Analysis
- max time kernel
90s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 20:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe
- Size 208KB
- Sample260814-zkdswsstdx
- SHA256 1fd59398693864c66d69ac6c4198f864dc5986e1c73fa64326c0f60f6fc1e0b9
- MD5 c66e28662a086de88e79b4475ec74673
- SHA1 313b433a285b0e80441f60f290244d8bac3330d3
- SHA512 e08e8c4296f07d2f43c64637c673ed4808d15b73a09741966542b8ae8948f7424084a7e6c2dd79da55add27d4e54f1c4f31e5d225c6fc9d4bfde4366b500c7d8
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcdL+LOfI4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlc5+LOQkEj1
- TLSH T1BA247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3936 RSU.exe 5528 IQBQIFN.exe 3264 ZAEGRT.exe 5080 OQF.exe 6904 JBV.exe 2432 LZBRT.exe 244 MCFM.exe 6808 VCHRK.exe 3224 NLVXWE.exe 1612 RTC.exe 2224 LGGGL.exe 772 VEMA.exe 3044 LUV.exe 460 PKCAL.exe 4796 ZIHUB.exe 5320 PSKKBHC.exe 3408 ODVAKN.exe 5424 YBANZ.exe 4232 IZO.exe 5712 ZJRXQKE.exe 4188 SKYIZKU.exe 2040 CAMCOT.exe 3176 RQN.exe 1056 VGUCZ.exe 6892 XEZW.exe 2028 FJMD.exe 4972 VZNUYBZ.exe 3844 IKVTM.exe 4596 KXACWMJ.exe 6788 ONPCJ.exe 4160 HIS.exe 5504 ILWCU.exe 4368 GWZS.exe 4984 BREBNQ.exe 1228 FZLJ.exe 3136 JHRJDA.exe 2952 AQTO.exe 2084 JQVBS.exe 3724 TOBOZ.exe 4884 XEPWMEE.exe 6268 BMWWY.exe 2392 WHBFIOP.exe 3784 NID.exe 5124 ASLJAW.exe 1080 CQRDH.exe 6372 SGSC.exe 3360 CEFPVI.exe 4624 GMMXIB.exe 6876 PUOCLYJ.exe 6532 BCVC.exe 7084 FSBKJJT.exe 5380 YNFGPZ.exe 1284 NDGFWMR.exe 2436 IRLO.exe 1180 NRTCPO.exe 5284 FZVHSMJ.exe 5092 JHBPF.exe 4576 HAMF.exe 5916 AVQ.exe 1940 NGYAHL.exe 4748 ZWF.exe 6116 XJEAYG.exe 4136 MENN.exe 5516 HASWT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\RSU.exe 2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe File created C:\windows\SysWOW64\WHBFIOP.exe BMWWY.exe File created C:\windows\SysWOW64\JMVCTUV.exe OQQSJ.exe File opened for modification C:\windows\SysWOW64\TDZAF.exe EIQWUIP.exe File opened for modification C:\windows\SysWOW64\ZYZJKY.exe TDZAF.exe File created C:\windows\SysWOW64\ZYZJKY.exe.bat TDZAF.exe File opened for modification C:\windows\SysWOW64\IUBQTO.exe TESRM.exe File created C:\windows\SysWOW64\IUBQTO.exe.bat TESRM.exe File created C:\windows\SysWOW64\BREBNQ.exe GWZS.exe File opened for modification C:\windows\SysWOW64\KTX.exe KNXGDTO.exe File created C:\windows\SysWOW64\BUSK.exe.bat GGNSZTN.exe File created C:\windows\SysWOW64\TDZAF.exe.bat EIQWUIP.exe File created C:\windows\SysWOW64\FISOVJE.exe KUNFK.exe File created C:\windows\SysWOW64\FISOVJE.exe.bat KUNFK.exe File created C:\windows\SysWOW64\SYABKZ.exe YLVS.exe File created C:\windows\SysWOW64\YNNVUUH.exe UQVGEYM.exe File opened for modification C:\windows\SysWOW64\VGUCZ.exe RQN.exe File opened for modification C:\windows\SysWOW64\KNXGDTO.exe HASWT.exe File created C:\windows\SysWOW64\HUAXSV.exe.bat BUSK.exe File created C:\windows\SysWOW64\RSU.exe.bat 2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe File created C:\windows\SysWOW64\VCHRK.exe.bat MCFM.exe File opened for modification C:\windows\SysWOW64\CQDIFGU.exe THBV.exe File created C:\windows\SysWOW64\HUAXSV.exe BUSK.exe File opened for modification C:\windows\SysWOW64\SYABKZ.exe YLVS.exe File created C:\windows\SysWOW64\SYABKZ.exe.bat YLVS.exe File created C:\windows\SysWOW64\EEIREJ.exe TMNZE.exe File opened for modification C:\windows\SysWOW64\YNNVUUH.exe UQVGEYM.exe File created C:\windows\SysWOW64\VZNUYBZ.exe.bat FJMD.exe File opened for