Analysis
- max time kernel
70s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe
- Size 208KB
- Sample260810-1853qaah76
- SHA256 0f8adcc6c401366a86e1d3791d3f651720af5003e5595f2f2ccf4c9f5391f8f0
- MD5 7344ce1b424a6007e9341cf1750596a5
- SHA1 23d5af2390e1ae83e4121af33879994fd71b1e58
- SHA512 cb6e3bc8e938ffe6da4e96981e91e02b17ea52a4ff0f413d1d1c675f642ff6ac702644442dbc91ec6670e80a965eaca6710ef9d5aca6350eca1d5034217f8d07
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOf54pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LOxkEj1
- TLSH T124247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5004 GMGADAR.exe 928 ZXRMR.exe 2584 WQTPD.exe 3676 DJIFNPT.exe 5596 HMTK.exe 2056 URB.exe 2940 SHO.exe 4144 ANT.exe 5588 IAFBJRE.exe 5700 OWRB.exe 1096 UGGKH.exe 5840 GZOVQ.exe 2432 OMAB.exe 4812 WSNI.exe 2972 PGMOQ.exe 1832 JYB.exe 5364 LWHTPOV.exe 3100 CEVQCFQ.exe 2700 HXX.exe 2848 XPIJO.exe 756 CVSYEK.exe 944 RLTX.exe 5868 XYFQ.exe 4724 NBOVCHE.exe 6032 VHBJNFZ.exe 2404 KXCBT.exe 4120 XIS.exe 2156 SVPJS.exe 4616 TYBNXBA.exe 3196 JJEVGH.exe 5056 BJGI.exe 4728 OUOYXPT.exe 4652 FCQ.exe 4200 SFZCPY.exe 4768 RYJSY.exe 3388 VGQ.exe 6016 FDWMREK.exe 1288 OEY.exe 5984 EUZRCXB.exe 5272 GSMLJG.exe 5888 SITL.exe 3736 ISW.exe 1808 EDMASP.exe 2004 RBMM.exe 2136 QZX.exe 4180 WMXPM.exe 4276 NULNYA.exe 2460 AFTL.exe 2568 UTAJ.exe 1792 YBHJEWX.exe 1144 JTWUNXF.exe 1444 RHPJPCI.exe 5936 EJFHD.exe 4140 VSHNGKF.exe 3704 OVLQUI.exe 4632 BYT.exe 1348 AIWXJZY.exe 4664 KGKRYIZ.exe 5660 FBPB.exe 2668 USQAH.exe 3312 YAW.exe 5696 XKZQCTV.exe 1040 BAGY.exe 1532 VOK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\EVCT.exe ANWTBSJ.exe File created C:\windows\SysWOW64\WDEGRIH.exe EVCT.exe File created C:\windows\SysWOW64\CEVQCFQ.exe.bat LWHTPOV.exe File created C:\windows\SysWOW64\OUOYXPT.exe.bat BJGI.exe File created C:\windows\SysWOW64\EVCT.exe.bat ANWTBSJ.exe File opened for modification C:\windows\SysWOW64\WDEGRIH.exe EVCT.exe File created C:\windows\SysWOW64\XIS.exe.bat KXCBT.exe File created C:\windows\SysWOW64\BJGI.exe JJEVGH.exe File created C:\windows\SysWOW64\OVLQUI.exe VSHNGKF.exe File opened for modification C:\windows\SysWOW64\NZXAWBA.exe PCM.exe File opened for modification C:\windows\SysWOW64\DPG.exe NZXAWBA.exe File opened for modification C:\windows\SysWOW64\NBOVCHE.exe XYFQ.exe File opened for modification C:\windows\SysWOW64\QZX.exe RBMM.exe File created C:\windows\SysWOW64\YBHJEWX.exe.bat UTAJ.exe File created C:\windows\SysWOW64\EVCT.exe ANWTBSJ.exe File opened for modification C:\windows\SysWOW64\URB.exe HMTK.exe File created C:\windows\SysWOW64\URB.exe.bat HMTK.exe File created C:\windows\SysWOW64\NBOVCHE.exe XYFQ.exe File created C:\windows\SysWOW64\KXCBT.exe.bat VHBJNFZ.exe File opened for modification C:\windows\SysWOW64\XIS.exe KXCBT.exe File created C:\windows\SysWOW64\VGQ.exe RYJSY.exe File created C:\windows\SysWOW64\YBHJEWX.exe UTAJ.exe File opened for modification C:\windows\SysWOW64\OVLQUI.exe VSHNGKF.exe File created C:\windows\SysWOW64\XIS.exe KXCBT.exe File opened for modification C:\windows\SysWOW64\FCQ.exe OUOYXPT.exe File created C:\windows\SysWOW64\AIWXJZY.exe BYT.exe File created C:\windows\SysWOW64\WDEGRIH.exe.bat EVCT.exe File created C:\windows\SysWOW64\JDKTJ.exe.bat DPG.exe File created C:\windows\SysWOW64\URB.exe HMTK.exe File opened for modification C:\windows\SysWOW64\OWRB.exe IAFBJRE.exe File created C:\windows\SysWOW64\VHBJNFZ.exe.bat