4328 YEBHI.exe 6032 KWEAQQ.exe 3324 OEK.exe 896 IAPRM.exe 1596 JVTN.exe 5016 UVIYBZN.exe 5484 AJAGG.exe 4320 PMR.exe 2128 DJRWBA.exe 4112 SEBB.exe 3240 LHEFRL.exe 3272 XPLFE.exe 3976 GYNKHAN.exe 4616 TJDIV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ZFKRNNS.exe TECDE.exe File created C:\windows\SysWOW64\ZFSYS.exe.bat EUCAE.exe File opened for modification C:\windows\SysWOW64\IYDIW.exe 2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\HBFJRB.exe AGN.exe File opened for modification C:\windows\SysWOW64\OVET.exe WSBQC.exe File created C:\windows\SysWOW64\HKPXYLN.exe.bat ZFKRNNS.exe File created C:\windows\SysWOW64\HNSBDB.exe.bat HKPXYLN.exe File created C:\windows\SysWOW64\CERJDO.exe.bat QWXJH.exe File created C:\windows\SysWOW64\TDTTZGC.exe BDROVJ.exe File created C:\windows\SysWOW64\JHMLVOT.exe HKH.exe File opened for modification C:\windows\SysWOW64\JHMLVOT.exe HKH.exe File created C:\windows\SysWOW64\PMR.exe AJAGG.exe File created C:\windows\SysWOW64\GYNKHAN.exe.bat XPLFE.exe File created C:\windows\SysWOW64\PJVPQNA.exe.bat LTPH.exe File created C:\windows\SysWOW64\JHMLVOT.exe.bat HKH.exe File opened for modification C:\windows\SysWOW64\XFAF.exe LXUFKVO.exe File created C:\windows\SysWOW64\VPR.exe.bat BCNCAC.exe File opened for modification C:\windows\SysWOW64\IAPRM.exe OEK.exe File created C:\windows\SysWOW64\OEK.exe.bat KWEAQQ.exe File created C:\windows\SysWOW64\TJDIV.exe.bat GYNKHAN.exe File created C:\windows\SysWOW64\QUK.exe VZFKGP.exe File created C:\windows\SysWOW64\WQQM.exe OCLFS.exe File opened for modification C:\windows\SysWOW64\VPR.exe BCNCAC.exe File created C:\windows\SysWOW64\RQMBAF.exe EFWCMU.exe File created C:\windows\SysWOW64\EUCAE.exe ARDFWYJ.exe File created C:\windows\SysWOW64\DDKA.exe.bat VPR.exe File opened for modification C:\windows\SysWOW64\RQMBAF.exe EFWCMU.exe File created C:\windows\SysWOW64\EUCAE.exe.bat ARDFWYJ.exe File created C:\windows\SysWOW64\IYDIW.exe 2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe File created C:\windows\SysWOW64\TDTTZGC.exe.bat BDROVJ.exe File opened for modification C:\windows\SysWOW64\QUK.exe VZFKGP.exe File created C:\windows\SysWOW64\UTO.exe.bat QDIEH.exe File created C:\windows\SysWOW64\HNSBDB.exe HKPXYLN.exe File created C:\windows\SysWOW64\VEZJ.exe HCQSLA.exe File created C:\windows\SysWOW64\VPR.exe BCNCAC.exe File opened for modification C:\windows\SysWOW64\SEBB.exe DJRWBA.exe File created C:\windows\SysWOW64\LTPH.exe.bat FTHTVBC.exe File created C:\windows\SysWOW64\IYDIW.exe.bat 2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe File created C:\windows\SysWOW64\ABV.exe WTPTMQ.exe File created C:\windows\SysWOW64\XFAF.exe LXUFKVO.exe File created C:\windows\SysWOW64\UTO.exe QDIEH.exe File created C:\windows\SysWOW64\TJDIV.exe GYNKHAN.exe File opened for modification C:\windows\SysWOW64\ZFKRNNS.exe TECDE.exe File opened for modification C:\windows\SysWOW64\ABV.exe WTPTMQ.exe File created C:\windows\SysWOW64\KQMFA.exe.bat VNDB.exe File created C:\windows\SysWOW64\HBFJRB.exe AGN.exe File opened for modification C:\windows\SysWOW64\DDKA.exe VPR.exe File opened for modification C:\windows\SysWOW64\TDTTZGC.exe BDROVJ.exe File created C:\windows\SysWOW64\SEBB.exe.bat DJRWBA.exe File opened for modification C:\windows\SysWOW64\VWACA.exe ABV.exe File opened for modification C:\windows\SysWOW64\KQMFA.exe VNDB.exe File created C:\windows\SysWOW64\OVET.exe WSBQC.exe File created C:\windows\SysWOW64\PJVPQNA.exe LTPH.exe File opened for modification C:\windows\SysWOW64\HNSBDB.exe HKPXYLN.exe File created C:\windows\SysWOW64\VWACA.exe ABV.exe File created C:\windows\SysWOW64\BDROVJ.exe.bat DDKA.exe File opened for modification C:\windows\SysWOW64\YEBHI.exe TDTTZGC.exe File created C:\windows\SysWOW64\TECDE.exe.bat KWAY.exe File created