modification C:\windows\SysWOW64\YNFGPZ.exe FSBKJJT.exe File opened for modification C:\windows\SysWOW64\BUSK.exe GGNSZTN.exe File opened for modification C:\windows\SysWOW64\JMVCTUV.exe OQQSJ.exe File created C:\windows\SysWOW64\EEIREJ.exe.bat TMNZE.exe File created C:\windows\SysWOW64\BNRKZ.exe KFP.exe File created C:\windows\SysWOW64\VCHRK.exe MCFM.exe File created C:\windows\SysWOW64\ASLJAW.exe NID.exe File created C:\windows\SysWOW64\KNXGDTO.exe.bat HASWT.exe File opened for modification C:\windows\SysWOW64\HUAXSV.exe BUSK.exe File created C:\windows\SysWOW64\OTIN.exe ZYZJKY.exe File created C:\windows\SysWOW64\KFP.exe.bat EEIREJ.exe File created C:\windows\SysWOW64\URWXLWA.exe.bat TOKTG.exe File created C:\windows\SysWOW64\VZNUYBZ.exe FJMD.exe File opened for modification C:\windows\SysWOW64\WHBFIOP.exe BMWWY.exe File created C:\windows\SysWOW64\JQVBS.exe.bat AQTO.exe File opened for modification C:\windows\SysWOW64\ASLJAW.exe NID.exe File opened for modification C:\windows\SysWOW64\VHRCI.exe RRL.exe File created C:\windows\SysWOW64\JMVCTUV.exe.bat OQQSJ.exe File opened for modification C:\windows\SysWOW64\KFP.exe EEIREJ.exe File created C:\windows\SysWOW64\YNNVUUH.exe.bat UQVGEYM.exe File opened for modification C:\windows\SysWOW64\URWXLWA.exe TOKTG.exe File created C:\windows\SysWOW64\JHRJDA.exe FZLJ.exe File created C:\windows\SysWOW64\XJEAYG.exe.bat ZWF.exe File opened for modification C:\windows\SysWOW64\HASWT.exe MENN.exe File created C:\windows\SysWOW64\VHRCI.exe.bat RRL.exe File created C:\windows\SysWOW64\ZYZJKY.exe TDZAF.exe File created C:\windows\SysWOW64\OTIN.exe.bat ZYZJKY.exe File opened for modification C:\windows\SysWOW64\JQVBS.exe AQTO.exe File created C:\windows\SysWOW64\NID.exe WHBFIOP.exe File created C:\windows\SysWOW64\HASWT.exe MENN.exe File created C:\windows\SysWOW64\KTX.exe.bat KNXGDTO.exe File opened for modification C:\windows\SysWOW64\OTIN.exe ZYZJKY.exe File created C:\windows\SysWOW64\KFP.exe EEIREJ.exe File created C:\windows\SysWOW64\VGUCZ.exe.bat RQN.exe File created C:\windows\SysWOW64\JHRJDA.exe.bat FZLJ.exe File created C:\windows\SysWOW64\ASLJAW.exe.bat NID.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\UHOR.exe FEFMXQ.exe File opened for modification C:\windows\NLVXWE.exe VCHRK.exe File created C:\windows\system\KXACWMJ.exe IKVTM.exe File opened for modification C:\windows\ONPCJ.exe KXACWMJ.exe File opened for modification C:\windows\system\NRTCPO.exe IRLO.exe File opened for modification C:\windows\system\BXFMY.exe IUBQTO.exe File created C:\windows\NLVXWE.exe.bat VCHRK.exe File created C:\windows\ZJRXQKE.exe.bat IZO.exe File created C:\windows\BCVC.exe PUOCLYJ.exe File opened for modification C:\windows\ZWF.exe NGYAHL.exe File created C:\windows\RQOAXU.exe FXLHO.exe File created C:\windows\system\TESRM.exe.bat YBKSY.exe File opened for modification C:\windows\LIXDHPA.exe JVTUX.exe File created C:\windows\LIXDHPA.exe.bat JVTUX.exe File created C:\windows\IQBQIFN.exe.bat RSU.exe File opened for modification C:\windows\system\PSKKBHC.exe ZIHUB.exe File opened for modification C:\windows\system\TOBOZ.exe JQVBS.exe File created C:\windows\XEPWMEE.exe TOBOZ.exe File opened for modification C:\windows\BCVC.exe PUOCLYJ.exe File created C:\windows\system\AVQ.exe.bat HAMF.exe File created C:\windows\OQQSJ.exe.bat TDT.exe File created C:\windows\system\FEFMXQ.exe.bat JMVCTUV.exe File created C:\windows\MENN.exe XJEAYG.exe File opened for modification