Analysis
- max time kernel
80s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 02:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe
- Size 208KB
- Sample260819-ckwblscl91
- SHA256 825273c88326fac5427e9e7e33bff1481c769407094efe77f0c3ebed93b0988a
- MD5 1afdd5b3bd299f928f837dadad018ab0
- SHA1 390378527ee766099afa8aad4816a96cb2b370ee
- SHA512 fbf6fcbb074401a56513805f340d31c38723b8550fe2323a8f662f9ca9eb416d97d60d8720d29fb3cd57c1cf273ea94ab47e70d02ae03fcfb09787ee4cb3d589
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOfn4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LOvkEj1
- TLSH T143247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4488 TUGD.exe 2668 OASHOYN.exe 6088 ADD.exe 4528 KDFZAIS.exe 5572 ZGO.exe 2088 KZJW.exe 5668 QZRKDE.exe 432 YEDRND.exe 1684 ZIHUB.exe 6116 TVMEDT.exe 4992 JLN.exe 1956 MTUDW.exe 5812 FWXZ.exe 5616 URPLUJQ.exe 1640 PMUV.exe 4584 VALVB.exe 5724 KDCAMZD.exe 1752 UAIUCHL.exe 1236 NVMY.exe 1848 CMNPOSK.exe 2928 PWDOC.exe 4752 XCIUN.exe 4532 HKK.exe 1876 HNODW.exe 828 RLTX.exe 1160 BLVDPD.exe 2092 QGNH.exe 5104 DRJ.exe 1904 UHQQQBA.exe 5220 MKHUVFI.exe 3456 XIS.exe 816 TQNHLK.exe 2396 FGTH.exe 2896 DTSQTYI.exe 2760 YEBHI.exe 4672 RHFK.exe 4800 MUJUX.exe 4952 YCQ.exe 6064 YQQ.exe 3396 NLAVEQ.exe 4728 YDDOEYJ.exe 5248 LOLET.exe 5036 BEME.exe 4680 HEURIY.exe 5612 ZZY.exe 2540 NFGZYAF.exe 1420 IIOXM.exe 1932 RQQ.exe 5108 XRY.exe 4944 GRAVKH.exe 4548 WUJI.exe 528 EAJWW.exe 4252 IIQWJZG.exe 4304 LYWEV.exe 1532 PGDEHCQ.exe 5556 VBCFE.exe 5560 LWM.exe 3768 JHWZFGC.exe 5276 TPQ.exe 3424 IKIRUY.exe 300 ZSCWXVP.exe 2040 SNOZ.exe 2268 FYWQ.exe 4740 AMBABW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\NVMY.exe UAIUCHL.exe File created C:\windows\SysWOW64\HNODW.exe HKK.exe File created C:\windows\SysWOW64\BLVDPD.exe.bat RLTX.exe File created C:\windows\SysWOW64\YEBHI.exe DTSQTYI.exe File opened for modification C:\windows\SysWOW64\YEBHI.exe DTSQTYI.exe File created C:\windows\SysWOW64\FYWQ.exe SNOZ.exe File created C:\windows\SysWOW64\LJWOCE.exe NJOA.exe File opened for modification C:\windows\SysWOW64\EAHXF.exe PXXSTOK.exe File opened for modification C:\windows\SysWOW64\JHWZFGC.exe LWM.exe File created C:\windows\SysWOW64\YEBHI.exe.bat DTSQTYI.exe File created C:\windows\SysWOW64\IULJW.exe ZTJELCA.exe File opened for modification C:\windows\SysWOW64\IIVUQE.exe CINGHJ.exe File created C:\windows\SysWOW64\IIVUQE.exe.bat CINGHJ.exe File opened for modification C:\windows\SysWOW64\QXWVI.exe HWC.exe File created C:\windows\SysWOW64\XCIUN.exe PWDOC.exe File opened for modification C:\windows\SysWOW64\HNODW.exe HKK.exe File created C:\windows\SysWOW64\HNODW.exe.bat HKK.exe File opened for modification C:\windows\SysWOW64\BLVDPD.exe RLTX.exe File opened for modification C:\windows\SysWOW64\TPQ.exe JHWZFGC.exe File created C:\windows\SysWOW64\FAPH.exe.bat AUFS.exe File created C:\windows\SysWOW64\HHCBHSF.exe BMDSCP.exe File created C:\windows\SysWOW64\NJOA.exe RDIDESX.exe File opened for modification C:\windows\SysWOW64\TUGD.exe 2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe File created C:\windows\SysWOW64\BLVDPD.exe RLTX.exe File opened for modification C:\windows\SysWOW64\RHFK.exe YEBHI.exe File opened for modification C:\windows\SysWOW64\HHCBHSF.exe BMDSCP.exe File opened for modification C:\windows\SysWOW64\LJWOCE.exe NJOA.exe File opened for modification C:\windows\SysWOW64\BZXGA.exe LJWOCE.exe File opened