Analysis
- max time kernel
85s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 20:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_537bb8fb107fb040427d0bfcd9ea48a8_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-10_537bb8fb107fb040427d0bfcd9ea48a8_elex_emotet_stop.exe
- Size 208KB
- Sample260810-y72b2axfld
- SHA256 7ee2b803feb738c04078eb85eb2e109107f106281bad242e75cdccb004d83624
- MD5 537bb8fb107fb040427d0bfcd9ea48a8
- SHA1 430b0ccdc0f732369d1ce0dc469bac4f12a7f1b0
- SHA512 71d051531c34aa891b53330f2647e72a1121f4c4db949ec7416994d59fb2352bd336c0644e34921df660d383ef62a0991c6f50688ced66f66ade6e51c2d9130d
- SSDEEP 3072:ILQaL9tbLkRIgd1Lye9yjE2hWAN5XbxlUKL+LOfA4pLthEjQT6j:slZtbLWIgd1LZ9oECZbxlUS+LOYkEj1
- TLSH T118247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1052 UCMHAXM.exe 2988 AKCNLGJ.exe 5032 NVM.exe 1512 XTEMKMO.exe 5548 HQKH.exe 4940 PWXN.exe 1400 YEZSGRU.exe 952 XPCJ.exe 6096 SASH.exe 700 ZQTZJ.exe 3340 UBBXX.exe 1288 EBDCBLY.exe 3320 EEHG.exe 4152 XZL.exe 2832 YCPF.exe 3264 WAI.exe 2552 ADGVMN.exe 2820 VQXXGZ.exe 4916 DECMQX.exe 5756 LJPSBW.exe 2628 AZQK.exe 3452 EPWSMJ.exe 2620 QXDS.exe 5060 YNERFPP.exe 5312 ABJB.exe 5872 HWSFAKM.exe 4224 RTGZHS.exe 2472 HKH.exe 3100 BFMIY.exe 1784 UAP.exe 3624 EYVYTE.exe 1188 FBZUZ.exe 5220 XELYESU.exe 2080 BMRY.exe 4656 WZWHAK.exe 4084 IPD.exe 5304 VNDB.exe 2172 IYLRDQX.exe 3828 MOAZ.exe 5788 LYD.exe 4320 PHJPCH.exe 4400 VCI.exe 4820 USUTUPT.exe 1772 JIV.exe 1284 WSL.exe 5400 RGQTZ.exe 4664 RJUWEDB.exe 3764 BRW.exe 3412 WUE.exe 2352 PXIWB.exe 3936 PAMZ.exe 4316 GLXPXF.exe 1280 STDQC.exe 3540 ZJEPILJ.exe 2664 FJMD.exe 1992 LJTQII.exe 5960 CSV.exe 4568 GACVY.exe 4416 BNHFIXY.exe 5596 DLMZQG.exe 2232 JGMIUJP.exe 4988 ETQR.exe 4796 ZEZI.exe 4868 KXCBT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\PAMZ.exe.bat PXIWB.exe File created C:\windows\SysWOW64\MEPM.exe.bat RRL.exe File opened for modification C:\windows\SysWOW64\ZQTZJ.exe SASH.exe File created C:\windows\SysWOW64\FGTH.exe.bat OSJ.exe File opened for modification C:\windows\SysWOW64\AOXEKXN.exe RBMM.exe File opened for modification C:\windows\SysWOW64\MEPM.exe RRL.exe File created C:\windows\SysWOW64\DZG.exe SHDCZP.exe File created C:\windows\SysWOW64\XTEMKMO.exe NVM.exe File opened for modification C:\windows\SysWOW64\YEZSGRU.exe PWXN.exe File opened for modification C:\windows\SysWOW64\WAI.exe YCPF.exe File created C:\windows\SysWOW64\EPWSMJ.exe AZQK.exe File created C:\windows\SysWOW64\PAMZ.exe PXIWB.exe File created C:\windows\SysWOW64\JGMIUJP.exe.bat DLMZQG.exe File created C:\windows\SysWOW64\USUTUPT.exe VCI.exe File created C:\windows\SysWOW64\WSL.exe.bat JIV.exe File created C:\windows\SysWOW64\PRJ.exe GJHUPWE.exe File created C:\windows\SysWOW64\DLF.exe.bat XLFRFE.exe File created C:\windows\SysWOW64\VQXXGZ.exe.bat ADGVMN.exe File opened for modification C:\windows\SysWOW64\FGTH.exe OSJ.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe CPWQ.exe File created C:\windows\SysWOW64\SASH.exe XPCJ.exe File created C:\windows\SysWOW64\BRW.exe.bat RJUWEDB.exe File opened for modification C:\windows\SysWOW64\GJHUPWE.exe YDDOEYJ.exe File created C:\windows\SysWOW64\DWZR.exe.bat FBAQJD.exe File opened for modification C:\windows\SysWOW64\PSHHLX.exe EAEOC.exe File created C:\windows\SysWOW64\XZL.exe.bat EEHG.exe File created C:\windows\SysWOW64\HWSFAKM.exe.bat ABJB.exe File created C:\windows\SysWOW64\FBAQJD.exe TTTQ.exe File opened for modification C:\windows\SysWOW64\USUTUPT.exe VCI.exe File