Analysis
- max time kernel
91s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_98bff1dc0f83e45b0203d42118569158_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-20_98bff1dc0f83e45b0203d42118569158_elex_emotet_stop.exe
- Size 208KB
- Sample260820-1e2hfaar8v
- SHA256 97b3801925ca7a6d5da13b73b316d0f55cf666d5bfccc4d6f950a363d6372b30
- MD5 98bff1dc0f83e45b0203d42118569158
- SHA1 bf519a919db6dde614fd1c4f7cc41c4962da7f80
- SHA512 80477849faaf13365fb87f83c21660fbadb510a5b3447da6f1ef5d20142a01ffb24c35185b716959993eb5d3ebee3a4f83cf43959d3506deb4dea5d264be0a6c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf94NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOFQEj1
- TLSH T117247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 432 WQP.exe 4616 XIX.exe 5608 VTIYPQB.exe 6112 JRIJZ.exe 3140 NHO.exe 2920 PUG.exe 5900 XIS.exe 4808 BLRVHF.exe 6976 PVZL.exe 2420 IOOW.exe 1148 HZR.exe 6596 JWXHD.exe 4792 YNYG.exe 3568 TXOXQVE.exe 6000 OGP.exe 3808 WLC.exe 264 VEEQQCS.exe 5352 DJRWBA.exe 3724 QUZV.exe 5000 RPD.exe 4140 PIOHDHG.exe 4940 TQVH.exe 6736 BEHW.exe 7080 PGQMGIL.exe 2092 TJOHO.exe 3788 FZVHSMJ.exe 3552 SKLGHXF.exe 5076 HAMF.exe 1524 JYS.exe 3244 KTVVI.exe 3252 ZWF.exe 3480 YHQQCJJ.exe 4220 CPWQ.exe 4392 LXY.exe 3076 MSCZX.exe 2348 ZDLXLAW.exe 1276 ILNCPF.exe 2096 JGQ.exe 6156 LEESJDQ.exe 2600 KPHI.exe 6140 EKMSCJ.exe 3388 FFPVI.exe 6764 GIGRWJ.exe 3748 TOGV.exe 1968 SEZ.exe 5664 YZYZQ.exe 4100 YCCCDSN.exe 752 VIM.exe 4520 IFUDVZ.exe 1260 CYCOFA.exe 4408 KLOVQY.exe 6252 CHS.exe 4692 DKWUIMY.exe 6324 XXBE.exe 5148 BNHEXE.exe 5896 WAM.exe 1336 NJOA.exe 5448 GES.exe 5844 EBLZLX.exe 5880 ZPI.exe 2712 QPKOZ.exe 4248 LKPXJC.exe 1976 PSVF.exe 6508 EIEWUIZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IUBP.exe NHKO.exe File created C:\windows\SysWOW64\PGQMGIL.exe BEHW.exe File created C:\windows\SysWOW64\VHRIOBH.exe.bat CGCXXAR.exe File opened for modification C:\windows\SysWOW64\OCVE.exe VHRIOBH.exe File created C:\windows\SysWOW64\PUG.exe.bat NHO.exe File created C:\windows\SysWOW64\FFPVI.exe EKMSCJ.exe File created C:\windows\SysWOW64\IUBP.exe.bat NHKO.exe File created C:\windows\SysWOW64\KLOVQY.exe.bat CYCOFA.exe File opened for modification C:\windows\SysWOW64\QPKOZ.exe ZPI.exe File opened for modification C:\windows\SysWOW64\BYPW.exe VDLD.exe File opened for modification C:\windows\SysWOW64\BIA.exe IUBP.exe File created C:\windows\SysWOW64\BIA.exe.bat IUBP.exe File created C:\windows\SysWOW64\XIS.exe.bat PUG.exe File created C:\windows\SysWOW64\TXOXQVE.exe YNYG.exe File created C:\windows\SysWOW64\AAEN.exe PHB.exe File created C:\windows\SysWOW64\VHRIOBH.exe CGCXXAR.exe File opened for modification C:\windows\SysWOW64\HUNEW.exe XMLZSVO.exe File created C:\windows\SysWOW64\HUNEW.exe.bat XMLZSVO.exe File created C:\windows\SysWOW64\VDLD.exe GNCDO.exe File created C:\windows\SysWOW64\BIA.exe IUBP.exe File created C:\windows\SysWOW64\TXOXQVE.exe.bat YNYG.exe File opened for modification C:\windows\SysWOW64\TQVH.exe PIOHDHG.exe File created C:\windows\SysWOW64\EBLZLX.exe GES.exe File created C:\windows\SysWOW64\OCVE.exe.bat VHRIOBH.exe File created C:\windows\SysWOW64\SZVJ.exe AZTELPL.exe File created C:\windows\SysWOW64\HUNEW.exe XMLZSVO.exe File opened for modification C:\windows\SysWOW64\VDLD.exe GNCDO.exe File created C:\windows\SysWOW64\VDLD.exe.bat GNCDO.exe File opened for modification C:\windows\SysWOW64\QUZV.exe DJRWBA.exe File created