Analysis
- max time kernel
68s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe
- Size 208KB
- Sample260810-2en3saba28
- SHA256 b4b330bcc8def172b955509b6521d1116ec1df9230470ddfcb9c85a09bbdc6cf
- MD5 5c524585b5166e84a5b266e5e2e5e43a
- SHA1 59b8e381fd85710d63cef8f5815517a9f23d2f94
- SHA512 2bec3723c8ff68144af79e0668cf2426cdb3215bff9a8230e526e54d280d6fe104f907b9552f36406f0cde60b5b5799930974564aa2f8a2f0d2bc7ff861b1c6d
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb8l9dL+LOfA4pLthEjQT6j:vlZtbLWIgd1LZ9oECZb8l95+LOIkEj1
- TLSH T144247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 424 HSBQU.exe 5240 VARX.exe 1844 QVWGP.exe 5904 ATB.exe 564 CRHVENV.exe 5880 MPVHTWE.exe 6132 LZYX.exe 4748 JKA.exe 4240 EXSX.exe 5712 FWZFY.exe 4492 CMNPOSK.exe 4920 FHE.exe 2112 SEQDK.exe 2464 VNZRRD.exe 2816 SNBBDZ.exe 4844 PDWLLO.exe 1528 MJHABJ.exe 1228 YUR.exe 4964 NKFF.exe 5612 JHRJDA.exe 5328 CVYPIC.exe 6128 DYODXLB.exe 5112 JTAE.exe 3440 RHFK.exe 2068 IHTI.exe 1888 WNTTKBS.exe 5832 YAK.exe 4760 HOXKGTV.exe 3316 RLCEVBD.exe 5452 SJQQ.exe 5496 MXPWI.exe 1068 PKGYTX.exe 2496 JSPVA.exe 3492 MNYWTC.exe 1644 LYJMU.exe 3160 VWPG.exe 1040 GKW.exe 5916 OPALZZY.exe 5464 IIQWJZG.exe 2984 ZQE.exe 5660 HVJIGPW.exe 704 PJVPQNA.exe 3684 EZWGP.exe 800 ZMOQIU.exe 4944 JKT.exe 5608 IVWSZJB.exe 2408 STKMGRJ.exe 2920 DGJKL.exe 1916 AMBABW.exe 4124 RUDNFTD.exe 5468 TSJZUCL.exe 876 FAPH.exe 1872 DVOID.exe 1304 SQY.exe 3176 COLGDSY.exe 4820 BZOWMG.exe 764 TCS.exe 1960 UFWWFMF.exe 1392 NAAA.exe 2992 VNMG.exe 4288 MBXYDX.exe 4368 BRY.exe 2056 LRAV.exe 4780 VPFP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\SEQDK.exe.bat FHE.exe File created C:\windows\SysWOW64\PDWLLO.exe.bat SNBBDZ.exe File created C:\windows\SysWOW64\IHTI.exe RHFK.exe File opened for modification C:\windows\SysWOW64\SJQQ.exe RLCEVBD.exe File created C:\windows\SysWOW64\ZQE.exe IIQWJZG.exe File created C:\windows\SysWOW64\HVJIGPW.exe ZQE.exe File opened for modification C:\windows\SysWOW64\PJVPQNA.exe HVJIGPW.exe File created C:\windows\SysWOW64\STKMGRJ.exe IVWSZJB.exe File created C:\windows\SysWOW64\PDWLLO.exe SNBBDZ.exe File created C:\windows\SysWOW64\JHRJDA.exe NKFF.exe File created C:\windows\SysWOW64\FAPH.exe TSJZUCL.exe File opened for modification C:\windows\SysWOW64\STKMGRJ.exe IVWSZJB.exe File created C:\windows\SysWOW64\STKMGRJ.exe.bat IVWSZJB.exe File created C:\windows\SysWOW64\DVOID.exe FAPH.exe File opened for modification C:\windows\SysWOW64\NAAA.exe UFWWFMF.exe File created C:\windows\SysWOW64\VNMG.exe.bat NAAA.exe File opened for modification C:\windows\SysWOW64\PDWLLO.exe SNBBDZ.exe File created C:\windows\SysWOW64\MJHABJ.exe.bat PDWLLO.exe File created C:\windows\SysWOW64\XWCD.exe DJY.exe File created C:\windows\SysWOW64\SSHMSB.exe XWCD.exe File created C:\windows\SysWOW64\SSHMSB.exe.bat XWCD.exe File opened for modification C:\windows\SysWOW64\STNVI.exe CYDRXYU.exe File created C:\windows\SysWOW64\JKA.exe LZYX.exe File created C:\windows\SysWOW64\JKA.exe.bat LZYX.exe File created C:\windows\SysWOW64\JTAE.exe DYODXLB.exe File created C:\windows\SysWOW64\PJVPQNA.exe.bat HVJIGPW.exe File opened for modification C:\windows\SysWOW64\TSJZUCL.exe RUDNFTD.exe File created C:\windows\SysWOW64\BRY.exe.bat MBXYDX.exe File opened for modification C:\windows\SysWOW64\SSHMSB.exe XWCD.exe File created C:\windows\SysWOW64\CYDRXYU.exe.bat NICR.exe File opened for modification C:\windows\SysWOW64\MBXYDX.exe VNMG.exe File created