Analysis
- max time kernel
87s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 19:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_4f067b8c215e9b7157e05a1d131025a8_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-17_4f067b8c215e9b7157e05a1d131025a8_elex_emotet_stop.exe
- Size 208KB
- Sample260817-x3cbnsysfv
- SHA256 de2d212b51fc4d01d2f45d5993388b3a0ab16c48bda25af6fe43e4bfd65846f2
- MD5 4f067b8c215e9b7157e05a1d131025a8
- SHA1 0d4079c1e1fe02c45e1b4f0f297cec59776675cc
- SHA512 d1dc40740948eeb37083b32e0586477d84a6b258a6b99905cac0bf62cce2ae053e0329a04e7f58d0b51db258e4ff689d408bac1d6bd97e8c0bb0bdf79a44bff7
- SSDEEP 3072:ILQaL9tbLkRIgd1Lye9yjE2hWAN5XbxlUKL+LOfb4pLthEjQT6j:slZtbLWIgd1LZ9oECZbxlUS+LOTkEj1
- TLSH T167247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2380 CJMVYF.exe 6104 FJPEPQ.exe 1140 ZCFPYR.exe 2940 XVIFH.exe 6020 JNX.exe 2976 VVE.exe 5080 IBECMU.exe 4936 VEMA.exe 5712 LUV.exe 5856 NRBMP.exe 3256 EADZ.exe 2504 GYIMZO.exe 1004 BAZKOR.exe 2240 UDC.exe 3248 YTJOF.exe 1676 AHOXQZK.exe 3940 YCNYU.exe 4384 ECVMD.exe 1548 OAAGT.exe 6064 HVEKYDM.exe 2804 DBK.exe 6004 NJMMJ.exe 4816 ZRTM.exe 4624 MCBLJNZ.exe 5204 SPA.exe 5452 LSEPTGY.exe 3184 ANNU.exe 1812 PDWLLO.exe 3116 EGGX.exe 1320 SEGJGMG.exe 1688 MRLS.exe 3892 HFQCSM.exe 4468 NFX.exe 4128 TFFDS.exe 2944 EYAWBQB.exe 1444 ZTF.exe 5424 KMIYL.exe 3924 QMPMU.exe 5964 BFSFDH.exe 2780 WSX.exe 5236 OVBKSXM.exe 3804 ADHS.exe 5832 KLJXI.exe 3204 VEEQQCS.exe 4548 MJPI.exe 2968 VRRNJW.exe 204 SXXKR.exe 2316 XATJWX.exe 5636 ANY.exe 4336 UICBQ.exe 4324 HLT.exe 4964 YWJ.exe 2988 TJOHO.exe 5320 PPUEVDP.exe 3064 GCEWLIL.exe 2800 SVZH.exe 3684 DNCAU.exe 1776 YBHJEWX.exe 5724 DBPX.exe 3948 YOTOXY.exe 5868 HXVUBWP.exe 4628 TPQ.exe 4256 XXFMVW.exe 5992 ZSCWXVP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\ZKCV.exe HHQSK.exe File created C:\windows\SysWOW64\PDWLLO.exe ANNU.exe File created C:\windows\SysWOW64\XAEI.exe.bat IFUDVZ.exe File opened for modification C:\windows\SysWOW64\RKYR.exe QHU.exe File created C:\windows\SysWOW64\JFC.exe RKYR.exe File created C:\windows\SysWOW64\GTM.exe.bat RDDD.exe File created C:\windows\SysWOW64\QRT.exe.bat VLLC.exe File created C:\windows\SysWOW64\XVIFH.exe ZCFPYR.exe File created C:\windows\SysWOW64\AHOXQZK.exe.bat YTJOF.exe File opened for modification C:\windows\SysWOW64\TFFDS.exe NFX.exe File opened for modification C:\windows\SysWOW64\WSX.exe BFSFDH.exe File created C:\windows\SysWOW64\PPUEVDP.exe TJOHO.exe File created C:\windows\SysWOW64\DBPX.exe.bat YBHJEWX.exe File created C:\windows\SysWOW64\CJUCI.exe.bat LZR.exe File created C:\windows\SysWOW64\UYVQZ.exe UTVJ.exe File created C:\windows\SysWOW64\NFX.exe HFQCSM.exe File created C:\windows\SysWOW64\TFFDS.exe NFX.exe File created C:\windows\SysWOW64\WSX.exe.bat BFSFDH.exe File created C:\windows\SysWOW64\SXXKR.exe.bat VRRNJW.exe File opened for modification C:\windows\SysWOW64\DBPX.exe YBHJEWX.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe LZR.exe File created C:\windows\SysWOW64\IDYHN.exe XKVP.exe File opened for modification C:\windows\SysWOW64\HVEKYDM.exe OAAGT.exe File created C:\windows\SysWOW64\HVEKYDM.exe.bat OAAGT.exe File created C:\windows\SysWOW64\QMPMU.exe.bat KMIYL.exe File opened for modification C:\windows\SysWOW64\KLJXI.exe ADHS.exe File created C:\windows\SysWOW64\TPQ.exe.bat HXVUBWP.exe File created C:\windows\SysWOW64\QHU.exe VUQEZV.exe File opened for modification C:\windows\SysWOW64\JFC.exe RKYR.exe File created