C:\windows\SysWOW64\BNHEXE.exe XXBE.exe File created C:\windows\SysWOW64\BYPW.exe VDLD.exe File created C:\windows\SysWOW64\JKQPNM.exe KSOZNYY.exe File opened for modification C:\windows\SysWOW64\XIS.exe PUG.exe File created C:\windows\SysWOW64\PVZL.exe.bat BLRVHF.exe File opened for modification C:\windows\SysWOW64\BNHEXE.exe XXBE.exe File created C:\windows\SysWOW64\WAM.exe BNHEXE.exe File created C:\windows\SysWOW64\GES.exe.bat NJOA.exe File created C:\windows\SysWOW64\TQVH.exe.bat PIOHDHG.exe File created C:\windows\SysWOW64\GES.exe NJOA.exe File opened for modification C:\windows\SysWOW64\IUBP.exe NHKO.exe File created C:\windows\SysWOW64\PGQMGIL.exe.bat BEHW.exe File opened for modification C:\windows\SysWOW64\WLC.exe OGP.exe File created C:\windows\SysWOW64\XIS.exe PUG.exe File opened for modification C:\windows\SysWOW64\TXOXQVE.exe YNYG.exe File created C:\windows\SysWOW64\QUZV.exe.bat DJRWBA.exe File opened for modification C:\windows\SysWOW64\KLOVQY.exe CYCOFA.exe File created C:\windows\SysWOW64\WAM.exe.bat BNHEXE.exe File created C:\windows\SysWOW64\VNRE.exe UKNBP.exe File created C:\windows\SysWOW64\TQVH.exe PIOHDHG.exe File opened for modification C:\windows\SysWOW64\JYS.exe HAMF.exe File created C:\windows\SysWOW64\KLOVQY.exe CYCOFA.exe File created C:\windows\SysWOW64\NJOA.exe WAM.exe File opened for modification C:\windows\SysWOW64\EBLZLX.exe GES.exe File created C:\windows\SysWOW64\JKQPNM.exe.bat KSOZNYY.exe File created C:\windows\SysWOW64\PUG.exe NHO.exe File created C:\windows\SysWOW64\PVZL.exe BLRVHF.exe File created C:\windows\SysWOW64\FFPVI.exe.bat EKMSCJ.exe File opened for modification C:\windows\SysWOW64\NJOA.exe WAM.exe File created C:\windows\SysWOW64\AAEN.exe.bat PHB.exe File opened for modification C:\windows\SysWOW64\JKQPNM.exe KSOZNYY.exe File created C:\windows\SysWOW64\WLC.exe OGP.exe File opened for modification C:\windows\SysWOW64\PGQMGIL.exe BEHW.exe File created C:\windows\SysWOW64\TOGV.exe.bat GIGRWJ.exe File created C:\windows\SysWOW64\BNHEXE.exe.bat XXBE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\JRIJZ.exe.bat VTIYPQB.exe File created C:\windows\LXY.exe.bat CPWQ.exe File created C:\windows\KPHI.exe.bat LEESJDQ.exe File created C:\windows\JXAVE.exe OCVE.exe File created C:\windows\system\TCUFILM.exe HUNEW.exe File opened for modification C:\windows\system\RPD.exe QUZV.exe File opened for modification C:\windows\CPWQ.exe YHQQCJJ.exe File created C:\windows\CPWQ.exe.bat YHQQCJJ.exe File created C:\windows\JTPAMQ.exe.bat IYLE.exe File created C:\windows\system\TCUFILM.exe.bat HUNEW.exe File opened for modification C:\windows\UQVGEYM.exe JXAVE.exe File created C:\windows\system\UKNBP.exe.bat LKLV.exe File created C:\windows\NRJFVU.exe.bat SOB.exe File opened for modification C:\windows\system\EZYDHK.exe NRJFVU.exe File created C:\windows\system\KAWK.exe JKQPNM.exe File opened for modification C:\windows\BTV.exe NQFGK.exe File created C:\windows\PSVF.exe.bat LKPXJC.exe File created C:\windows\system\NQFGK.exe KAWK.exe File created C:\windows\OGP.exe TXOXQVE.exe File opened for modification C:\windows\system\BEHW.exe TQVH.exe File created C:\windows\RDN.exe.bat BNMKF.exe File created C:\windows\system\JRIJZ.exe VTIYPQB.exe File opened for modification C:\windows\system\GIGRWJ.exe FFPVI.exe File created C:\windows\DKWUIMY.exe.bat CHS.exe File opened for modification C:\windows\LKPXJC.exe QPKOZ.exe File opened for modification