C:\windows\SysWOW64\CYDRXYU.exe NICR.exe File created C:\windows\SysWOW64\TSJZUCL.exe RUDNFTD.exe File created C:\windows\SysWOW64\TSJZUCL.exe.bat RUDNFTD.exe File opened for modification C:\windows\SysWOW64\SQY.exe DVOID.exe File created C:\windows\SysWOW64\BRY.exe MBXYDX.exe File created C:\windows\SysWOW64\AIGDKD.exe QLBJDVK.exe File opened for modification C:\windows\SysWOW64\FAPH.exe TSJZUCL.exe File opened for modification C:\windows\SysWOW64\JTAE.exe DYODXLB.exe File created C:\windows\SysWOW64\JSPVA.exe PKGYTX.exe File created C:\windows\SysWOW64\ZQE.exe.bat IIQWJZG.exe File opened for modification C:\windows\SysWOW64\DVOID.exe FAPH.exe File created C:\windows\SysWOW64\TCS.exe.bat BZOWMG.exe File created C:\windows\SysWOW64\UFWWFMF.exe TCS.exe File created C:\windows\SysWOW64\MBXYDX.exe VNMG.exe File opened for modification C:\windows\SysWOW64\JKA.exe LZYX.exe File created C:\windows\SysWOW64\RHFK.exe.bat JTAE.exe File created C:\windows\SysWOW64\SQY.exe DVOID.exe File created C:\windows\SysWOW64\SQY.exe.bat DVOID.exe File created C:\windows\SysWOW64\AIGDKD.exe.bat QLBJDVK.exe File created C:\windows\SysWOW64\NICR.exe LKPXJC.exe File created C:\windows\SysWOW64\STNVI.exe.bat CYDRXYU.exe File opened for modification C:\windows\SysWOW64\SEQDK.exe FHE.exe File created C:\windows\SysWOW64\JTAE.exe.bat DYODXLB.exe File opened for modification C:\windows\SysWOW64\IHTI.exe RHFK.exe File opened for modification C:\windows\SysWOW64\YAK.exe WNTTKBS.exe File opened for modification C:\windows\SysWOW64\VNMG.exe NAAA.exe File opened for modification C:\windows\SysWOW64\QVWGP.exe VARX.exe File created C:\windows\SysWOW64\IHTI.exe.bat RHFK.exe File created C:\windows\SysWOW64\YAK.exe WNTTKBS.exe File created C:\windows\SysWOW64\YAK.exe.bat WNTTKBS.exe File opened for modification C:\windows\SysWOW64\HVJIGPW.exe ZQE.exe File created C:\windows\SysWOW64\PJVPQNA.exe HVJIGPW.exe File created C:\windows\SysWOW64\SEQDK.exe FHE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\WNTTKBS.exe IHTI.exe File opened for modification C:\windows\system\GKW.exe VWPG.exe File opened for modification C:\windows\HOXKGTV.exe YAK.exe File opened for modification C:\windows\system\ATB.exe QVWGP.exe File created C:\windows\system\EXSX.exe JKA.exe File opened for modification C:\windows\YUR.exe MJHABJ.exe File created C:\windows\system\LYJMU.exe MNYWTC.exe File opened for modification C:\windows\OPALZZY.exe GKW.exe File created C:\windows\LRAV.exe.bat BRY.exe File created C:\windows\LKPXJC.exe SSHMSB.exe File created C:\windows\UUWLDR.exe FRNH.exe File created C:\windows\system\ATB.exe.bat QVWGP.exe File created C:\windows\JKT.exe.bat ZMOQIU.exe File created C:\windows\system\RUDNFTD.exe AMBABW.exe File opened for modification C:\windows\system\COLGDSY.exe SQY.exe File created C:\windows\FHE.exe.bat CMNPOSK.exe File created C:\windows\system\COLGDSY.exe.bat SQY.exe File created C:\windows\DGJKL.exe STKMGRJ.exe File created C:\windows\DGJKL.exe.bat STKMGRJ.exe File opened for modification C:\windows\system\BZOWMG.exe COLGDSY.exe File created C:\windows\system\RLCEVBD.exe HOXKGTV.exe File created C:\windows\HSBQU.exe.bat 2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe File created C:\windows\LZYX.exe MPVHTWE.exe File opened for modification C:\windows\system\FWZFY.exe EXSX.exe File opened for modification C:\windows\CMNPOSK.exe FWZFY.exe File opened for modification C:\windows\system\LYJMU.exe MNYWTC.exe File opened