Analysis
- max time kernel
83s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 15:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe
- Size 208KB
- Sample260820-tbvr6afj71
- SHA256 143d835b36d0a218631cfa9d2f13f0ca00db21fd3628f6b70af88220ec858720
- MD5 20c295a35356102fcc5b5558977a8f12
- SHA1 02aebb9bf42b85b86f09d04ba425f88fffae193d
- SHA512 0d4d6a3df7b8aff04448045d022fa2e0a29408c71baf6176a82bc9fdfcec30c830675920ed27b553bdcb448e912892a0f86e7f436578a601a9df15f8e737d337
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfC4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO6QEj1
- TLSH T168247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 884 NDERX.exe 2780 EWH.exe 4440 GTUSEJ.exe 5584 MHUS.exe 1816 KEFNWRG.exe 3520 BPVLVMC.exe 3124 HQDZ.exe 4508 ALPDSE.exe 2204 VVXTYP.exe 1576 GJWZD.exe 2612 FHP.exe 2804 JKNPYP.exe 3028 AXYH.exe 5036 ZIBXWR.exe 4088 OYCPV.exe 2664 SGQXHFC.exe 3576 HBABS.exe 788 XRB.exe 6108 RMGKJ.exe 2644 ZSKRU.exe 4812 BQYL.exe 1800 CTCHPK.exe 3412 VOF.exe 3340 VRJGAQE.exe 988 ZHQG.exe 376 MJGFATW.exe 2684 NMKJGJ.exe 5472 PKQ.exe 1568 FARUUNV.exe 4516 NGDBEL.exe 2516 XEJVMU.exe 2592 EUKVSHO.exe 1868 KRDQNM.exe 2740 INUQ.exe 4792 JIGUYF.exe 4480 IGRX.exe 4064 PWSORGS.exe 3328 BEZWD.exe 6036 DBNJ.exe 6064 SRO.exe 1376 RCQYA.exe 5836 ZQDF.exe 4612 HVIL.exe 4428 YEWJAW.exe 3628 FZIKOT.exe 1972 HMZLZE.exe 3896 ENBWL.exe 4132 BDO.exe 4768 YDYPXLY.exe 2668 GJDWHS.exe 2676 JEUYBDB.exe 1452 RJGELCX.exe 5388 PUJUUQ.exe 3320 BNZFDJ.exe 1860 FYXA.exe 3332 JDHQUFG.exe 1356 RJUWEDB.exe 3532 FHUIG.exe 3208 YHJTX.exe 1644 GXKK.exe 5928 BATJKOD.exe 4308 YACLWK.exe 5368 UGNBMNH.exe 4532 XOV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\NMKJGJ.exe MJGFATW.exe File created C:\windows\SysWOW64\REUQK.exe.bat WRQ.exe File created C:\windows\SysWOW64\FHP.exe.bat GJWZD.exe File created C:\windows\SysWOW64\HBABS.exe.bat SGQXHFC.exe File opened for modification C:\windows\SysWOW64\FYXA.exe BNZFDJ.exe File created C:\windows\SysWOW64\NGDBEL.exe.bat FARUUNV.exe File opened for modification C:\windows\SysWOW64\VPFU.exe GZE.exe File created C:\windows\SysWOW64\VPFU.exe.bat GZE.exe File opened for modification C:\windows\SysWOW64\JDHQUFG.exe FYXA.exe File created C:\windows\SysWOW64\MUSTCN.exe.bat IMLT.exe File opened for modification C:\windows\SysWOW64\RMGKJ.exe XRB.exe File created C:\windows\SysWOW64\FHP.exe GJWZD.exe File created C:\windows\SysWOW64\MJGFATW.exe ZHQG.exe File created C:\windows\SysWOW64\BEZWD.exe.bat PWSORGS.exe File created C:\windows\SysWOW64\TQVH.exe.bat IXS.exe File opened for modification C:\windows\SysWOW64\MUSTCN.exe IMLT.exe File created C:\windows\SysWOW64\SGQXHFC.exe.bat OYCPV.exe File opened for modification C:\windows\SysWOW64\FARUUNV.exe PKQ.exe File created C:\windows\SysWOW64\XEJVMU.exe.bat NGDBEL.exe File opened for modification C:\windows\SysWOW64\BEZWD.exe PWSORGS.exe File created C:\windows\SysWOW64\GXKK.exe YHJTX.exe File created C:\windows\SysWOW64\REUQK.exe WRQ.exe File opened for modification C:\windows\SysWOW64\NWUHDQQ.exe UTQLQ.exe File opened for modification C:\windows\SysWOW64\TQVH.exe IXS.exe File created C:\windows\SysWOW64\FLIU.exe.bat BVBUX.exe File created C:\windows\SysWOW64\NGDBEL.exe FARUUNV.exe File created C:\windows\SysWOW64\FYXA.exe.bat BNZFDJ.exe File created C:\windows\SysWOW64\IMLT.exe.bat FRGKGVP.exe File opened for modification C:\windows\SysWOW64\INUQ.exe KRDQNM.exe File opened for modification C:\windows\SysWOW64\MHUS.exe GTUSEJ.exe File created