Analysis
- max time kernel
90s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 05:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_02d574a7c731c61a8f2b1826c3351895_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_02d574a7c731c61a8f2b1826c3351895_elex_emotet_stop.exe
- Size 208KB
- Sample260809-gl28rsvycw
- SHA256 537bf7d98427a0894a7b57a5fac877eb5e7286583f0fb25a51f02f90e3e2edd3
- MD5 02d574a7c731c61a8f2b1826c3351895
- SHA1 a4df2a9140feb3ccdd9c51ad0b9b79e71f5c02cb
- SHA512 186e41cb6aa60f298e2f3164a9baa585ae138804aa1f16e68b03b6599097a78520f47e6abd34c67f5b62d6ea47c3edf8d917df9695e6bd6b1caeec2d5c84e3ff
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfS4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO6kEj1
- TLSH T160247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5636 PTXSJF.exe 1128 XRRTUJP.exe 5980 HPXOJR.exe 828 ASI.exe 1756 BNMNUXI.exe 1500 FDTN.exe 4344 JLZVTAS.exe 4240 ATB.exe 3288 NWK.exe 5592 WEME.exe 6016 GCAY.exe 4676 QAFLLE.exe 5088 QFFZMJE.exe 5312 GAPMX.exe 3440 PJRRJB.exe 1860 OTUHR.exe 5024 DOD.exe 5860 LCQ.exe 3496 UCSXRG.exe 1624 VFV.exe 4500 KAFFPI.exe 1904 ZQGE.exe 5020 JRIJZ.exe 1144 WCQ.exe 6092 HUTBO.exe 5996 CHYKYT.exe 2596 OXFK.exe 5696 SFLKWW.exe 5956 HWMK.exe 1396 CRRTFR.exe 1292 RMBX.exe 4280 RRBMA.exe 1620 XSIZJTC.exe 3332 IKL.exe 2452 OLTG.exe 4112 XLVTEAV.exe 1768 IDQ.exe 4644 FJW.exe 5964 FCECH.exe 1444 ZPJMRVI.exe 5564 RPD.exe 4672 VFSZH.exe 5404 VIWVMJH.exe 5576 ZQCVYTD.exe 5436 LJFNHJ.exe 572 QJN.exe 5892 OEEKUG.exe 4572 JSJ.exe 2448 VIQTJ.exe 5960 QVUDTYB.exe 5392 VVCQ.exe 3256 VBCFE.exe 5864 NONXTC.exe 3176 NUNLVP.exe 5916 HHS.exe 1416 NHZJOJ.exe 1680 RXG.exe 3972 RDYF.exe 2304 XDGTTI.exe 5604 XJGHVVH.exe 5660 DJOV.exe 5984 PZUVQI.exe 2784 YAW.exe 5732 NVGMM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RXG.exe NHZJOJ.exe File opened for modification C:\windows\SysWOW64\DJOV.exe XJGHVVH.exe File created C:\windows\SysWOW64\PTB.exe.bat LLV.exe File opened for modification C:\windows\SysWOW64\ASI.exe HPXOJR.exe File created C:\windows\SysWOW64\ASI.exe.bat HPXOJR.exe File created C:\windows\SysWOW64\RRBMA.exe RMBX.exe File created C:\windows\SysWOW64\OLTG.exe IKL.exe File created C:\windows\SysWOW64\QVUDTYB.exe VIQTJ.exe File opened for modification C:\windows\SysWOW64\RQMBAF.exe NIGTON.exe File created C:\windows\SysWOW64\IKL.exe.bat XSIZJTC.exe File opened for modification C:\windows\SysWOW64\QVUDTYB.exe VIQTJ.exe File created C:\windows\SysWOW64\NVGMM.exe.bat YAW.exe File created C:\windows\SysWOW64\HUTBO.exe.bat WCQ.exe File created C:\windows\SysWOW64\BQW.exe VQOZAD.exe File created C:\windows\SysWOW64\XURXAX.exe HZA.exe File created C:\windows\SysWOW64\FCECH.exe FJW.exe File created C:\windows\SysWOW64\PJRRJB.exe GAPMX.exe File created C:\windows\SysWOW64\PJRRJB.exe.bat GAPMX.exe File opened for modification C:\windows\SysWOW64\IKL.exe XSIZJTC.exe File created C:\windows\SysWOW64\XLVTEAV.exe.bat OLTG.exe File created C:\windows\SysWOW64\NVGMM.exe YAW.exe File opened for modification C:\windows\SysWOW64\HHWT.exe BHPFEZU.exe File created C:\windows\SysWOW64\VIQTJ.exe JSJ.exe File opened for modification C:\windows\SysWOW64\OLTG.exe IKL.exe File created C:\windows\SysWOW64\QVUDTYB.exe.bat VIQTJ.exe File opened for modification C:\windows\SysWOW64\HHS.exe NUNLVP.exe File opened for modification C:\windows\SysWOW64\KKACQ.exe RHW.exe File created C:\windows\SysWOW64\LRRT.exe NRJFVU.exe File created