for modification C:\windows\SysWOW64\CINGHJ.exe HUIX.exe File opened for modification C:\windows\SysWOW64\LKRWGRT.exe VUQEZV.exe File created C:\windows\SysWOW64\JHWZFGC.exe.bat LWM.exe File created C:\windows\SysWOW64\IULJW.exe.bat ZTJELCA.exe File created C:\windows\SysWOW64\CINGHJ.exe HUIX.exe File created C:\windows\SysWOW64\LKRWGRT.exe.bat VUQEZV.exe File created C:\windows\SysWOW64\RKYR.exe.bat LKRWGRT.exe File created C:\windows\SysWOW64\TQIWLXI.exe EAHXF.exe File created C:\windows\SysWOW64\OEN.exe TQIWLXI.exe File created C:\windows\SysWOW64\NVMY.exe.bat UAIUCHL.exe File opened for modification C:\windows\SysWOW64\XCIUN.exe PWDOC.exe File created C:\windows\SysWOW64\RHFK.exe YEBHI.exe File created C:\windows\SysWOW64\BEME.exe LOLET.exe File opened for modification C:\windows\SysWOW64\EAJWW.exe WUJI.exe File created C:\windows\SysWOW64\JHWZFGC.exe LWM.exe File created C:\windows\SysWOW64\TPQ.exe.bat JHWZFGC.exe File opened for modification C:\windows\SysWOW64\NJOA.exe RDIDESX.exe File opened for modification C:\windows\SysWOW64\YEDRND.exe QZRKDE.exe File created C:\windows\SysWOW64\NVMY.exe UAIUCHL.exe File opened for modification C:\windows\SysWOW64\FGTH.exe TQNHLK.exe File created C:\windows\SysWOW64\FAPH.exe AUFS.exe File created C:\windows\SysWOW64\ZTJELCA.exe.bat JYAZAP.exe File opened for modification C:\windows\SysWOW64\HUIX.exe QUGSTE.exe File created C:\windows\SysWOW64\HUIX.exe.bat QUGSTE.exe File created C:\windows\SysWOW64\IIVUQE.exe CINGHJ.exe File created C:\windows\SysWOW64\XCIUN.exe.bat PWDOC.exe File created C:\windows\SysWOW64\FGTH.exe TQNHLK.exe File created C:\windows\SysWOW64\HEURIY.exe.bat BEME.exe File created C:\windows\SysWOW64\RQQ.exe IIOXM.exe File created C:\windows\SysWOW64\RQQ.exe.bat IIOXM.exe File opened for modification C:\windows\SysWOW64\FYWQ.exe SNOZ.exe File created C:\windows\SysWOW64\BZXGA.exe.bat LJWOCE.exe File created C:\windows\SysWOW64\CINGHJ.exe.bat HUIX.exe File created C:\windows\SysWOW64\YEDRND.exe.bat QZRKDE.exe File opened for modification C:\windows\SysWOW64\XIS.exe MKHUVFI.exe File created C:\windows\SysWOW64\LKRWGRT.exe VUQEZV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\YQQ.exe YCQ.exe File opened for modification C:\windows\NFGZYAF.exe ZZY.exe File created C:\windows\system\BLI.exe ZNUQJU.exe File created C:\windows\KDCAMZD.exe VALVB.exe File created C:\windows\CMNPOSK.exe NVMY.exe File created C:\windows\GRAVKH.exe XRY.exe File opened for modification C:\windows\JYAZAP.exe BLI.exe File opened for modification C:\windows\BMDSCP.exe ARZX.exe File created C:\windows\ZVGYAV.exe FHBP.exe File created C:\windows\system\QZRKDE.exe KZJW.exe File created C:\windows\KDCAMZD.exe.bat VALVB.exe File created C:\windows\system\UAIUCHL.exe KDCAMZD.exe File created C:\windows\LOLET.exe YDDOEYJ.exe File created C:\windows\system\DKUW.exe.bat JXPMBXM.exe File opened for modification C:\windows\IIOXM.exe NFGZYAF.exe File created C:\windows\ZGO.exe.bat KDFZAIS.exe File opened for modification C:\windows\PMUV.exe URPLUJQ.exe File opened for modification C:\windows\system\RLTX.exe HNODW.exe File opened for modification C:\windows\TQNHLK.exe XIS.exe File created C:\windows\LOLET.exe.bat YDDOEYJ.exe File opened for modification C:\windows\system\ZZY.exe HEURIY.exe File created C:\windows\system\BLI.exe.bat ZNUQJU.exe File created C:\windows\MTUDW.exe JLN.exe File created C:\windows\URPLUJQ.exe FWXZ.exe