C:\windows\SysWOW64\GTM.exe RDDD.exe File created C:\windows\SysWOW64\XADPX.exe HKCPRNK.exe File created C:\windows\SysWOW64\VUQEZV.exe.bat MGF.exe File created C:\windows\SysWOW64\QRT.exe VLLC.exe File created C:\windows\SysWOW64\ANY.exe.bat XATJWX.exe File created C:\windows\SysWOW64\YOTOXY.exe.bat DBPX.exe File created C:\windows\SysWOW64\ZKCV.exe HHQSK.exe File created C:\windows\SysWOW64\EGGX.exe PDWLLO.exe File opened for modification C:\windows\SysWOW64\YBHJEWX.exe DNCAU.exe File opened for modification C:\windows\SysWOW64\HJEON.exe UYVQZ.exe File opened for modification C:\windows\SysWOW64\PATOCP.exe YPV.exe File created C:\windows\SysWOW64\RKYR.exe.bat QHU.exe File opened for modification C:\windows\SysWOW64\GTM.exe RDDD.exe File created C:\windows\SysWOW64\DBPX.exe YBHJEWX.exe File created C:\windows\SysWOW64\HVEKYDM.exe OAAGT.exe File opened for modification C:\windows\SysWOW64\NJMMJ.exe DBK.exe File created C:\windows\SysWOW64\EGGX.exe.bat PDWLLO.exe File created C:\windows\SysWOW64\NFX.exe.bat HFQCSM.exe File opened for modification C:\windows\SysWOW64\EVCT.exe PATOCP.exe File opened for modification C:\windows\SysWOW64\IDYHN.exe XKVP.exe File created C:\windows\SysWOW64\EBFYIMO.exe EIEWUIZ.exe File opened for modification C:\windows\SysWOW64\YTJOF.exe UDC.exe File created C:\windows\SysWOW64\AHOXQZK.exe YTJOF.exe File opened for modification C:\windows\SysWOW64\AHOXQZK.exe YTJOF.exe File created C:\windows\SysWOW64\ECVMD.exe YCNYU.exe File opened for modification C:\windows\SysWOW64\EGGX.exe PDWLLO.exe File created C:\windows\SysWOW64\ANY.exe XATJWX.exe File opened for modification C:\windows\SysWOW64\XAEI.exe IFUDVZ.exe File created C:\windows\SysWOW64\EBFYIMO.exe.bat EIEWUIZ.exe File created C:\windows\SysWOW64\XVIFH.exe.bat ZCFPYR.exe File created C:\windows\SysWOW64\YBHJEWX.exe DNCAU.exe File created C:\windows\SysWOW64\UYVQZ.exe.bat UTVJ.exe File created C:\windows\SysWOW64\HJEON.exe UYVQZ.exe File created C:\windows\SysWOW64\XAEI.exe IFUDVZ.exe File created C:\windows\SysWOW64\EVCT.exe PATOCP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\UDC.exe BAZKOR.exe File created C:\windows\OVBKSXM.exe WSX.exe File opened for modification C:\windows\SVZH.exe GCEWLIL.exe File opened for modification C:\windows\ZTF.exe EYAWBQB.exe File created C:\windows\system\VEEQQCS.exe.bat KLJXI.exe File created C:\windows\HKCPRNK.exe.bat CJUCI.exe File opened for modification C:\windows\system\SEGJGMG.exe EGGX.exe File created C:\windows\VRRNJW.exe MJPI.exe File opened for modification C:\windows\DAK.exe XADPX.exe File opened for modification C:\windows\system\MGF.exe EBFYIMO.exe File opened for modification C:\windows\system\ZCFPYR.exe FJPEPQ.exe File opened for modification C:\windows\system\IBECMU.exe VVE.exe File created C:\windows\HKCPRNK.exe CJUCI.exe File opened for modification C:\windows\system\XKVP.exe CXRFCRB.exe File opened for modification C:\windows\LUV.exe VEMA.exe File opened for modification C:\windows\VRRNJW.exe MJPI.exe File created C:\windows\system\YWJ.exe.bat HLT.exe File created C:\windows\BEM.exe HIHCXK.exe File created C:\windows\system\MGF.exe EBFYIMO.exe File created C:\windows\FKCJGI.exe.bat ZKCV.exe File opened for modification C:\windows\BAZKOR.exe GYIMZO.exe File created C:\windows\system\SEGJGMG.exe EGGX.exe File created C:\windows\KMIYL.exe ZTF.exe File opened for modification C:\windows\DNCAU.exe SVZH.exe File created C:\windows\DAK.exe.bat XADPX.exe File created