C:\windows\system\PHB.exe DPU.exe File opened for modification C:\windows\LKLV.exe MMASZM.exe File created C:\windows\RDN.exe BNMKF.exe File created C:\windows\system\KAWK.exe.bat JKQPNM.exe File created C:\windows\DKWUIMY.exe CHS.exe File opened for modification C:\windows\system\SDWO.exe BVIRBO.exe File created C:\windows\LKLV.exe MMASZM.exe File created C:\windows\system\GYEGWR.exe RDN.exe File opened for modification C:\windows\system\XIX.exe WQP.exe File created C:\windows\system\DJRWBA.exe.bat VEEQQCS.exe File created C:\windows\SKLGHXF.exe.bat FZVHSMJ.exe File created C:\windows\AZTELPL.exe KGQ.exe File created C:\windows\system\PBFU.exe.bat BYPW.exe File opened for modification C:\windows\IFUDVZ.exe VIM.exe File created C:\windows\ZWF.exe.bat KTVVI.exe File opened for modification C:\windows\system\YZYZQ.exe SEZ.exe File created C:\windows\EIEWUIZ.exe.bat PSVF.exe File created C:\windows\NHO.exe.bat JRIJZ.exe File created C:\windows\system\RPD.exe QUZV.exe File created C:\windows\system\GIGRWJ.exe.bat FFPVI.exe File opened for modification C:\windows\system\KSOZNYY.exe GKHZA.exe File created C:\windows\IOOW.exe PVZL.exe File opened for modification C:\windows\system\ZDLXLAW.exe MSCZX.exe File created C:\windows\system\VIM.exe YCCCDSN.exe File opened for modification C:\windows\system\EKMSCJ.exe KPHI.exe File opened for modification C:\windows\system\MPZCO.exe EZYDHK.exe File opened for modification C:\windows\BLRVHF.exe XIS.exe File created C:\windows\BLRVHF.exe.bat XIS.exe File opened for modification C:\windows\KTVVI.exe JYS.exe File created C:\windows\system\ZDLXLAW.exe.bat MSCZX.exe File opened for modification C:\windows\ZPI.exe EBLZLX.exe File opened for modification C:\windows\system\JWXHD.exe HZR.exe File created C:\windows\ZWF.exe KTVVI.exe File opened for modification C:\windows\ZWF.exe KTVVI.exe File created C:\windows\system\PBFU.exe BYPW.exe File created C:\windows\system\CYCOFA.exe.bat IFUDVZ.exe File opened for modification C:\windows\YYCOQR.exe UQVGEYM.exe File opened for modification C:\windows\system\DPU.exe JTPAMQ.exe File created C:\windows\system\MPZCO.exe EZYDHK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5016 cmd.exe 2752 cmd.exe 2776 cmd.exe 5116 cmd.exe 5980 cmd.exe 7060 cmd.exe 7112 cmd.exe 6948 cmd.exe 2696 cmd.exe 3976 cmd.exe 5100 cmd.exe 2836 cmd.exe 1476 cmd.exe 4292 cmd.exe 6012 cmd.exe 7140 cmd.exe 3264 cmd.exe 2764 cmd.exe 6080 cmd.exe 4836 cmd.exe 6256 cmd.exe 4424 cmd.exe 5676 cmd.exe 3268 cmd.exe 5152 cmd.exe 5604 cmd.exe 1624 cmd.exe 676 cmd.exe 2664 cmd.exe 6172 cmd.exe 6832 cmd.exe 2608 cmd.exe 4612 cmd.exe 6644 cmd.exe 5652 cmd.exe 2176 cmd.exe 3716 cmd.exe 4152 cmd.exe 4120 cmd.exe 3756 cmd.exe 3536 cmd.exe 3872 cmd.exe 4384 cmd.exe 1496 cmd.exe 6636 cmd.exe 4624 cmd.exe 6328 cmd.exe 2316 cmd.exe 2360 cmd.exe 3352 cmd.exe 2008 cmd.exe 6352 cmd.exe 1312 cmd.exe 6084 cmd.exe 4540 cmd.exe 1960 cmd.exe 4576 cmd.exe 4744 cmd.exe 6232 cmd.exe 896 cmd.exe 4536 cmd.exe 1100 cmd.exe 4704 cmd.exe 5440 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3352 6812 WerFault.exe 88 480 432 WerFault.exe 94 4392 4616 WerFault.exe 99 4340 5608 WerFault.exe 105 5276 6112 WerFault.exe 110 3992 3140 WerFault.exe 115 1520 2920 WerFault.exe 120 568 5900 WerFault.exe 125 7132 4808 WerFault.exe 130 1512 6976 WerFault.exe 135 6900 2420 WerFault.exe 140 3492 1148 WerFault.exe 145 3304 6596 WerFault.exe 150 5844 4792 WerFault.exe 