C:\windows\SysWOW64\CNU.exe AQOQ.exe File opened for modification C:\windows\SysWOW64\UTO.exe QDIEH.exe File opened for modification C:\windows\SysWOW64\IMLT.exe JUIDH.exe File opened for modification C:\windows\SysWOW64\PJVPQNA.exe LTPH.exe File created C:\windows\SysWOW64\HKPXYLN.exe ZFKRNNS.exe File opened for modification C:\windows\SysWOW64\CERJDO.exe QWXJH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\XPLFE.exe.bat LHEFRL.exe File created C:\windows\system\XHUYJPE.exe IMLT.exe File created C:\windows\EFWCMU.exe.bat VFCX.exe File created C:\windows\system\DJRWBA.exe PMR.exe File created C:\windows\system\ENBWL.exe.bat VEZJ.exe File opened for modification C:\windows\LJTPZWA.exe HTMPN.exe File created C:\windows\system\LXUFKVO.exe.bat UEJ.exe File created C:\windows\system\KYA.exe ZFSYS.exe File opened for modification C:\windows\EZT.exe WTG.exe File opened for modification C:\windows\system\NLETMCM.exe KYA.exe File created C:\windows\WTPTMQ.exe EQLPYAH.exe File opened for modification C:\windows\HKH.exe BJZDF.exe File created C:\windows\system\TVMEDT.exe.bat RIVCSH.exe File created C:\windows\system\HTMPN.exe.bat TVMEDT.exe File opened for modification C:\windows\system\GZOVQ.exe TOFWCVW.exe File created C:\windows\system\JUIDH.exe JZE.exe File created C:\windows\system\KWAY.exe PJVPQNA.exe File created C:\windows\system\PDTTKXM.exe HNSBDB.exe File opened for modification C:\windows\system\UEJ.exe ZBAQN.exe File opened for modification C:\windows\system\UCQBVHZ.exe QUK.exe File created C:\windows\system\UCQBVHZ.exe.bat QUK.exe File opened for modification C:\windows\system\ARDFWYJ.exe MHVO.exe File created C:\windows\system\NLETMCM.exe KYA.exe File created C:\windows\system\RILXZP.exe CNU.exe File created C:\windows\HCQSLA.exe.bat SLP.exe File created C:\windows\LJTPZWA.exe HTMPN.exe File opened for modification C:\windows\AJYAEY.exe YLKGXQA.exe File created C:\windows\system\LXUFKVO.exe UEJ.exe File created C:\windows\system\IZJH.exe.bat WRCZBUK.exe File created C:\windows\system\UVIYBZN.exe.bat JVTN.exe File opened for modification C:\windows\system\LHEFRL.exe SEBB.exe File created C:\windows\system\ENBWL.exe VEZJ.exe File created C:\windows\UHTSO.exe CZFU.exe File opened for modification C:\windows\XHQABD.exe GZOVQ.exe File opened for modification C:\windows\KWEAQQ.exe YEBHI.exe File opened for modification C:\windows\QCGB.exe XHUYJPE.exe File created C:\windows\QCGB.exe.bat XHUYJPE.exe File opened for modification C:\windows\system\VZFKGP.exe EYLFV.exe File opened for modification C:\windows\WTPTMQ.exe EQLPYAH.exe File created C:\windows\system\FFI.exe TXTZL.exe File created C:\windows\CZFU.exe.bat HBFJRB.exe File created C:\windows\UHTSO.exe.bat CZFU.exe File opened for modification C:\windows\system\RIVCSH.exe UHTSO.exe File opened for modification C:\windows\system\HTMPN.exe TVMEDT.exe File opened for modification C:\windows\system\WRCZBUK.exe UTO.exe File created C:\windows\system\VZFKGP.exe.bat EYLFV.exe File created C:\windows\EQLPYAH.exe.bat FFI.exe File created C:\windows\system\RIVCSH.exe.bat UHTSO.exe File created C:\windows\system\ULDSUYU.exe.bat IYWU.exe File opened for modification C:\windows\system\QWXJH.exe IYDIW.exe File created C:\windows\EQLPYAH.exe FFI.exe File created C:\windows\system\YLKGXQA.exe OVET.exe File created C:\windows\system\YLKGXQA.exe.bat OVET.exe File created C:\windows\system\PDTTKXM.exe.bat HNSBDB.exe File created C:\windows\system\VFCX.exe UCQBVHZ.exe File opened for modification C:\windows\system\ULDSUYU.exe IYWU.exe File created C:\windows\SLP.exe RILXZP.exe File created C:\windows\SLP.exe.bat RILXZP.exe File opened for modification C:\windows\system\VNDB.exe ENBWL.exe File opened for modification C:\windows\system\AGN.exe KQMFA.exe File opened for modification