C:\windows\SysWOW64\HHWT.exe.bat BHPFEZU.exe File created C:\windows\SysWOW64\WCQ.exe.bat JRIJZ.exe File opened for modification C:\windows\SysWOW64\PTXSJF.exe 2026-08-09_02d574a7c731c61a8f2b1826c3351895_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\PJRRJB.exe GAPMX.exe File opened for modification C:\windows\SysWOW64\VFV.exe UCSXRG.exe File opened for modification C:\windows\SysWOW64\BNMNUXI.exe ASI.exe File opened for modification C:\windows\SysWOW64\IDQ.exe XLVTEAV.exe File created C:\windows\SysWOW64\NHZJOJ.exe HHS.exe File opened for modification C:\windows\SysWOW64\XQUPJZ.exe RQMBAF.exe File created C:\windows\SysWOW64\KIJ.exe.bat RQOAXU.exe File created C:\windows\SysWOW64\LXDBZL.exe.bat HHWT.exe File created C:\windows\SysWOW64\HPXOJR.exe XRRTUJP.exe File created C:\windows\SysWOW64\BNMNUXI.exe ASI.exe File created C:\windows\SysWOW64\VFV.exe UCSXRG.exe File created C:\windows\SysWOW64\XQUPJZ.exe.bat RQMBAF.exe File created C:\windows\SysWOW64\LXDBZL.exe HHWT.exe File opened for modification C:\windows\SysWOW64\BQW.exe VQOZAD.exe File created C:\windows\SysWOW64\BQW.exe.bat VQOZAD.exe File created C:\windows\SysWOW64\XRRTUJP.exe PTXSJF.exe File opened for modification C:\windows\SysWOW64\FCECH.exe FJW.exe File created C:\windows\SysWOW64\DJOV.exe XJGHVVH.exe File created C:\windows\SysWOW64\NAAA.exe YCCCDSN.exe File created C:\windows\SysWOW64\RRBMA.exe.bat RMBX.exe File created C:\windows\SysWOW64\HUTBO.exe WCQ.exe File created C:\windows\SysWOW64\OXFK.exe CHYKYT.exe File created C:\windows\SysWOW64\KIJ.exe RQOAXU.exe File opened for modification C:\windows\SysWOW64\XZSYNR.exe RDTXQ.exe File opened for modification C:\windows\SysWOW64\VIQTJ.exe JSJ.exe File created C:\windows\SysWOW64\WCQ.exe JRIJZ.exe File created C:\windows\SysWOW64\NHZJOJ.exe.bat HHS.exe File created C:\windows\SysWOW64\HHWT.exe BHPFEZU.exe File created C:\windows\SysWOW64\GCAY.exe WEME.exe File created C:\windows\SysWOW64\FCECH.exe.bat FJW.exe File created C:\windows\SysWOW64\VQOZAD.exe AUKQ.exe File opened for modification C:\windows\SysWOW64\LRRT.exe NRJFVU.exe File created C:\windows\SysWOW64\VFV.exe.bat UCSXRG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\AUKQ.exe.bat GHFGNDB.exe File created C:\windows\system\FEDBFC.exe.bat KQYSV.exe File opened for modification C:\windows\system\GVYOYBO.exe VDVVYU.exe File created C:\windows\system\CRRTFR.exe HWMK.exe File opened for modification C:\windows\RHW.exe XURXAX.exe File created C:\windows\SDGVHJH.exe.bat BDEH.exe File created C:\windows\QAFLLE.exe.bat GCAY.exe File created C:\windows\UCSXRG.exe LCQ.exe File opened for modification C:\windows\system\KAFFPI.exe VFV.exe File opened for modification C:\windows\system\BOCUJSB.exe QVH.exe File created C:\windows\SDGVHJH.exe BDEH.exe File created C:\windows\system\QFFZMJE.exe QAFLLE.exe File opened for modification C:\windows\LCQ.exe DOD.exe File created C:\windows\system\LPCAQAY.exe.bat QBXQG.exe File created C:\windows\NRJFVU.exe.bat WQHSR.exe File created C:\windows\ZQCVYTD.exe VIWVMJH.exe File created C:\windows\system\DJINKY.exe.bat DZAT.exe File created C:\windows\BDEH.exe.bat IAAMYVE.exe File created C:\windows\OTUHR.exe PJRRJB.exe File created C:\windows\ZQGE.exe KAFFPI.exe File created C:\windows\system\CHYKYT.exe HUTBO.exe File created C:\windows\system\SFLKWW.exe OXFK.exe File created C:\windows\BBPRCM.exe.bat VBHD.exe File created C:\windows\PTKP.exe GLI.exe