155 5880 3568 WerFault.exe 160 4100 6000 WerFault.exe 165 2288 3808 WerFault.exe 170 4252 264 WerFault.exe 175 6956 5352 WerFault.exe 180 7124 3724 WerFault.exe 185 6284 5000 WerFault.exe 190 4608 4140 WerFault.exe 195 1176 4940 WerFault.exe 200 6720 6736 WerFault.exe 205 5424 7080 WerFault.exe 210 2916 2092 WerFault.exe 215 1336 3788 WerFault.exe 220 6164 3552 WerFault.exe 225 5420 5076 WerFault.exe 230 4760 1524 WerFault.exe 235 1956 3244 WerFault.exe 240 4132 3252 WerFault.exe 245 4964 3480 WerFault.exe 250 6864 4220 WerFault.exe 255 3120 4392 WerFault.exe 260 4412 3076 WerFault.exe 265 4716 2348 WerFault.exe 271 4692 1276 WerFault.exe 276 6632 2096 WerFault.exe 281 7044 6156 WerFault.exe 286 6460 2600 WerFault.exe 291 2604 6140 WerFault.exe 296 2268 3388 WerFault.exe 301 3988 6764 WerFault.exe 306 2044 3748 WerFault.exe 311 676 1968 WerFault.exe 316 4156 5664 WerFault.exe 321 4116 4100 WerFault.exe 326 5152 752 WerFault.exe 331 5884 4520 WerFault.exe 336 6920 1260 WerFault.exe 341 6024 4408 WerFault.exe 346 5892 6252 WerFault.exe 351 1216 4692 WerFault.exe 356 6652 6324 WerFault.exe 361 1672 5148 WerFault.exe 366 1192 5896 WerFault.exe 371 2612 1336 WerFault.exe 376 6368 5448 WerFault.exe 381 5812 5844 WerFault.exe 386 120 5880 WerFault.exe 391 3476 2712 WerFault.exe 396 4884 4248 WerFault.exe 401 5776 1976 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEEQQCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLRVHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIOHDHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYCOFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJWD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGQMGIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILNCPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYCOQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIGRWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSCZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLOVQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TJOHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDLXLAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRIJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJRWBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKLGHXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWXHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUZV.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6812 2026-08-20_98bff1dc0f83e45b0203d42118569158_elex_emotet_stop.exe 6812 2026-08-20_98bff1dc0f83e45b0203d42118569158_elex_emotet_stop.exe 432 WQP.exe 432 WQP.exe 4616 XIX.exe 4616 XIX.exe 5608 VTIYPQB.exe 5608 VTIYPQB.exe 6112 JRIJZ.exe 6112 JRIJZ.exe 3140 NHO.exe 3140 NHO.exe 2920 PUG.exe 2920 PUG.exe 5900 XIS.exe 5900 XIS.exe 4808 BLRVHF.exe 4808 BLRVHF.exe 6976 PVZL.exe 6976 PVZL.exe 2420 IOOW.exe 2420 IOOW.exe 1148 HZR.exe 1148 HZR.exe 6596 JWXHD.exe 6596 JWXHD.exe 4792 YNYG.exe 4792 YNYG.exe 3568 TXOXQVE.exe 3568 TXOXQVE.exe 6000 OGP.exe 6000 OGP.exe 3808 WLC.exe 3808 WLC.exe 264 VEEQQCS.exe 264 VEEQQCS.exe 5352 DJRWBA.exe 5352 DJRWBA.exe 3724 QUZV.exe 3724 QUZV.exe 5000 RPD.exe 5000 RPD.exe 4140 PIOHDHG.exe 4140 PIOHDHG.exe 4940 TQVH.exe 4940 TQVH.exe 6736 BEHW.exe 6736 BEHW.exe 7080 PGQMGIL.exe 7080 PGQMGIL.exe 2092 TJOHO.exe 2092 TJOHO.exe 3788 FZVHSMJ.exe 3788 FZVHSMJ.exe 3552 SKLGHXF.exe 3552 SKLGHXF.exe 5076 HAMF.exe 5076 HAMF.exe 1524 JYS.exe 1524 JYS.exe 3244 KTVVI.exe 3244 