created C:\windows\SysWOW64\BRW.exe RJUWEDB.exe File created C:\windows\SysWOW64\FGTH.exe OSJ.exe File opened for modification C:\windows\SysWOW64\FBAQJD.exe TTTQ.exe File created C:\windows\SysWOW64\DLF.exe XLFRFE.exe File created C:\windows\SysWOW64\PSHHLX.exe.bat EAEOC.exe File created C:\windows\SysWOW64\XTEMKMO.exe.bat NVM.exe File opened for modification C:\windows\SysWOW64\YCPF.exe XZL.exe File created C:\windows\SysWOW64\UAP.exe.bat BFMIY.exe File created C:\windows\SysWOW64\AOXEKXN.exe RBMM.exe File created C:\windows\SysWOW64\HQKH.exe.bat XTEMKMO.exe File created C:\windows\SysWOW64\PXIWB.exe WUE.exe File created C:\windows\SysWOW64\KXCBT.exe.bat ZEZI.exe File created C:\windows\SysWOW64\BMRY.exe XELYESU.exe File created C:\windows\SysWOW64\HQKH.exe XTEMKMO.exe File created C:\windows\SysWOW64\ZQTZJ.exe SASH.exe File created C:\windows\SysWOW64\YEBHI.exe.bat ATYZHC.exe File opened for modification C:\windows\SysWOW64\HWSFAKM.exe ABJB.exe File created C:\windows\SysWOW64\YCPF.exe.bat XZL.exe File opened for modification C:\windows\SysWOW64\QXDS.exe EPWSMJ.exe File created C:\windows\SysWOW64\SDVAV.exe YQQ.exe File created C:\windows\SysWOW64\WCBHQB.exe CPWQ.exe File opened for modification C:\windows\SysWOW64\TFEGXY.exe KXCBT.exe File created C:\windows\SysWOW64\GJHUPWE.exe YDDOEYJ.exe File created C:\windows\SysWOW64\ZQTZJ.exe.bat SASH.exe File created C:\windows\SysWOW64\QXDS.exe.bat EPWSMJ.exe File opened for modification C:\windows\SysWOW64\YNERFPP.exe QXDS.exe File created C:\windows\SysWOW64\USUTUPT.exe.bat VCI.exe File opened for modification C:\windows\SysWOW64\WSL.exe JIV.exe File opened for modification C:\windows\SysWOW64\JGMIUJP.exe DLMZQG.exe File created C:\windows\SysWOW64\VQXXGZ.exe ADGVMN.exe File created C:\windows\SysWOW64\LJPSBW.exe.bat DECMQX.exe File opened for modification C:\windows\SysWOW64\DLMZQG.exe BNHFIXY.exe File opened for modification C:\windows\SysWOW64\FSTSNBK.exe OHDCNHO.exe File opened for modification C:\windows\SysWOW64\UPIZI.exe ACD.exe File created C:\windows\SysWOW64\FBAQJD.exe.bat TTTQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\PHJPCH.exe.bat LYD.exe File created C:\windows\system\CSV.exe LJTQII.exe File created C:\windows\system\RBMM.exe.bat GIJ.exe File created C:\windows\CPWQ.exe.bat YHQQCJJ.exe File opened for modification C:\windows\system\YUWMSAE.exe MEPM.exe File created C:\windows\system\BFMIY.exe HKH.exe File created C:\windows\PHJPCH.exe LYD.exe File created C:\windows\WQTOAOO.exe WCBHQB.exe File created C:\windows\RRL.exe.bat DLF.exe File created C:\windows\NVM.exe AKCNLGJ.exe File opened for modification C:\windows\system\RGQTZ.exe WSL.exe File created C:\windows\system\STDQC.exe.bat GLXPXF.exe File opened for modification C:\windows\HNYB.exe FSTSNBK.exe File opened for modification C:\windows\YFPHULN.exe UPIZI.exe File created C:\windows\system\SHDCZP.exe ORWU.exe File created C:\windows\system\CSV.exe.bat LJTQII.exe File created C:\windows\TRGYSI.exe.bat YEBHI.exe File created C:\windows\system\VCI.exe.bat PHJPCH.exe File created C:\windows\GLXPXF.exe PAMZ.exe File created C:\windows\LJTQII.exe.bat FJMD.exe File created C:\windows\CADLHB.exe HNYB.exe File created C:\windows\system\ZEZI.exe ETQR.exe File opened for modification C:\windows\system\AKCNLGJ.exe UCMHAXM.exe File created C:\windows\system\DECMQX.exe VQXXGZ.exe File created C:\windows\system\LYD.exe MOAZ.exe File opened for modification C:\windows\RRL.exe DLF.exe File created