File created C:\windows\ORWU.exe XQUPJZ.exe File created C:\windows\JLZVTAS.exe FDTN.exe File created C:\windows\XDGTTI.exe.bat RDYF.exe File opened for modification C:\windows\system\QJN.exe LJFNHJ.exe File created C:\windows\QVH.exe EFT.exe File opened for modification C:\windows\BDEH.exe IAAMYVE.exe File created C:\windows\system\DOD.exe OTUHR.exe File created C:\windows\system\DOD.exe.bat OTUHR.exe File created C:\windows\ZQGE.exe.bat KAFFPI.exe File opened for modification C:\windows\BBPRCM.exe VBHD.exe File created C:\windows\system\GVYOYBO.exe VDVVYU.exe File created C:\windows\system\RPD.exe ZPJMRVI.exe File created C:\windows\OTUHR.exe.bat PJRRJB.exe File created C:\windows\LCQ.exe DOD.exe File created C:\windows\ZQCVYTD.exe.bat VIWVMJH.exe File created C:\windows\QVH.exe.bat EFT.exe File created C:\windows\BHPFEZU.exe.bat BBPRCM.exe File created C:\windows\system\JRIJZ.exe.bat ZQGE.exe File created C:\windows\system\VBCFE.exe VVCQ.exe File opened for modification C:\windows\QBXQG.exe ZBDL.exe File created C:\windows\RDYF.exe.bat RXG.exe File opened for modification C:\windows\system\XJGHVVH.exe XDGTTI.exe File created C:\windows\system\KAFFPI.exe.bat VFV.exe File opened for modification C:\windows\NWK.exe ATB.exe File created C:\windows\system\OEEKUG.exe QJN.exe File created C:\windows\PTKP.exe.bat GLI.exe File opened for modification C:\windows\system\FEDBFC.exe KQYSV.exe File created C:\windows\system\HZA.exe.bat FEDBFC.exe File opened for modification C:\windows\OTUHR.exe PJRRJB.exe File opened for modification C:\windows\ZQCVYTD.exe VIWVMJH.exe File created C:\windows\system\PZUVQI.exe DJOV.exe File created C:\windows\OCLFS.exe DJINKY.exe File created C:\windows\system\GKN.exe.bat OCLFS.exe File opened for modification C:\windows\system\DOD.exe OTUHR.exe File created C:\windows\system\GBFSMYG.exe.bat PTKP.exe File opened for modification C:\windows\NRJFVU.exe WQHSR.exe File opened for modification C:\windows\QAFLLE.exe GCAY.exe File opened for modification C:\windows\OCLFS.exe DJINKY.exe File opened for modification C:\windows\VBHD.exe BOCUJSB.exe File created C:\windows\JLZVTAS.exe.bat FDTN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1600 cmd.exe 3520 cmd.exe 4304 cmd.exe 5216 cmd.exe 2156 cmd.exe 2244 cmd.exe 6108 cmd.exe 5640 cmd.exe 1176 cmd.exe 4596 cmd.exe 4940 cmd.exe 2436 cmd.exe 4708 cmd.exe 6060 cmd.exe 672 cmd.exe 2432 cmd.exe 2220 cmd.exe 4860 cmd.exe 3840 cmd.exe 3548 cmd.exe 5548 cmd.exe 5828 cmd.exe 3068 cmd.exe 4296 cmd.exe 4648 cmd.exe 2456 cmd.exe 4560 cmd.exe 5192 cmd.exe 2556 cmd.exe 5132 cmd.exe 2524 cmd.exe 1276 cmd.exe 6040 cmd.exe 2748 cmd.exe 4116 cmd.exe 3204 cmd.exe 5308 cmd.exe 5904 cmd.exe 4424 cmd.exe 5176 cmd.exe 4604 cmd.exe 2800 cmd.exe 4452 cmd.exe 4140 cmd.exe 1712 cmd.exe 4832 cmd.exe 3140 cmd.exe 2400 cmd.exe 2460 cmd.exe 4836 cmd.exe 6052 cmd.exe 3728 cmd.exe 5344 cmd.exe 5408 cmd.exe 4504 cmd.exe 5752 cmd.exe 5328 cmd.exe 5700 cmd.exe 4928 cmd.exe 1052 cmd.exe 1124 cmd.exe 5800 cmd.exe 1800 cmd.exe 4316 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4736 1648 WerFault.exe 89 4448 5636 WerFault.exe 93 5832 1128 WerFault.exe 100 3704 5980 WerFault.exe 105 1296 828 WerFault.exe 110 4920 1756 WerFault.exe 115 2420 1500 WerFault.exe 120 5944 4344 WerFault.exe 125 2524 4240 WerFault.exe 130 2748 3288 WerFault.exe 135 1724 5592 WerFault.exe 140 1620 6016 WerFault.exe 145 4404 4676 WerFault.exe 150 3108 5088 