KTVVI.exe 3252 ZWF.exe 3252 ZWF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6812 2026-08-20_98bff1dc0f83e45b0203d42118569158_elex_emotet_stop.exe 6812 2026-08-20_98bff1dc0f83e45b0203d42118569158_elex_emotet_stop.exe 432 WQP.exe 432 WQP.exe 4616 XIX.exe 4616 XIX.exe 5608 VTIYPQB.exe 5608 VTIYPQB.exe 6112 JRIJZ.exe 6112 JRIJZ.exe 3140 NHO.exe 3140 NHO.exe 2920 PUG.exe 2920 PUG.exe 5900 XIS.exe 5900 XIS.exe 4808 BLRVHF.exe 4808 BLRVHF.exe 6976 PVZL.exe 6976 PVZL.exe 2420 IOOW.exe 2420 IOOW.exe 1148 HZR.exe 1148 HZR.exe 6596 JWXHD.exe 6596 JWXHD.exe 4792 YNYG.exe 4792 YNYG.exe 3568 TXOXQVE.exe 3568 TXOXQVE.exe 6000 OGP.exe 6000 OGP.exe 3808 WLC.exe 3808 WLC.exe 264 VEEQQCS.exe 264 VEEQQCS.exe 5352 DJRWBA.exe 5352 DJRWBA.exe 3724 QUZV.exe 3724 QUZV.exe 5000 RPD.exe 5000 RPD.exe 4140 PIOHDHG.exe 4140 PIOHDHG.exe 4940 TQVH.exe 4940 TQVH.exe 6736 BEHW.exe 6736 BEHW.exe 7080 PGQMGIL.exe 7080 PGQMGIL.exe 2092 TJOHO.exe 2092 TJOHO.exe 3788 FZVHSMJ.exe 3788 FZVHSMJ.exe 3552 SKLGHXF.exe 3552 SKLGHXF.exe 5076 HAMF.exe 5076 HAMF.exe 1524 JYS.exe 1524 JYS.exe 3244 KTVVI.exe 3244 KTVVI.exe 3252 ZWF.exe 3252 ZWF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6812 wrote to memory of 7148 6812 2026-08-20_98bff1dc0f83e45b0203d42118569158_elex_emotet_stop.exe 90 PID 7148 wrote to memory of 432 7148 cmd.exe 94 PID 432 wrote to memory of 6256 432 WQP.exe 96 PID 6256 wrote to memory of 4616 6256 cmd.exe 99 PID 4616 wrote to memory of 5136 4616 XIX.exe 101 PID 5136 wrote to memory of 5608 5136 cmd.exe 105 PID 5608 wrote to memory of 5712 5608 VTIYPQB.exe 106 PID 5712 wrote to memory of 6112 5712 cmd.exe 110 PID 6112 wrote to memory of 1960 6112 JRIJZ.exe 111 PID 1960 wrote to memory of 3140 1960 cmd.exe 115 PID 3140 wrote to memory of 4576 3140 NHO.exe 116 PID 4576 wrote to memory of 2920 4576 cmd.exe 120 PID 2920 wrote to memory of 2664 2920 PUG.exe 121 PID 2664 wrote to memory of 5900 2664 cmd.exe 125 PID 5900 wrote to memory of 5612 5900 XIS.exe 126 PID 5612 wrote to memory of 4808 5612 cmd.exe 130 PID 4808 wrote to memory of 4972 4808 BLRVHF.exe 131 PID 4972 wrote to memory of 6976 4972 cmd.exe 135 PID 6976 wrote to memory of 6636 6976 PVZL.exe 136 PID 6636 wrote to memory of 2420 6636 cmd.exe 140 PID 2420 wrote to memory of 4400 2420 IOOW.exe 141 PID 4400 wrote to memory of 1148 4400 cmd.exe 145 PID 1148 wrote to memory of 6480 1148 HZR.exe 146 PID 6480 wrote to memory of 6596 6480 cmd.exe 150 PID 6596 wrote to memory of 4292 6596 JWXHD.exe 151 PID 4292 wrote to memory of 4792 4292 cmd.exe 155 PID 4792 wrote to memory of 3440 4792 YNYG.exe 156 PID 3440 wrote to memory of 3568 3440 cmd.exe 160 PID 3568 wrote to memory of 3852 3568 TXOXQVE.exe 161 PID 3852 wrote to memory of 6000 3852 cmd.exe 165 PID 6000 wrote to memory of 1584 6000 OGP.exe 166 PID 1584 wrote to memory of 3808 1584 cmd.exe 170 PID 3808 wrote to memory of 6944 3808 WLC.exe 171 PID 6944 wrote to memory of 264 6944 cmd.exe 175 PID 264 wrote to memory of 3672 264 VEEQQCS.exe 176 PID 3672 wrote to memory of 5352 3672 cmd.exe 180 PID 5352 wrote to memory of 6012 5352 DJRWBA.exe 181 PID 6012 wrote to memory of 3724 6012 cmd.exe 185 PID 3724 wrote to memory of 6172 3724 QUZV.exe 186 PID 6172 wrote to memory of 5000 6172 cmd.exe 190 PID 5000 wrote to memory of 4568 5000 RPD.exe 191 PID 4568 wrote to memory of 4140 4568 cmd.exe 195 PID 4140 wrote to memory of 2468 4140 PIOHDHG.exe 196 PID 2468 wrote to memory of 4940 