for modification C:\windows\VNZRRD.exe SEQDK.exe File opened for modification C:\windows\system\MXPWI.exe SJQQ.exe File opened for modification C:\windows\VWPG.exe LYJMU.exe File created C:\windows\OPALZZY.exe GKW.exe File created C:\windows\EZWGP.exe PJVPQNA.exe File created C:\windows\system\RUDNFTD.exe.bat AMBABW.exe File created C:\windows\system\VPFP.exe LRAV.exe File created C:\windows\system\IIQWJZG.exe.bat OPALZZY.exe File opened for modification C:\windows\DJY.exe GJOR.exe File opened for modification C:\windows\CRHVENV.exe ATB.exe File created C:\windows\system\IVWSZJB.exe.bat JKT.exe File created C:\windows\system\QLBJDVK.exe.bat BUAJW.exe File created C:\windows\system\FRNH.exe.bat STNVI.exe File opened for modification C:\windows\LZYX.exe MPVHTWE.exe File created C:\windows\VNZRRD.exe.bat SEQDK.exe File created C:\windows\system\MPVHTWE.exe.bat CRHVENV.exe File created C:\windows\SNBBDZ.exe VNZRRD.exe File opened for modification C:\windows\system\CVYPIC.exe JHRJDA.exe File opened for modification C:\windows\system\QLBJDVK.exe BUAJW.exe File created C:\windows\VWPG.exe.bat LYJMU.exe File opened for modification C:\windows\UUWLDR.exe FRNH.exe File created C:\windows\system\QLBJDVK.exe BUAJW.exe File created C:\windows\DJY.exe GJOR.exe File created C:\windows\system\MXPWI.exe SJQQ.exe File created C:\windows\system\MXPWI.exe.bat SJQQ.exe File opened for modification C:\windows\system\AMBABW.exe DGJKL.exe File created C:\windows\LRAV.exe BRY.exe File created C:\windows\system\CVYPIC.exe.bat JHRJDA.exe File created C:\windows\JKT.exe ZMOQIU.exe File opened for modification C:\windows\JKT.exe ZMOQIU.exe File created C:\windows\system\ATB.exe QVWGP.exe File created C:\windows\LZYX.exe.bat MPVHTWE.exe File created C:\windows\system\FWZFY.exe.bat EXSX.exe File created C:\windows\system\WNTTKBS.exe IHTI.exe File created C:\windows\system\LYJMU.exe.bat MNYWTC.exe File created C:\windows\EZWGP.exe.bat PJVPQNA.exe File created C:\windows\CMNPOSK.exe.bat FWZFY.exe File opened for modification C:\windows\system\FRNH.exe STNVI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3228 cmd.exe 6020 cmd.exe 4224 cmd.exe 5088 cmd.exe 5032 cmd.exe 3400 cmd.exe 3572 cmd.exe 984 cmd.exe 1308 cmd.exe 5036 cmd.exe 5616 cmd.exe 4164 cmd.exe 120 cmd.exe 2884 cmd.exe 3720 cmd.exe 4076 cmd.exe 1100 cmd.exe 2372 cmd.exe 5472 cmd.exe 4828 cmd.exe 5568 cmd.exe 1476 cmd.exe 1976 cmd.exe 2764 cmd.exe 3620 cmd.exe 5400 cmd.exe 4672 cmd.exe 1700 cmd.exe 3680 cmd.exe 1120 cmd.exe 1980 cmd.exe 3488 cmd.exe 3836 cmd.exe 1884 cmd.exe 2352 cmd.exe 5336 cmd.exe 5764 cmd.exe 4772 cmd.exe 996 cmd.exe 5596 cmd.exe 4880 cmd.exe 472 cmd.exe 1276 cmd.exe 1608 cmd.exe 2756 cmd.exe 3816 cmd.exe 5308 cmd.exe 1880 cmd.exe 6012 cmd.exe 3456 cmd.exe 2136 cmd.exe 3108 cmd.exe 904 cmd.exe 3292 cmd.exe 2188 cmd.exe 5800 cmd.exe 980 cmd.exe 5488 cmd.exe 1692 cmd.exe 4856 cmd.exe 3028 cmd.exe 2452 cmd.exe 6072 cmd.exe 1748 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2932 1140 WerFault.exe 88 5096 424 WerFault.exe 93 5704 5240 WerFault.exe 99 1100 1844 WerFault.exe 104 4176 5904 WerFault.exe 109 4444 564 WerFault.exe 114 1540 5880 WerFault.exe 119 2584 6132 WerFault.exe 124 2760 4748 WerFault.exe 129 480 4240 WerFault.exe 134 4464 5712 WerFault.exe 139 5112 4492 WerFault.exe 144 2764 4920 WerFault.exe 149 5096 2112 WerFault.exe 154 2768 2464 WerFault.exe 159 4996 2816 WerFault.exe 164 6140 4844 WerFault.exe 169 2924 1528 