C:\windows\SysWOW64\VVXTYP.exe.bat ALPDSE.exe File created C:\windows\SysWOW64\HBABS.exe SGQXHFC.exe File created C:\windows\SysWOW64\CTCHPK.exe.bat BQYL.exe File opened for modification C:\windows\SysWOW64\NMKJGJ.exe MJGFATW.exe File created C:\windows\SysWOW64\EUKVSHO.exe XEJVMU.exe File created C:\windows\SysWOW64\XOV.exe UGNBMNH.exe File opened for modification C:\windows\SysWOW64\MGK.exe DFITFHE.exe File created C:\windows\SysWOW64\ZFMU.exe VPFU.exe File created C:\windows\SysWOW64\IGRX.exe JIGUYF.exe File opened for modification C:\windows\SysWOW64\HQDZ.exe BPVLVMC.exe File created C:\windows\SysWOW64\HQDZ.exe.bat BPVLVMC.exe File opened for modification C:\windows\SysWOW64\EUKVSHO.exe XEJVMU.exe File created C:\windows\SysWOW64\XEJVMU.exe NGDBEL.exe File created C:\windows\SysWOW64\NWUHDQQ.exe UTQLQ.exe File opened for modification C:\windows\SysWOW64\FLIU.exe BVBUX.exe File opened for modification C:\windows\SysWOW64\SGQXHFC.exe OYCPV.exe File created C:\windows\SysWOW64\XOV.exe.bat UGNBMNH.exe File opened for modification C:\windows\SysWOW64\ZFMU.exe VPFU.exe File created C:\windows\SysWOW64\MUSTCN.exe IMLT.exe File opened for modification C:\windows\SysWOW64\JIGUYF.exe INUQ.exe File created C:\windows\SysWOW64\KEFNWRG.exe MHUS.exe File created C:\windows\SysWOW64\SGQXHFC.exe OYCPV.exe File opened for modification C:\windows\SysWOW64\YDYPXLY.exe BDO.exe File opened for modification C:\windows\SysWOW64\KEFNWRG.exe MHUS.exe File opened for modification C:\windows\SysWOW64\XOV.exe UGNBMNH.exe File created C:\windows\SysWOW64\QCZU.exe IWMN.exe File created C:\windows\SysWOW64\IMLT.exe FRGKGVP.exe File created C:\windows\SysWOW64\INUQ.exe.bat KRDQNM.exe File created C:\windows\SysWOW64\YDYPXLY.exe.bat BDO.exe File created C:\windows\SysWOW64\TQVH.exe IXS.exe File created C:\windows\SysWOW64\HQDZ.exe BPVLVMC.exe File opened for modification C:\windows\SysWOW64\HBABS.exe SGQXHFC.exe File opened for modification C:\windows\SysWOW64\DBNJ.exe BEZWD.exe File created C:\windows\SysWOW64\YDYPXLY.exe BDO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\CMHPUBA.exe.bat NRYKJG.exe File created C:\windows\system\XHMY.exe.bat CMHPUBA.exe File created C:\windows\system\YAMC.exe EMHSPKP.exe File opened for modification C:\windows\BVBUX.exe GIW.exe File opened for modification C:\windows\XHWWG.exe LOB.exe File created C:\windows\ZIBXWR.exe.bat AXYH.exe File opened for modification C:\windows\PKQ.exe NMKJGJ.exe File created C:\windows\PKQ.exe.bat NMKJGJ.exe File created C:\windows\system\UGNBMNH.exe YACLWK.exe File opened for modification C:\windows\system\CMHPUBA.exe NRYKJG.exe File created C:\windows\system\YAMC.exe.bat EMHSPKP.exe File created C:\windows\WLKZMC.exe.bat FLIU.exe File created C:\windows\BPVLVMC.exe KEFNWRG.exe File opened for modification C:\windows\RCQYA.exe SRO.exe File created C:\windows\system\YRZTZ.exe XOV.exe File created C:\windows\system\WRQ.exe.bat FJOBWDP.exe File opened for modification C:\windows\system\YAMC.exe EMHSPKP.exe File created C:\windows\system\FRGKGVP.exe.bat YBFL.exe File created C:\windows\system\GHYKJC.exe XHWWG.exe File opened for modification C:\windows\NDERX.exe 2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe File created C:\windows\KRDQNM.exe.bat EUKVSHO.exe File created C:\windows\SRO.exe.bat DBNJ.exe File created C:\windows\RCQYA.exe.bat SRO.exe File created C:\windows\system\HMZLZE.exe.bat FZIKOT.exe File created C:\windows\system\BDO.exe ENBWL.exe File opened for modification