File created C:\windows\NFGZYAF.exe.bat ZZY.exe File created C:\windows\IIOXM.exe.bat NFGZYAF.exe File created C:\windows\system\IIQWJZG.exe EAJWW.exe File opened for modification C:\windows\system\BLI.exe ZNUQJU.exe File created C:\windows\JXPMBXM.exe IULJW.exe File created C:\windows\system\PXXSTOK.exe RKYR.exe File created C:\windows\system\KDFZAIS.exe.bat ADD.exe File created C:\windows\system\ZIHUB.exe.bat YEDRND.exe File created C:\windows\TQNHLK.exe.bat XIS.exe File opened for modification C:\windows\GRG.exe XQENDDU.exe File opened for modification C:\windows\system\UAIUCHL.exe KDCAMZD.exe File created C:\windows\CMNPOSK.exe.bat NVMY.exe File created C:\windows\system\IIQWJZG.exe.bat EAJWW.exe File created C:\windows\system\SNOZ.exe ZSCWXVP.exe File opened for modification C:\windows\ZNUQJU.exe FAPH.exe File created C:\windows\system\ARZX.exe.bat WBKXK.exe File created C:\windows\system\QZRKDE.exe.bat KZJW.exe File created C:\windows\system\TVMEDT.exe ZIHUB.exe File opened for modification C:\windows\system\YDDOEYJ.exe NLAVEQ.exe File created C:\windows\system\YDDOEYJ.exe.bat NLAVEQ.exe File created C:\windows\IIOXM.exe NFGZYAF.exe File opened for modification C:\windows\system\VBCFE.exe PGDEHCQ.exe File opened for modification C:\windows\system\IKIRUY.exe TPQ.exe File created C:\windows\ZNUQJU.exe.bat FAPH.exe File created C:\windows\ZGO.exe KDFZAIS.exe File created C:\windows\system\HKK.exe.bat XCIUN.exe File created C:\windows\system\NLAVEQ.exe.bat YQQ.exe File opened for modification C:\windows\LWM.exe VBCFE.exe File created C:\windows\GHAIGZQ.exe.bat AMBABW.exe File opened for modification C:\windows\YXZFOX.exe DKUW.exe File created C:\windows\BMDSCP.exe.bat ARZX.exe File created C:\windows\XQENDDU.exe.bat CDZEA.exe File opened for modification C:\windows\system\KZJW.exe ZGO.exe File created C:\windows\VALVB.exe PMUV.exe File opened for modification C:\windows\WUJI.exe GRAVKH.exe File opened for modification C:\windows\system\IIQWJZG.exe EAJWW.exe File created C:\windows\RAIZ.exe QXWVI.exe File opened for modification C:\windows\MKHUVFI.exe UHQQQBA.exe File created C:\windows\WUJI.exe.bat GRAVKH.exe File opened for modification C:\windows\GHAIGZQ.exe AMBABW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5532 cmd.exe 4960 cmd.exe 6080 cmd.exe 4644 cmd.exe 2900 cmd.exe 4372 cmd.exe 4764 cmd.exe 2864 cmd.exe 2128 cmd.exe 4716 cmd.exe 2592 cmd.exe 4604 cmd.exe 4676 cmd.exe 5288 cmd.exe 4112 cmd.exe 1356 cmd.exe 5840 cmd.exe 2428 cmd.exe 1800 cmd.exe 1708 cmd.exe 5524 cmd.exe 1416 cmd.exe 2688 cmd.exe 3044 cmd.exe 3336 cmd.exe 2232 cmd.exe 5348 cmd.exe 3840 cmd.exe 2980 cmd.exe 5360 cmd.exe 1604 cmd.exe 1516 cmd.exe 2056 cmd.exe 2680 cmd.exe 1600 cmd.exe 2284 cmd.exe 4260 cmd.exe 1208 cmd.exe 1668 cmd.exe 2296 cmd.exe 3364 cmd.exe 5216 cmd.exe 944 cmd.exe 4656 cmd.exe 3648 cmd.exe 5540 cmd.exe 1172 cmd.exe 4536 cmd.exe 2672 cmd.exe 2992 cmd.exe 2392 cmd.exe 4248 cmd.exe 3080 cmd.exe 888 cmd.exe 3376 cmd.exe 3000 cmd.exe 2216 cmd.exe 5044 cmd.exe 5008 cmd.exe 5652 cmd.exe 5448 cmd.exe 3272 cmd.exe 4412 cmd.exe 6068 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4532 2820 WerFault.exe 87 4260 4488 WerFault.exe 93 5612 2668 WerFault.exe 99 5576 6088 WerFault.exe 104 3560 4528 WerFault.exe 109 5480 5572 WerFault.exe 114 2592 2088 WerFault.exe 119 2764 5668 WerFault.exe 124 804 432 WerFault.exe 129 3788 1684 WerFault.exe 134 4756 6116 