WerFault.exe 174 1052 1228 WerFault.exe 179 2992 4964 WerFault.exe 184 5332 5612 WerFault.exe 189 4452 5328 WerFault.exe 194 6104 6128 WerFault.exe 199 5244 5112 WerFault.exe 204 4088 3440 WerFault.exe 209 3192 2068 WerFault.exe 214 1964 1888 WerFault.exe 219 2664 5832 WerFault.exe 224 2584 4760 WerFault.exe 229 6060 3316 WerFault.exe 234 3516 5452 WerFault.exe 239 3840 5496 WerFault.exe 244 2660 1068 WerFault.exe 249 2688 2496 WerFault.exe 255 4828 3492 WerFault.exe 260 5696 1644 WerFault.exe 265 2076 3160 WerFault.exe 270 2480 1040 WerFault.exe 275 1432 5916 WerFault.exe 280 2612 5464 WerFault.exe 285 5724 2984 WerFault.exe 290 4352 5660 WerFault.exe 295 252 704 WerFault.exe 300 2436 3684 WerFault.exe 305 5796 800 WerFault.exe 310 1412 4944 WerFault.exe 315 3288 5608 WerFault.exe 320 5484 2408 WerFault.exe 325 3744 2920 WerFault.exe 330 3256 1916 WerFault.exe 335 3108 4124 WerFault.exe 340 1164 5468 WerFault.exe 345 3484 876 WerFault.exe 350 3340 1872 WerFault.exe 355 916 1304 WerFault.exe 360 2560 3176 WerFault.exe 365 1388 4820 WerFault.exe 370 3968 764 WerFault.exe 375 2988 1960 WerFault.exe 380 5860 1392 WerFault.exe 385 3760 2992 WerFault.exe 390 5028 4288 WerFault.exe 395 5620 4368 WerFault.exe 400 5796 2056 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKGYTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRHVENV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XWCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VARX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVWGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDWLLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VWPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIQWJZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVWSZJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMOQIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMBABW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSJZUCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSHMSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MPVHTWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUDNFTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBXYDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGJKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HSBQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYODXLB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEQDK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXPWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNYWTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVJIGPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUWLDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1140 2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe 1140 2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe 424 HSBQU.exe 424 HSBQU.exe 5240 VARX.exe 5240 VARX.exe 1844 QVWGP.exe 1844 QVWGP.exe 5904 ATB.exe 5904 ATB.exe 564 CRHVENV.exe 564 CRHVENV.exe 5880 MPVHTWE.exe 5880 MPVHTWE.exe 6132 LZYX.exe 6132 LZYX.exe 4748 JKA.exe 4748 JKA.exe 4240 EXSX.exe 4240 EXSX.exe 5712 FWZFY.exe 5712 FWZFY.exe 4492 CMNPOSK.exe 4492 CMNPOSK.exe 4920 FHE.exe 4920 FHE.exe 2112 SEQDK.exe 2112 SEQDK.exe 2464 VNZRRD.exe 2464 VNZRRD.exe 2816 SNBBDZ.exe 2816 SNBBDZ.exe 4844 PDWLLO.exe 4844 PDWLLO.exe 1528 MJHABJ.exe 1528 MJHABJ.exe 1228 YUR.exe 1228 YUR.exe 4964 NKFF.exe 4964 NKFF.exe 5612 JHRJDA.exe 5612 JHRJDA.exe 5328 CVYPIC.exe 5328 CVYPIC.exe 6128 DYODXLB.exe 6128 DYODXLB.exe 5112 