C:\windows\CZFU.exe HBFJRB.exe File created C:\windows\system\RIVCSH.exe UHTSO.exe File created C:\windows\WSBQC.exe.bat XHQABD.exe File opened for modification C:\windows\QDIEH.exe EVB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4604 cmd.exe 2372 cmd.exe 2912 cmd.exe 1740 cmd.exe 3124 cmd.exe 1188 cmd.exe 5816 cmd.exe 1952 cmd.exe 1600 cmd.exe 4168 cmd.exe 1268 cmd.exe 2924 cmd.exe 4992 cmd.exe 4528 cmd.exe 3392 cmd.exe 4396 cmd.exe 4368 cmd.exe 2892 cmd.exe 2916 cmd.exe 2512 cmd.exe 4896 cmd.exe 4608 cmd.exe 840 cmd.exe 4372 cmd.exe 4876 cmd.exe 3412 cmd.exe 6108 cmd.exe 4892 cmd.exe 5636 cmd.exe 3224 cmd.exe 4084 cmd.exe 4364 cmd.exe 5604 cmd.exe 5368 cmd.exe 4928 cmd.exe 5528 cmd.exe 3076 cmd.exe 5004 cmd.exe 5284 cmd.exe 1896 cmd.exe 4856 cmd.exe 5128 cmd.exe 3320 cmd.exe 1224 cmd.exe 3200 cmd.exe 5692 cmd.exe 5048 cmd.exe 5112 cmd.exe 3180 cmd.exe 5896 cmd.exe 2516 cmd.exe 3500 cmd.exe 1804 cmd.exe 6096 cmd.exe 2840 cmd.exe 2748 cmd.exe 4240 cmd.exe 5408 cmd.exe 4956 cmd.exe 3808 cmd.exe 5488 cmd.exe 252 cmd.exe 356 cmd.exe 4816 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5956 4348 WerFault.exe 88 5732 2116 WerFault.exe 93 4084 1140 WerFault.exe 99 4480 1128 WerFault.exe 104 4684 3704 WerFault.exe 109 1416 5588 WerFault.exe 114 1120 2928 WerFault.exe 119 2988 564 WerFault.exe 124 2916 4488 WerFault.exe 129 1872 2856 WerFault.exe 134 5292 1612 WerFault.exe 139 3556 552 WerFault.exe 143 956 5740 WerFault.exe 149 3412 4632 WerFault.exe 154 5008 3724 WerFault.exe 159 6136 1116 WerFault.exe 164 1416 4388 WerFault.exe 169 6088 2884 WerFault.exe 174 4292 4700 WerFault.exe 179 3308 4536 WerFault.exe 184 2368 2316 WerFault.exe 189 844 1940 WerFault.exe 194 4592 4092 WerFault.exe 199 720 4336 WerFault.exe 204 5640 1132 WerFault.exe 209 5784 2352 WerFault.exe 214 3160 3548 WerFault.exe 219 5692 4684 WerFault.exe 224 5364 4936 WerFault.exe 229 2068 4752 WerFault.exe 234 4644 2324 WerFault.exe 239 3176 4964 WerFault.exe 244 3592 4068 WerFault.exe 249 1828 6012 WerFault.exe 254 4504 3196 WerFault.exe 259 3912 2304 WerFault.exe 264 5928 6064 WerFault.exe 269 3116 2320 WerFault.exe 275 4448 368 WerFault.exe 280 6088 4800 WerFault.exe 285 5828 5612 WerFault.exe 290 4604 1272 WerFault.exe 295 3404 2260 WerFault.exe 300 2100 2820 WerFault.exe 305 2796 732 WerFault.exe 310 4164 4504 WerFault.exe 315 6104 3832 WerFault.exe 320 4792 4640 WerFault.exe 325 5936 4768 WerFault.exe 330 1100 716 WerFault.exe 335 2016 2244 WerFault.exe 340 2840 4328 WerFault.exe 345 1664 6032 WerFault.exe 350 5852 3324 WerFault.exe 355 3732 896 WerFault.exe 360 5860 1596 WerFault.exe 365 3400 5016 WerFault.exe 370 2908 5484 WerFault.exe 375 4208 4320 WerFault.exe 380 1156 2128 WerFault.exe 385 3248 4112 WerFault.exe 390 1964 3240 WerFault.exe 395 5112 3272 WerFault.exe 400 2104 3976 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVMEDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TJDIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIVCSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZOVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJYAEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFKRNNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHEFRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTPTMQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZFKGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUIDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTHTVBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQMBAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENBWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TECDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVIYBZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCQBVHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCLFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDIEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CERJDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBAQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STQXFVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLETMCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4348 