C:\windows\EIEWUIZ.exe.bat IDYHN.exe File created C:\windows\system\UTVJ.exe XNPM.exe File created C:\windows\system\SPA.exe.bat MCBLJNZ.exe File created C:\windows\TPNDMB.exe EJPO.exe File created C:\windows\FKCJGI.exe ZKCV.exe File opened for modification C:\windows\ANNU.exe LSEPTGY.exe File opened for modification C:\windows\XXFMVW.exe TPQ.exe File opened for modification C:\windows\FYKYQ.exe XTKKO.exe File created C:\windows\XNPM.exe.bat DAK.exe File created C:\windows\HJGNKR.exe.bat XAEI.exe File created C:\windows\system\MCBLJNZ.exe.bat ZRTM.exe File opened for modification C:\windows\system\HIHCXK.exe EVCT.exe File created C:\windows\system\HIHCXK.exe.bat EVCT.exe File created C:\windows\BAZKOR.exe.bat GYIMZO.exe File opened for modification C:\windows\system\CXRFCRB.exe WXJRLPA.exe File opened for modification C:\windows\system\LZR.exe FYKYQ.exe File opened for modification C:\windows\system\TFK.exe NKLCE.exe File opened for modification C:\windows\IFUDVZ.exe QCQA.exe File opened for modification C:\windows\system\VLLC.exe CQIGNK.exe File opened for modification C:\windows\system\VVE.exe JNX.exe File created C:\windows\system\IBECMU.exe.bat VVE.exe File created C:\windows\ZSCWXVP.exe.bat XXFMVW.exe File created C:\windows\ANNU.exe.bat LSEPTGY.exe File opened for modification C:\windows\system\MRLS.exe SEGJGMG.exe File created C:\windows\XTKKO.exe.bat ZSCWXVP.exe File created C:\windows\YPV.exe TPNDMB.exe File opened for modification C:\windows\CQIGNK.exe FKCJGI.exe File opened for modification C:\windows\system\NRBMP.exe LUV.exe File created C:\windows\system\BFSFDH.exe.bat QMPMU.exe File created C:\windows\FYKYQ.exe XTKKO.exe File created C:\windows\system\NKLCE.exe.bat HJEON.exe File created C:\windows\system\CXRFCRB.exe.bat WXJRLPA.exe File created C:\windows\system\XKVP.exe.bat CXRFCRB.exe File opened for modification C:\windows\system\MUL.exe GTM.exe File opened for modification C:\windows\system\HHQSK.exe MUL.exe File opened for modification C:\windows\system\JNX.exe XVIFH.exe File created C:\windows\system\BFSFDH.exe QMPMU.exe File opened for modification C:\windows\HLT.exe UICBQ.exe File created C:\windows\system\GCEWLIL.exe PPUEVDP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3280 cmd.exe 4412 cmd.exe 2364 cmd.exe 5548 cmd.exe 2452 cmd.exe 5672 cmd.exe 2388 cmd.exe 1560 cmd.exe 5040 cmd.exe 1572 cmd.exe 5756 cmd.exe 4892 cmd.exe 5104 cmd.exe 4904 cmd.exe 3244 cmd.exe 1796 cmd.exe 5308 cmd.exe 264 cmd.exe 5316 cmd.exe 2600 cmd.exe 4000 cmd.exe 1964 cmd.exe 436 cmd.exe 1292 cmd.exe 6048 cmd.exe 3456 cmd.exe 4664 cmd.exe 4656 cmd.exe 1384 cmd.exe 3284 cmd.exe 5644 cmd.exe 3960 cmd.exe 4092 cmd.exe 4552 cmd.exe 3464 cmd.exe 3780 cmd.exe 3324 cmd.exe 2160 cmd.exe 4480 cmd.exe 4272 cmd.exe 5544 cmd.exe 2480 cmd.exe 2072 cmd.exe 2552 cmd.exe 2668 cmd.exe 1488 cmd.exe 1440 cmd.exe 3436 cmd.exe 4812 cmd.exe 1312 cmd.exe 5772 cmd.exe 1816 cmd.exe 1636 cmd.exe 4600 cmd.exe 4208 cmd.exe 1948 cmd.exe 1316 cmd.exe 5232 cmd.exe 2832 cmd.exe 6136 cmd.exe 1760 cmd.exe 4808 cmd.exe 1368 cmd.exe 1980 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2160 2696 WerFault.exe 88 4728 2380 WerFault.exe 93 2800 6104 WerFault.exe 99 5472 1140 WerFault.exe 104 6072 2940 WerFault.exe 109 2780 6020 WerFault.exe 114 5828 2976 WerFault.exe 119 4828 5080 WerFault.exe 124 1572 4936 WerFault.exe 129 2856 5712 WerFault.exe 134 4144 5856 WerFault.exe 139 3848 3256 WerFault.exe 144 4252 2504 WerFault.exe 149 204 1004 