JTAE.exe 5112 JTAE.exe 3440 RHFK.exe 3440 RHFK.exe 2068 IHTI.exe 2068 IHTI.exe 1888 WNTTKBS.exe 1888 WNTTKBS.exe 5832 YAK.exe 5832 YAK.exe 4760 HOXKGTV.exe 4760 HOXKGTV.exe 3316 RLCEVBD.exe 3316 RLCEVBD.exe 5452 SJQQ.exe 5452 SJQQ.exe 5496 MXPWI.exe 5496 MXPWI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1140 2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe 1140 2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe 424 HSBQU.exe 424 HSBQU.exe 5240 VARX.exe 5240 VARX.exe 1844 QVWGP.exe 1844 QVWGP.exe 5904 ATB.exe 5904 ATB.exe 564 CRHVENV.exe 564 CRHVENV.exe 5880 MPVHTWE.exe 5880 MPVHTWE.exe 6132 LZYX.exe 6132 LZYX.exe 4748 JKA.exe 4748 JKA.exe 4240 EXSX.exe 4240 EXSX.exe 5712 FWZFY.exe 5712 FWZFY.exe 4492 CMNPOSK.exe 4492 CMNPOSK.exe 4920 FHE.exe 4920 FHE.exe 2112 SEQDK.exe 2112 SEQDK.exe 2464 VNZRRD.exe 2464 VNZRRD.exe 2816 SNBBDZ.exe 2816 SNBBDZ.exe 4844 PDWLLO.exe 4844 PDWLLO.exe 1528 MJHABJ.exe 1528 MJHABJ.exe 1228 YUR.exe 1228 YUR.exe 4964 NKFF.exe 4964 NKFF.exe 5612 JHRJDA.exe 5612 JHRJDA.exe 5328 CVYPIC.exe 5328 CVYPIC.exe 6128 DYODXLB.exe 6128 DYODXLB.exe 5112 JTAE.exe 5112 JTAE.exe 3440 RHFK.exe 3440 RHFK.exe 2068 IHTI.exe 2068 IHTI.exe 1888 WNTTKBS.exe 1888 WNTTKBS.exe 5832 YAK.exe 5832 YAK.exe 4760 HOXKGTV.exe 4760 HOXKGTV.exe 3316 RLCEVBD.exe 3316 RLCEVBD.exe 5452 SJQQ.exe 5452 SJQQ.exe 5496 MXPWI.exe 5496 MXPWI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1140 wrote to memory of 5400 1140 2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe 89 PID 5400 wrote to memory of 424 5400 cmd.exe 93 PID 424 wrote to memory of 3672 424 HSBQU.exe 95 PID 3672 wrote to memory of 5240 3672 cmd.exe 99 PID 5240 wrote to memory of 3400 5240 VARX.exe 100 PID 3400 wrote to memory of 1844 3400 cmd.exe 104 PID 1844 wrote to memory of 1216 1844 QVWGP.exe 105 PID 1216 wrote to memory of 5904 1216 cmd.exe 109 PID 5904 wrote to memory of 5068 5904 ATB.exe 110 PID 5068 wrote to memory of 564 5068 cmd.exe 114 PID 564 wrote to memory of 5624 564 CRHVENV.exe 115 PID 5624 wrote to memory of 5880 5624 cmd.exe 119 PID 5880 wrote to memory of 1884 5880 MPVHTWE.exe 120 PID 1884 wrote to memory of 6132 1884 cmd.exe 124 PID 6132 wrote to memory of 5036 6132 LZYX.exe 125 PID 5036 wrote to memory of 4748 5036 cmd.exe 129 PID 4748 wrote to memory of 2200 4748 JKA.exe 130 PID 2200 wrote to memory of 4240 2200 cmd.exe 134 PID 4240 wrote to memory of 5848 4240 EXSX.exe 135 PID 5848 wrote to memory of 5712 5848 cmd.exe 139 PID 5712 wrote to memory of 3388 5712 FWZFY.exe 140 PID 3388 wrote to memory of 4492 3388 cmd.exe 144 PID 4492 wrote to memory of 236 4492 CMNPOSK.exe 145 PID 236 wrote to memory of 4920 236 cmd.exe 149 PID 4920 wrote to memory of 904 4920 FHE.exe 150 PID 904 wrote to memory of 2112 904 cmd.exe 154 PID 2112 wrote to memory of 404 2112 SEQDK.exe 155 PID 404 wrote to memory of 2464 404 cmd.exe 159 PID 2464 wrote to memory of 5876 2464 VNZRRD.exe 160 PID 5876 wrote to memory of 2816 5876 cmd.exe 164 PID 2816 wrote to memory of 2352 2816 SNBBDZ.exe 165 PID 2352 wrote to memory of 4844 2352 cmd.exe 169 PID 4844 wrote to memory of 5336 4844 PDWLLO.exe 170 PID 5336 wrote to memory of 1528 5336 cmd.exe 174 PID 1528 wrote to memory of 4268 1528 MJHABJ.exe 175 PID 4268 wrote to memory of 1228 4268 cmd.exe 179 PID 1228 wrote to memory of 5616 1228 YUR.exe 180 PID 5616 wrote to memory of 4964 5616 cmd.exe 184 PID 4964 wrote to memory of 1840 4964 NKFF.exe 185 PID 1840 wrote to memory