2468 cmd.exe 200 PID 4940 wrote to memory of 2912 4940 TQVH.exe 201 PID 2912 wrote to memory of 6736 2912 cmd.exe 205 PID 6736 wrote to memory of 7060 6736 BEHW.exe 206 PID 7060 wrote to memory of 7080 7060 cmd.exe 210 PID 7080 wrote to memory of 6248 7080 PGQMGIL.exe 211 PID 6248 wrote to memory of 2092 6248 cmd.exe 215 PID 2092 wrote to memory of 4704 2092 TJOHO.exe 216 PID 4704 wrote to memory of 3788 4704 cmd.exe 220 PID 3788 wrote to memory of 5544 3788 FZVHSMJ.exe 221 PID 5544 wrote to memory of 3552 5544 cmd.exe 225 PID 3552 wrote to memory of 4152 3552 SKLGHXF.exe 226 PID 4152 wrote to memory of 5076 4152 cmd.exe 230 PID 5076 wrote to memory of 4120 5076 HAMF.exe 231 PID 4120 wrote to memory of 1524 4120 cmd.exe 235 PID 1524 wrote to memory of 4424 1524 JYS.exe 236 PID 4424 wrote to memory of 3244 4424 cmd.exe 240 PID 3244 wrote to memory of 5676 3244 KTVVI.exe 241 PID 5676 wrote to memory of 3252 5676 cmd.exe 245 PID 3252 wrote to memory of 2360 3252 ZWF.exe 246 PID 2360 wrote to memory of 3480 2360 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_98bff1dc0f83e45b0203d42118569158_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_98bff1dc0f83e45b0203d42118569158_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQP.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7148 -
C:\windows\system\WQP.exeC:\windows\system\WQP.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XIX.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6256 -
C:\windows\system\XIX.exeC:\windows\system\XIX.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VTIYPQB.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\windows\system\VTIYPQB.exeC:\windows\system\VTIYPQB.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHO.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\windows\NHO.exeC:\windows\NHO.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUG.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\SysWOW64\PUG.exeC:\windows\system32\PUG.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIS.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\windows\SysWOW64\XIS.exeC:\windows\system32\XIS.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BLRVHF.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\BLRVHF.exeC:\windows\BLRVHF.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVZL.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\SysWOW64\PVZL.exeC:\windows\system32\PVZL.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOOW.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6636 -
C:\windows\IOOW.exeC:\windows\IOOW.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZR.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\HZR.exeC:\windows\HZR.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWXHD.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:6480 -
C:\windows\system\JWXHD.exeC:\windows\system\JWXHD.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNYG.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\windows\system\YNYG.exeC:\windows\system\YNYG.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXOXQVE.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\windows\SysWOW64\TXOXQVE.exeC:\windows\system32\TXOXQVE.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\windows\OGP.exeC:\windows\OGP.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLC.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\windows\SysWOW64\WLC.exeC:\windows\system32\WLC.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VEEQQCS.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:6944 -