WerFault.exe 154 2828 2240 WerFault.exe 159 4840 3248 WerFault.exe 164 5860 1676 WerFault.exe 169 1520 3940 WerFault.exe 174 2124 4384 WerFault.exe 179 4636 1548 WerFault.exe 184 6124 6064 WerFault.exe 189 2232 2804 WerFault.exe 194 3404 6004 WerFault.exe 199 3220 4816 WerFault.exe 204 4712 4624 WerFault.exe 209 3212 5204 WerFault.exe 214 4992 5452 WerFault.exe 219 3200 3184 WerFault.exe 224 5920 1812 WerFault.exe 229 4536 3116 WerFault.exe 234 460 1320 WerFault.exe 239 3632 1688 WerFault.exe 244 5308 3892 WerFault.exe 249 3404 4468 WerFault.exe 254 2448 4128 WerFault.exe 259 4592 2944 WerFault.exe 264 4396 1444 WerFault.exe 269 2548 5424 WerFault.exe 275 2792 3924 WerFault.exe 280 5508 5964 WerFault.exe 285 4828 2780 WerFault.exe 290 1684 5236 WerFault.exe 295 5308 3804 WerFault.exe 300 3080 5832 WerFault.exe 305 5744 3204 WerFault.exe 310 4592 4548 WerFault.exe 315 3244 2968 WerFault.exe 320 3432 204 WerFault.exe 325 5124 2316 WerFault.exe 330 2296 5636 WerFault.exe 335 4828 4336 WerFault.exe 340 5956 4324 WerFault.exe 345 2856 4964 WerFault.exe 350 2632 2988 WerFault.exe 355 248 5320 WerFault.exe 360 6036 3064 WerFault.exe 365 4452 2800 WerFault.exe 370 716 3684 WerFault.exe 375 5508 1776 WerFault.exe 380 4552 5724 WerFault.exe 385 3400 3948 WerFault.exe 390 3160 5868 WerFault.exe 395 1948 4628 WerFault.exe 400 3972 4256 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQIGNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJUCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKCJGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRBMP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXXKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPNDMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJMVYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBHJEWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOTOXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKCPRNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSCWXVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJIAVXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYVQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MCBLJNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PATOCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMIYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMPMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXJRLPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YTJOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFQCSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAZKOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLJXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXVUBWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDWLLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDYHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EADZ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2696 2026-08-17_4f067b8c215e9b7157e05a1d131025a8_elex_emotet_stop.exe 2696 2026-08-17_4f067b8c215e9b7157e05a1d131025a8_elex_emotet_stop.exe 2380 CJMVYF.exe 2380 CJMVYF.exe 6104 FJPEPQ.exe 6104 FJPEPQ.exe 1140 ZCFPYR.exe 1140 ZCFPYR.exe 2940 XVIFH.exe 2940 XVIFH.exe 6020 JNX.exe 6020 JNX.exe 2976 VVE.exe 2976 VVE.exe 5080 IBECMU.exe 5080 IBECMU.exe 4936 VEMA.exe 4936 VEMA.exe 5712 LUV.exe 5712 LUV.exe 5856 NRBMP.exe 5856 NRBMP.exe 3256 EADZ.exe 3256 EADZ.exe 2504 GYIMZO.exe 2504 GYIMZO.exe 1004 BAZKOR.exe 1004 BAZKOR.exe 2240 UDC.exe 2240 UDC.exe 3248 YTJOF.exe 3248 YTJOF.exe 