2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe 4348 2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe 2116 IYDIW.exe 2116 IYDIW.exe 1140 QWXJH.exe 1140 QWXJH.exe 1128 CERJDO.exe 1128 CERJDO.exe 3704 TXTZL.exe 3704 TXTZL.exe 5588 FFI.exe 5588 FFI.exe 2928 EQLPYAH.exe 2928 EQLPYAH.exe 564 WTPTMQ.exe 564 WTPTMQ.exe 4488 ABV.exe 4488 ABV.exe 2856 VWACA.exe 2856 VWACA.exe 1612 BJZDF.exe 1612 BJZDF.exe 552 HKH.exe 552 HKH.exe 5740 JHMLVOT.exe 5740 JHMLVOT.exe 4632 AQOQ.exe 4632 AQOQ.exe 3724 CNU.exe 3724 CNU.exe 1116 RILXZP.exe 1116 RILXZP.exe 4388 SLP.exe 4388 SLP.exe 2884 HCQSLA.exe 2884 HCQSLA.exe 4700 VEZJ.exe 4700 VEZJ.exe 4536 ENBWL.exe 4536 ENBWL.exe 2316 VNDB.exe 2316 VNDB.exe 1940 KQMFA.exe 1940 KQMFA.exe 4092 AGN.exe 4092 AGN.exe 4336 HBFJRB.exe 4336 HBFJRB.exe 1132 CZFU.exe 1132 CZFU.exe 2352 UHTSO.exe 2352 UHTSO.exe 3548 RIVCSH.exe 3548 RIVCSH.exe 4684 TVMEDT.exe 4684 TVMEDT.exe 4936 HTMPN.exe 4936 HTMPN.exe 4752 LJTPZWA.exe 4752 LJTPZWA.exe 2324 TOFWCVW.exe 2324 TOFWCVW.exe 4964 GZOVQ.exe 4964 GZOVQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4348 2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe 4348 2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe 2116 IYDIW.exe 2116 IYDIW.exe 1140 QWXJH.exe 1140 QWXJH.exe 1128 CERJDO.exe 1128 CERJDO.exe 3704 TXTZL.exe 3704 TXTZL.exe 5588 FFI.exe 5588 FFI.exe 2928 EQLPYAH.exe 2928 EQLPYAH.exe 564 WTPTMQ.exe 564 WTPTMQ.exe 4488 ABV.exe 4488 ABV.exe 2856 VWACA.exe 2856 VWACA.exe 1612 BJZDF.exe 1612 BJZDF.exe 552 HKH.exe 552 HKH.exe 5740 JHMLVOT.exe 5740 JHMLVOT.exe 4632 AQOQ.exe 4632 AQOQ.exe 3724 CNU.exe 3724 CNU.exe 1116 RILXZP.exe 1116 RILXZP.exe 4388 SLP.exe 4388 SLP.exe 2884 HCQSLA.exe 2884 HCQSLA.exe 4700 VEZJ.exe 4700 VEZJ.exe 4536 ENBWL.exe 4536 ENBWL.exe 2316 VNDB.exe 2316 VNDB.exe 1940 KQMFA.exe 1940 KQMFA.exe 4092 AGN.exe 4092 AGN.exe 4336 HBFJRB.exe 4336 HBFJRB.exe 1132 CZFU.exe 1132 CZFU.exe 2352 UHTSO.exe 2352 UHTSO.exe 3548 RIVCSH.exe 3548 RIVCSH.exe 4684 TVMEDT.exe 4684 TVMEDT.exe 4936 HTMPN.exe 4936 HTMPN.exe 4752 LJTPZWA.exe 4752 LJTPZWA.exe 2324 TOFWCVW.exe 2324 TOFWCVW.exe 4964 GZOVQ.exe 4964 GZOVQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4348 wrote to memory of 4240 4348 2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe 89 PID 4240 wrote to memory of 2116 4240 cmd.exe 93 PID 2116 wrote to memory of 4300 2116 IYDIW.exe 95 PID 4300 wrote to memory of 1140 4300 cmd.exe 99 PID 1140 wrote to memory of 5004 1140 QWXJH.exe 100 PID 5004 wrote to memory of 1128 5004 cmd.exe 104 PID 1128 wrote to memory of 252 1128 CERJDO.exe 105 PID 252 wrote to memory of 3704 252 cmd.exe 109 PID 3704 wrote to memory of 1316 3704 TXTZL.exe 110 PID 1316 wrote to memory of 5588 1316 cmd.exe 114 PID 5588 wrote to memory of 5960 5588 FFI.exe 115 PID 5960 wrote to memory of 2928 5960 cmd.exe 119 PID 2928 wrote to memory of 2980 2928 EQLPYAH.exe 120 PID 2980 wrote to memory of 564 2980 cmd.exe 124 PID 564 wrote to memory of 2860 564 WTPTMQ.exe 125 PID 2860 wrote to memory of 4488 2860 cmd.exe 129 PID 4488 wrote to memory of 1224 4488 ABV.exe 130 PID 1224 wrote to memory of 2856 1224 cmd.exe 134 PID 2856 wrote to memory of 3476 2856 VWACA.exe 135 PID 3476 wrote to memory of 1612 3476 cmd.exe 139 PID 1612 wrote to memory of 5284 1612 BJZDF.exe 140 PID 5284 wrote to memory of 552 5284 cmd.exe 143 PID 552 wrote to memory of 1152 552 HKH.exe 145 PID 1152 wrote to memory of 5740 1152 cmd.exe 149 PID 