Analysis
- max time kernel
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe
- Size 208KB
- Sample260819-e54vlawgqf
- SHA256 c17de9d0de1fc2a54c47b39eeba9d5f651d7ca22ad2c9ab36de671c8bc866129
- MD5 bd9f69c443e59251a5c00bb460223612
- SHA1 7de78b0b2010c6f19c760312cc30ef851b113164
- SHA512 9742cbddcdad269190b26e138281b89d4d5a9f9b1025ef7a6f64fe4c050bbfb4fd07680ff3beb7d4a4644fb721d004755c5e0bac1f87a8ba28bdbf46150b76d7
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOf+4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LO2kEj1
- TLSH T150247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3452 KNMLJ.exe 2544 CBMQC.exe 5724 DEQMHMF.exe 3372 OWFWYMN.exe 1376 AEMFD.exe 2988 CCRZ.exe 2920 MAFLAOS.exe 436 QDDGZ.exe 5280 EOMF.exe 2372 OLZZDAZ.exe 4764 GODVJQ.exe 1932 FZGLR.exe 2848 UUP.exe 3920 YXNK.exe 2152 TIEJ.exe 4516 FBLU.exe 3288 FEPQND.exe 3304 YHBTTTW.exe 472 NXCLZP.exe 1508 RFJ.exe 1904 MSNCO.exe 3316 NVRY.exe 5308 SVZM.exe 5548 LYD.exe 5072 GMHZA.exe 4116 XMJEDM.exe 252 MPTI.exe 2012 KCSRTCP.exe 1156 ZFBVM.exe 4216 RGDAQU.exe 4192 VWK.exe 724 ZERIOF.exe 5584 KWUBOMR.exe 1800 LZYX.exe 940 FNCGEC.exe 4712 OVET.exe 5420 NLQ.exe 3476 TGP.exe 5872 VEU.exe 4720 YRZTZ.exe 5360 VSHPISN.exe 4584 EXH.exe 3500 FVNPZ.exe 4284 VQE.exe 1036 BLVDPD.exe 4088 FTK.exe 4804 ZPHMD.exe 828 AKSQQLB.exe 4400 UFPZ.exe 260 PSUJD.exe 2132 TAJRP.exe 5668 QGHG.exe 3212 KTLPHN.exe 2488 BBNCK.exe 1380 KHAJ.exe 5352 TUKBK.exe 4800 CDMGOL.exe 2708 VVHZWSM.exe 6092 HOKR.exe 4732 OJUWPM.exe 6072 FJW.exe 5884 AWBKD.exe 5020 USFUNR.exe 6016 JNPG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JSPVA.exe JNPG.exe File created C:\windows\SysWOW64\GRBCGXL.exe.bat LDXLW.exe File created C:\windows\SysWOW64\KNMLJ.exe 2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe File created C:\windows\SysWOW64\TEMJ.exe.bat JWKWURJ.exe File opened for modification C:\windows\SysWOW64\DPG.exe NZXAWBA.exe File created C:\windows\SysWOW64\FEPQND.exe.bat FBLU.exe File created C:\windows\SysWOW64\GRBCGXL.exe LDXLW.exe File opened for modification C:\windows\SysWOW64\ZFSYS.exe IXQLHEF.exe File created C:\windows\SysWOW64\ZFSYS.exe.bat IXQLHEF.exe File created C:\windows\SysWOW64\TEMJ.exe JWKWURJ.exe File created C:\windows\SysWOW64\BBNCK.exe KTLPHN.exe File opened for modification C:\windows\SysWOW64\GODVJQ.exe OLZZDAZ.exe File created C:\windows\SysWOW64\YXNK.exe UUP.exe File created C:\windows\SysWOW64\NXCLZP.exe YHBTTTW.exe File created C:\windows\SysWOW64\OVET.exe.bat FNCGEC.exe File created C:\windows\SysWOW64\TGP.exe.bat NLQ.exe File opened for modification C:\windows\SysWOW64\EVIB.exe JIDSXCA.exe File created C:\windows\SysWOW64\NZXAWBA.exe IZQM.exe File opened for modification C:\windows\SysWOW64\JIDSXCA.exe DMEJS.exe File created C:\windows\SysWOW64\IXQLHEF.exe.bat CXIYYC.exe File created C:\windows\SysWOW64\BUAJW.exe.bat XMT.exe File created C:\windows\SysWOW64\ZFSYS.exe IXQLHEF.exe File created C:\windows\SysWOW64\NVRY.exe.bat MSNCO.exe File created C:\windows\SysWOW64\FBLU.exe.bat TIEJ.exe File created C:\windows\SysWOW64\ZERIOF.exe VWK.exe File opened for modification C:\windows\SysWOW64\TGP.exe NLQ.exe File opened for modification C:\windows\SysWOW64\KNMLJ.exe 2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\FBLU.exe TIEJ.exe File opened for modification C:\windows\SysWOW64\VEU.exe TGP.exe File created C:\windows\SysWOW64\JIDSXCA.exe.bat DMEJS.exe File created C:\windows\SysWOW64\KHAJ.exe.bat BBNCK.exe File opened for