C:\windows\ORWU.exe.bat OWSYH.exe File created C:\windows\RTGZHS.exe.bat HWSFAKM.exe File created C:\windows\LJTQII.exe FJMD.exe File created C:\windows\system\YDDOEYJ.exe SDVAV.exe File created C:\windows\EEHG.exe EBDCBLY.exe File opened for modification C:\windows\system\QXL.exe TRGYSI.exe File opened for modification C:\windows\system\XPCJ.exe YEZSGRU.exe File created C:\windows\system\ADGVMN.exe.bat WAI.exe File created C:\windows\RTGZHS.exe HWSFAKM.exe File created C:\windows\HKH.exe RTGZHS.exe File created C:\windows\system\VCI.exe PHJPCH.exe File created C:\windows\system\WUE.exe.bat BRW.exe File created C:\windows\system\XLFRFE.exe WQTOAOO.exe File created C:\windows\system\UBBXX.exe ZQTZJ.exe File opened for modification C:\windows\system\BFMIY.exe HKH.exe File created C:\windows\WZWHAK.exe.bat BMRY.exe File created C:\windows\IPD.exe.bat WZWHAK.exe File opened for modification C:\windows\system\VNDB.exe IPD.exe File created C:\windows\system\VNDB.exe.bat IPD.exe File opened for modification C:\windows\system\LYD.exe MOAZ.exe File opened for modification C:\windows\PHJPCH.exe LYD.exe File opened for modification C:\windows\system\VCI.exe PHJPCH.exe File opened for modification C:\windows\JIV.exe USUTUPT.exe File opened for modification C:\windows\system\TFSVLK.exe QXL.exe File created C:\windows\YQQ.exe TFSVLK.exe File created C:\windows\OHDCNHO.exe PRJ.exe File created C:\windows\system\ACD.exe.bat WMXPM.exe File opened for modification C:\windows\TTTQ.exe YFPHULN.exe File created C:\windows\RRL.exe DLF.exe File created C:\windows\PWXN.exe HQKH.exe File opened for modification C:\windows\EEHG.exe EBDCBLY.exe File created C:\windows\RJUWEDB.exe.bat RGQTZ.exe File created C:\windows\GLXPXF.exe.bat PAMZ.exe File opened for modification C:\windows\system\ZEZI.exe ETQR.exe File created C:\windows\OSJ.exe.bat TFEGXY.exe File opened for modification C:\windows\YQQ.exe TFSVLK.exe File created C:\windows\system\ACD.exe WMXPM.exe File opened for modification C:\windows\system\ADGVMN.exe WAI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3776 cmd.exe 4588 cmd.exe 1800 cmd.exe 2508 cmd.exe 2296 cmd.exe 6120 cmd.exe 4836 cmd.exe 5352 cmd.exe 4740 cmd.exe 1836 cmd.exe 5424 cmd.exe 2400 cmd.exe 2496 cmd.exe 4748 cmd.exe 1132 cmd.exe 4144 cmd.exe 1352 cmd.exe 2544 cmd.exe 4420 cmd.exe 3028 cmd.exe 3588 cmd.exe 6076 cmd.exe 4488 cmd.exe 1768 cmd.exe 2968 cmd.exe 5616 cmd.exe 6032 cmd.exe 5692 cmd.exe 5268 cmd.exe 2672 cmd.exe 2788 cmd.exe 5252 cmd.exe 3824 cmd.exe 1256 cmd.exe 3308 cmd.exe 260 cmd.exe 1576 cmd.exe 5092 cmd.exe 2492 cmd.exe 2880 cmd.exe 1396 cmd.exe 2436 cmd.exe 4888 cmd.exe 3332 cmd.exe 3788 cmd.exe 1136 cmd.exe 3012 cmd.exe 4864 cmd.exe 4120 cmd.exe 5296 cmd.exe 3476 cmd.exe 5836 cmd.exe 5760 cmd.exe 2868 cmd.exe 2028 cmd.exe 4816 cmd.exe 6072 cmd.exe 1996 cmd.exe 3368 cmd.exe 5984 cmd.exe 5856 cmd.exe 2956 cmd.exe 3268 cmd.exe 4520 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4572 3532 WerFault.exe 87 5784 1052 WerFault.exe 93 5828 2988 WerFault.exe 99 5052 5032 WerFault.exe 104 1256 1512 WerFault.exe 109 3728 5548 WerFault.exe 114 2468 4940 WerFault.exe 119 4100 1400 WerFault.exe 124 2304 952 WerFault.exe 129 4704 6096 WerFault.exe 134 3720 700 WerFault.exe 139 1860 3340 WerFault.exe 144 4372 1288 WerFault.exe 149 1820 3320 WerFault.exe 154 5956 4152 WerFault.exe 159 4920 2832 WerFault.exe 164 5616 3264 WerFault.exe 169 4336 2552 WerFault.exe 174 4972 2820 WerFault.exe 179 3956 4916 WerFault.exe 