of 5612 1840 cmd.exe 189 PID 5612 wrote to memory of 1880 5612 JHRJDA.exe 190 PID 1880 wrote to memory of 5328 1880 cmd.exe 194 PID 5328 wrote to memory of 4164 5328 CVYPIC.exe 195 PID 4164 wrote to memory of 6128 4164 cmd.exe 199 PID 6128 wrote to memory of 3432 6128 DYODXLB.exe 200 PID 3432 wrote to memory of 5112 3432 cmd.exe 204 PID 5112 wrote to memory of 120 5112 JTAE.exe 205 PID 120 wrote to memory of 3440 120 cmd.exe 209 PID 3440 wrote to memory of 4252 3440 RHFK.exe 210 PID 4252 wrote to memory of 2068 4252 cmd.exe 214 PID 2068 wrote to memory of 1224 2068 IHTI.exe 215 PID 1224 wrote to memory of 1888 1224 cmd.exe 219 PID 1888 wrote to memory of 472 1888 WNTTKBS.exe 220 PID 472 wrote to memory of 5832 472 cmd.exe 224 PID 5832 wrote to memory of 5764 5832 YAK.exe 225 PID 5764 wrote to memory of 4760 5764 cmd.exe 229 PID 4760 wrote to memory of 2980 4760 HOXKGTV.exe 230 PID 2980 wrote to memory of 3316 2980 cmd.exe 234 PID 3316 wrote to memory of 6012 3316 RLCEVBD.exe 235 PID 6012 wrote to memory of 5452 6012 cmd.exe 239 PID 5452 wrote to memory of 2884 5452 SJQQ.exe 240 PID 2884 wrote to memory of 5496 2884 cmd.exe 244 PID 5496 wrote to memory of 3292 5496 MXPWI.exe 245 PID 3292 wrote to memory of 1068 3292 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5c524585b5166e84a5b266e5e2e5e43a_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HSBQU.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\HSBQU.exeC:\windows\HSBQU.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VARX.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\windows\system\VARX.exeC:\windows\system\VARX.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVWGP.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\SysWOW64\QVWGP.exeC:\windows\system32\QVWGP.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRHVENV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\CRHVENV.exeC:\windows\CRHVENV.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPVHTWE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\system\MPVHTWE.exeC:\windows\system\MPVHTWE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZYX.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\windows\LZYX.exeC:\windows\LZYX.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JKA.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\windows\SysWOW64\JKA.exeC:\windows\system32\JKA.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXSX.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\windows\system\EXSX.exeC:\windows\system\EXSX.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZFY.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\windows\system\FWZFY.exeC:\windows\system\FWZFY.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMNPOSK.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\CMNPOSK.exeC:\windows\CMNPOSK.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\FHE.exeC:\windows\FHE.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEQDK.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:904 -