modification C:\windows\SysWOW64\SAWUXSR.exe ZFSYS.exe File opened for modification C:\windows\SysWOW64\NZXAWBA.exe IZQM.exe File created C:\windows\SysWOW64\NZXAWBA.exe.bat IZQM.exe File opened for modification C:\windows\SysWOW64\FVNPZ.exe EXH.exe File opened for modification C:\windows\SysWOW64\AWBKD.exe FJW.exe File created C:\windows\SysWOW64\EVIB.exe JIDSXCA.exe File created C:\windows\SysWOW64\EVIB.exe.bat JIDSXCA.exe File created C:\windows\SysWOW64\NRF.exe.bat JJY.exe File created C:\windows\SysWOW64\VWK.exe.bat RGDAQU.exe File created C:\windows\SysWOW64\AWBKD.exe FJW.exe File opened for modification C:\windows\SysWOW64\NRF.exe JJY.exe File opened for modification C:\windows\SysWOW64\TEMJ.exe JWKWURJ.exe File opened for modification C:\windows\SysWOW64\FEPQND.exe FBLU.exe File created C:\windows\SysWOW64\VEU.exe.bat TGP.exe File opened for modification C:\windows\SysWOW64\TQRFSXP.exe EVIB.exe File created C:\windows\SysWOW64\FBLU.exe TIEJ.exe File opened for modification C:\windows\SysWOW64\OVET.exe FNCGEC.exe File created C:\windows\SysWOW64\LDXLW.exe CDVF.exe File created C:\windows\SysWOW64\BLVDPD.exe.bat VQE.exe File created C:\windows\SysWOW64\KNMLJ.exe.bat 2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\NXCLZP.exe YHBTTTW.exe File created C:\windows\SysWOW64\BUAJW.exe XMT.exe File opened for modification C:\windows\SysWOW64\KHAJ.exe BBNCK.exe File created C:\windows\SysWOW64\HHS.exe HCR.exe File created C:\windows\SysWOW64\NHZJOJ.exe.bat HHS.exe File created C:\windows\SysWOW64\CBMQC.exe.bat KNMLJ.exe File opened for modification C:\windows\SysWOW64\YXNK.exe UUP.exe File created C:\windows\SysWOW64\VWK.exe RGDAQU.exe File opened for modification C:\windows\SysWOW64\ZERIOF.exe VWK.exe File created C:\windows\SysWOW64\TGP.exe NLQ.exe File opened for modification C:\windows\SysWOW64\HUD.exe HOD.exe File opened for modification C:\windows\SysWOW64\BUAJW.exe XMT.exe File created C:\windows\SysWOW64\RGDAQU.exe.bat ZFBVM.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\JWEDR.exe HYLBT.exe File created C:\windows\LZYX.exe KWUBOMR.exe File created C:\windows\VSHPISN.exe YRZTZ.exe File opened for modification C:\windows\VQE.exe FVNPZ.exe File created C:\windows\system\EGUEKRI.exe.bat JSPVA.exe File created C:\windows\system\QWBE.exe.bat EGUEKRI.exe File created C:\windows\system\OWFWYMN.exe.bat DEQMHMF.exe File created C:\windows\system\TIEJ.exe YXNK.exe File opened for modification C:\windows\system\XMJEDM.exe GMHZA.exe File created C:\windows\VQE.exe FVNPZ.exe File created C:\windows\system\AKSQQLB.exe.bat ZPHMD.exe File created C:\windows\TAJRP.exe PSUJD.exe File opened for modification C:\windows\system\VVHZWSM.exe CDMGOL.exe File created C:\windows\system\IVWSZJB.exe.bat NHZJOJ.exe File created C:\windows\system\MAFLAOS.exe CCRZ.exe File opened for modification C:\windows\RFJ.exe NXCLZP.exe File created C:\windows\ZFBVM.exe.bat KCSRTCP.exe File opened for modification C:\windows\EXH.exe VSHPISN.exe File created C:\windows\CDMGOL.exe TUKBK.exe File created C:\windows\JNPG.exe.bat USFUNR.exe File created C:\windows\system\JJY.exe SAWUXSR.exe File created C:\windows\system\XMT.exe.bat TEMJ.exe File created C:\windows\system\OWFWYMN.exe DEQMHMF.exe File opened for modification C:\windows\system\KTLPHN.exe QGHG.exe File created C:\windows\USFUNR.exe.bat AWBKD.exe File opened for modification C:\windows\system\QWBE.exe EGUEKRI.exe File opened for modification C:\windows\WDNSCXT.exe