184 3012 5756 WerFault.exe 189 3480 2628 WerFault.exe 194 2544 3452 WerFault.exe 199 3316 2620 WerFault.exe 204 5276 5060 WerFault.exe 209 3572 5312 WerFault.exe 214 5908 5872 WerFault.exe 219 1800 4224 WerFault.exe 224 5300 2472 WerFault.exe 229 5596 3100 WerFault.exe 234 1252 1784 WerFault.exe 239 3620 3624 WerFault.exe 244 3480 1188 WerFault.exe 249 2664 5220 WerFault.exe 254 1096 2080 WerFault.exe 259 3052 4656 WerFault.exe 264 5540 4084 WerFault.exe 270 4272 5304 WerFault.exe 275 2324 2172 WerFault.exe 280 1260 3828 WerFault.exe 285 4100 5788 WerFault.exe 290 4504 4320 WerFault.exe 295 3152 4400 WerFault.exe 300 704 4820 WerFault.exe 305 3960 1772 WerFault.exe 310 4380 1284 WerFault.exe 315 2848 5400 WerFault.exe 320 3128 4664 WerFault.exe 325 1020 3764 WerFault.exe 330 4832 3412 WerFault.exe 335 3108 2352 WerFault.exe 340 3612 3936 WerFault.exe 345 3476 4316 WerFault.exe 350 2452 1280 WerFault.exe 355 6020 3540 WerFault.exe 360 908 2664 WerFault.exe 365 1352 1992 WerFault.exe 370 5908 5960 WerFault.exe 375 4692 4568 WerFault.exe 380 2892 4416 WerFault.exe 385 3356 5596 WerFault.exe 390 5352 2232 WerFault.exe 395 4208 4988 WerFault.exe 400 3324 4796 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJTQII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNHFIXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQTOAOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEZSGRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFPHULN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADGVMN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJUWEDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMXPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWSYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBDCBLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWSFAKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDDOEYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDVAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAEOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSTSNBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQTZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLMZQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXIWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJEPILJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFSVLK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3532 2026-08-10_537bb8fb107fb040427d0bfcd9ea48a8_elex_emotet_stop.exe 3532 2026-08-10_537bb8fb107fb040427d0bfcd9ea48a8_elex_emotet_stop.exe 1052 UCMHAXM.exe 1052 UCMHAXM.exe 2988 AKCNLGJ.exe 2988 AKCNLGJ.exe 5032 NVM.exe 5032 NVM.exe 1512 XTEMKMO.exe 1512 XTEMKMO.exe 5548 HQKH.exe 5548 HQKH.exe 4940 PWXN.exe 4940 PWXN.exe 1400 YEZSGRU.exe 1400 YEZSGRU.exe 952 XPCJ.exe 952 XPCJ.exe 6096 SASH.exe 6096 SASH.exe 700 ZQTZJ.exe 700 ZQTZJ.exe 3340 UBBXX.exe 3340 UBBXX.exe 1288 EBDCBLY.exe 1288 EBDCBLY.exe 3320 EEHG.exe 3320 EEHG.exe 4152 XZL.exe 4152 XZL.exe 2832 YCPF.exe 2832 YCPF.exe 3264 WAI.exe 3264 WAI.exe 2552 ADGVMN.exe 2552 ADGVMN.exe 2820 VQXXGZ.exe 2820 VQXXGZ.exe 4916 DECMQX.exe 4916 DECMQX.exe 5756 LJPSBW.exe 5756 LJPSBW.exe 2628 AZQK.exe 2628 AZQK.exe 3452 EPWSMJ.exe 3452 EPWSMJ.exe 2620 QXDS.exe 2620 QXDS.exe 5060 YNERFPP.exe 5060 YNERFPP.exe 5312 ABJB.exe 5312 ABJB.exe 5872 HWSFAKM.exe 5872 HWSFAKM.exe 4224 RTGZHS.exe 4224 RTGZHS.exe 2472 HKH.exe 2472 HKH.exe 3100 BFMIY.exe 3100 BFMIY.exe 1784 UAP.exe 1784 UAP.exe 3624 EYVYTE.exe 3624 EYVYTE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3532 