NBOVCHE.exe File opened for modification C:\windows\SysWOW64\KXCBT.exe VHBJNFZ.exe File created C:\windows\SysWOW64\RHPJPCI.exe.bat JTWUNXF.exe File opened for modification C:\windows\SysWOW64\SHO.exe URB.exe File created C:\windows\SysWOW64\VHBJNFZ.exe NBOVCHE.exe File opened for modification C:\windows\SysWOW64\AIWXJZY.exe BYT.exe File created C:\windows\SysWOW64\IVYUR.exe.bat KKVEIA.exe File created C:\windows\SysWOW64\GMGADAR.exe 2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe File created C:\windows\SysWOW64\SHO.exe.bat URB.exe File created C:\windows\SysWOW64\OUOYXPT.exe BJGI.exe File created C:\windows\SysWOW64\AIWXJZY.exe.bat BYT.exe File created C:\windows\SysWOW64\KKVEIA.exe XZFOUY.exe File created C:\windows\SysWOW64\IVYUR.exe KKVEIA.exe File created C:\windows\SysWOW64\DPG.exe NZXAWBA.exe File created C:\windows\SysWOW64\RHPJPCI.exe JTWUNXF.exe File created C:\windows\SysWOW64\NZXAWBA.exe PCM.exe File opened for modification C:\windows\SysWOW64\JDKTJ.exe DPG.exe File created C:\windows\SysWOW64\GMGADAR.exe.bat 2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\CEVQCFQ.exe LWHTPOV.exe File created C:\windows\SysWOW64\BJGI.exe.bat JJEVGH.exe File opened for modification C:\windows\SysWOW64\RHPJPCI.exe JTWUNXF.exe File opened for modification C:\windows\SysWOW64\KKVEIA.exe XZFOUY.exe File created C:\windows\SysWOW64\KKVEIA.exe.bat XZFOUY.exe File opened for modification C:\windows\SysWOW64\VHBJNFZ.exe NBOVCHE.exe File created C:\windows\SysWOW64\FCQ.exe.bat OUOYXPT.exe File created C:\windows\SysWOW64\QZX.exe RBMM.exe File created C:\windows\SysWOW64\OVLQUI.exe.bat VSHNGKF.exe File opened for modification C:\windows\SysWOW64\GMGADAR.exe 2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\IAFBJRE.exe ANT.exe File created C:\windows\SysWOW64\QZX.exe.bat RBMM.exe File opened for modification C:\windows\SysWOW64\IVYUR.exe KKVEIA.exe File created C:\windows\SysWOW64\DPG.exe.bat NZXAWBA.exe File created C:\windows\SysWOW64\SHO.exe URB.exe File opened for modification C:\windows\SysWOW64\VGQ.exe RYJSY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\VSHNGKF.exe.bat EJFHD.exe File created C:\windows\IYBYFW.exe.bat VOK.exe File created C:\windows\CKK.exe.bat MUJK.exe File created C:\windows\OYIC.exe WDEGRIH.exe File created C:\windows\TYBNXBA.exe SVPJS.exe File created C:\windows\system\WQTPD.exe ZXRMR.exe File opened for modification C:\windows\system\PGMOQ.exe WSNI.exe File opened for modification C:\windows\SITL.exe GSMLJG.exe File opened for modification C:\windows\system\ISW.exe SITL.exe File created C:\windows\MUJK.exe OJZUXYV.exe File created C:\windows\system\PGMOQ.exe WSNI.exe File created C:\windows\system\UGGKH.exe OWRB.exe File created C:\windows\system\RBMM.exe.bat EDMASP.exe File created C:\windows\NULNYA.exe.bat WMXPM.exe File created C:\windows\CVSYEK.exe.bat XPIJO.exe File created C:\windows\system\RLTX.exe CVSYEK.exe File created C:\windows\TYBNXBA.exe.bat SVPJS.exe File created C:\windows\KGKRYIZ.exe.bat AIWXJZY.exe File created C:\windows\system\BAGY.exe XKZQCTV.exe File created C:\windows\MUJK.exe.bat OJZUXYV.exe File created C:\windows\HMTK.exe DJIFNPT.exe File created C:\windows\system\ANT.exe SHO.exe File created C:\windows\system\ANT.exe.bat SHO.exe File opened for modification C:\windows\system\GZOVQ.exe UGGKH.exe File created C:\windows\SVPJS.exe XIS.exe File created C:\windows\SFZCPY.exe FCQ.exe File opened