C:\windows\SysWOW64\SEQDK.exeC:\windows\system32\SEQDK.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VNZRRD.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\windows\VNZRRD.exeC:\windows\VNZRRD.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNBBDZ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\windows\SNBBDZ.exeC:\windows\SNBBDZ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDWLLO.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\SysWOW64\PDWLLO.exeC:\windows\system32\PDWLLO.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJHABJ.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\windows\SysWOW64\MJHABJ.exeC:\windows\system32\MJHABJ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUR.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\YUR.exeC:\windows\YUR.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKFF.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\NKFF.exeC:\windows\NKFF.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHRJDA.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\windows\SysWOW64\JHRJDA.exeC:\windows\system32\JHRJDA.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CVYPIC.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\windows\system\CVYPIC.exeC:\windows\system\CVYPIC.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYODXLB.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\windows\system\DYODXLB.exeC:\windows\system\DYODXLB.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JTAE.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\SysWOW64\JTAE.exeC:\windows\system32\JTAE.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHFK.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:120 -
C:\windows\SysWOW64\RHFK.exeC:\windows\system32\RHFK.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHTI.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\windows\SysWOW64\IHTI.exeC:\windows\system32\IHTI.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WNTTKBS.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\system\WNTTKBS.exeC:\windows\system\WNTTKBS.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:472 -
C:\windows\SysWOW64\YAK.exeC:\windows\system32\YAK.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOXKGTV.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\windows\HOXKGTV.exeC:\windows\HOXKGTV.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLCEVBD.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\system\RLCEVBD.exeC:\windows\system\RLCEVBD.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJQQ.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\SysWOW64\SJQQ.exeC:\windows\system32\SJQQ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXPWI.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\windows\system\MXPWI.exeC:\windows\system\MXPWI.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKGYTX.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\windows\PKGYTX.exeC:\windows\PKGYTX.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "66⤵PID:3064
-
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe67⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MNYWTC.exe.bat" "68⤵PID:4208
-
C:\windows\SysWOW64\MNYWTC.exeC:\windows\system32\MNYWTC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYJMU.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5472 -
C:\windows\system\LYJMU.exeC:\windows\system\LYJMU.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VWPG.exe.bat" "72⤵PID:4580
-
C:\windows\VWPG.exeC:\windows\VWPG.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKW.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3572 -
C:\windows\system\GKW.exeC:\windows\system\GKW.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OPALZZY.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4672 -