C:\windows\MTJJW.exe TQF.exe File created C:\windows\VEMA.exe LGGGL.exe File created C:\windows\system\TOKTG.exe KGQ.exe File opened for modification C:\windows\system\FSBKJJT.exe BCVC.exe File created C:\windows\system\NRTCPO.exe.bat IRLO.exe File opened for modification C:\windows\system\AVQ.exe HAMF.exe File created C:\windows\system\EIQWUIP.exe.bat UHOR.exe File created C:\windows\JHBPF.exe FZVHSMJ.exe File created C:\windows\system\MMASZM.exe.bat URWXLWA.exe File created C:\windows\system\TOBOZ.exe.bat JQVBS.exe File opened for modification C:\windows\LZBRT.exe JBV.exe File created C:\windows\JVTUX.exe.bat VKKVJMQ.exe File created C:\windows\UQVGEYM.exe BNRKZ.exe File created C:\windows\CQRDH.exe ASLJAW.exe File opened for modification C:\windows\PKCAL.exe LUV.exe File created C:\windows\ONPCJ.exe KXACWMJ.exe File opened for modification C:\windows\KRJBFUG.exe PEESV.exe File created C:\windows\system\ZAEGRT.exe IQBQIFN.exe File created C:\windows\CEFPVI.exe.bat SGSC.exe File opened for modification C:\windows\system\YUWMSAE.exe VHRCI.exe File created C:\windows\RTC.exe NLVXWE.exe File created C:\windows\THBV.exe YUWMSAE.exe File opened for modification C:\windows\system\MMASZM.exe URWXLWA.exe File created C:\windows\system\PSKKBHC.exe.bat ZIHUB.exe File created C:\windows\ZWF.exe.bat NGYAHL.exe File opened for modification C:\windows\system\EGCEP.exe KTX.exe File created C:\windows\THBV.exe.bat YUWMSAE.exe File created C:\windows\system\EIQWUIP.exe UHOR.exe File created C:\windows\PEESV.exe.bat AOD.exe File opened for modification C:\windows\TMNZE.exe YYI.exe File created C:\windows\system\CAMCOT.exe SKYIZKU.exe File created C:\windows\system\RQN.exe.bat CAMCOT.exe File created C:\windows\system\AQTO.exe.bat JHRJDA.exe File opened for modification C:\windows\CEFPVI.exe SGSC.exe File opened for modification C:\windows\system\GMMXIB.exe CEFPVI.exe File created C:\windows\NDGFWMR.exe YNFGPZ.exe File created C:\windows\HAMF.exe JHBPF.exe File created C:\windows\YLVS.exe FISOVJE.exe File opened for modification C:\windows\OQF.exe ZAEGRT.exe File created C:\windows\LIXDHPA.exe JVTUX.exe File created C:\windows\LUV.exe.bat VEMA.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3292 cmd.exe 1756 cmd.exe 5684 cmd.exe 2788 cmd.exe 7000 cmd.exe 5392 cmd.exe 3008 cmd.exe 5804 cmd.exe 4304 cmd.exe 2832 cmd.exe 4072 cmd.exe 6000 cmd.exe 4584 cmd.exe 6840 cmd.exe 7056 cmd.exe 3016 cmd.exe 5184 cmd.exe 4408 cmd.exe 1616 cmd.exe 2324 cmd.exe 1008 cmd.exe 3808 cmd.exe 5872 cmd.exe 6560 cmd.exe 6936 cmd.exe 5348 cmd.exe 4612 cmd.exe 2844 cmd.exe 4152 cmd.exe 5480 cmd.exe 472 cmd.exe 5164 cmd.exe 1820 cmd.exe 1224 cmd.exe 4224 cmd.exe 4384 cmd.exe 3804 cmd.exe 6716 cmd.exe 2080 cmd.exe 7064 cmd.exe 1836 cmd.exe 2988 cmd.exe 3152 cmd.exe 6512 cmd.exe 4132 cmd.exe 6940 cmd.exe 4392 cmd.exe 964 cmd.exe 7128 cmd.exe 4904 cmd.exe 3940 cmd.exe 4608 cmd.exe 5624 cmd.exe 5700 cmd.exe 4080 cmd.exe 1380 cmd.exe 4204 cmd.exe 4296 cmd.exe 1100 cmd.exe 4776 cmd.exe 6744 cmd.exe 4728 cmd.exe 6920 cmd.exe 4164 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4568 6856 WerFault.exe 88 5920 3936 WerFault.exe 94 3400 5528 WerFault.exe 100 1960 3264 WerFault.exe 105 568 5080 WerFault.exe 110 5168 6904 WerFault.exe 115 292 2432 WerFault.exe 120 2576 244 WerFault.exe 125 5600 6808 WerFault.exe 130 5980 3224 WerFault.exe 135 7148 1612 WerFault.exe 140 2556 2224 WerFault.exe 145 5820 772 WerFault.exe 150 3316 3044 