2026-08-10_537bb8fb107fb040427d0bfcd9ea48a8_elex_emotet_stop.exe 3532 2026-08-10_537bb8fb107fb040427d0bfcd9ea48a8_elex_emotet_stop.exe 1052 UCMHAXM.exe 1052 UCMHAXM.exe 2988 AKCNLGJ.exe 2988 AKCNLGJ.exe 5032 NVM.exe 5032 NVM.exe 1512 XTEMKMO.exe 1512 XTEMKMO.exe 5548 HQKH.exe 5548 HQKH.exe 4940 PWXN.exe 4940 PWXN.exe 1400 YEZSGRU.exe 1400 YEZSGRU.exe 952 XPCJ.exe 952 XPCJ.exe 6096 SASH.exe 6096 SASH.exe 700 ZQTZJ.exe 700 ZQTZJ.exe 3340 UBBXX.exe 3340 UBBXX.exe 1288 EBDCBLY.exe 1288 EBDCBLY.exe 3320 EEHG.exe 3320 EEHG.exe 4152 XZL.exe 4152 XZL.exe 2832 YCPF.exe 2832 YCPF.exe 3264 WAI.exe 3264 WAI.exe 2552 ADGVMN.exe 2552 ADGVMN.exe 2820 VQXXGZ.exe 2820 VQXXGZ.exe 4916 DECMQX.exe 4916 DECMQX.exe 5756 LJPSBW.exe 5756 LJPSBW.exe 2628 AZQK.exe 2628 AZQK.exe 3452 EPWSMJ.exe 3452 EPWSMJ.exe 2620 QXDS.exe 2620 QXDS.exe 5060 YNERFPP.exe 5060 YNERFPP.exe 5312 ABJB.exe 5312 ABJB.exe 5872 HWSFAKM.exe 5872 HWSFAKM.exe 4224 RTGZHS.exe 4224 RTGZHS.exe 2472 HKH.exe 2472 HKH.exe 3100 BFMIY.exe 3100 BFMIY.exe 1784 UAP.exe 1784 UAP.exe 3624 EYVYTE.exe 3624 EYVYTE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3532 wrote to memory of 5016 3532 2026-08-10_537bb8fb107fb040427d0bfcd9ea48a8_elex_emotet_stop.exe 89 PID 5016 wrote to memory of 1052 5016 cmd.exe 93 PID 1052 wrote to memory of 1396 1052 UCMHAXM.exe 95 PID 1396 wrote to memory of 2988 1396 cmd.exe 99 PID 2988 wrote to memory of 2404 2988 AKCNLGJ.exe 100 PID 2404 wrote to memory of 5032 2404 cmd.exe 104 PID 5032 wrote to memory of 1748 5032 NVM.exe 105 PID 1748 wrote to memory of 1512 1748 cmd.exe 109 PID 1512 wrote to memory of 5692 1512 XTEMKMO.exe 110 PID 5692 wrote to memory of 5548 5692 cmd.exe 114 PID 5548 wrote to memory of 5268 5548 HQKH.exe 115 PID 5268 wrote to memory of 4940 5268 cmd.exe 119 PID 4940 wrote to memory of 3136 4940 PWXN.exe 120 PID 3136 wrote to memory of 1400 3136 cmd.exe 124 PID 1400 wrote to memory of 2012 1400 YEZSGRU.exe 125 PID 2012 wrote to memory of 952 2012 cmd.exe 129 PID 952 wrote to memory of 2236 952 XPCJ.exe 130 PID 2236 wrote to memory of 6096 2236 cmd.exe 134 PID 6096 wrote to memory of 1216 6096 SASH.exe 135 PID 1216 wrote to memory of 700 1216 cmd.exe 139 PID 700 wrote to memory of 1828 700 ZQTZJ.exe 140 PID 1828 wrote to memory of 3340 1828 cmd.exe 144 PID 3340 wrote to memory of 2508 3340 UBBXX.exe 145 PID 2508 wrote to memory of 1288 2508 cmd.exe 149 PID 1288 wrote to memory of 4456 1288 EBDCBLY.exe 150 PID 4456 wrote to memory of 3320 4456 cmd.exe 154 PID 3320 wrote to memory of 4120 3320 EEHG.exe 155 PID 4120 wrote to memory of 4152 4120 cmd.exe 159 PID 4152 wrote to memory of 4072 4152 XZL.exe 160 PID 4072 wrote to memory of 2832 4072 cmd.exe 164 PID 2832 wrote to memory of 3596 2832 YCPF.exe 165 PID 3596 wrote to memory of 3264 3596 cmd.exe 169 PID 3264 wrote to memory of 3348 3264 WAI.exe 170 PID 3348 wrote to memory of 2552 3348 cmd.exe 174 PID 2552 wrote to memory of 5780 2552 ADGVMN.exe 175 PID 5780 wrote to memory of 2820 5780 cmd.exe 179 PID 2820 wrote to memory of 1296 2820 VQXXGZ.exe 180 PID 1296 wrote to memory of 4916 1296 cmd.exe 184 PID 4916 wrote to memory of 2436 4916 DECMQX.exe 185 PID 2436 wrote to memory of 5756 2436 cmd.exe 189 PID 5756 wrote to memory of 3028 5756 LJPSBW.exe 190 PID 3028 wrote to memory of 2628 3028 cmd.exe 194 PID 2628 wrote to memory of 5996 2628 AZQK.exe 195 PID 5996 wrote to memory of 3452 5996 cmd.exe 199 PID 3452 wrote to memory of 2296 3452 EPWSMJ.exe 200 PID 2296 