C:\windows\BATJKOD.exe GXKK.exe File opened for modification C:\windows\NRYKJG.exe NWUHDQQ.exe File opened for modification C:\windows\system\OYCPV.exe ZIBXWR.exe File created C:\windows\system\XRB.exe.bat HBABS.exe File created C:\windows\ZQDF.exe.bat RCQYA.exe File opened for modification C:\windows\FHUIG.exe RJUWEDB.exe File created C:\windows\system\YACLWK.exe BATJKOD.exe File created C:\windows\system\LOB.exe.bat WLKZMC.exe File created C:\windows\system\ZHQG.exe.bat VRJGAQE.exe File created C:\windows\JEUYBDB.exe.bat GJDWHS.exe File created C:\windows\GIW.exe MUSTCN.exe File opened for modification C:\windows\system\JKNPYP.exe FHP.exe File created C:\windows\system\YEWJAW.exe HVIL.exe File opened for modification C:\windows\system\HMZLZE.exe FZIKOT.exe File opened for modification C:\windows\system\ENBWL.exe HMZLZE.exe File created C:\windows\PUJUUQ.exe RJGELCX.exe File created C:\windows\FJOBWDP.exe MGK.exe File opened for modification C:\windows\GQDJUPL.exe KFUK.exe File created C:\windows\system\EMHSPKP.exe QCZU.exe File created C:\windows\FHUIG.exe.bat RJUWEDB.exe File opened for modification C:\windows\ZOK.exe YTGE.exe File created C:\windows\IXS.exe YAMC.exe File opened for modification C:\windows\IXS.exe YAMC.exe File created C:\windows\system\FRGKGVP.exe YBFL.exe File opened for modification C:\windows\GTUSEJ.exe EWH.exe File created C:\windows\system\OYCPV.exe ZIBXWR.exe File created C:\windows\system\VOF.exe CTCHPK.exe File opened for modification C:\windows\SRO.exe DBNJ.exe File opened for modification C:\windows\VRJGAQE.exe VOF.exe File created C:\windows\KFUK.exe XHMY.exe File opened for modification C:\windows\system\LOB.exe WLKZMC.exe File created C:\windows\system\ALPDSE.exe HQDZ.exe File created C:\windows\GJWZD.exe VVXTYP.exe File opened for modification C:\windows\ZIBXWR.exe AXYH.exe File created C:\windows\XHWWG.exe LOB.exe File created C:\windows\HVIL.exe.bat ZQDF.exe File created C:\windows\system\HMZLZE.exe FZIKOT.exe File opened for modification C:\windows\BNZFDJ.exe PUJUUQ.exe File created C:\windows\system\WRQ.exe FJOBWDP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1232 cmd.exe 4328 cmd.exe 4800 cmd.exe 3104 cmd.exe 5772 cmd.exe 4992 cmd.exe 756 cmd.exe 4836 cmd.exe 4568 cmd.exe 4180 cmd.exe 2632 cmd.exe 3812 cmd.exe 4068 cmd.exe 1760 cmd.exe 3508 cmd.exe 2808 cmd.exe 1052 cmd.exe 556 cmd.exe 4660 cmd.exe 704 cmd.exe 5484 cmd.exe 4732 cmd.exe 2552 cmd.exe 3064 cmd.exe 3352 cmd.exe 5656 cmd.exe 3724 cmd.exe 1540 cmd.exe 696 cmd.exe 1464 cmd.exe 4896 cmd.exe 5580 cmd.exe 5220 cmd.exe 1008 cmd.exe 1744 cmd.exe 4108 cmd.exe 1748 cmd.exe 3552 cmd.exe 3356 cmd.exe 3164 cmd.exe 5612 cmd.exe 1640 cmd.exe 3900 cmd.exe 4580 cmd.exe 3020 cmd.exe 2680 cmd.exe 5832 cmd.exe 5292 cmd.exe 3052 cmd.exe 5360 cmd.exe 4712 cmd.exe 6024 cmd.exe 2576 cmd.exe 3468 cmd.exe 944 cmd.exe 1048 cmd.exe 5176 cmd.exe 2272 cmd.exe 408 cmd.exe 612 cmd.exe 1440 cmd.exe 5424 cmd.exe 1148 cmd.exe 3116 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6016 472 WerFault.exe 87 1312 884 WerFault.exe 93 5928 2780 WerFault.exe 99 2716 4440 WerFault.exe 104 696 5584 WerFault.exe 109 5804 1816 WerFault.exe 114 5128 3520 WerFault.exe 119 5156 3124 WerFault.exe 124 2388 4508 WerFault.exe 129 2524 2204 WerFault.exe 134 2036 1576 WerFault.exe 139 3560 2612 WerFault.exe 144 4104 2804 WerFault.exe 148 5092 3028 WerFault.exe 153 5044 5036 WerFault.exe 159 3736 4088 WerFault.exe 164 5356 2664 WerFault.exe 169 4128 3576 WerFault.exe 