NULNYA.exe File created C:\windows\system\IVWSZJB.exe NHZJOJ.exe File created C:\windows\system\HYLBT.exe.bat QLBJDVK.exe File created C:\windows\DEQMHMF.exe.bat CBMQC.exe File opened for modification C:\windows\system\OLZZDAZ.exe EOMF.exe File created C:\windows\system\FNCGEC.exe.bat LZYX.exe File created C:\windows\EXH.exe VSHPISN.exe File created C:\windows\TUKBK.exe.bat KHAJ.exe File opened for modification C:\windows\system\EGUEKRI.exe JSPVA.exe File created C:\windows\IIW.exe IVWSZJB.exe File opened for modification C:\windows\system\QLBJDVK.exe BUAJW.exe File opened for modification C:\windows\system\KWUBOMR.exe ZERIOF.exe File created C:\windows\UFPZ.exe.bat AKSQQLB.exe File created C:\windows\TUKBK.exe KHAJ.exe File created C:\windows\HOD.exe BOWXX.exe File opened for modification C:\windows\system\HBTFA.exe GYQJVB.exe File created C:\windows\system\JWEDR.exe.bat HYLBT.exe File created C:\windows\system\TIEJ.exe.bat YXNK.exe File created C:\windows\VQE.exe.bat FVNPZ.exe File created C:\windows\system\PSUJD.exe.bat UFPZ.exe File opened for modification C:\windows\IIW.exe IVWSZJB.exe File created C:\windows\AEMFD.exe OWFWYMN.exe File created C:\windows\AEMFD.exe.bat OWFWYMN.exe File created C:\windows\RFJ.exe.bat NXCLZP.exe File opened for modification C:\windows\TAJRP.exe PSUJD.exe File created C:\windows\system\HOKR.exe VVHZWSM.exe File opened for modification C:\windows\FJW.exe OJUWPM.exe File created C:\windows\system\XMT.exe TEMJ.exe File created C:\windows\system\JWEDR.exe HYLBT.exe File created C:\windows\system\KWUBOMR.exe.bat ZERIOF.exe File created C:\windows\system\NLQ.exe OVET.exe File created C:\windows\QGHG.exe TAJRP.exe File created C:\windows\system\KTLPHN.exe QGHG.exe File created C:\windows\system\VVHZWSM.exe CDMGOL.exe File opened for modification C:\windows\LZYX.exe KWUBOMR.exe File opened for modification C:\windows\OJUWPM.exe HOKR.exe File created C:\windows\USFUNR.exe AWBKD.exe File created C:\windows\system\JWKWURJ.exe NRF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4772 cmd.exe 1648 cmd.exe 1924 cmd.exe 5988 cmd.exe 2384 cmd.exe 4112 cmd.exe 1328 cmd.exe 4180 cmd.exe 3960 cmd.exe 4784 cmd.exe 564 cmd.exe 2432 cmd.exe 2116 cmd.exe 4208 cmd.exe 6004 cmd.exe 2360 cmd.exe 3480 cmd.exe 2812 cmd.exe 1316 cmd.exe 3456 cmd.exe 1692 cmd.exe 1084 cmd.exe 2468 cmd.exe 5620 cmd.exe 256 cmd.exe 2320 cmd.exe 4108 cmd.exe 1296 cmd.exe 1220 cmd.exe 1892 cmd.exe 4168 cmd.exe 3040 cmd.exe 3148 cmd.exe 2528 cmd.exe 5416 cmd.exe 3024 cmd.exe 4876 cmd.exe 3188 cmd.exe 1832 cmd.exe 5504 cmd.exe 5944 cmd.exe 572 cmd.exe 3276 cmd.exe 292 cmd.exe 1240 cmd.exe 5076 cmd.exe 1984 cmd.exe 4620 cmd.exe 1628 cmd.exe 2928 cmd.exe 3972 cmd.exe 5252 cmd.exe 2780 cmd.exe 4372 cmd.exe 5300 cmd.exe 1400 cmd.exe 6136 cmd.exe 1876 cmd.exe 3664 cmd.exe 5008 cmd.exe 1368 cmd.exe 1224 cmd.exe 4508 cmd.exe 3340 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5008 5460 WerFault.exe 87 2000 3452 WerFault.exe 93 6124 2544 WerFault.exe 99 244 5724 WerFault.exe 104 4608 3372 WerFault.exe 109 1464 1376 WerFault.exe 114 4216 2988 WerFault.exe 119 3952 2920 WerFault.exe 124 3500 436 WerFault.exe 129 3012 5280 WerFault.exe 134 5688 2372 WerFault.exe 139 5564 4764 WerFault.exe 144 3004 1932 WerFault.exe 149 5072 2848 WerFault.exe 154 4260 3920 WerFault.exe 159 4672 2152 WerFault.exe 164 2648 4516 WerFault.exe 169 2828 3288 WerFault.exe 174 5296 3304 WerFault.exe 179 4728 472 WerFault.exe 184 5796 1508 WerFault.exe 