C:\windows\system\VEEQQCS.exeC:\windows\system\VEEQQCS.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJRWBA.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\windows\system\DJRWBA.exeC:\windows\system\DJRWBA.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\SysWOW64\QUZV.exeC:\windows\system32\QUZV.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPD.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6172 -
C:\windows\system\RPD.exeC:\windows\system\RPD.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIOHDHG.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\windows\PIOHDHG.exeC:\windows\PIOHDHG.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQVH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\windows\SysWOW64\TQVH.exeC:\windows\system32\TQVH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BEHW.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\system\BEHW.exeC:\windows\system\BEHW.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PGQMGIL.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:7060 -
C:\windows\SysWOW64\PGQMGIL.exeC:\windows\system32\PGQMGIL.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6248 -
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZVHSMJ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\windows\system\FZVHSMJ.exeC:\windows\system\FZVHSMJ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SKLGHXF.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\SKLGHXF.exeC:\windows\SKLGHXF.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAMF.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\HAMF.exeC:\windows\HAMF.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYS.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\SysWOW64\JYS.exeC:\windows\system32\JYS.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTVVI.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\windows\KTVVI.exeC:\windows\KTVVI.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWF.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\ZWF.exeC:\windows\ZWF.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHQQCJJ.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\system\YHQQCJJ.exeC:\windows\system\YHQQCJJ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPWQ.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3352 -
C:\windows\CPWQ.exeC:\windows\CPWQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXY.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5572 -
C:\windows\LXY.exeC:\windows\LXY.exe69⤵
- Executes dropped EXE
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSCZX.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1764 -
C:\windows\MSCZX.exeC:\windows\MSCZX.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDLXLAW.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3268 -
C:\windows\system\ZDLXLAW.exeC:\windows\system\ZDLXLAW.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILNCPF.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:6940 -
C:\windows\system\ILNCPF.exeC:\windows\system\ILNCPF.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JGQ.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2008 -
C:\windows\JGQ.exeC:\windows\JGQ.exe77⤵
- Executes dropped EXE
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LEESJDQ.exe.bat" "78⤵PID:824