WerFault.exe 155 6348 460 WerFault.exe 160 5976 4796 WerFault.exe 165 4168 5320 WerFault.exe 170 1176 3408 WerFault.exe 175 7120 5424 WerFault.exe 180 6704 4232 WerFault.exe 185 7144 5712 WerFault.exe 190 1756 4188 WerFault.exe 195 256 2040 WerFault.exe 200 5892 3176 WerFault.exe 204 468 1056 WerFault.exe 210 1984 6892 WerFault.exe 215 5092 2028 WerFault.exe 220 4128 4972 WerFault.exe 225 5124 3844 WerFault.exe 230 3672 4596 WerFault.exe 235 6080 6788 WerFault.exe 240 6084 4160 WerFault.exe 245 4624 5504 WerFault.exe 250 6688 4368 WerFault.exe 255 6560 4984 WerFault.exe 260 2476 1228 WerFault.exe 265 6548 3136 WerFault.exe 271 2500 2952 WerFault.exe 276 428 2084 WerFault.exe 281 1136 3724 WerFault.exe 286 3364 4884 WerFault.exe 291 6132 6268 WerFault.exe 296 4576 2392 WerFault.exe 301 804 3784 WerFault.exe 306 4064 5124 WerFault.exe 311 2272 1080 WerFault.exe 316 4600 6372 WerFault.exe 321 1600 3360 WerFault.exe 326 6052 4624 WerFault.exe 331 6848 6876 WerFault.exe 336 1356 6532 WerFault.exe 341 1092 7084 WerFault.exe 346 1148 5380 WerFault.exe 351 1900 1284 WerFault.exe 356 7128 2436 WerFault.exe 361 4080 1180 WerFault.exe 366 6152 5284 WerFault.exe 371 3100 5092 WerFault.exe 376 2440 4576 WerFault.exe 381 2888 5916 WerFault.exe 386 2416 1940 WerFault.exe 391 4600 4748 WerFault.exe 396 1608 6116 WerFault.exe 401 4864 4136 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MCFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONPCJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLVXWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VGUCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXACWMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHBFIOP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGCEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKVTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQVGEYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKCAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKYIZKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDGFWMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUAXSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMVCTUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BREBNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOBOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEFPVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEMA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCHRK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGNSZTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHBPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6856 2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe 6856 2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe 3936 RSU.exe 3936 RSU.exe 5528 IQBQIFN.exe 5528 IQBQIFN.exe 3264 ZAEGRT.exe 3264 ZAEGRT.exe 5080 OQF.exe 5080 OQF.exe 6904 JBV.exe 6904 JBV.exe 2432 LZBRT.exe 2432 LZBRT.exe 244 MCFM.exe 244 MCFM.exe 6808 VCHRK.exe 6808 VCHRK.exe 3224 NLVXWE.exe 3224 NLVXWE.exe 1612 RTC.exe 1612 RTC.exe 2224 LGGGL.exe 2224 LGGGL.exe 772 VEMA.exe 772 VEMA.exe 3044 LUV.exe 3044 LUV.exe 460 PKCAL.exe 460 PKCAL.exe 4796 ZIHUB.exe 4796 ZIHUB.exe 5320 PSKKBHC.exe 5320 PSKKBHC.exe 3408 ODVAKN.exe 3408 ODVAKN.exe 5424 YBANZ.exe 5424 YBANZ.exe 4232 IZO.exe 4232 IZO.exe 5712 ZJRXQKE.exe 5712 ZJRXQKE.exe 4188 SKYIZKU.exe 4188 SKYIZKU.exe 2040 CAMCOT.exe 2040 CAMCOT.exe 3176 RQN.exe 3176 RQN.exe 1056 VGUCZ.exe 1056 VGUCZ.exe 6892 XEZW.exe 6892 