wrote to memory of 2620 2296 cmd.exe 204 PID 2620 wrote to memory of 6012 2620 QXDS.exe 205 PID 6012 wrote to memory of 5060 6012 cmd.exe 209 PID 5060 wrote to memory of 6120 5060 YNERFPP.exe 210 PID 6120 wrote to memory of 5312 6120 cmd.exe 214 PID 5312 wrote to memory of 5856 5312 ABJB.exe 215 PID 5856 wrote to memory of 5872 5856 cmd.exe 219 PID 5872 wrote to memory of 1228 5872 HWSFAKM.exe 220 PID 1228 wrote to memory of 4224 1228 cmd.exe 224 PID 4224 wrote to memory of 2400 4224 RTGZHS.exe 225 PID 2400 wrote to memory of 2472 2400 cmd.exe 229 PID 2472 wrote to memory of 5464 2472 HKH.exe 230 PID 5464 wrote to memory of 3100 5464 cmd.exe 234 PID 3100 wrote to memory of 4668 3100 BFMIY.exe 235 PID 4668 wrote to memory of 1784 4668 cmd.exe 239 PID 1784 wrote to memory of 3588 1784 UAP.exe 240 PID 3588 wrote to memory of 3624 3588 cmd.exe 244 PID 3624 wrote to memory of 5204 3624 EYVYTE.exe 245 PID 5204 wrote to memory of 1188 5204 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_537bb8fb107fb040427d0bfcd9ea48a8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_537bb8fb107fb040427d0bfcd9ea48a8_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCMHAXM.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\windows\UCMHAXM.exeC:\windows\UCMHAXM.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AKCNLGJ.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\windows\system\AKCNLGJ.exeC:\windows\system\AKCNLGJ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NVM.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\NVM.exeC:\windows\NVM.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XTEMKMO.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\SysWOW64\XTEMKMO.exeC:\windows\system32\XTEMKMO.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HQKH.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\SysWOW64\HQKH.exeC:\windows\system32\HQKH.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWXN.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\windows\PWXN.exeC:\windows\PWXN.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEZSGRU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\SysWOW64\YEZSGRU.exeC:\windows\system32\YEZSGRU.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPCJ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\windows\system\XPCJ.exeC:\windows\system\XPCJ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SASH.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\windows\SysWOW64\SASH.exeC:\windows\system32\SASH.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQTZJ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\windows\SysWOW64\ZQTZJ.exeC:\windows\system32\ZQTZJ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBBXX.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\windows\system\UBBXX.exeC:\windows\system\UBBXX.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBDCBLY.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\SysWOW64\EBDCBLY.exeC:\windows\system32\EBDCBLY.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEHG.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\EEHG.exeC:\windows\EEHG.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XZL.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\SysWOW64\XZL.exeC:\windows\system32\XZL.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCPF.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\windows\SysWOW64\YCPF.exeC:\windows\system32\YCPF.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WAI.