174 2676 788 WerFault.exe 179 5824 6108 WerFault.exe 184 5752 2644 WerFault.exe 189 3020 4812 WerFault.exe 194 1668 1800 WerFault.exe 199 4372 3412 WerFault.exe 204 2368 3340 WerFault.exe 209 124 988 WerFault.exe 214 4436 376 WerFault.exe 219 3404 2684 WerFault.exe 224 2824 5472 WerFault.exe 229 5612 1568 WerFault.exe 234 2552 4516 WerFault.exe 239 5280 2516 WerFault.exe 244 1856 2592 WerFault.exe 249 2520 1868 WerFault.exe 254 4644 2740 WerFault.exe 259 3044 4792 WerFault.exe 264 2656 4480 WerFault.exe 269 2996 4064 WerFault.exe 275 1204 3328 WerFault.exe 280 4668 6036 WerFault.exe 285 4944 6064 WerFault.exe 290 5376 1376 WerFault.exe 295 1268 5836 WerFault.exe 300 4592 4612 WerFault.exe 305 1944 4428 WerFault.exe 310 4588 3628 WerFault.exe 315 240 1972 WerFault.exe 320 5028 3896 WerFault.exe 325 5580 4132 WerFault.exe 330 5256 4768 WerFault.exe 335 1440 2668 WerFault.exe 340 5824 2676 WerFault.exe 345 5752 1452 WerFault.exe 349 5952 5388 WerFault.exe 355 3792 3320 WerFault.exe 360 1228 1860 WerFault.exe 365 2064 3332 WerFault.exe 370 5944 1356 WerFault.exe 375 1128 3532 WerFault.exe 379 5460 3208 WerFault.exe 385 2404 1644 WerFault.exe 390 5632 5928 WerFault.exe 395 2148 4308 WerFault.exe 400 4592 5368 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KEFNWRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXBT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALPDSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BQYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIGUYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YTGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FARUUNV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRDQNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJDWHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUJUUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REUQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZIBXWR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGQXHFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDHQUFG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWUHDQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPVLVMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RMGKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENBWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMHSPKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUSTCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHWWG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHUS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 472 2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe 472 2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe 884 NDERX.exe 884 NDERX.exe 2780 EWH.exe 2780 EWH.exe 4440 GTUSEJ.exe 4440 GTUSEJ.exe 5584 MHUS.exe 5584 MHUS.exe 1816 KEFNWRG.exe 1816 KEFNWRG.exe 3520 BPVLVMC.exe 3520 BPVLVMC.exe 3124 HQDZ.exe 3124 HQDZ.exe 4508 ALPDSE.exe 4508 ALPDSE.exe 2204 VVXTYP.exe 2204 VVXTYP.exe 1576 GJWZD.exe 1576 GJWZD.exe 2612 FHP.exe 2612 FHP.exe 2804 JKNPYP.exe 2804 JKNPYP.exe 3028 AXYH.exe 3028 AXYH.exe 5036 ZIBXWR.exe 5036 ZIBXWR.exe 4088 OYCPV.exe 4088 OYCPV.exe 2664 SGQXHFC.exe 2664 SGQXHFC.exe 3576 HBABS.exe 3576 HBABS.exe 788 XRB.exe 788 XRB.exe 6108 RMGKJ.exe 6108 RMGKJ.exe 2644 ZSKRU.exe 2644 ZSKRU.exe 4812 BQYL.exe 4812 BQYL.exe 1800 CTCHPK.exe 1800 CTCHPK.exe 3412 VOF.exe 3412 VOF.exe 3340 VRJGAQE.exe 3340 VRJGAQE.exe 988 ZHQG.exe 988 ZHQG.exe 376 MJGFATW.exe 376 MJGFATW.exe 2684 NMKJGJ.exe 2684 NMKJGJ.exe 5472 PKQ.exe 5472 