WerFault.exe 139 6120 4992 WerFault.exe 144 4904 1956 WerFault.exe 149 912 5812 WerFault.exe 154 1320 5616 WerFault.exe 159 2992 1640 WerFault.exe 164 1768 4584 WerFault.exe 169 3028 5724 WerFault.exe 174 1820 1752 WerFault.exe 179 2140 1236 WerFault.exe 184 2460 1848 WerFault.exe 189 3020 2928 WerFault.exe 194 2940 4752 WerFault.exe 199 2896 4532 WerFault.exe 204 3836 1876 WerFault.exe 209 2548 828 WerFault.exe 214 5832 1160 WerFault.exe 219 3412 2092 WerFault.exe 224 5848 5104 WerFault.exe 229 3152 1904 WerFault.exe 234 5536 5220 WerFault.exe 239 4756 3456 WerFault.exe 244 4620 816 WerFault.exe 249 2096 2396 WerFault.exe 254 2508 2896 WerFault.exe 259 4740 2760 WerFault.exe 264 3032 4672 WerFault.exe 269 3412 4800 WerFault.exe 274 3028 4952 WerFault.exe 280 2424 6064 WerFault.exe 285 3488 3396 WerFault.exe 290 3832 4728 WerFault.exe 295 1716 5248 WerFault.exe 300 1192 5036 WerFault.exe 305 4980 4680 WerFault.exe 310 4856 5612 WerFault.exe 315 6060 2540 WerFault.exe 320 556 1420 WerFault.exe 325 2800 1932 WerFault.exe 330 3208 5108 WerFault.exe 335 3488 4944 WerFault.exe 340 2772 4548 WerFault.exe 345 940 528 WerFault.exe 350 5924 4252 WerFault.exe 355 4212 4304 WerFault.exe 360 2804 1532 WerFault.exe 365 2344 5556 WerFault.exe 370 5776 5560 WerFault.exe 375 5516 3768 WerFault.exe 380 5016 5276 WerFault.exe 385 4756 3424 WerFault.exe 390 4188 300 WerFault.exe 395 236 2040 WerFault.exe 400 1976 2268 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKIRUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GHAIGZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBKXK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UAIUCHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQNHLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQIWLXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXPMBXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GRAVKH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTUDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKRWGRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZXGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCIUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLAVEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNUQJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDIDESX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIQWJZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OASHOYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVMEDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VALVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBCFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMDSCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVGYAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIVUQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUGSTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2820 2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe 2820 2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe 4488 TUGD.exe 4488 TUGD.exe 2668 OASHOYN.exe 2668 OASHOYN.exe 6088 ADD.exe 6088 ADD.exe 4528 KDFZAIS.exe 4528 KDFZAIS.exe 5572 ZGO.exe 5572 ZGO.exe 2088 KZJW.exe 2088 KZJW.exe 5668 QZRKDE.exe 5668 QZRKDE.exe 432 YEDRND.exe 432 YEDRND.exe 1684 ZIHUB.exe 1684 ZIHUB.exe 6116 TVMEDT.exe 6116 TVMEDT.exe 4992 JLN.exe 4992 JLN.exe 1956 MTUDW.exe 1956 MTUDW.exe 5812 FWXZ.exe 5812 FWXZ.exe 5616 URPLUJQ.exe 5616 URPLUJQ.exe 1640 PMUV.exe 1640 PMUV.exe 