for modification C:\windows\system\GSMLJG.exe EUZRCXB.exe File created C:\windows\EDMASP.exe ISW.exe File created C:\windows\XPIJO.exe.bat HXX.exe File created C:\windows\system\JTWUNXF.exe YBHJEWX.exe File created C:\windows\CKK.exe MUJK.exe File created C:\windows\system\YGT.exe.bat JDKTJ.exe File created C:\windows\EUZRCXB.exe OEY.exe File created C:\windows\WMXPM.exe QZX.exe File created C:\windows\XKZQCTV.exe.bat YAW.exe File created C:\windows\ZXRMR.exe GMGADAR.exe File created C:\windows\system\DJIFNPT.exe.bat WQTPD.exe File created C:\windows\system\GZOVQ.exe.bat UGGKH.exe File created C:\windows\CVSYEK.exe XPIJO.exe File created C:\windows\EUZRCXB.exe.bat OEY.exe File created C:\windows\system\RBMM.exe EDMASP.exe File opened for modification C:\windows\NULNYA.exe WMXPM.exe File opened for modification C:\windows\system\DJIFNPT.exe WQTPD.exe File created C:\windows\system\GZOVQ.exe UGGKH.exe File created C:\windows\system\LWHTPOV.exe.bat JYB.exe File created C:\windows\JJEVGH.exe TYBNXBA.exe File opened for modification C:\windows\EUZRCXB.exe OEY.exe File created C:\windows\system\YAW.exe USQAH.exe File opened for modification C:\windows\system\BAGY.exe XKZQCTV.exe File opened for modification C:\windows\system\PCM.exe OYIC.exe File opened for modification C:\windows\system\UGGKH.exe OWRB.exe File created C:\windows\system\WSNI.exe OMAB.exe File created C:\windows\system\PGMOQ.exe.bat WSNI.exe File created C:\windows\JYB.exe PGMOQ.exe File opened for modification C:\windows\IYBYFW.exe VOK.exe File created C:\windows\system\PCM.exe.bat OYIC.exe File opened for modification C:\windows\TYBNXBA.exe SVPJS.exe File opened for modification C:\windows\HMTK.exe DJIFNPT.exe File created C:\windows\HMTK.exe.bat DJIFNPT.exe File created C:\windows\system\FDWMREK.exe VGQ.exe File opened for modification C:\windows\system\LWHTPOV.exe JYB.exe File opened for modification C:\windows\SFZCPY.exe FCQ.exe File created C:\windows\AFTL.exe.bat NULNYA.exe File created C:\windows\system\UTAJ.exe AFTL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4252 cmd.exe 5760 cmd.exe 2712 cmd.exe 3580 cmd.exe 260 cmd.exe 5672 cmd.exe 4220 cmd.exe 3556 cmd.exe 4588 cmd.exe 1992 cmd.exe 5632 cmd.exe 4580 cmd.exe 3764 cmd.exe 2772 cmd.exe 5156 cmd.exe 1208 cmd.exe 3616 cmd.exe 2296 cmd.exe 1560 cmd.exe 3900 cmd.exe 4156 cmd.exe 2076 cmd.exe 3744 cmd.exe 2036 cmd.exe 1132 cmd.exe 4172 cmd.exe 3584 cmd.exe 2364 cmd.exe 4820 cmd.exe 1868 cmd.exe 3356 cmd.exe 5060 cmd.exe 5688 cmd.exe 2620 cmd.exe 840 cmd.exe 4512 cmd.exe 1460 cmd.exe 5480 cmd.exe 4432 cmd.exe 1716 cmd.exe 3752 cmd.exe 2372 cmd.exe 4104 cmd.exe 2360 cmd.exe 3140 cmd.exe 5652 cmd.exe 3068 cmd.exe 468 cmd.exe 5540 cmd.exe 3236 cmd.exe 6064 cmd.exe 4052 cmd.exe 4516 cmd.exe 4996 cmd.exe 1508 cmd.exe 4976 cmd.exe 3304 cmd.exe 3324 cmd.exe 2756 cmd.exe 5388 cmd.exe 1408 cmd.exe 4892 cmd.exe 2536 cmd.exe 5184 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2760 4956 WerFault.exe 87 2992 5004 WerFault.exe 93 2136 928 WerFault.exe 98 3652 2584 WerFault.exe 104 1956 3676 WerFault.exe 109 2860 5596 WerFault.exe 114 3292 2056 WerFault.exe 119 4196 2940 WerFault.exe 124 4564 4144 WerFault.exe 129 3616 5588 WerFault.exe 134 260 5700 WerFault.exe 139 2448 1096 WerFault.exe 144 4388 5840 WerFault.exe 149 2992 2432 WerFault.exe 154 4976 4812 WerFault.exe 159 3652 2972 WerFault.exe 164 4112 1832 WerFault.exe 169 3556 5364 WerFault.exe 