1676 AHOXQZK.exe 1676 AHOXQZK.exe 3940 YCNYU.exe 3940 YCNYU.exe 4384 ECVMD.exe 4384 ECVMD.exe 1548 OAAGT.exe 1548 OAAGT.exe 6064 HVEKYDM.exe 6064 HVEKYDM.exe 2804 DBK.exe 2804 DBK.exe 6004 NJMMJ.exe 6004 NJMMJ.exe 4816 ZRTM.exe 4816 ZRTM.exe 4624 MCBLJNZ.exe 4624 MCBLJNZ.exe 5204 SPA.exe 5204 SPA.exe 5452 LSEPTGY.exe 5452 LSEPTGY.exe 3184 ANNU.exe 3184 ANNU.exe 1812 PDWLLO.exe 1812 PDWLLO.exe 3116 EGGX.exe 3116 EGGX.exe 1320 SEGJGMG.exe 1320 SEGJGMG.exe 1688 MRLS.exe 1688 MRLS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2696 2026-08-17_4f067b8c215e9b7157e05a1d131025a8_elex_emotet_stop.exe 2696 2026-08-17_4f067b8c215e9b7157e05a1d131025a8_elex_emotet_stop.exe 2380 CJMVYF.exe 2380 CJMVYF.exe 6104 FJPEPQ.exe 6104 FJPEPQ.exe 1140 ZCFPYR.exe 1140 ZCFPYR.exe 2940 XVIFH.exe 2940 XVIFH.exe 6020 JNX.exe 6020 JNX.exe 2976 VVE.exe 2976 VVE.exe 5080 IBECMU.exe 5080 IBECMU.exe 4936 VEMA.exe 4936 VEMA.exe 5712 LUV.exe 5712 LUV.exe 5856 NRBMP.exe 5856 NRBMP.exe 3256 EADZ.exe 3256 EADZ.exe 2504 GYIMZO.exe 2504 GYIMZO.exe 1004 BAZKOR.exe 1004 BAZKOR.exe 2240 UDC.exe 2240 UDC.exe 3248 YTJOF.exe 3248 YTJOF.exe 1676 AHOXQZK.exe 1676 AHOXQZK.exe 3940 YCNYU.exe 3940 YCNYU.exe 4384 ECVMD.exe 4384 ECVMD.exe 1548 OAAGT.exe 1548 OAAGT.exe 6064 HVEKYDM.exe 6064 HVEKYDM.exe 2804 DBK.exe 2804 DBK.exe 6004 NJMMJ.exe 6004 NJMMJ.exe 4816 ZRTM.exe 4816 ZRTM.exe 4624 MCBLJNZ.exe 4624 MCBLJNZ.exe 5204 SPA.exe 5204 SPA.exe 5452 LSEPTGY.exe 5452 LSEPTGY.exe 3184 ANNU.exe 3184 ANNU.exe 1812 PDWLLO.exe 1812 PDWLLO.exe 3116 EGGX.exe 3116 EGGX.exe 1320 SEGJGMG.exe 1320 SEGJGMG.exe 1688 MRLS.exe 1688 MRLS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2364 2696 2026-08-17_4f067b8c215e9b7157e05a1d131025a8_elex_emotet_stop.exe 89 PID 2364 wrote to memory of 2380 2364 cmd.exe 93 PID 2380 wrote to memory of 1728 2380 CJMVYF.exe 95 PID 1728 wrote to memory of 6104 1728 cmd.exe 99 PID 6104 wrote to memory of 4588 6104 FJPEPQ.exe 100 PID 4588 wrote to memory of 1140 4588 cmd.exe 104 PID 1140 wrote to memory of 2544 1140 ZCFPYR.exe 105 PID 2544 wrote to memory of 2940 2544 cmd.exe 109 PID 2940 wrote to memory of 1384 2940 XVIFH.exe 110 PID 1384 wrote to memory of 6020 1384 cmd.exe 114 PID 6020 wrote to memory of 3564 6020 JNX.exe 115 PID 3564 wrote to memory of 2976 3564 cmd.exe 119 PID 2976 wrote to memory of 4560 2976 VVE.exe 120 PID 4560 wrote to memory of 5080 4560 cmd.exe 124 PID 5080 wrote to memory of 4700 5080 IBECMU.exe 125 PID 4700 wrote to memory of 4936 4700 cmd.exe 129 PID 4936 wrote to memory of 4920 4936 VEMA.exe 130 PID 4920 wrote to memory of 5712 4920 cmd.exe 134 PID 5712 wrote to memory of 3920 5712 LUV.exe 135 PID 3920 wrote to memory of 5856 3920 cmd.exe 139 PID 5856 wrote to memory of 4300 5856 NRBMP.exe 140 PID 4300 wrote to memory of 3256 4300 cmd.exe 144 PID 3256 wrote to memory of 4960 3256 EADZ.exe 145 PID 4960 wrote to memory of 2504 4960 cmd.exe 149 PID 2504 wrote to memory of 5232 2504 GYIMZO.exe 150 PID 5232 wrote to memory of 1004 5232 cmd.exe 154 PID 1004 wrote to memory of 124 1004 BAZKOR.exe 155 PID 124 wrote to memory of 2240 124 cmd.exe 159 PID 2240 wrote to memory of 1312 2240 UDC.exe 160 PID 1312 wrote to memory of 3248 1312 cmd.exe 164 PID 3248 wrote to memory of 3704 3248 YTJOF.exe 165 PID 3704 wrote to memory of 1676 3704 cmd.exe 169 PID 1676 wrote to memory of 2016 1676 AHOXQZK.exe 170 PID 2016 wrote to memory of 3940 2016 cmd.exe 174 PID 3940 wrote to memory of 1716 3940 YCNYU.exe 175 PID 1716 