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\windows\SysWOW64\WAI.exeC:\windows\system32\WAI.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADGVMN.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\system\ADGVMN.exeC:\windows\system\ADGVMN.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQXXGZ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\SysWOW64\VQXXGZ.exeC:\windows\system32\VQXXGZ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DECMQX.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\windows\system\DECMQX.exeC:\windows\system\DECMQX.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJPSBW.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\windows\SysWOW64\LJPSBW.exeC:\windows\system32\LJPSBW.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZQK.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\windows\SysWOW64\AZQK.exeC:\windows\system32\AZQK.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPWSMJ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\windows\SysWOW64\EPWSMJ.exeC:\windows\system32\EPWSMJ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QXDS.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\SysWOW64\QXDS.exeC:\windows\system32\QXDS.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNERFPP.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\SysWOW64\YNERFPP.exeC:\windows\system32\YNERFPP.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABJB.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\windows\system\ABJB.exeC:\windows\system\ABJB.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWSFAKM.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\SysWOW64\HWSFAKM.exeC:\windows\system32\HWSFAKM.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTGZHS.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\windows\RTGZHS.exeC:\windows\RTGZHS.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HKH.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\HKH.exeC:\windows\HKH.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFMIY.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\windows\system\BFMIY.exeC:\windows\system\BFMIY.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UAP.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\windows\SysWOW64\UAP.exeC:\windows\system32\UAP.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYVYTE.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\windows\SysWOW64\EYVYTE.exeC:\windows\system32\EYVYTE.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBZUZ.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\windows\FBZUZ.exeC:\windows\FBZUZ.exe65⤵
- Executes dropped EXE
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XELYESU.exe.bat" "66⤵PID:4256
-
C:\windows\system\XELYESU.exeC:\windows\system\XELYESU.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMRY.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2672 -
C:\windows\SysWOW64\BMRY.exeC:\windows\system32\BMRY.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WZWHAK.exe.bat" "70⤵PID:4536
-
C:\windows\WZWHAK.exeC:\windows\WZWHAK.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IPD.exe.bat" "72⤵PID:2256
-
C:\windows\IPD.exeC:\windows\IPD.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNDB.exe.bat" "74⤵PID:2124
-
C:\windows\system\VNDB.exeC:\windows\system\VNDB.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IYLRDQX.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2788 -