174 996 3100 WerFault.exe 179 5636 2700 WerFault.exe 184 6124 2848 WerFault.exe 189 4728 756 WerFault.exe 194 5608 944 WerFault.exe 199 4200 5868 WerFault.exe 204 5628 4724 WerFault.exe 209 3468 6032 WerFault.exe 214 2140 2404 WerFault.exe 219 1340 4120 WerFault.exe 224 6000 2156 WerFault.exe 229 1460 4616 WerFault.exe 234 4560 3196 WerFault.exe 239 1948 5056 WerFault.exe 244 1304 4728 WerFault.exe 249 6044 4652 WerFault.exe 254 4044 4200 WerFault.exe 260 3912 4768 WerFault.exe 265 1588 3388 WerFault.exe 270 4492 6016 WerFault.exe 275 4936 1288 WerFault.exe 280 3932 5984 WerFault.exe 285 4560 5272 WerFault.exe 290 3068 5888 WerFault.exe 295 1252 3736 WerFault.exe 300 6064 1808 WerFault.exe 305 6004 2004 WerFault.exe 310 2296 2136 WerFault.exe 315 4808 4180 WerFault.exe 320 1340 4276 WerFault.exe 325 1368 2460 WerFault.exe 330 3616 2568 WerFault.exe 335 5180 1792 WerFault.exe 340 1208 1144 WerFault.exe 345 6052 1444 WerFault.exe 350 2984 5936 WerFault.exe 355 5620 4140 WerFault.exe 360 1876 3704 WerFault.exe 365 6076 4632 WerFault.exe 370 3540 1348 WerFault.exe 375 4568 4664 WerFault.exe 380 888 5660 WerFault.exe 385 1220 2668 WerFault.exe 390 5708 3312 WerFault.exe 395 3384 5696 WerFault.exe 400 4464 1040 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RADBB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSNI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHPJPCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJFHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVYUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGMOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVLQUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKVEIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYQVJVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJEVGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUZRCXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZFOUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVTAT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TYBNXBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUOYXPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LWHTPOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYJSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTWUNXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEVQCFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDMASP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANWTBSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHBJNFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4956 2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe 4956 2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe 5004 GMGADAR.exe 5004 GMGADAR.exe 928 ZXRMR.exe 928 ZXRMR.exe 2584 WQTPD.exe 2584 WQTPD.exe 3676 DJIFNPT.exe 3676 DJIFNPT.exe 5596 HMTK.exe 5596 HMTK.exe 2056 URB.exe 2056 URB.exe 2940 SHO.exe 2940 SHO.exe 4144 ANT.exe 4144 ANT.exe 5588 IAFBJRE.exe 5588 IAFBJRE.exe 5700 OWRB.exe 5700 OWRB.exe 1096 UGGKH.exe 1096 UGGKH.exe 5840 GZOVQ.exe 5840 GZOVQ.exe 2432 OMAB.exe 2432 OMAB.exe 4812 WSNI.exe 4812 WSNI.exe 2972 PGMOQ.exe 2972 PGMOQ.exe 1832 JYB.exe 1832 JYB.exe 5364 LWHTPOV.exe 5364 LWHTPOV.exe 3100 CEVQCFQ.exe 3100 CEVQCFQ.exe 2700 HXX.exe 2700 HXX.exe 2848 XPIJO.exe 2848 XPIJO.exe 756 CVSYEK.exe 756 CVSYEK.exe 944 RLTX.exe 944 RLTX.exe 5868 XYFQ.exe 5868 XYFQ.exe 4724 NBOVCHE.exe 4724 NBOVCHE.exe 6032 VHBJNFZ.exe 6032 VHBJNFZ.exe 2404 