189 3692 1904 WerFault.exe 194 1700 3316 WerFault.exe 199 5832 5308 WerFault.exe 204 4372 5548 WerFault.exe 209 1596 5072 WerFault.exe 214 4152 4116 WerFault.exe 219 4904 252 WerFault.exe 224 2304 2012 WerFault.exe 229 4920 1156 WerFault.exe 234 2900 4216 WerFault.exe 239 4968 4192 WerFault.exe 244 1872 724 WerFault.exe 249 6040 5584 WerFault.exe 254 3628 1800 WerFault.exe 259 6048 940 WerFault.exe 264 4748 4712 WerFault.exe 269 296 5420 WerFault.exe 274 6088 3476 WerFault.exe 279 3836 5872 WerFault.exe 284 796 4720 WerFault.exe 289 5884 5360 WerFault.exe 294 3728 4584 WerFault.exe 299 2396 3500 WerFault.exe 304 5688 4284 WerFault.exe 309 4388 1036 WerFault.exe 314 1804 4088 WerFault.exe 319 3104 4804 WerFault.exe 324 936 828 WerFault.exe 329 4288 4400 WerFault.exe 334 5480 260 WerFault.exe 339 3384 2132 WerFault.exe 344 3328 5668 WerFault.exe 349 5248 3212 WerFault.exe 354 2112 2488 WerFault.exe 359 5340 1380 WerFault.exe 364 5908 5352 WerFault.exe 369 4128 4800 WerFault.exe 374 4656 2708 WerFault.exe 379 1208 6092 WerFault.exe 384 1116 4732 WerFault.exe 389 3348 6072 WerFault.exe 394 484 5884 WerFault.exe 399 1084 5020 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAWUXSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMJEDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWKWURJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUAJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXCLZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWBKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWEDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYQJVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWLOFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLZZDAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVIB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSHPISN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVWSZJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAFLAOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSNCO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTLPHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLBJDVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NZXAWBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDNSCXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEMFD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCRZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YHBTTTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NULNYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5460 2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe 5460 2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe 3452 KNMLJ.exe 3452 KNMLJ.exe 2544 CBMQC.exe 2544 CBMQC.exe 5724 DEQMHMF.exe 5724 DEQMHMF.exe 3372 OWFWYMN.exe 3372 OWFWYMN.exe 1376 AEMFD.exe 1376 AEMFD.exe 2988 CCRZ.exe 2988 CCRZ.exe 2920 MAFLAOS.exe 2920 MAFLAOS.exe 436 QDDGZ.exe 436 QDDGZ.exe 5280 EOMF.exe 5280 EOMF.exe 2372 OLZZDAZ.exe 2372 OLZZDAZ.exe 4764 GODVJQ.exe 4764 GODVJQ.exe 1932 FZGLR.exe 1932 FZGLR.exe 2848 UUP.exe 2848 UUP.exe 3920 YXNK.exe 3920 YXNK.exe 2152 TIEJ.exe 2152 TIEJ.exe 4516 FBLU.exe 4516 FBLU.exe 3288 FEPQND.exe 3288 FEPQND.exe 3304 YHBTTTW.exe 3304 YHBTTTW.exe 472 NXCLZP.exe 472 NXCLZP.exe 1508 RFJ.exe 1508 RFJ.exe 1904 MSNCO.exe 1904 MSNCO.exe 3316 NVRY.exe 3316 NVRY.exe 5308 SVZM.exe 5308 SVZM.exe 5548 LYD.exe 5548 LYD.exe 5072 GMHZA.exe 5072 GMHZA.exe 4116 XMJEDM.exe 4116 XMJEDM.exe 252 MPTI.exe 252 MPTI.exe 2012 KCSRTCP.exe 2012 