PKQ.exe 1568 FARUUNV.exe 1568 FARUUNV.exe 4516 NGDBEL.exe 4516 NGDBEL.exe 2516 XEJVMU.exe 2516 XEJVMU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 472 2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe 472 2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe 884 NDERX.exe 884 NDERX.exe 2780 EWH.exe 2780 EWH.exe 4440 GTUSEJ.exe 4440 GTUSEJ.exe 5584 MHUS.exe 5584 MHUS.exe 1816 KEFNWRG.exe 1816 KEFNWRG.exe 3520 BPVLVMC.exe 3520 BPVLVMC.exe 3124 HQDZ.exe 3124 HQDZ.exe 4508 ALPDSE.exe 4508 ALPDSE.exe 2204 VVXTYP.exe 2204 VVXTYP.exe 1576 GJWZD.exe 1576 GJWZD.exe 2612 FHP.exe 2612 FHP.exe 2804 JKNPYP.exe 2804 JKNPYP.exe 3028 AXYH.exe 3028 AXYH.exe 5036 ZIBXWR.exe 5036 ZIBXWR.exe 4088 OYCPV.exe 4088 OYCPV.exe 2664 SGQXHFC.exe 2664 SGQXHFC.exe 3576 HBABS.exe 3576 HBABS.exe 788 XRB.exe 788 XRB.exe 6108 RMGKJ.exe 6108 RMGKJ.exe 2644 ZSKRU.exe 2644 ZSKRU.exe 4812 BQYL.exe 4812 BQYL.exe 1800 CTCHPK.exe 1800 CTCHPK.exe 3412 VOF.exe 3412 VOF.exe 3340 VRJGAQE.exe 3340 VRJGAQE.exe 988 ZHQG.exe 988 ZHQG.exe 376 MJGFATW.exe 376 MJGFATW.exe 2684 NMKJGJ.exe 2684 NMKJGJ.exe 5472 PKQ.exe 5472 PKQ.exe 1568 FARUUNV.exe 1568 FARUUNV.exe 4516 NGDBEL.exe 4516 NGDBEL.exe 2516 XEJVMU.exe 2516 XEJVMU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 472 wrote to memory of 5096 472 2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe 89 PID 5096 wrote to memory of 884 5096 cmd.exe 93 PID 884 wrote to memory of 1552 884 NDERX.exe 95 PID 1552 wrote to memory of 2780 1552 cmd.exe 99 PID 2780 wrote to memory of 1748 2780 EWH.exe 100 PID 1748 wrote to memory of 4440 1748 cmd.exe 104 PID 4440 wrote to memory of 52 4440 GTUSEJ.exe 105 PID 52 wrote to memory of 5584 52 cmd.exe 109 PID 5584 wrote to memory of 4836 5584 MHUS.exe 110 PID 4836 wrote to memory of 1816 4836 cmd.exe 114 PID 1816 wrote to memory of 5832 1816 KEFNWRG.exe 115 PID 5832 wrote to memory of 3520 5832 cmd.exe 119 PID 3520 wrote to memory of 4528 3520 BPVLVMC.exe 120 PID 4528 wrote to memory of 3124 4528 cmd.exe 124 PID 3124 wrote to memory of 4956 3124 HQDZ.exe 125 PID 4956 wrote to memory of 4508 4956 cmd.exe 129 PID 4508 wrote to memory of 4660 4508 ALPDSE.exe 130 PID 4660 wrote to memory of 2204 4660 cmd.exe 134 PID 2204 wrote to memory of 5560 2204 VVXTYP.exe 135 PID 5560 wrote to memory of 1576 5560 cmd.exe 139 PID 1576 wrote to memory of 3228 1576 GJWZD.exe 140 PID 3228 wrote to memory of 2612 3228 cmd.exe 144 PID 2612 wrote to memory of 3552 2612 FHP.exe 145 PID 3552 wrote to memory of 2804 3552 cmd.exe 148 PID 2804 wrote to memory of 4068 2804 JKNPYP.exe 150 PID 4068 wrote to memory of 3028 4068 cmd.exe 153 PID 3028 wrote to memory of 5424 3028 AXYH.exe 155 PID 5424 wrote to memory of 5036 5424 cmd.exe 159 PID 5036 wrote to memory of 6000 5036 ZIBXWR.exe 160 PID 6000 wrote to memory of 4088 6000 cmd.exe 164 PID 4088 wrote to memory of 1048 4088 OYCPV.exe 165 PID 1048 wrote to memory of 2664 1048 cmd.exe 169 PID 2664 wrote to memory of 6060 2664 SGQXHFC.exe 170 PID 6060 wrote to memory of 3576 6060 cmd.exe 174 PID 3576 wrote to memory of 2660 3576 HBABS.exe 175 PID 2660 wrote to memory of 788 2660 cmd.exe 179 PID 788 wrote to memory of 5976 788 XRB.exe 180 PID 5976 wrote to memory of 6108 5976 cmd.exe 184 PID 6108 wrote to memory of 3372 6108 RMGKJ.exe 185 PID 3372 wrote to memory of 2644 3372 cmd.exe 189 PID 2644 wrote to memory of 3528 2644 ZSKRU.exe 190 PID 3528 wrote to memory of 4812 3528 cmd.exe 194 PID 4812 wrote to memory of 5868 4812 BQYL.exe 195 PID 5868 wrote