KXCBT.exe 2404 KXCBT.exe 4120 XIS.exe 4120 XIS.exe 2156 SVPJS.exe 2156 SVPJS.exe 4616 TYBNXBA.exe 4616 TYBNXBA.exe 3196 JJEVGH.exe 3196 JJEVGH.exe 5056 BJGI.exe 5056 BJGI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4956 2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe 4956 2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe 5004 GMGADAR.exe 5004 GMGADAR.exe 928 ZXRMR.exe 928 ZXRMR.exe 2584 WQTPD.exe 2584 WQTPD.exe 3676 DJIFNPT.exe 3676 DJIFNPT.exe 5596 HMTK.exe 5596 HMTK.exe 2056 URB.exe 2056 URB.exe 2940 SHO.exe 2940 SHO.exe 4144 ANT.exe 4144 ANT.exe 5588 IAFBJRE.exe 5588 IAFBJRE.exe 5700 OWRB.exe 5700 OWRB.exe 1096 UGGKH.exe 1096 UGGKH.exe 5840 GZOVQ.exe 5840 GZOVQ.exe 2432 OMAB.exe 2432 OMAB.exe 4812 WSNI.exe 4812 WSNI.exe 2972 PGMOQ.exe 2972 PGMOQ.exe 1832 JYB.exe 1832 JYB.exe 5364 LWHTPOV.exe 5364 LWHTPOV.exe 3100 CEVQCFQ.exe 3100 CEVQCFQ.exe 2700 HXX.exe 2700 HXX.exe 2848 XPIJO.exe 2848 XPIJO.exe 756 CVSYEK.exe 756 CVSYEK.exe 944 RLTX.exe 944 RLTX.exe 5868 XYFQ.exe 5868 XYFQ.exe 4724 NBOVCHE.exe 4724 NBOVCHE.exe 6032 VHBJNFZ.exe 6032 VHBJNFZ.exe 2404 KXCBT.exe 2404 KXCBT.exe 4120 XIS.exe 4120 XIS.exe 2156 SVPJS.exe 2156 SVPJS.exe 4616 TYBNXBA.exe 4616 TYBNXBA.exe 3196 JJEVGH.exe 3196 JJEVGH.exe 5056 BJGI.exe 5056 BJGI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 1992 4956 2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe 89 PID 1992 wrote to memory of 5004 1992 cmd.exe 93 PID 5004 wrote to memory of 3760 5004 GMGADAR.exe 95 PID 3760 wrote to memory of 928 3760 cmd.exe 98 PID 928 wrote to memory of 4432 928 ZXRMR.exe 100 PID 4432 wrote to memory of 2584 4432 cmd.exe 104 PID 2584 wrote to memory of 3828 2584 WQTPD.exe 105 PID 3828 wrote to memory of 3676 3828 cmd.exe 109 PID 3676 wrote to memory of 716 3676 DJIFNPT.exe 110 PID 716 wrote to memory of 5596 716 cmd.exe 114 PID 5596 wrote to memory of 3300 5596 HMTK.exe 115 PID 3300 wrote to memory of 2056 3300 cmd.exe 119 PID 2056 wrote to memory of 5032 2056 URB.exe 120 PID 5032 wrote to memory of 2940 5032 cmd.exe 124 PID 2940 wrote to memory of 4992 2940 SHO.exe 125 PID 4992 wrote to memory of 4144 4992 cmd.exe 129 PID 4144 wrote to memory of 5688 4144 ANT.exe 130 PID 5688 wrote to memory of 5588 5688 cmd.exe 134 PID 5588 wrote to memory of 3856 5588 IAFBJRE.exe 135 PID 3856 wrote to memory of 5700 3856 cmd.exe 139 PID 5700 wrote to memory of 2620 5700 OWRB.exe 140 PID 2620 wrote to memory of 1096 2620 cmd.exe 144 PID 1096 wrote to memory of 1680 1096 UGGKH.exe 145 PID 1680 wrote to memory of 5840 1680 cmd.exe 149 PID 5840 wrote to memory of 5872 5840 GZOVQ.exe 150 PID 5872 wrote to memory of 2432 5872 cmd.exe 154 PID 2432 wrote to memory of 5392 2432 OMAB.exe 155 PID 5392 wrote to memory of 4812 5392 cmd.exe 159 PID 4812 wrote to memory of 5156 4812 WSNI.exe 160 PID 5156 wrote to memory of 2972 5156 cmd.exe 164 PID 2972 wrote to memory of 4996 2972 PGMOQ.exe 165 PID 4996 wrote to memory of 1832 4996 cmd.exe 169 PID 1832 wrote to memory of 4244 1832 JYB.exe 170 PID 4244 wrote to memory of 5364 4244 cmd.exe 174 PID 5364 wrote to memory of 4488 5364 LWHTPOV.exe 175 PID 4488 wrote to memory of 3100 4488 cmd.exe 179 PID 3100 wrote to memory of 2364 3100 CEVQCFQ.exe 180 PID 2364 wrote to memory of 2700 2364 cmd.exe 184 PID 2700 wrote to memory of 468 2700 HXX.exe 185 PID 468 wrote to memory of 2848 468 cmd.exe 189 PID 2848 wrote to memory of 5236 2848 XPIJO.exe 190 PID 5236 wrote