WerFault.exe 155 2700 5312 WerFault.exe 160 5436 3440 WerFault.exe 165 4120 1860 WerFault.exe 170 4788 5024 WerFault.exe 175 2148 5860 WerFault.exe 180 2448 3496 WerFault.exe 185 5960 1624 WerFault.exe 190 5004 4500 WerFault.exe 195 3832 1904 WerFault.exe 200 3108 5020 WerFault.exe 205 2340 1144 WerFault.exe 210 5836 6092 WerFault.exe 215 988 5996 WerFault.exe 220 4432 2596 WerFault.exe 225 416 5696 WerFault.exe 230 2428 5956 WerFault.exe 235 2648 1396 WerFault.exe 240 4424 1292 WerFault.exe 245 4660 4280 WerFault.exe 250 2324 1620 WerFault.exe 255 2560 3332 WerFault.exe 260 5144 2452 WerFault.exe 265 3464 4112 WerFault.exe 270 468 1768 WerFault.exe 275 3156 4644 WerFault.exe 280 4852 5964 WerFault.exe 286 2568 1444 WerFault.exe 291 5272 5564 WerFault.exe 296 1628 4672 WerFault.exe 301 4596 5404 WerFault.exe 306 2224 5576 WerFault.exe 311 3688 5436 WerFault.exe 316 2208 572 WerFault.exe 321 2344 5892 WerFault.exe 326 2756 4572 WerFault.exe 331 3532 2448 WerFault.exe 336 5112 5960 WerFault.exe 341 5660 5392 WerFault.exe 346 3472 3256 WerFault.exe 351 2560 5864 WerFault.exe 356 4120 3176 WerFault.exe 361 4580 5916 WerFault.exe 366 5216 1416 WerFault.exe 371 4628 1680 WerFault.exe 376 4852 3972 WerFault.exe 381 2220 2304 WerFault.exe 386 3832 5604 WerFault.exe 391 5464 5660 WerFault.exe 396 5252 5984 WerFault.exe 401 2224 2784 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEEKUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQHSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVYOYBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFSZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTUHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUNLVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAPMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHYKYT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRRTFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQYSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLZVTAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCECH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QJN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZSYNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJFNHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDGTTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDGVHJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBXQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAAMYVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLVTEAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSIZJTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1648 2026-08-09_02d574a7c731c61a8f2b1826c3351895_elex_emotet_stop.exe 1648 2026-08-09_02d574a7c731c61a8f2b1826c3351895_elex_emotet_stop.exe 5636 PTXSJF.exe 5636 PTXSJF.exe 1128 XRRTUJP.exe 1128 XRRTUJP.exe 5980 HPXOJR.exe 5980 HPXOJR.exe 828 ASI.exe 828 ASI.exe 1756 BNMNUXI.exe 1756 BNMNUXI.exe 1500 FDTN.exe 1500 FDTN.exe 4344 JLZVTAS.exe 4344 JLZVTAS.exe 4240 ATB.exe 4240 ATB.exe 3288 NWK.exe 3288 NWK.exe 5592 WEME.exe 5592 WEME.exe 6016 GCAY.exe 6016 GCAY.exe 4676 QAFLLE.exe 4676 QAFLLE.exe 5088 QFFZMJE.exe 5088 QFFZMJE.exe 5312 GAPMX.exe 5312 GAPMX.exe 3440 PJRRJB.exe 3440 PJRRJB.exe 1860 OTUHR.exe 1860 OTUHR.exe 5024 DOD.exe 5024 DOD.exe 5860 LCQ.exe 5860 LCQ.exe 3496 UCSXRG.exe 3496 UCSXRG.exe 1624 VFV.exe 1624 VFV.exe 4500 KAFFPI.exe 4500 KAFFPI.exe 1904 ZQGE.exe 1904 ZQGE.exe 5020 JRIJZ.exe 5020 JRIJZ.exe 1144 