5740 wrote to memory of 5408 5740 JHMLVOT.exe 150 PID 5408 wrote to memory of 4632 5408 cmd.exe 154 PID 4632 wrote to memory of 5124 4632 AQOQ.exe 155 PID 5124 wrote to memory of 3724 5124 cmd.exe 159 PID 3724 wrote to memory of 1284 3724 CNU.exe 160 PID 1284 wrote to memory of 1116 1284 cmd.exe 164 PID 1116 wrote to memory of 5304 1116 RILXZP.exe 165 PID 5304 wrote to memory of 4388 5304 cmd.exe 169 PID 4388 wrote to memory of 1072 4388 SLP.exe 170 PID 1072 wrote to memory of 2884 1072 cmd.exe 174 PID 2884 wrote to memory of 1780 2884 HCQSLA.exe 175 PID 1780 wrote to memory of 4700 1780 cmd.exe 179 PID 4700 wrote to memory of 2264 4700 VEZJ.exe 180 PID 2264 wrote to memory of 4536 2264 cmd.exe 184 PID 4536 wrote to memory of 3168 4536 ENBWL.exe 185 PID 3168 wrote to memory of 2316 3168 cmd.exe 189 PID 2316 wrote to memory of 2760 2316 VNDB.exe 190 PID 2760 wrote to memory of 1940 2760 cmd.exe 194 PID 1940 wrote to memory of 1188 1940 KQMFA.exe 195 PID 1188 wrote to memory of 4092 1188 cmd.exe 199 PID 4092 wrote to memory of 3892 4092 AGN.exe 200 PID 3892 wrote to memory of 4336 3892 cmd.exe 204 PID 4336 wrote to memory of 3508 4336 HBFJRB.exe 205 PID 3508 wrote to memory of 1132 3508 cmd.exe 209 PID 1132 wrote to memory of 3352 1132 CZFU.exe 210 PID 3352 wrote to memory of 2352 3352 cmd.exe 214 PID 2352 wrote to memory of 1240 2352 UHTSO.exe 215 PID 1240 wrote to memory of 3548 1240 cmd.exe 219 PID 3548 wrote to memory of 5660 3548 RIVCSH.exe 220 PID 5660 wrote to memory of 4684 5660 cmd.exe 224 PID 4684 wrote to memory of 4984 4684 TVMEDT.exe 225 PID 4984 wrote to memory of 4936 4984 cmd.exe 229 PID 4936 wrote to memory of 6004 4936 HTMPN.exe 230 PID 6004 wrote to memory of 4752 6004 cmd.exe 234 PID 4752 wrote to memory of 6048 4752 LJTPZWA.exe 235 PID 6048 wrote to memory of 2324 6048 cmd.exe 239 PID 2324 wrote to memory of 3624 2324 TOFWCVW.exe 240 PID 3624 wrote to memory of 4964 3624 cmd.exe 244 PID 4964 wrote to memory of 4316 4964 GZOVQ.exe 245 PID 4316 wrote to memory of 4068 4316 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_fc900a5619bd8ed981fdc0bf6bb9f9eb_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYDIW.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\windows\SysWOW64\IYDIW.exeC:\windows\system32\IYDIW.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWXJH.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\system\QWXJH.exeC:\windows\system\QWXJH.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CERJDO.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\windows\SysWOW64\CERJDO.exeC:\windows\system32\CERJDO.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TXTZL.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:252 -
C:\windows\system\TXTZL.exeC:\windows\system\TXTZL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFI.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\windows\system\FFI.exeC:\windows\system\FFI.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQLPYAH.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\EQLPYAH.exeC:\windows\EQLPYAH.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTPTMQ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\WTPTMQ.exeC:\windows\WTPTMQ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABV.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\windows\SysWOW64\ABV.exeC:\windows\system32\ABV.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWACA.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\SysWOW64\VWACA.exeC:\windows\system32\VWACA.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BJZDF.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\BJZDF.exeC:\windows\BJZDF.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HKH.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\windows\HKH.exeC:\windows\HKH.