to memory of 1800 5868 cmd.exe 199 PID 1800 wrote to memory of 2024 1800 CTCHPK.exe 200 PID 2024 wrote to memory of 3412 2024 cmd.exe 204 PID 3412 wrote to memory of 908 3412 VOF.exe 205 PID 908 wrote to memory of 3340 908 cmd.exe 209 PID 3340 wrote to memory of 1880 3340 VRJGAQE.exe 210 PID 1880 wrote to memory of 988 1880 cmd.exe 214 PID 988 wrote to memory of 3884 988 ZHQG.exe 215 PID 3884 wrote to memory of 376 3884 cmd.exe 219 PID 376 wrote to memory of 2812 376 MJGFATW.exe 220 PID 2812 wrote to memory of 2684 2812 cmd.exe 224 PID 2684 wrote to memory of 4580 2684 NMKJGJ.exe 225 PID 4580 wrote to memory of 5472 4580 cmd.exe 229 PID 5472 wrote to memory of 3500 5472 PKQ.exe 230 PID 3500 wrote to memory of 1568 3500 cmd.exe 234 PID 1568 wrote to memory of 2984 1568 FARUUNV.exe 235 PID 2984 wrote to memory of 4516 2984 cmd.exe 239 PID 4516 wrote to memory of 4568 4516 NGDBEL.exe 240 PID 4568 wrote to memory of 2516 4568 cmd.exe 244 PID 2516 wrote to memory of 3064 2516 XEJVMU.exe 245 PID 3064 wrote to memory of 2592 3064 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_20c295a35356102fcc5b5558977a8f12_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDERX.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\windows\NDERX.exeC:\windows\NDERX.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWH.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\windows\system\EWH.exeC:\windows\system\EWH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTUSEJ.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\GTUSEJ.exeC:\windows\GTUSEJ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHUS.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:52 -
C:\windows\SysWOW64\MHUS.exeC:\windows\system32\MHUS.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KEFNWRG.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\SysWOW64\KEFNWRG.exeC:\windows\system32\KEFNWRG.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPVLVMC.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\BPVLVMC.exeC:\windows\BPVLVMC.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HQDZ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\SysWOW64\HQDZ.exeC:\windows\system32\HQDZ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ALPDSE.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\system\ALPDSE.exeC:\windows\system\ALPDSE.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVXTYP.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\SysWOW64\VVXTYP.exeC:\windows\system32\VVXTYP.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJWZD.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\GJWZD.exeC:\windows\GJWZD.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FHP.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\windows\SysWOW64\FHP.exeC:\windows\system32\FHP.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKNPYP.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\windows\system\JKNPYP.exeC:\windows\system\JKNPYP.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AXYH.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\windows\SysWOW64\AXYH.exeC:\windows\system32\AXYH.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZIBXWR.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\ZIBXWR.exeC:\windows\ZIBXWR.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYCPV.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\windows\system\OYCPV.exeC:\windows\system\OYCPV.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGQXHFC.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\windows\SysWOW64\SGQXHFC.exeC:\windows\system32\SGQXHFC.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBABS.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\SysWOW64\HBABS.exeC:\windows\system32\HBABS.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\windows\system\XRB.exeC:\windows\system\XRB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMGKJ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\SysWOW64\RMGKJ.exeC:\windows\system32\RMGKJ.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSKRU.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\ZSKRU.exeC:\windows\ZSKRU.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BQYL.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\BQYL.exeC:\windows\BQYL.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CTCHPK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\SysWOW64\CTCHPK.exeC:\windows\system32\CTCHPK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VOF.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\windows\system\VOF.exeC:\windows\system\VOF.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRJGAQE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\windows\VRJGAQE.exeC:\windows\VRJGAQE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZHQG.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\windows\system\ZHQG.exeC:\windows\system\ZHQG.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJGFATW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\windows\SysWOW64\MJGFATW.exeC:\windows\system32\MJGFATW.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMKJGJ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\windows\SysWOW64\NMKJGJ.exeC:\windows\system32\NMKJGJ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKQ.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\PKQ.exeC:\windows\PKQ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FARUUNV.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\windows\SysWOW64\FARUUNV.exeC:\windows\system32\FARUUNV.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGDBEL.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\windows\SysWOW64\NGDBEL.exeC:\windows\system32\NGDBEL.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEJVMU.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\windows\SysWOW64\XEJVMU.exeC:\windows\system32\XEJVMU.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EUKVSHO.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\SysWOW64\EUKVSHO.exeC:\windows\system32\EUKVSHO.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KRDQNM.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3352 -
C:\windows\KRDQNM.exeC:\windows\KRDQNM.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INUQ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5656 -
C:\windows\SysWOW64\INUQ.exeC:\windows\system32\INUQ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIGUYF.exe.bat" "70⤵PID:5740
-
C:\windows\SysWOW64\JIGUYF.exeC:\windows\system32\JIGUYF.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IGRX.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4616 -
C:\windows\SysWOW64\IGRX.exeC:\windows\system32\IGRX.exe73⤵
- Executes dropped EXE
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWSORGS.exe.bat" "74⤵PID:692
-
C:\windows\PWSORGS.exeC:\windows\PWSORGS.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEZWD.exe.bat" "76⤵PID:4872
-