4584 VALVB.exe 4584 VALVB.exe 5724 KDCAMZD.exe 5724 KDCAMZD.exe 1752 UAIUCHL.exe 1752 UAIUCHL.exe 1236 NVMY.exe 1236 NVMY.exe 1848 CMNPOSK.exe 1848 CMNPOSK.exe 2928 PWDOC.exe 2928 PWDOC.exe 4752 XCIUN.exe 4752 XCIUN.exe 4532 HKK.exe 4532 HKK.exe 1876 HNODW.exe 1876 HNODW.exe 828 RLTX.exe 828 RLTX.exe 1160 BLVDPD.exe 1160 BLVDPD.exe 2092 QGNH.exe 2092 QGNH.exe 5104 DRJ.exe 5104 DRJ.exe 1904 UHQQQBA.exe 1904 UHQQQBA.exe 5220 MKHUVFI.exe 5220 MKHUVFI.exe 3456 XIS.exe 3456 XIS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2820 2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe 2820 2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe 4488 TUGD.exe 4488 TUGD.exe 2668 OASHOYN.exe 2668 OASHOYN.exe 6088 ADD.exe 6088 ADD.exe 4528 KDFZAIS.exe 4528 KDFZAIS.exe 5572 ZGO.exe 5572 ZGO.exe 2088 KZJW.exe 2088 KZJW.exe 5668 QZRKDE.exe 5668 QZRKDE.exe 432 YEDRND.exe 432 YEDRND.exe 1684 ZIHUB.exe 1684 ZIHUB.exe 6116 TVMEDT.exe 6116 TVMEDT.exe 4992 JLN.exe 4992 JLN.exe 1956 MTUDW.exe 1956 MTUDW.exe 5812 FWXZ.exe 5812 FWXZ.exe 5616 URPLUJQ.exe 5616 URPLUJQ.exe 1640 PMUV.exe 1640 PMUV.exe 4584 VALVB.exe 4584 VALVB.exe 5724 KDCAMZD.exe 5724 KDCAMZD.exe 1752 UAIUCHL.exe 1752 UAIUCHL.exe 1236 NVMY.exe 1236 NVMY.exe 1848 CMNPOSK.exe 1848 CMNPOSK.exe 2928 PWDOC.exe 2928 PWDOC.exe 4752 XCIUN.exe 4752 XCIUN.exe 4532 HKK.exe 4532 HKK.exe 1876 HNODW.exe 1876 HNODW.exe 828 RLTX.exe 828 RLTX.exe 1160 BLVDPD.exe 1160 BLVDPD.exe 2092 QGNH.exe 2092 QGNH.exe 5104 DRJ.exe 5104 DRJ.exe 1904 UHQQQBA.exe 1904 UHQQQBA.exe 5220 MKHUVFI.exe 5220 MKHUVFI.exe 3456 XIS.exe 3456 XIS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 3648 2820 2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe 89 PID 3648 wrote to memory of 4488 3648 cmd.exe 93 PID 4488 wrote to memory of 2892 4488 TUGD.exe 95 PID 2892 wrote to memory of 2668 2892 cmd.exe 99 PID 2668 wrote to memory of 5644 2668 OASHOYN.exe 100 PID 5644 wrote to memory of 6088 5644 cmd.exe 104 PID 6088 wrote to memory of 1776 6088 ADD.exe 105 PID 1776 wrote to memory of 4528 1776 cmd.exe 109 PID 4528 wrote to memory of 1600 4528 KDFZAIS.exe 110 PID 1600 wrote to memory of 5572 1600 cmd.exe 114 PID 5572 wrote to memory of 5540 5572 ZGO.exe 115 PID 5540 wrote to memory of 2088 5540 cmd.exe 119 PID 2088 wrote to memory of 2236 2088 KZJW.exe 120 PID 2236 wrote to memory of 5668 2236 cmd.exe 124 PID 5668 wrote to memory of 5208 5668 QZRKDE.exe 125 PID 5208 wrote to memory of 432 5208 cmd.exe 129 PID 432 wrote to memory of 4368 432 YEDRND.exe 130 PID 4368 wrote to memory of 1684 4368 cmd.exe 134 PID 1684 wrote to memory of 2908 1684 ZIHUB.exe 135 PID 2908 wrote to memory of 6116 2908 cmd.exe 139 PID 6116 wrote to memory of 3316 6116 TVMEDT.exe 140 PID 3316 wrote to memory of 4992 3316 cmd.exe 144 PID 4992 wrote to memory of 4364 4992 JLN.exe 145 PID 4364 wrote to memory of 1956 4364 cmd.exe 149 PID 1956 wrote to memory of 3840 1956 MTUDW.exe 150 PID 3840 wrote to memory of 5812 3840 cmd.exe 154 PID 5812 wrote to memory of 5244 5812 FWXZ.exe 155 PID 5244 wrote to memory of 5616 5244 cmd.exe 159 PID 5616 wrote to memory of 4080 5616 URPLUJQ.exe 160 PID 4080 wrote to memory of 1640 4080 cmd.exe 164 PID 1640 wrote to memory of 2816 1640 PMUV.exe 165 PID 2816 wrote to memory of 4584 2816 cmd.exe 169 PID 4584 wrote to memory of 2720 4584 VALVB.exe 170 PID 2720 wrote to memory of 5724 2720 cmd.exe 174 PID 5724 wrote to memory of 2284 5724 