wrote to memory of 4384 1716 cmd.exe 179 PID 4384 wrote to memory of 4356 4384 ECVMD.exe 180 PID 4356 wrote to memory of 1548 4356 cmd.exe 184 PID 1548 wrote to memory of 5548 1548 OAAGT.exe 185 PID 5548 wrote to memory of 6064 5548 cmd.exe 189 PID 6064 wrote to memory of 6032 6064 HVEKYDM.exe 190 PID 6032 wrote to memory of 2804 6032 cmd.exe 194 PID 2804 wrote to memory of 3008 2804 DBK.exe 195 PID 3008 wrote to memory of 6004 3008 cmd.exe 199 PID 6004 wrote to memory of 2552 6004 NJMMJ.exe 200 PID 2552 wrote to memory of 4816 2552 cmd.exe 204 PID 4816 wrote to memory of 5600 4816 ZRTM.exe 205 PID 5600 wrote to memory of 4624 5600 cmd.exe 209 PID 4624 wrote to memory of 1668 4624 MCBLJNZ.exe 210 PID 1668 wrote to memory of 5204 1668 cmd.exe 214 PID 5204 wrote to memory of 1220 5204 SPA.exe 215 PID 1220 wrote to memory of 5452 1220 cmd.exe 219 PID 5452 wrote to memory of 3284 5452 LSEPTGY.exe 220 PID 3284 wrote to memory of 3184 3284 cmd.exe 224 PID 3184 wrote to memory of 2444 3184 ANNU.exe 225 PID 2444 wrote to memory of 1812 2444 cmd.exe 229 PID 1812 wrote to memory of 4532 1812 PDWLLO.exe 230 PID 4532 wrote to memory of 3116 4532 cmd.exe 234 PID 3116 wrote to memory of 2344 3116 EGGX.exe 235 PID 2344 wrote to memory of 1320 2344 cmd.exe 239 PID 1320 wrote to memory of 4000 1320 SEGJGMG.exe 240 PID 4000 wrote to memory of 1688 4000 cmd.exe 244 PID 1688 wrote to memory of 1964 1688 MRLS.exe 245 PID 1964 wrote to memory of 3892 1964 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_4f067b8c215e9b7157e05a1d131025a8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_4f067b8c215e9b7157e05a1d131025a8_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJMVYF.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\CJMVYF.exeC:\windows\CJMVYF.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJPEPQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\system\FJPEPQ.exeC:\windows\system\FJPEPQ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCFPYR.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\system\ZCFPYR.exeC:\windows\system\ZCFPYR.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XVIFH.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\windows\SysWOW64\XVIFH.exeC:\windows\system32\XVIFH.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JNX.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\system\JNX.exeC:\windows\system\JNX.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\windows\system\VVE.exeC:\windows\system\VVE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBECMU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\system\IBECMU.exeC:\windows\system\IBECMU.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEMA.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\windows\VEMA.exeC:\windows\VEMA.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\LUV.exeC:\windows\LUV.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRBMP.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\windows\system\NRBMP.exeC:\windows\system\NRBMP.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EADZ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\system\EADZ.exeC:\windows\system\EADZ.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYIMZO.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\system\GYIMZO.exeC:\windows\system\GYIMZO.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BAZKOR.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\windows\BAZKOR.exeC:\windows\BAZKOR.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UDC.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:124 -