WCQ.exe 1144 WCQ.exe 6092 HUTBO.exe 6092 HUTBO.exe 5996 CHYKYT.exe 5996 CHYKYT.exe 2596 OXFK.exe 2596 OXFK.exe 5696 SFLKWW.exe 5696 SFLKWW.exe 5956 HWMK.exe 5956 HWMK.exe 1396 CRRTFR.exe 1396 CRRTFR.exe 1292 RMBX.exe 1292 RMBX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1648 2026-08-09_02d574a7c731c61a8f2b1826c3351895_elex_emotet_stop.exe 1648 2026-08-09_02d574a7c731c61a8f2b1826c3351895_elex_emotet_stop.exe 5636 PTXSJF.exe 5636 PTXSJF.exe 1128 XRRTUJP.exe 1128 XRRTUJP.exe 5980 HPXOJR.exe 5980 HPXOJR.exe 828 ASI.exe 828 ASI.exe 1756 BNMNUXI.exe 1756 BNMNUXI.exe 1500 FDTN.exe 1500 FDTN.exe 4344 JLZVTAS.exe 4344 JLZVTAS.exe 4240 ATB.exe 4240 ATB.exe 3288 NWK.exe 3288 NWK.exe 5592 WEME.exe 5592 WEME.exe 6016 GCAY.exe 6016 GCAY.exe 4676 QAFLLE.exe 4676 QAFLLE.exe 5088 QFFZMJE.exe 5088 QFFZMJE.exe 5312 GAPMX.exe 5312 GAPMX.exe 3440 PJRRJB.exe 3440 PJRRJB.exe 1860 OTUHR.exe 1860 OTUHR.exe 5024 DOD.exe 5024 DOD.exe 5860 LCQ.exe 5860 LCQ.exe 3496 UCSXRG.exe 3496 UCSXRG.exe 1624 VFV.exe 1624 VFV.exe 4500 KAFFPI.exe 4500 KAFFPI.exe 1904 ZQGE.exe 1904 ZQGE.exe 5020 JRIJZ.exe 5020 JRIJZ.exe 1144 WCQ.exe 1144 WCQ.exe 6092 HUTBO.exe 6092 HUTBO.exe 5996 CHYKYT.exe 5996 CHYKYT.exe 2596 OXFK.exe 2596 OXFK.exe 5696 SFLKWW.exe 5696 SFLKWW.exe 5956 HWMK.exe 5956 HWMK.exe 1396 CRRTFR.exe 1396 CRRTFR.exe 1292 RMBX.exe 1292 RMBX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1648 wrote to memory of 1316 1648 2026-08-09_02d574a7c731c61a8f2b1826c3351895_elex_emotet_stop.exe 90 PID 1316 wrote to memory of 5636 1316 cmd.exe 93 PID 5636 wrote to memory of 4704 5636 PTXSJF.exe 96 PID 4704 wrote to memory of 1128 4704 cmd.exe 100 PID 1128 wrote to memory of 5456 1128 XRRTUJP.exe 101 PID 5456 wrote to memory of 5980 5456 cmd.exe 105 PID 5980 wrote to memory of 2400 5980 HPXOJR.exe 106 PID 2400 wrote to memory of 828 2400 cmd.exe 110 PID 828 wrote to memory of 1516 828 ASI.exe 111 PID 1516 wrote to memory of 1756 1516 cmd.exe 115 PID 1756 wrote to memory of 5884 1756 BNMNUXI.exe 116 PID 5884 wrote to memory of 1500 5884 cmd.exe 120 PID 1500 wrote to memory of 2112 1500 FDTN.exe 121 PID 2112 wrote to memory of 4344 2112 cmd.exe 125 PID 4344 wrote to memory of 5212 4344 JLZVTAS.exe 126 PID 5212 wrote to memory of 4240 5212 cmd.exe 130 PID 4240 wrote to memory of 5780 4240 ATB.exe 131 PID 5780 wrote to memory of 3288 5780 cmd.exe 135 PID 3288 wrote to memory of 2432 3288 NWK.exe 136 PID 2432 wrote to memory of 5592 2432 cmd.exe 140 PID 5592 wrote to memory of 5992 5592 WEME.exe 141 PID 5992 wrote to memory of 6016 5992 cmd.exe 145 PID 6016 wrote to memory of 5460 6016 GCAY.exe 146 PID 5460 wrote to memory of 4676 5460 cmd.exe 150 PID 4676 wrote to memory of 4820 4676 QAFLLE.exe 151 PID 4820 wrote to memory of 5088 4820 cmd.exe 155 PID 5088 wrote to memory of 3580 5088 QFFZMJE.exe 156 PID 3580 wrote to memory of 5312 3580 cmd.exe 160 PID 5312 wrote to memory of 1236 5312 GAPMX.exe 161 PID 1236 wrote to memory of 3440 1236 cmd.exe 165 PID 3440 wrote to memory of 2460 3440 PJRRJB.exe 166 PID 2460 wrote to memory of 1860 2460 cmd.exe 170 PID 1860 wrote to memory of 1056 1860 OTUHR.exe 171 PID 1056 wrote to memory of 5024 1056 cmd.exe 175 PID 5024 wrote to memory of 2092 5024 DOD.exe 176 PID 2092 wrote to memory of 5860 2092 cmd.exe 180 PID 5860 wrote to memory of 5944 5860 LCQ.exe 181 PID 5944 wrote to memory of 3496 5944 cmd.exe 185 PID 3496 wrote to memory of 2776 3496 UCSXRG.exe 186 