KDCAMZD.exe 175 PID 2284 wrote to memory of 1752 2284 cmd.exe 179 PID 1752 wrote to memory of 1172 1752 UAIUCHL.exe 180 PID 1172 wrote to memory of 1236 1172 cmd.exe 184 PID 1236 wrote to memory of 1200 1236 NVMY.exe 185 PID 1200 wrote to memory of 1848 1200 cmd.exe 189 PID 1848 wrote to memory of 3232 1848 CMNPOSK.exe 190 PID 3232 wrote to memory of 2928 3232 cmd.exe 194 PID 2928 wrote to memory of 5720 2928 PWDOC.exe 195 PID 5720 wrote to memory of 4752 5720 cmd.exe 199 PID 4752 wrote to memory of 5672 4752 XCIUN.exe 200 PID 5672 wrote to memory of 4532 5672 cmd.exe 204 PID 4532 wrote to memory of 1332 4532 HKK.exe 205 PID 1332 wrote to memory of 1876 1332 cmd.exe 209 PID 1876 wrote to memory of 4260 1876 HNODW.exe 210 PID 4260 wrote to memory of 828 4260 cmd.exe 214 PID 828 wrote to memory of 1208 828 RLTX.exe 215 PID 1208 wrote to memory of 1160 1208 cmd.exe 219 PID 1160 wrote to memory of 5348 1160 BLVDPD.exe 220 PID 5348 wrote to memory of 2092 5348 cmd.exe 224 PID 2092 wrote to memory of 5608 2092 QGNH.exe 225 PID 5608 wrote to memory of 5104 5608 cmd.exe 229 PID 5104 wrote to memory of 4644 5104 DRJ.exe 230 PID 4644 wrote to memory of 1904 4644 cmd.exe 234 PID 1904 wrote to memory of 5008 1904 UHQQQBA.exe 235 PID 5008 wrote to memory of 5220 5008 cmd.exe 239 PID 5220 wrote to memory of 3788 5220 MKHUVFI.exe 240 PID 3788 wrote to memory of 3456 3788 cmd.exe 244 PID 3456 wrote to memory of 4112 3456 XIS.exe 245 PID 4112 wrote to memory of 816 4112 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_1afdd5b3bd299f928f837dadad018ab0_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TUGD.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\windows\SysWOW64\TUGD.exeC:\windows\system32\TUGD.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OASHOYN.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\SysWOW64\OASHOYN.exeC:\windows\system32\OASHOYN.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADD.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\system\ADD.exeC:\windows\system\ADD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDFZAIS.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\windows\system\KDFZAIS.exeC:\windows\system\KDFZAIS.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\windows\ZGO.exeC:\windows\ZGO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZJW.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\system\KZJW.exeC:\windows\system\KZJW.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QZRKDE.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\windows\system\QZRKDE.exeC:\windows\system\QZRKDE.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEDRND.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\windows\SysWOW64\YEDRND.exeC:\windows\system32\YEDRND.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIHUB.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\system\ZIHUB.exeC:\windows\system\ZIHUB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TVMEDT.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\system\TVMEDT.exeC:\windows\system\TVMEDT.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLN.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\windows\JLN.exeC:\windows\JLN.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTUDW.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\windows\MTUDW.exeC:\windows\MTUDW.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWXZ.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\windows\FWXZ.exeC:\windows\FWXZ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URPLUJQ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\windows\URPLUJQ.exeC:\windows\URPLUJQ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMUV.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\windows\PMUV.exeC:\windows\PMUV.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VALVB.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\VALVB.exeC:\windows\VALVB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KDCAMZD.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\windows\KDCAMZD.exeC:\windows\KDCAMZD.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAIUCHL.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\windows\system\UAIUCHL.exeC:\windows\system\UAIUCHL.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVMY.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\windows\SysWOW64\NVMY.exeC:\windows\system32\NVMY.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMNPOSK.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\windows\CMNPOSK.exeC:\windows\CMNPOSK.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWDOC.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\windows\system\PWDOC.exeC:\windows\system\PWDOC.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XCIUN.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\windows\SysWOW64\XCIUN.exeC:\windows\system32\XCIUN.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKK.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\windows\system\HKK.exeC:\windows\system\HKK.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNODW.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\windows\SysWOW64\HNODW.exeC:\windows\system32\HNODW.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLVDPD.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\windows\SysWOW64\BLVDPD.exeC:\windows\system32\BLVDPD.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGNH.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\QGNH.exeC:\windows\QGNH.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRJ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\windows\system\DRJ.exeC:\windows\system\DRJ.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHQQQBA.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\UHQQQBA.exeC:\windows\UHQQQBA.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKHUVFI.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\windows\MKHUVFI.exeC:\windows\MKHUVFI.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIS.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\windows\SysWOW64\XIS.exeC:\windows\system32\XIS.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQNHLK.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\windows\TQNHLK.exeC:\windows\TQNHLK.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGTH.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\windows\SysWOW64\FGTH.exeC:\windows\system32\FGTH.exe67⤵
- Executes dropped EXE
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTSQTYI.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4536 -
C:\windows\DTSQTYI.exeC:\windows\DTSQTYI.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEBHI.exe.bat" "70⤵PID:5316
-
C:\windows\SysWOW64\YEBHI.exeC:\windows\system32\YEBHI.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHFK.exe.bat" "72⤵PID:6136