C:\windows\system\IYLRDQX.exeC:\windows\system\IYLRDQX.exe77⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOAZ.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5296 -
C:\windows\SysWOW64\MOAZ.exeC:\windows\system32\MOAZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYD.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4888 -
C:\windows\system\LYD.exeC:\windows\system\LYD.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHJPCH.exe.bat" "82⤵PID:3004
-
C:\windows\PHJPCH.exeC:\windows\PHJPCH.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCI.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2956 -
C:\windows\system\VCI.exeC:\windows\system\VCI.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USUTUPT.exe.bat" "86⤵PID:5476
-
C:\windows\SysWOW64\USUTUPT.exeC:\windows\system32\USUTUPT.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIV.exe.bat" "88⤵PID:5200
-
C:\windows\JIV.exeC:\windows\JIV.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSL.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3332 -
C:\windows\SysWOW64\WSL.exeC:\windows\system32\WSL.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGQTZ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4556 -
C:\windows\system\RGQTZ.exeC:\windows\system\RGQTZ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJUWEDB.exe.bat" "94⤵
- Executes a command shell one-liner
PID:6072 -
C:\windows\RJUWEDB.exeC:\windows\RJUWEDB.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRW.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4836 -
C:\windows\SysWOW64\BRW.exeC:\windows\system32\BRW.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WUE.exe.bat" "98⤵PID:4772
-
C:\windows\system\WUE.exeC:\windows\system\WUE.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXIWB.exe.bat" "100⤵PID:2228
-
C:\windows\SysWOW64\PXIWB.exeC:\windows\system32\PXIWB.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PAMZ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3268 -
C:\windows\SysWOW64\PAMZ.exeC:\windows\system32\PAMZ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLXPXF.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1996 -
C:\windows\GLXPXF.exeC:\windows\GLXPXF.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STDQC.exe.bat" "106⤵PID:3720
-
C:\windows\system\STDQC.exeC:\windows\system\STDQC.exe107⤵
- Executes dropped EXE
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJEPILJ.exe.bat" "108⤵PID:2780
-
C:\windows\system\ZJEPILJ.exeC:\windows\system\ZJEPILJ.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJMD.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2496 -
C:\windows\FJMD.exeC:\windows\FJMD.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJTQII.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:5624 -
C:\windows\LJTQII.exeC:\windows\LJTQII.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CSV.exe.bat" "114⤵PID:5584
-
C:\windows\system\CSV.exeC:\windows\system\CSV.exe115⤵
- Executes dropped EXE
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GACVY.exe.bat" "116⤵PID:3232
-
C:\windows\system\GACVY.exeC:\windows\system\GACVY.exe117⤵
- Executes dropped EXE
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNHFIXY.exe.bat" "118⤵
- Executes a command shell one-liner
PID:1256 -
C:\windows\BNHFIXY.exeC:\windows\BNHFIXY.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLMZQG.exe.bat" "120⤵PID:3728
-
C:\windows\SysWOW64\DLMZQG.exeC:\windows\system32\DLMZQG.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-