C:\windows\OPALZZY.exeC:\windows\OPALZZY.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIQWJZG.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4772 -
C:\windows\system\IIQWJZG.exeC:\windows\system\IIQWJZG.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQE.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3028 -
C:\windows\SysWOW64\ZQE.exeC:\windows\system32\ZQE.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVJIGPW.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5048 -
C:\windows\SysWOW64\HVJIGPW.exeC:\windows\system32\HVJIGPW.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJVPQNA.exe.bat" "84⤵PID:4380
-
C:\windows\SysWOW64\PJVPQNA.exeC:\windows\system32\PJVPQNA.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZWGP.exe.bat" "86⤵PID:2304
-
C:\windows\EZWGP.exeC:\windows\EZWGP.exe87⤵
- Executes dropped EXE
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMOQIU.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:996 -
C:\windows\system\ZMOQIU.exeC:\windows\system\ZMOQIU.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKT.exe.bat" "90⤵PID:2768
-
C:\windows\JKT.exeC:\windows\JKT.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVWSZJB.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4828 -
C:\windows\system\IVWSZJB.exeC:\windows\system\IVWSZJB.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2976 -
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DGJKL.exe.bat" "96⤵PID:596
-
C:\windows\DGJKL.exeC:\windows\DGJKL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMBABW.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1276 -
C:\windows\system\AMBABW.exeC:\windows\system\AMBABW.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUDNFTD.exe.bat" "100⤵
- Executes a command shell one-liner
PID:984 -
C:\windows\system\RUDNFTD.exeC:\windows\system\RUDNFTD.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TSJZUCL.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:940 -
C:\windows\SysWOW64\TSJZUCL.exeC:\windows\system32\TSJZUCL.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FAPH.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4620 -
C:\windows\SysWOW64\FAPH.exeC:\windows\system32\FAPH.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DVOID.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1700 -
C:\windows\SysWOW64\DVOID.exeC:\windows\system32\DVOID.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQY.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4216 -
C:\windows\SysWOW64\SQY.exeC:\windows\system32\SQY.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COLGDSY.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2372 -
C:\windows\system\COLGDSY.exeC:\windows\system\COLGDSY.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BZOWMG.exe.bat" "112⤵PID:1060
-
C:\windows\system\BZOWMG.exeC:\windows\system\BZOWMG.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCS.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3680 -
C:\windows\SysWOW64\TCS.exeC:\windows\system32\TCS.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFWWFMF.exe.bat" "116⤵PID:2924
-
C:\windows\SysWOW64\UFWWFMF.exeC:\windows\system32\UFWWFMF.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NAAA.exe.bat" "118⤵PID:1964
-
C:\windows\SysWOW64\NAAA.exeC:\windows\system32\NAAA.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNMG.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3228 -
C:\windows\SysWOW64\VNMG.exeC:\windows\system32\VNMG.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-