-
C:\windows\SysWOW64\RHFK.exeC:\windows\system32\RHFK.exe73⤵
- Executes dropped EXE
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUJUX.exe.bat" "74⤵PID:5432
-
C:\windows\SysWOW64\MUJUX.exeC:\windows\system32\MUJUX.exe75⤵
- Executes dropped EXE
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCQ.exe.bat" "76⤵PID:2960
-
C:\windows\YCQ.exeC:\windows\YCQ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4248 -
C:\windows\YQQ.exeC:\windows\YQQ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "80⤵PID:780
-
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDDOEYJ.exe.bat" "82⤵PID:2212
-
C:\windows\system\YDDOEYJ.exeC:\windows\system\YDDOEYJ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LOLET.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4516 -
C:\windows\LOLET.exeC:\windows\LOLET.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "86⤵PID:6132
-
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEURIY.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2672 -
C:\windows\SysWOW64\HEURIY.exeC:\windows\system32\HEURIY.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZY.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1668 -
C:\windows\system\ZZY.exeC:\windows\system\ZZY.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2900 -
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIOXM.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:3032 -
C:\windows\IIOXM.exeC:\windows\IIOXM.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQQ.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3080 -
C:\windows\SysWOW64\RQQ.exeC:\windows\system32\RQQ.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRY.exe.bat" "98⤵
- Executes a command shell one-liner
PID:888 -
C:\windows\system\XRY.exeC:\windows\system\XRY.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRAVKH.exe.bat" "100⤵PID:4824
-
C:\windows\GRAVKH.exeC:\windows\GRAVKH.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUJI.exe.bat" "102⤵PID:4712
-
C:\windows\WUJI.exeC:\windows\WUJI.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAJWW.exe.bat" "104⤵PID:4632
-
C:\windows\SysWOW64\EAJWW.exeC:\windows\system32\EAJWW.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIQWJZG.exe.bat" "106⤵PID:4864
-
C:\windows\system\IIQWJZG.exeC:\windows\system\IIQWJZG.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYWEV.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5524 -
C:\windows\system\LYWEV.exeC:\windows\system\LYWEV.exe109⤵
- Executes dropped EXE
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PGDEHCQ.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2296 -
C:\windows\PGDEHCQ.exeC:\windows\PGDEHCQ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "112⤵PID:2876
-
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LWM.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5684 -
C:\windows\LWM.exeC:\windows\LWM.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHWZFGC.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2864 -
C:\windows\SysWOW64\JHWZFGC.exeC:\windows\system32\JHWZFGC.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TPQ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:1556 -
C:\windows\SysWOW64\TPQ.exeC:\windows\system32\TPQ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IKIRUY.exe.bat" "120⤵PID:5788
-
C:\windows\system\IKIRUY.exeC:\windows\system\IKIRUY.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-