KCSRTCP.exe 1156 ZFBVM.exe 1156 ZFBVM.exe 4216 RGDAQU.exe 4216 RGDAQU.exe 4192 VWK.exe 4192 VWK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5460 2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe 5460 2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe 3452 KNMLJ.exe 3452 KNMLJ.exe 2544 CBMQC.exe 2544 CBMQC.exe 5724 DEQMHMF.exe 5724 DEQMHMF.exe 3372 OWFWYMN.exe 3372 OWFWYMN.exe 1376 AEMFD.exe 1376 AEMFD.exe 2988 CCRZ.exe 2988 CCRZ.exe 2920 MAFLAOS.exe 2920 MAFLAOS.exe 436 QDDGZ.exe 436 QDDGZ.exe 5280 EOMF.exe 5280 EOMF.exe 2372 OLZZDAZ.exe 2372 OLZZDAZ.exe 4764 GODVJQ.exe 4764 GODVJQ.exe 1932 FZGLR.exe 1932 FZGLR.exe 2848 UUP.exe 2848 UUP.exe 3920 YXNK.exe 3920 YXNK.exe 2152 TIEJ.exe 2152 TIEJ.exe 4516 FBLU.exe 4516 FBLU.exe 3288 FEPQND.exe 3288 FEPQND.exe 3304 YHBTTTW.exe 3304 YHBTTTW.exe 472 NXCLZP.exe 472 NXCLZP.exe 1508 RFJ.exe 1508 RFJ.exe 1904 MSNCO.exe 1904 MSNCO.exe 3316 NVRY.exe 3316 NVRY.exe 5308 SVZM.exe 5308 SVZM.exe 5548 LYD.exe 5548 LYD.exe 5072 GMHZA.exe 5072 GMHZA.exe 4116 XMJEDM.exe 4116 XMJEDM.exe 252 MPTI.exe 252 MPTI.exe 2012 KCSRTCP.exe 2012 KCSRTCP.exe 1156 ZFBVM.exe 1156 ZFBVM.exe 4216 RGDAQU.exe 4216 RGDAQU.exe 4192 VWK.exe 4192 VWK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5460 wrote to memory of 5116 5460 2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe 89 PID 5116 wrote to memory of 3452 5116 cmd.exe 93 PID 3452 wrote to memory of 1972 3452 KNMLJ.exe 95 PID 1972 wrote to memory of 2544 1972 cmd.exe 99 PID 2544 wrote to memory of 4956 2544 CBMQC.exe 100 PID 4956 wrote to memory of 5724 4956 cmd.exe 104 PID 5724 wrote to memory of 1204 5724 DEQMHMF.exe 105 PID 1204 wrote to memory of 3372 1204 cmd.exe 109 PID 3372 wrote to memory of 2468 3372 OWFWYMN.exe 110 PID 2468 wrote to memory of 1376 2468 cmd.exe 114 PID 1376 wrote to memory of 5988 1376 AEMFD.exe 115 PID 5988 wrote to memory of 2988 5988 cmd.exe 119 PID 2988 wrote to memory of 5252 2988 CCRZ.exe 120 PID 5252 wrote to memory of 2920 5252 cmd.exe 124 PID 2920 wrote to memory of 4576 2920 MAFLAOS.exe 125 PID 4576 wrote to memory of 436 4576 cmd.exe 129 PID 436 wrote to memory of 1164 436 QDDGZ.exe 130 PID 1164 wrote to memory of 5280 1164 cmd.exe 134 PID 5280 wrote to memory of 1248 5280 EOMF.exe 135 PID 1248 wrote to memory of 2372 1248 cmd.exe 139 PID 2372 wrote to memory of 3048 2372 OLZZDAZ.exe 140 PID 3048 wrote to memory of 4764 3048 cmd.exe 144 PID 4764 wrote to memory of 5300 4764 GODVJQ.exe 145 PID 5300 wrote to memory of 1932 5300 cmd.exe 149 PID 1932 wrote to memory of 1188 1932 FZGLR.exe 150 PID 1188 wrote to memory of 2848 1188 cmd.exe 154 PID 2848 wrote to memory of 4508 2848 UUP.exe 155 PID 4508 wrote to memory of 3920 4508 cmd.exe 159 PID 3920 wrote to memory of 5328 3920 YXNK.exe 160 PID 5328 wrote to memory of 2152 5328 cmd.exe 164 PID 2152 wrote to memory of 1784 2152 TIEJ.exe 165 PID 1784 wrote to memory of 4516 1784 cmd.exe 169 PID 4516 wrote to memory of 3164 4516 FBLU.exe 170 PID 3164 wrote to memory of 3288 3164 cmd.exe 174 PID 3288 wrote to memory of 4916 3288 FEPQND.exe 175 PID 4916 wrote to memory of 3304 4916 cmd.exe 179 PID 3304 wrote to memory of 4492 3304 YHBTTTW.exe 180 PID 4492 wrote to memory of 472 4492 cmd.exe 184 PID 472 wrote to memory of 4760 472 NXCLZP.exe 185 PID 4760 wrote to memory of 1508 4760 cmd.exe 189 PID 1508 wrote to memory of 3340 1508 RFJ.exe 190 PID 3340 wrote to memory of 1904 3340 cmd.exe 194 PID 1904 wrote to memory of 6004 1904 