C:\windows\UDC.exeC:\windows\UDC.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTJOF.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\SysWOW64\YTJOF.exeC:\windows\system32\YTJOF.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AHOXQZK.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\windows\SysWOW64\AHOXQZK.exeC:\windows\system32\AHOXQZK.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCNYU.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\windows\YCNYU.exeC:\windows\YCNYU.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ECVMD.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\windows\SysWOW64\ECVMD.exeC:\windows\system32\ECVMD.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OAAGT.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\OAAGT.exeC:\windows\OAAGT.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVEKYDM.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\windows\SysWOW64\HVEKYDM.exeC:\windows\system32\HVEKYDM.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DBK.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\windows\DBK.exeC:\windows\DBK.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJMMJ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\SysWOW64\NJMMJ.exeC:\windows\system32\NJMMJ.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRTM.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\windows\system\ZRTM.exeC:\windows\system\ZRTM.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCBLJNZ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\windows\system\MCBLJNZ.exeC:\windows\system\MCBLJNZ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPA.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\windows\system\SPA.exeC:\windows\system\SPA.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSEPTGY.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\windows\LSEPTGY.exeC:\windows\LSEPTGY.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ANNU.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\windows\ANNU.exeC:\windows\ANNU.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDWLLO.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\SysWOW64\PDWLLO.exeC:\windows\system32\PDWLLO.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EGGX.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\SysWOW64\EGGX.exeC:\windows\system32\EGGX.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEGJGMG.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\windows\system\SEGJGMG.exeC:\windows\system\SEGJGMG.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRLS.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\windows\system\MRLS.exeC:\windows\system\MRLS.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HFQCSM.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\HFQCSM.exeC:\windows\HFQCSM.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFX.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2452 -
C:\windows\SysWOW64\NFX.exeC:\windows\system32\NFX.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFFDS.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5772 -
C:\windows\SysWOW64\TFFDS.exeC:\windows\system32\TFFDS.exe69⤵
- Executes dropped EXE
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EYAWBQB.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5672 -