XEZW.exe 2028 FJMD.exe 2028 FJMD.exe 4972 VZNUYBZ.exe 4972 VZNUYBZ.exe 3844 IKVTM.exe 3844 IKVTM.exe 4596 KXACWMJ.exe 4596 KXACWMJ.exe 6788 ONPCJ.exe 6788 ONPCJ.exe 4160 HIS.exe 4160 HIS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6856 2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe 6856 2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe 3936 RSU.exe 3936 RSU.exe 5528 IQBQIFN.exe 5528 IQBQIFN.exe 3264 ZAEGRT.exe 3264 ZAEGRT.exe 5080 OQF.exe 5080 OQF.exe 6904 JBV.exe 6904 JBV.exe 2432 LZBRT.exe 2432 LZBRT.exe 244 MCFM.exe 244 MCFM.exe 6808 VCHRK.exe 6808 VCHRK.exe 3224 NLVXWE.exe 3224 NLVXWE.exe 1612 RTC.exe 1612 RTC.exe 2224 LGGGL.exe 2224 LGGGL.exe 772 VEMA.exe 772 VEMA.exe 3044 LUV.exe 3044 LUV.exe 460 PKCAL.exe 460 PKCAL.exe 4796 ZIHUB.exe 4796 ZIHUB.exe 5320 PSKKBHC.exe 5320 PSKKBHC.exe 3408 ODVAKN.exe 3408 ODVAKN.exe 5424 YBANZ.exe 5424 YBANZ.exe 4232 IZO.exe 4232 IZO.exe 5712 ZJRXQKE.exe 5712 ZJRXQKE.exe 4188 SKYIZKU.exe 4188 SKYIZKU.exe 2040 CAMCOT.exe 2040 CAMCOT.exe 3176 RQN.exe 3176 RQN.exe 1056 VGUCZ.exe 1056 VGUCZ.exe 6892 XEZW.exe 6892 XEZW.exe 2028 FJMD.exe 2028 FJMD.exe 4972 VZNUYBZ.exe 4972 VZNUYBZ.exe 3844 IKVTM.exe 3844 IKVTM.exe 4596 KXACWMJ.exe 4596 KXACWMJ.exe 6788 ONPCJ.exe 6788 ONPCJ.exe 4160 HIS.exe 4160 HIS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6856 wrote to memory of 1100 6856 2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe 90 PID 1100 wrote to memory of 3936 1100 cmd.exe 94 PID 3936 wrote to memory of 6204 3936 RSU.exe 96 PID 6204 wrote to memory of 5528 6204 cmd.exe 100 PID 5528 wrote to memory of 5548 5528 IQBQIFN.exe 101 PID 5548 wrote to memory of 3264 5548 cmd.exe 105 PID 3264 wrote to memory of 4132 3264 ZAEGRT.exe 106 PID 4132 wrote to memory of 5080 4132 cmd.exe 110 PID 5080 wrote to memory of 2788 5080 OQF.exe 111 PID 2788 wrote to memory of 6904 2788 cmd.exe 115 PID 6904 wrote to memory of 2424 6904 JBV.exe 116 PID 2424 wrote to memory of 2432 2424 cmd.exe 120 PID 2432 wrote to memory of 3120 2432 LZBRT.exe 121 PID 3120 wrote to memory of 244 3120 cmd.exe 125 PID 244 wrote to memory of 4408 244 MCFM.exe 126 PID 4408 wrote to memory of 6808 4408 cmd.exe 130 PID 6808 wrote to memory of 4084 6808 VCHRK.exe 131 PID 4084 wrote to memory of 3224 4084 cmd.exe 135 PID 3224 wrote to memory of 1820 3224 NLVXWE.exe 136 PID 1820 wrote to memory of 1612 1820 cmd.exe 140 PID 1612 wrote to memory of 4104 1612 RTC.exe 141 PID 4104 wrote to memory of 2224 4104 cmd.exe 145 PID 2224 wrote to memory of 1224 2224 LGGGL.exe 146 PID 1224 wrote to memory of 772 1224 cmd.exe 150 PID 772 wrote to memory of 3336 772 VEMA.exe 151 PID 3336 wrote to memory of 3044 3336 cmd.exe 155 PID 3044 wrote to memory of 5564 3044 LUV.exe 156 PID 5564 wrote to memory of 460 5564 cmd.exe 160 PID 460 wrote to memory of 6940 460 PKCAL.exe 161 PID 6940 wrote to memory of 4796 6940 cmd.exe 165 PID 4796 wrote to memory of 1836 4796 ZIHUB.exe 166 PID 1836 wrote to memory of 5320 1836 cmd.exe 170 PID 5320 wrote to memory of 2832 5320 PSKKBHC.exe 171 PID 2832 wrote to memory of 3408 2832 cmd.exe 175 PID 3408 wrote to memory of 5024 3408 ODVAKN.exe 176 PID 5024 wrote to memory of 5424 5024 cmd.exe 180 PID 5424 wrote to memory of 1716 5424 YBANZ.exe 181 PID 1716 wrote to memory of 4232 1716 cmd.exe 185 PID 4232 wrote to memory of 5884 4232 IZO.exe 186 PID 5884 wrote to memory of 5712 5884 cmd.exe 190 PID 5712 wrote to memory of 7000 5712 ZJRXQKE.exe 191 PID 7000 