C:\windows\SysWOW64\BEZWD.exeC:\windows\system32\BEZWD.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBNJ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3356 -
C:\windows\SysWOW64\DBNJ.exeC:\windows\system32\DBNJ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRO.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2192 -
C:\windows\SRO.exeC:\windows\SRO.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RCQYA.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\windows\RCQYA.exeC:\windows\RCQYA.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQDF.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\windows\ZQDF.exeC:\windows\ZQDF.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVIL.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1760 -
C:\windows\HVIL.exeC:\windows\HVIL.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEWJAW.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3508 -
C:\windows\system\YEWJAW.exeC:\windows\system\YEWJAW.exe89⤵
- Executes dropped EXE
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZIKOT.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5292 -
C:\windows\FZIKOT.exeC:\windows\FZIKOT.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMZLZE.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3052 -
C:\windows\system\HMZLZE.exeC:\windows\system\HMZLZE.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ENBWL.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2528 -
C:\windows\system\ENBWL.exeC:\windows\system\ENBWL.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BDO.exe.bat" "96⤵PID:3220
-
C:\windows\system\BDO.exeC:\windows\system\BDO.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDYPXLY.exe.bat" "98⤵PID:2376
-
C:\windows\SysWOW64\YDYPXLY.exeC:\windows\system32\YDYPXLY.exe99⤵
- Executes dropped EXE
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJDWHS.exe.bat" "100⤵PID:1380
-
C:\windows\GJDWHS.exeC:\windows\GJDWHS.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JEUYBDB.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\windows\JEUYBDB.exeC:\windows\JEUYBDB.exe103⤵
- Executes dropped EXE
PID:2676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJGELCX.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\windows\system\RJGELCX.exeC:\windows\system\RJGELCX.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUJUUQ.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3580 -
C:\windows\PUJUUQ.exeC:\windows\PUJUUQ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNZFDJ.exe.bat" "108⤵PID:4496
-
C:\windows\BNZFDJ.exeC:\windows\BNZFDJ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYXA.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2132 -
C:\windows\SysWOW64\FYXA.exeC:\windows\system32\FYXA.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDHQUFG.exe.bat" "112⤵
- Executes a command shell one-liner
PID:756 -
C:\windows\SysWOW64\JDHQUFG.exeC:\windows\system32\JDHQUFG.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJUWEDB.exe.bat" "114⤵PID:5420
-
C:\windows\RJUWEDB.exeC:\windows\RJUWEDB.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHUIG.exe.bat" "116⤵PID:236
-
C:\windows\FHUIG.exeC:\windows\FHUIG.exe117⤵
- Executes dropped EXE
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHJTX.exe.bat" "118⤵
- Executes a command shell one-liner
PID:1148 -
C:\windows\YHJTX.exeC:\windows\YHJTX.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXKK.exe.bat" "120⤵PID:1572
-
C:\windows\SysWOW64\GXKK.exeC:\windows\system32\GXKK.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-