C:\windows\system\EYAWBQB.exeC:\windows\system\EYAWBQB.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTF.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2832 -
C:\windows\ZTF.exeC:\windows\ZTF.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMIYL.exe.bat" "74⤵PID:5464
-
C:\windows\KMIYL.exeC:\windows\KMIYL.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QMPMU.exe.bat" "76⤵PID:3516
-
C:\windows\SysWOW64\QMPMU.exeC:\windows\system32\QMPMU.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFSFDH.exe.bat" "78⤵PID:692
-
C:\windows\system\BFSFDH.exeC:\windows\system\BFSFDH.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "80⤵PID:5828
-
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVBKSXM.exe.bat" "82⤵PID:3608
-
C:\windows\OVBKSXM.exeC:\windows\OVBKSXM.exe83⤵
- Executes dropped EXE
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADHS.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3324 -
C:\windows\system\ADHS.exeC:\windows\system\ADHS.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLJXI.exe.bat" "86⤵PID:4556
-
C:\windows\SysWOW64\KLJXI.exeC:\windows\system32\KLJXI.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VEEQQCS.exe.bat" "88⤵PID:2620
-
C:\windows\system\VEEQQCS.exeC:\windows\system\VEEQQCS.exe89⤵
- Executes dropped EXE
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJPI.exe.bat" "90⤵
- Executes a command shell one-liner
PID:2160 -
C:\windows\MJPI.exeC:\windows\MJPI.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRRNJW.exe.bat" "92⤵PID:4848
-
C:\windows\VRRNJW.exeC:\windows\VRRNJW.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SXXKR.exe.bat" "94⤵PID:3736
-
C:\windows\SysWOW64\SXXKR.exeC:\windows\system32\SXXKR.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XATJWX.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5104 -
C:\windows\XATJWX.exeC:\windows\XATJWX.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANY.exe.bat" "98⤵PID:4896
-
C:\windows\SysWOW64\ANY.exeC:\windows\system32\ANY.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UICBQ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:436 -
C:\windows\system\UICBQ.exeC:\windows\system\UICBQ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLT.exe.bat" "102⤵PID:720
-
C:\windows\HLT.exeC:\windows\HLT.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YWJ.exe.bat" "104⤵PID:3632
-
C:\windows\system\YWJ.exeC:\windows\system\YWJ.exe105⤵
- Executes dropped EXE
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "106⤵PID:2268
-
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4904 -
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "110⤵PID:1680
-
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVZH.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:4608 -
C:\windows\SVZH.exeC:\windows\SVZH.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNCAU.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3244 -
C:\windows\DNCAU.exeC:\windows\DNCAU.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBHJEWX.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2652 -
C:\windows\SysWOW64\YBHJEWX.exeC:\windows\system32\YBHJEWX.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBPX.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5644 -
C:\windows\SysWOW64\DBPX.exeC:\windows\system32\DBPX.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOTOXY.exe.bat" "120⤵PID:2636
-
C:\windows\SysWOW64\YOTOXY.exeC:\windows\system32\YOTOXY.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-