wrote to memory of 4188 7000 cmd.exe 195 PID 4188 wrote to memory of 6620 4188 SKYIZKU.exe 196 PID 6620 wrote to memory of 2040 6620 cmd.exe 200 PID 2040 wrote to memory of 1464 2040 CAMCOT.exe 201 PID 1464 wrote to memory of 3176 1464 cmd.exe 204 PID 3176 wrote to memory of 4392 3176 RQN.exe 206 PID 4392 wrote to memory of 1056 4392 cmd.exe 210 PID 1056 wrote to memory of 4848 1056 VGUCZ.exe 211 PID 4848 wrote to memory of 6892 4848 cmd.exe 215 PID 6892 wrote to memory of 5500 6892 XEZW.exe 216 PID 5500 wrote to memory of 2028 5500 cmd.exe 220 PID 2028 wrote to memory of 1152 2028 FJMD.exe 221 PID 1152 wrote to memory of 4972 1152 cmd.exe 225 PID 4972 wrote to memory of 4776 4972 VZNUYBZ.exe 226 PID 4776 wrote to memory of 3844 4776 cmd.exe 230 PID 3844 wrote to memory of 4512 3844 IKVTM.exe 231 PID 4512 wrote to memory of 4596 4512 cmd.exe 235 PID 4596 wrote to memory of 6068 4596 KXACWMJ.exe 236 PID 6068 wrote to memory of 6788 6068 cmd.exe 240 PID 6788 wrote to memory of 4072 6788 ONPCJ.exe 241 PID 4072 wrote to memory of 4160 4072 cmd.exe 245 PID 4160 wrote to memory of 6000 4160 HIS.exe 246 PID 6000 wrote to memory of 5504 6000 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_c66e28662a086de88e79b4475ec74673_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSU.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\SysWOW64\RSU.exeC:\windows\system32\RSU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQBQIFN.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:6204 -
C:\windows\IQBQIFN.exeC:\windows\IQBQIFN.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZAEGRT.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\windows\system\ZAEGRT.exeC:\windows\system\ZAEGRT.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQF.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\OQF.exeC:\windows\OQF.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JBV.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\windows\JBV.exeC:\windows\JBV.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZBRT.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\windows\LZBRT.exeC:\windows\LZBRT.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCFM.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\system\MCFM.exeC:\windows\system\MCFM.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCHRK.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\SysWOW64\VCHRK.exeC:\windows\system32\VCHRK.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLVXWE.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\windows\NLVXWE.exeC:\windows\NLVXWE.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTC.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\windows\RTC.exeC:\windows\RTC.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LGGGL.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\system\LGGGL.exeC:\windows\system\LGGGL.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEMA.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\VEMA.exeC:\windows\VEMA.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUV.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\windows\LUV.exeC:\windows\LUV.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKCAL.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\windows\PKCAL.exeC:\windows\PKCAL.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIHUB.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6940 -