PID 2776 wrote to memory of 1624 2776 cmd.exe 190 PID 1624 wrote to memory of 4836 1624 VFV.exe 191 PID 4836 wrote to memory of 4500 4836 cmd.exe 195 PID 4500 wrote to memory of 4116 4500 KAFFPI.exe 196 PID 4116 wrote to memory of 1904 4116 cmd.exe 200 PID 1904 wrote to memory of 5100 1904 ZQGE.exe 201 PID 5100 wrote to memory of 5020 5100 cmd.exe 205 PID 5020 wrote to memory of 4624 5020 JRIJZ.exe 206 PID 4624 wrote to memory of 1144 4624 cmd.exe 210 PID 1144 wrote to memory of 5548 1144 WCQ.exe 211 PID 5548 wrote to memory of 6092 5548 cmd.exe 215 PID 6092 wrote to memory of 2548 6092 HUTBO.exe 216 PID 2548 wrote to memory of 5996 2548 cmd.exe 220 PID 5996 wrote to memory of 3776 5996 CHYKYT.exe 221 PID 3776 wrote to memory of 2596 3776 cmd.exe 225 PID 2596 wrote to memory of 5224 2596 OXFK.exe 226 PID 5224 wrote to memory of 5696 5224 cmd.exe 230 PID 5696 wrote to memory of 2488 5696 SFLKWW.exe 231 PID 2488 wrote to memory of 5956 2488 cmd.exe 235 PID 5956 wrote to memory of 4664 5956 HWMK.exe 236 PID 4664 wrote to memory of 1396 4664 cmd.exe 240 PID 1396 wrote to memory of 2772 1396 CRRTFR.exe 241 PID 2772 wrote to memory of 1292 2772 cmd.exe 245 PID 1292 wrote to memory of 2240 1292 RMBX.exe 246 PID 2240 wrote to memory of 4280 2240 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_02d574a7c731c61a8f2b1826c3351895_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_02d574a7c731c61a8f2b1826c3351895_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PTXSJF.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\windows\SysWOW64\PTXSJF.exeC:\windows\system32\PTXSJF.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRRTUJP.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\windows\SysWOW64\XRRTUJP.exeC:\windows\system32\XRRTUJP.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPXOJR.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\SysWOW64\HPXOJR.exeC:\windows\system32\HPXOJR.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASI.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\SysWOW64\ASI.exeC:\windows\system32\ASI.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNMNUXI.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\SysWOW64\BNMNUXI.exeC:\windows\system32\BNMNUXI.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDTN.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\system\FDTN.exeC:\windows\system\FDTN.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLZVTAS.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\windows\JLZVTAS.exeC:\windows\JLZVTAS.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NWK.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\NWK.exeC:\windows\NWK.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WEME.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\WEME.exeC:\windows\WEME.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCAY.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\windows\SysWOW64\GCAY.exeC:\windows\system32\GCAY.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QAFLLE.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\windows\QAFLLE.exeC:\windows\QAFLLE.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFFZMJE.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\system\QFFZMJE.exeC:\windows\system\QFFZMJE.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAPMX.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\windows\GAPMX.exeC:\windows\GAPMX.