-
C:\windows\SysWOW64\LEESJDQ.exeC:\windows\system32\LEESJDQ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPHI.exe.bat" "80⤵
- Executes a command shell one-liner
PID:6832 -
C:\windows\KPHI.exeC:\windows\KPHI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EKMSCJ.exe.bat" "82⤵PID:2116
-
C:\windows\system\EKMSCJ.exeC:\windows\system\EKMSCJ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FFPVI.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:6868 -
C:\windows\SysWOW64\FFPVI.exeC:\windows\system32\FFPVI.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIGRWJ.exe.bat" "86⤵PID:6312
-
C:\windows\system\GIGRWJ.exeC:\windows\system\GIGRWJ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TOGV.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2608 -
C:\windows\SysWOW64\TOGV.exeC:\windows\system32\TOGV.exe89⤵
- Executes dropped EXE
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SEZ.exe.bat" "90⤵PID:5140
-
C:\windows\SEZ.exeC:\windows\SEZ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZYZQ.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3756 -
C:\windows\system\YZYZQ.exeC:\windows\system\YZYZQ.exe93⤵
- Executes dropped EXE
PID:5664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YCCCDSN.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4612 -
C:\windows\system\YCCCDSN.exeC:\windows\system\YCCCDSN.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VIM.exe.bat" "96⤵
- Executes a command shell one-liner
PID:7140 -
C:\windows\system\VIM.exeC:\windows\system\VIM.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IFUDVZ.exe.bat" "98⤵PID:6672
-
C:\windows\IFUDVZ.exeC:\windows\IFUDVZ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYCOFA.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4624 -
C:\windows\system\CYCOFA.exeC:\windows\system\CYCOFA.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLOVQY.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:6184 -
C:\windows\SysWOW64\KLOVQY.exeC:\windows\system32\KLOVQY.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CHS.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1496 -
C:\windows\CHS.exeC:\windows\CHS.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKWUIMY.exe.bat" "106⤵PID:4276
-
C:\windows\DKWUIMY.exeC:\windows\DKWUIMY.exe107⤵
- Executes dropped EXE
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXBE.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2316 -
C:\windows\system\XXBE.exeC:\windows\system\XXBE.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNHEXE.exe.bat" "110⤵PID:6804
-
C:\windows\SysWOW64\BNHEXE.exeC:\windows\system32\BNHEXE.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WAM.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:7112 -
C:\windows\SysWOW64\WAM.exeC:\windows\system32\WAM.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJOA.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1756 -
C:\windows\SysWOW64\NJOA.exeC:\windows\system32\NJOA.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GES.exe.bat" "116⤵PID:6648
-
C:\windows\SysWOW64\GES.exeC:\windows\system32\GES.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBLZLX.exe.bat" "118⤵PID:6380
-
C:\windows\SysWOW64\EBLZLX.exeC:\windows\system32\EBLZLX.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPI.exe.bat" "120⤵PID:2996
-
C:\windows\ZPI.exeC:\windows\ZPI.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-