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHMLVOT.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\windows\SysWOW64\JHMLVOT.exeC:\windows\system32\JHMLVOT.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AQOQ.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\windows\AQOQ.exeC:\windows\AQOQ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNU.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\windows\SysWOW64\CNU.exeC:\windows\system32\CNU.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RILXZP.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\system\RILXZP.exeC:\windows\system\RILXZP.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLP.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\windows\SLP.exeC:\windows\SLP.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCQSLA.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\windows\HCQSLA.exeC:\windows\HCQSLA.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEZJ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\windows\SysWOW64\VEZJ.exeC:\windows\system32\VEZJ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ENBWL.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\system\ENBWL.exeC:\windows\system\ENBWL.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNDB.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\windows\system\VNDB.exeC:\windows\system\VNDB.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KQMFA.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\windows\SysWOW64\KQMFA.exeC:\windows\system32\KQMFA.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGN.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\windows\system\AGN.exeC:\windows\system\AGN.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBFJRB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\windows\SysWOW64\HBFJRB.exeC:\windows\system32\HBFJRB.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZFU.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\windows\CZFU.exeC:\windows\CZFU.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHTSO.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\windows\UHTSO.exeC:\windows\UHTSO.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIVCSH.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\windows\system\RIVCSH.exeC:\windows\system\RIVCSH.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TVMEDT.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\system\TVMEDT.exeC:\windows\system\TVMEDT.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HTMPN.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\windows\system\HTMPN.exeC:\windows\system\HTMPN.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJTPZWA.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\LJTPZWA.exeC:\windows\LJTPZWA.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TOFWCVW.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\windows\TOFWCVW.exeC:\windows\TOFWCVW.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZOVQ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\windows\system\GZOVQ.exeC:\windows\system\GZOVQ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHQABD.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\XHQABD.exeC:\windows\XHQABD.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSBQC.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4724 -
C:\windows\WSBQC.exeC:\windows\WSBQC.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVET.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3828 -
C:\windows\SysWOW64\OVET.exeC:\windows\system32\OVET.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YLKGXQA.exe.bat" "70⤵PID:2072
-
C:\windows\system\YLKGXQA.exeC:\windows\system\YLKGXQA.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJYAEY.exe.bat" "72⤵PID:1572