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJRRJB.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\windows\SysWOW64\PJRRJB.exeC:\windows\system32\PJRRJB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTUHR.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\windows\OTUHR.exeC:\windows\OTUHR.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOD.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\system\DOD.exeC:\windows\system\DOD.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCQ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\windows\LCQ.exeC:\windows\LCQ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCSXRG.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\UCSXRG.exeC:\windows\UCSXRG.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFV.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\SysWOW64\VFV.exeC:\windows\system32\VFV.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAFFPI.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\system\KAFFPI.exeC:\windows\system\KAFFPI.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQGE.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\windows\ZQGE.exeC:\windows\ZQGE.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCQ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\SysWOW64\WCQ.exeC:\windows\system32\WCQ.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUTBO.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\windows\SysWOW64\HUTBO.exeC:\windows\system32\HUTBO.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHYKYT.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\system\CHYKYT.exeC:\windows\system\CHYKYT.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXFK.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\windows\SysWOW64\OXFK.exeC:\windows\system32\OXFK.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFLKWW.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\windows\system\SFLKWW.exeC:\windows\system\SFLKWW.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWMK.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\windows\HWMK.exeC:\windows\HWMK.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRRTFR.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\system\CRRTFR.exeC:\windows\system\CRRTFR.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMBX.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\SysWOW64\RMBX.exeC:\windows\system32\RMBX.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRBMA.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\windows\SysWOW64\RRBMA.exeC:\windows\system32\RRBMA.exe65⤵
- Executes dropped EXE
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSIZJTC.exe.bat" "66⤵PID:4584
-
C:\windows\system\XSIZJTC.exeC:\windows\system\XSIZJTC.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKL.exe.bat" "68⤵PID:1140
-
C:\windows\SysWOW64\IKL.exeC:\windows\system32\IKL.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLTG.exe.bat" "70⤵PID:1196
-
C:\windows\SysWOW64\OLTG.exeC:\windows\system32\OLTG.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XLVTEAV.exe.bat" "72⤵PID:4212
-
C:\windows\SysWOW64\XLVTEAV.exeC:\windows\system32\XLVTEAV.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IDQ.exe.bat" "74⤵PID:6024
-
C:\windows\SysWOW64\IDQ.exeC:\windows\system32\IDQ.exe75⤵
- Executes dropped EXE
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJW.exe.bat" "76⤵PID:2804
-