C:\windows\system\ZIHUB.exeC:\windows\system\ZIHUB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSKKBHC.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\windows\system\PSKKBHC.exeC:\windows\system\PSKKBHC.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBANZ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\system\YBANZ.exeC:\windows\system\YBANZ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZO.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\windows\IZO.exeC:\windows\IZO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJRXQKE.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\ZJRXQKE.exeC:\windows\ZJRXQKE.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKYIZKU.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:7000 -
C:\windows\system\SKYIZKU.exeC:\windows\system\SKYIZKU.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAMCOT.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6620 -
C:\windows\system\CAMCOT.exeC:\windows\system\CAMCOT.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RQN.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\windows\system\RQN.exeC:\windows\system\RQN.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VGUCZ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\windows\SysWOW64\VGUCZ.exeC:\windows\system32\VGUCZ.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XEZW.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\XEZW.exeC:\windows\XEZW.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJMD.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\FJMD.exeC:\windows\FJMD.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZNUYBZ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\windows\SysWOW64\VZNUYBZ.exeC:\windows\system32\VZNUYBZ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IKVTM.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\system\IKVTM.exeC:\windows\system\IKVTM.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KXACWMJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\system\KXACWMJ.exeC:\windows\system\KXACWMJ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ONPCJ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\ONPCJ.exeC:\windows\ONPCJ.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIS.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\windows\HIS.exeC:\windows\HIS.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\windows\ILWCU.exeC:\windows\ILWCU.exe65⤵
- Executes dropped EXE
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GWZS.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4656 -
C:\windows\system\GWZS.exeC:\windows\system\GWZS.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BREBNQ.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4476 -
C:\windows\SysWOW64\BREBNQ.exeC:\windows\system32\BREBNQ.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZLJ.exe.bat" "70⤵PID:4648
-
C:\windows\system\FZLJ.exeC:\windows\system\FZLJ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHRJDA.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4888 -
C:\windows\SysWOW64\JHRJDA.exeC:\windows\system32\JHRJDA.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQTO.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:832 -
C:\windows\system\AQTO.exeC:\windows\system\AQTO.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JQVBS.exe.bat" "76⤵
- Executes a command shell one-liner
PID:964 -
C:\windows\SysWOW64\JQVBS.exeC:\windows\system32\JQVBS.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOBOZ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2080 -