to memory of 756 5236 cmd.exe 194 PID 756 wrote to memory of 2360 756 CVSYEK.exe 195 PID 2360 wrote to memory of 944 2360 cmd.exe 199 PID 944 wrote to memory of 1248 944 RLTX.exe 200 PID 1248 wrote to memory of 5868 1248 cmd.exe 204 PID 5868 wrote to memory of 4536 5868 XYFQ.exe 205 PID 4536 wrote to memory of 4724 4536 cmd.exe 209 PID 4724 wrote to memory of 3908 4724 NBOVCHE.exe 210 PID 3908 wrote to memory of 6032 3908 cmd.exe 214 PID 6032 wrote to memory of 4516 6032 VHBJNFZ.exe 215 PID 4516 wrote to memory of 2404 4516 cmd.exe 219 PID 2404 wrote to memory of 2076 2404 KXCBT.exe 220 PID 2076 wrote to memory of 4120 2076 cmd.exe 224 PID 4120 wrote to memory of 2148 4120 XIS.exe 225 PID 2148 wrote to memory of 2156 2148 cmd.exe 229 PID 2156 wrote to memory of 3648 2156 SVPJS.exe 230 PID 3648 wrote to memory of 4616 3648 cmd.exe 234 PID 4616 wrote to memory of 5632 4616 TYBNXBA.exe 235 PID 5632 wrote to memory of 3196 5632 cmd.exe 239 PID 3196 wrote to memory of 4980 3196 JJEVGH.exe 240 PID 4980 wrote to memory of 5056 4980 cmd.exe 244 PID 5056 wrote to memory of 260 5056 BJGI.exe 245 PID 260 wrote to memory of 4728 260 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7344ce1b424a6007e9341cf1750596a5_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GMGADAR.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\windows\SysWOW64\GMGADAR.exeC:\windows\system32\GMGADAR.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXRMR.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\windows\ZXRMR.exeC:\windows\ZXRMR.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQTPD.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\system\WQTPD.exeC:\windows\system\WQTPD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJIFNPT.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\windows\system\DJIFNPT.exeC:\windows\system\DJIFNPT.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMTK.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\HMTK.exeC:\windows\HMTK.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\windows\SysWOW64\URB.exeC:\windows\system32\URB.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHO.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\SysWOW64\SHO.exeC:\windows\system32\SHO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANT.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\windows\system\ANT.exeC:\windows\system\ANT.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAFBJRE.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\SysWOW64\IAFBJRE.exeC:\windows\system32\IAFBJRE.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWRB.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\SysWOW64\OWRB.exeC:\windows\system32\OWRB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGGKH.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\system\UGGKH.exeC:\windows\system\UGGKH.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZOVQ.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\windows\system\GZOVQ.exeC:\windows\system\GZOVQ.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMAB.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\OMAB.exeC:\windows\OMAB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSNI.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\windows\system\WSNI.exeC:\windows\system\WSNI.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGMOQ.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\windows\system\PGMOQ.exeC:\windows\system\PGMOQ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYB.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\windows\JYB.exeC:\windows\JYB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWHTPOV.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\system\LWHTPOV.exeC:\windows\system\LWHTPOV.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CEVQCFQ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\windows\SysWOW64\CEVQCFQ.exeC:\windows\system32\CEVQCFQ.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXX.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\system\HXX.exeC:\windows\system\HXX.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPIJO.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:468 -
C:\windows\XPIJO.exeC:\windows\XPIJO.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\windows\CVSYEK.exeC:\windows\CVSYEK.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYFQ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\XYFQ.exeC:\windows\XYFQ.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NBOVCHE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\SysWOW64\NBOVCHE.exeC:\windows\system32\NBOVCHE.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHBJNFZ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\windows\SysWOW64\VHBJNFZ.exeC:\windows\system32\VHBJNFZ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXCBT.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\windows\SysWOW64\KXCBT.exeC:\windows\system32\KXCBT.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIS.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\windows\SysWOW64\XIS.exeC:\windows\system32\XIS.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVPJS.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\SVPJS.exeC:\windows\SVPJS.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYBNXBA.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\windows\TYBNXBA.exeC:\windows\TYBNXBA.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JJEVGH.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\JJEVGH.exeC:\windows\JJEVGH.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BJGI.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\SysWOW64\BJGI.exeC:\windows\system32\BJGI.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUOYXPT.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260 -
C:\windows\SysWOW64\OUOYXPT.exeC:\windows\system32\OUOYXPT.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCQ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1156 -
C:\windows\SysWOW64\FCQ.exeC:\windows\system32\FCQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFZCPY.exe.bat" "68⤵PID:3344
-
C:\windows\SFZCPY.exeC:\windows\SFZCPY.exe69⤵
- Executes dropped EXE
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYJSY.exe.bat" "70⤵PID:2176
-
C:\windows\system\RYJSY.exeC:\windows\system\RYJSY.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VGQ.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3652 -
C:\windows\SysWOW64\VGQ.exeC:\windows\system32\VGQ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDWMREK.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5952 -
C:\windows\system\FDWMREK.exeC:\windows\system\FDWMREK.exe75⤵
- Executes dropped EXE
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEY.exe.bat" "76⤵
- Executes a command shell one-liner
PID:3556 -