C:\windows\FJW.exeC:\windows\FJW.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCECH.exe.bat" "78⤵PID:2752
-
C:\windows\SysWOW64\FCECH.exeC:\windows\system32\FCECH.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPJMRVI.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4912 -
C:\windows\system\ZPJMRVI.exeC:\windows\system\ZPJMRVI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPD.exe.bat" "82⤵PID:2664
-
C:\windows\system\RPD.exeC:\windows\system\RPD.exe83⤵
- Executes dropped EXE
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VFSZH.exe.bat" "84⤵PID:1920
-
C:\windows\VFSZH.exeC:\windows\VFSZH.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VIWVMJH.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3204 -
C:\windows\VIWVMJH.exeC:\windows\VIWVMJH.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQCVYTD.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5800 -
C:\windows\ZQCVYTD.exeC:\windows\ZQCVYTD.exe89⤵
- Executes dropped EXE
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJFNHJ.exe.bat" "90⤵PID:1136
-
C:\windows\LJFNHJ.exeC:\windows\LJFNHJ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJN.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5752 -
C:\windows\system\QJN.exeC:\windows\system\QJN.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEEKUG.exe.bat" "94⤵PID:3012
-
C:\windows\system\OEEKUG.exeC:\windows\system\OEEKUG.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JSJ.exe.bat" "96⤵PID:612
-
C:\windows\system\JSJ.exeC:\windows\system\JSJ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VIQTJ.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3852 -
C:\windows\SysWOW64\VIQTJ.exeC:\windows\system32\VIQTJ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVUDTYB.exe.bat" "100⤵PID:4744
-
C:\windows\SysWOW64\QVUDTYB.exeC:\windows\system32\QVUDTYB.exe101⤵
- Executes dropped EXE
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVCQ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4604 -
C:\windows\SysWOW64\VVCQ.exeC:\windows\system32\VVCQ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "104⤵PID:5272
-
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe105⤵
- Executes dropped EXE
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NONXTC.exe.bat" "106⤵PID:4148
-
C:\windows\system\NONXTC.exeC:\windows\system\NONXTC.exe107⤵
- Executes dropped EXE
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUNLVP.exe.bat" "108⤵PID:4396
-
C:\windows\system\NUNLVP.exeC:\windows\system\NUNLVP.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HHS.exe.bat" "110⤵PID:3792
-
C:\windows\SysWOW64\HHS.exeC:\windows\system32\HHS.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NHZJOJ.exe.bat" "112⤵PID:2640
-
C:\windows\SysWOW64\NHZJOJ.exeC:\windows\system32\NHZJOJ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXG.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1960 -
C:\windows\SysWOW64\RXG.exeC:\windows\system32\RXG.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDYF.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4460 -
C:\windows\RDYF.exeC:\windows\RDYF.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDGTTI.exe.bat" "118⤵PID:3708
-
C:\windows\XDGTTI.exeC:\windows\XDGTTI.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJGHVVH.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4560 -
C:\windows\system\XJGHVVH.exeC:\windows\system\XJGHVVH.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-