MSNCO.exe 195 PID 6004 wrote to memory of 3316 6004 cmd.exe 199 PID 3316 wrote to memory of 6080 3316 NVRY.exe 200 PID 6080 wrote to memory of 5308 6080 cmd.exe 204 PID 5308 wrote to memory of 5620 5308 SVZM.exe 205 PID 5620 wrote to memory of 5548 5620 cmd.exe 209 PID 5548 wrote to memory of 1984 5548 LYD.exe 210 PID 1984 wrote to memory of 5072 1984 cmd.exe 214 PID 5072 wrote to memory of 3024 5072 GMHZA.exe 215 PID 3024 wrote to memory of 4116 3024 cmd.exe 219 PID 4116 wrote to memory of 2360 4116 XMJEDM.exe 220 PID 2360 wrote to memory of 252 2360 cmd.exe 224 PID 252 wrote to memory of 5944 252 MPTI.exe 225 PID 5944 wrote to memory of 2012 5944 cmd.exe 229 PID 2012 wrote to memory of 2604 2012 KCSRTCP.exe 230 PID 2604 wrote to memory of 1156 2604 cmd.exe 234 PID 1156 wrote to memory of 5464 1156 ZFBVM.exe 235 PID 5464 wrote to memory of 4216 5464 cmd.exe 239 PID 4216 wrote to memory of 5216 4216 RGDAQU.exe 240 PID 5216 wrote to memory of 4192 5216 cmd.exe 244 PID 4192 wrote to memory of 2384 4192 VWK.exe 245 PID 2384 wrote to memory of 724 2384 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_bd9f69c443e59251a5c00bb460223612_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNMLJ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\windows\SysWOW64\KNMLJ.exeC:\windows\system32\KNMLJ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBMQC.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\SysWOW64\CBMQC.exeC:\windows\system32\CBMQC.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DEQMHMF.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\DEQMHMF.exeC:\windows\DEQMHMF.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OWFWYMN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\system\OWFWYMN.exeC:\windows\system\OWFWYMN.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AEMFD.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\windows\AEMFD.exeC:\windows\AEMFD.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCRZ.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\windows\CCRZ.exeC:\windows\CCRZ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MAFLAOS.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\windows\system\MAFLAOS.exeC:\windows\system\MAFLAOS.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QDDGZ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\system\QDDGZ.exeC:\windows\system\QDDGZ.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EOMF.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\windows\system\EOMF.exeC:\windows\system\EOMF.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OLZZDAZ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\system\OLZZDAZ.exeC:\windows\system\OLZZDAZ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GODVJQ.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\SysWOW64\GODVJQ.exeC:\windows\system32\GODVJQ.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZGLR.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\windows\FZGLR.exeC:\windows\FZGLR.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUP.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\windows\UUP.exeC:\windows\UUP.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXNK.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\windows\SysWOW64\YXNK.exeC:\windows\system32\YXNK.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TIEJ.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\windows\system\TIEJ.exeC:\windows\system\TIEJ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBLU.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\windows\SysWOW64\FBLU.exeC:\windows\system32\FBLU.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FEPQND.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\windows\SysWOW64\FEPQND.exeC:\windows\system32\FEPQND.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHBTTTW.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\windows\YHBTTTW.exeC:\windows\YHBTTTW.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NXCLZP.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\SysWOW64\NXCLZP.exeC:\windows\system32\NXCLZP.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFJ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\windows\RFJ.exeC:\windows\RFJ.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSNCO.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\windows\SysWOW64\MSNCO.exeC:\windows\system32\MSNCO.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVRY.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\SysWOW64\NVRY.exeC:\windows\system32\NVRY.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SVZM.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\system\SVZM.exeC:\windows\system\SVZM.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYD.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\windows\system\LYD.exeC:\windows\system\LYD.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMHZA.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\windows\system\GMHZA.exeC:\windows\system\GMHZA.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XMJEDM.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\system\XMJEDM.exeC:\windows\system\XMJEDM.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPTI.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\system\MPTI.exeC:\windows\system\MPTI.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCSRTCP.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\KCSRTCP.exeC:\windows\KCSRTCP.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFBVM.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\windows\ZFBVM.exeC:\windows\ZFBVM.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RGDAQU.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\windows\SysWOW64\RGDAQU.exeC:\windows\system32\RGDAQU.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWK.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\windows\SysWOW64\VWK.exeC:\windows\system32\VWK.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZERIOF.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\windows\SysWOW64\ZERIOF.exeC:\windows\system32\ZERIOF.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWUBOMR.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5176 -
C:\windows\system\KWUBOMR.exeC:\windows\system\KWUBOMR.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZYX.exe.bat" "68⤵PID:2484
-
C:\windows\LZYX.exeC:\windows\LZYX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNCGEC.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4112 -
C:\windows\system\FNCGEC.exeC:\windows\system\FNCGEC.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVET.exe.bat" "72⤵PID:856
-
C:\windows\SysWOW64\OVET.exeC:\windows\system32\OVET.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLQ.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1892 -
C:\windows\system\NLQ.exeC:\windows\system\NLQ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGP.exe.bat" "76⤵PID:1596