C:\windows\system\OEY.exeC:\windows\system\OEY.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUZRCXB.exe.bat" "78⤵PID:2340
-
C:\windows\EUZRCXB.exeC:\windows\EUZRCXB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GSMLJG.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4588 -
C:\windows\system\GSMLJG.exeC:\windows\system\GSMLJG.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SITL.exe.bat" "82⤵PID:4964
-
C:\windows\SITL.exeC:\windows\SITL.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ISW.exe.bat" "84⤵PID:3268
-
C:\windows\system\ISW.exeC:\windows\system\ISW.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDMASP.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5672 -
C:\windows\EDMASP.exeC:\windows\EDMASP.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBMM.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2756 -
C:\windows\system\RBMM.exeC:\windows\system\RBMM.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZX.exe.bat" "90⤵PID:3004
-
C:\windows\SysWOW64\QZX.exeC:\windows\system32\QZX.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WMXPM.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3744 -
C:\windows\WMXPM.exeC:\windows\WMXPM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NULNYA.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1716 -
C:\windows\NULNYA.exeC:\windows\NULNYA.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFTL.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4252 -
C:\windows\AFTL.exeC:\windows\AFTL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTAJ.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4820 -
C:\windows\system\UTAJ.exeC:\windows\system\UTAJ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBHJEWX.exe.bat" "100⤵PID:548
-
C:\windows\SysWOW64\YBHJEWX.exeC:\windows\system32\YBHJEWX.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTWUNXF.exe.bat" "102⤵PID:2564
-
C:\windows\system\JTWUNXF.exeC:\windows\system\JTWUNXF.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHPJPCI.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4052 -
C:\windows\SysWOW64\RHPJPCI.exeC:\windows\system32\RHPJPCI.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJFHD.exe.bat" "106⤵PID:1392
-
C:\windows\system\EJFHD.exeC:\windows\system\EJFHD.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSHNGKF.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1416 -
C:\windows\system\VSHNGKF.exeC:\windows\system\VSHNGKF.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVLQUI.exe.bat" "110⤵
- Executes a command shell one-liner
PID:1868 -
C:\windows\SysWOW64\OVLQUI.exeC:\windows\system32\OVLQUI.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYT.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3356 -
C:\windows\BYT.exeC:\windows\BYT.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIWXJZY.exe.bat" "114⤵PID:4808
-
C:\windows\SysWOW64\AIWXJZY.exeC:\windows\system32\AIWXJZY.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGKRYIZ.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4580 -
C:\windows\KGKRYIZ.exeC:\windows\KGKRYIZ.exe117⤵
- Executes dropped EXE
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBPB.exe.bat" "118⤵PID:5944
-
C:\windows\system\FBPB.exeC:\windows\system\FBPB.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USQAH.exe.bat" "120⤵PID:4304
-
C:\windows\system\USQAH.exeC:\windows\system\USQAH.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-