-
C:\windows\AJYAEY.exeC:\windows\AJYAEY.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBAQN.exe.bat" "74⤵
- Executes a command shell one-liner
PID:356 -
C:\windows\system\ZBAQN.exeC:\windows\system\ZBAQN.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UEJ.exe.bat" "76⤵PID:5908
-
C:\windows\system\UEJ.exeC:\windows\system\UEJ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXUFKVO.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3200 -
C:\windows\system\LXUFKVO.exeC:\windows\system\LXUFKVO.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFAF.exe.bat" "80⤵PID:6060
-
C:\windows\SysWOW64\XFAF.exeC:\windows\system32\XFAF.exe81⤵
- Executes dropped EXE
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVB.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4252 -
C:\windows\SysWOW64\EVB.exeC:\windows\system32\EVB.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QDIEH.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3180 -
C:\windows\QDIEH.exeC:\windows\QDIEH.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTO.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5816 -
C:\windows\SysWOW64\UTO.exeC:\windows\system32\UTO.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRCZBUK.exe.bat" "88⤵PID:3760
-
C:\windows\system\WRCZBUK.exeC:\windows\system\WRCZBUK.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZJH.exe.bat" "90⤵PID:1452
-
C:\windows\system\IZJH.exeC:\windows\system\IZJH.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCNCAC.exe.bat" "92⤵
- Executes a command shell one-liner
PID:6108 -
C:\windows\system\BCNCAC.exeC:\windows\system\BCNCAC.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPR.exe.bat" "94⤵PID:1404
-
C:\windows\SysWOW64\VPR.exeC:\windows\system32\VPR.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDKA.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1624 -
C:\windows\SysWOW64\DDKA.exeC:\windows\system32\DDKA.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDROVJ.exe.bat" "98⤵PID:2256
-
C:\windows\SysWOW64\BDROVJ.exeC:\windows\system32\BDROVJ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDTTZGC.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1952 -
C:\windows\SysWOW64\TDTTZGC.exeC:\windows\system32\TDTTZGC.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEBHI.exe.bat" "102⤵PID:1880
-
C:\windows\SysWOW64\YEBHI.exeC:\windows\system32\YEBHI.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWEAQQ.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1600 -
C:\windows\KWEAQQ.exeC:\windows\KWEAQQ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEK.exe.bat" "106⤵PID:3128
-
C:\windows\SysWOW64\OEK.exeC:\windows\system32\OEK.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAPRM.exe.bat" "108⤵PID:2100
-
C:\windows\SysWOW64\IAPRM.exeC:\windows\system32\IAPRM.exe109⤵
- Executes dropped EXE
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVTN.exe.bat" "110⤵PID:1472
-
C:\windows\JVTN.exeC:\windows\JVTN.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVIYBZN.exe.bat" "112⤵
- Executes a command shell one-liner
PID:4168 -
C:\windows\system\UVIYBZN.exeC:\windows\system\UVIYBZN.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJAGG.exe.bat" "114⤵
- Executes a command shell one-liner
PID:1268 -
C:\windows\AJAGG.exeC:\windows\AJAGG.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMR.exe.bat" "116⤵PID:1772
-
C:\windows\SysWOW64\PMR.exeC:\windows\system32\PMR.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJRWBA.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5432 -
C:\windows\system\DJRWBA.exeC:\windows\system\DJRWBA.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEBB.exe.bat" "120⤵PID:960
-
C:\windows\SysWOW64\SEBB.exeC:\windows\system32\SEBB.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-