C:\windows\system\TOBOZ.exeC:\windows\system\TOBOZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XEPWMEE.exe.bat" "80⤵PID:6536
-
C:\windows\XEPWMEE.exeC:\windows\XEPWMEE.exe81⤵
- Executes dropped EXE
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMWWY.exe.bat" "82⤵PID:6552
-
C:\windows\BMWWY.exeC:\windows\BMWWY.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHBFIOP.exe.bat" "84⤵PID:6692
-
C:\windows\SysWOW64\WHBFIOP.exeC:\windows\system32\WHBFIOP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NID.exe.bat" "86⤵PID:2052
-
C:\windows\SysWOW64\NID.exeC:\windows\system32\NID.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASLJAW.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:7064 -
C:\windows\SysWOW64\ASLJAW.exeC:\windows\system32\ASLJAW.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQRDH.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2924 -
C:\windows\CQRDH.exeC:\windows\CQRDH.exe91⤵
- Executes dropped EXE
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGSC.exe.bat" "92⤵PID:4212
-
C:\windows\system\SGSC.exeC:\windows\system\SGSC.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEFPVI.exe.bat" "94⤵PID:6316
-
C:\windows\CEFPVI.exeC:\windows\CEFPVI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMMXIB.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:6236 -
C:\windows\system\GMMXIB.exeC:\windows\system\GMMXIB.exe97⤵
- Executes dropped EXE
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PUOCLYJ.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:6188 -
C:\windows\system\PUOCLYJ.exeC:\windows\system\PUOCLYJ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCVC.exe.bat" "100⤵PID:2512
-
C:\windows\BCVC.exeC:\windows\BCVC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FSBKJJT.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4536 -
C:\windows\system\FSBKJJT.exeC:\windows\system\FSBKJJT.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:7084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNFGPZ.exe.bat" "104⤵PID:3228
-
C:\windows\SysWOW64\YNFGPZ.exeC:\windows\system32\YNFGPZ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDGFWMR.exe.bat" "106⤵PID:1312
-
C:\windows\NDGFWMR.exeC:\windows\NDGFWMR.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRLO.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4836 -
C:\windows\system\IRLO.exeC:\windows\system\IRLO.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRTCPO.exe.bat" "110⤵PID:2460
-
C:\windows\system\NRTCPO.exeC:\windows\system\NRTCPO.exe111⤵
- Executes dropped EXE
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZVHSMJ.exe.bat" "112⤵PID:3356
-
C:\windows\system\FZVHSMJ.exeC:\windows\system\FZVHSMJ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JHBPF.exe.bat" "114⤵
- Executes a command shell one-liner
PID:6744 -
C:\windows\JHBPF.exeC:\windows\JHBPF.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAMF.exe.bat" "116⤵PID:4996
-
C:\windows\HAMF.exeC:\windows\HAMF.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVQ.exe.bat" "118⤵
- Executes a command shell one-liner
PID:6936 -
C:\windows\system\AVQ.exeC:\windows\system\AVQ.exe119⤵
- Executes dropped EXE
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGYAHL.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5392 -
C:\windows\NGYAHL.exeC:\windows\NGYAHL.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-