-
C:\windows\SysWOW64\TGP.exeC:\windows\system32\TGP.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEU.exe.bat" "78⤵
- Executes a command shell one-liner
PID:256 -
C:\windows\SysWOW64\VEU.exeC:\windows\system32\VEU.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YRZTZ.exe.bat" "80⤵PID:1868
-
C:\windows\system\YRZTZ.exeC:\windows\system\YRZTZ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSHPISN.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:6116 -
C:\windows\VSHPISN.exeC:\windows\VSHPISN.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXH.exe.bat" "84⤵
- Executes a command shell one-liner
PID:572 -
C:\windows\EXH.exeC:\windows\EXH.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVNPZ.exe.bat" "86⤵PID:2300
-
C:\windows\SysWOW64\FVNPZ.exeC:\windows\system32\FVNPZ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQE.exe.bat" "88⤵PID:4276
-
C:\windows\VQE.exeC:\windows\VQE.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLVDPD.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4168 -
C:\windows\SysWOW64\BLVDPD.exeC:\windows\system32\BLVDPD.exe91⤵
- Executes dropped EXE
PID:1036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTK.exe.bat" "92⤵PID:4124
-
C:\windows\FTK.exeC:\windows\FTK.exe93⤵
- Executes dropped EXE
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPHMD.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4876 -
C:\windows\system\ZPHMD.exeC:\windows\system\ZPHMD.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AKSQQLB.exe.bat" "96⤵PID:4296
-
C:\windows\system\AKSQQLB.exeC:\windows\system\AKSQQLB.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFPZ.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2780 -
C:\windows\UFPZ.exeC:\windows\UFPZ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSUJD.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3276 -
C:\windows\system\PSUJD.exeC:\windows\system\PSUJD.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAJRP.exe.bat" "102⤵PID:5736
-
C:\windows\TAJRP.exeC:\windows\TAJRP.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGHG.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3456 -
C:\windows\QGHG.exeC:\windows\QGHG.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTLPHN.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2320 -
C:\windows\system\KTLPHN.exeC:\windows\system\KTLPHN.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBNCK.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2900 -
C:\windows\SysWOW64\BBNCK.exeC:\windows\system32\BBNCK.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHAJ.exe.bat" "110⤵PID:5400
-
C:\windows\SysWOW64\KHAJ.exeC:\windows\system32\KHAJ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUKBK.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:1372 -
C:\windows\TUKBK.exeC:\windows\TUKBK.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CDMGOL.exe.bat" "114⤵PID:4972
-
C:\windows\CDMGOL.exeC:\windows\CDMGOL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVHZWSM.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4108 -
C:\windows\system\VVHZWSM.exeC:\windows\system\VVHZWSM.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOKR.exe.bat" "118⤵PID:2744
-
C:\windows\system\HOKR.exeC:\windows\system\HOKR.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJUWPM.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:292 -
C:\windows\OJUWPM.exeC:\windows\OJUWPM.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-