Analysis
- max time kernel
100s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 23:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_6382318c2e7d3175988556f3fb83b73a_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-25_6382318c2e7d3175988556f3fb83b73a_elex_emotet_stop.exe
- Size 208KB
- Sample260826-3cdppscj61
- SHA256 29b60fd4b3b352f239fe1bc15196da58e39bd25852cd18601c0b7d38e406c613
- MD5 6382318c2e7d3175988556f3fb83b73a
- SHA1 11e1b770a473b8d49bbd6fd48149f7a12b5aebe4
- SHA512 725cbc5fc79a46497d7408a96f85325dc1beda225ba17642410dd1228d5bec4347929271b9830acff91fca1676e0fd07e342169056054ba791b09bb572609053
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf14pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOdkEj1
- TLSH T167247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2420 BLRVHF.exe 2552 ETEB.exe 2516 WMABLZR.exe 920 CMHPUBA.exe 1220 IHHQZ.exe 896 KFUK.exe 5476 FSRTQM.exe 2236 RIGT.exe 4456 MWKLN.exe 6948 PMR.exe 292 ZMTQ.exe 5568 LCAYHE.exe 3468 PKGYTX.exe 3064 JXL.exe 6012 CAPL.exe 4340 OIWLVFC.exe 6828 IEAU.exe 6480 UWDNN.exe 4512 DXFSRR.exe 1420 EAJWW.exe 4452 BARKF.exe 6516 NSMDOR.exe 1960 TTTQ.exe 1108 KTVVI.exe 1368 FOAFKQB.exe 2904 KPIS.exe 5452 DKM.exe 6768 JKT.exe 3212 PFTLVG.exe 2588 YTDDKCI.exe 5676 TGIM.exe 4228 VTNWX.exe 3816 VZFKGP.exe 1276 LCWO.exe 3984 FPBYCB.exe 2880 ACY.exe 4496 GYXQJ.exe 2996 VTG.exe 5604 QGLEE.exe 7072 BZOWMG.exe 908 VUT.exe 6496 FUVL.exe 5416 NFEMO.exe 1160 HAJWQI.exe 6660 XQKVX.exe 3644 CQRJGFN.exe 244 OJM.exe 5940 IWRLY.exe 6796 UPUE.exe 3688 DCEWOQM.exe 1788 XPJF.exe 2824 JIEYH.exe 2400 DVJIRXF.exe 3356 ABPXYH.exe 3372 LTS.exe 1840 CUUCKU.exe 3408 IUBQTO.exe 2896 TNWBBEH.exe 2376 XDDJN.exe 2508 DDLXWQF.exe 5160 YQQG.exe 5388 YWQVI.exe 3344 SRVESD.exe 5372 WZBE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VJAIHTM.exe.bat KQXPZE.exe File created C:\windows\SysWOW64\JKAG.exe QHWCL.exe File opened for modification C:\windows\SysWOW64\FSRTQM.exe KFUK.exe File created C:\windows\SysWOW64\HAJWQI.exe NFEMO.exe File created C:\windows\SysWOW64\HAJWQI.exe.bat NFEMO.exe File opened for modification C:\windows\SysWOW64\AJZ.exe JBXGGO.exe File opened for modification C:\windows\SysWOW64\WLV.exe WGVPGHE.exe File created C:\windows\SysWOW64\TYNJRNZ.exe VIC.exe File opened for modification C:\windows\SysWOW64\UCDZZ.exe JKAG.exe File created C:\windows\SysWOW64\UCDZZ.exe.bat JKAG.exe File created C:\windows\SysWOW64\LCAYHE.exe ZMTQ.exe File created C:\windows\SysWOW64\LCAYHE.exe.bat ZMTQ.exe File opened for modification C:\windows\SysWOW64\MJRG.exe RNM.exe File created C:\windows\SysWOW64\MQRV.exe.bat SCVLNRN.exe File created C:\windows\SysWOW64\AJZ.exe JBXGGO.exe File created C:\windows\SysWOW64\UUJ.exe UOI.exe File created C:\windows\SysWOW64\PDAF.exe EKX.exe File created C:\windows\SysWOW64\BJHVQ.exe.bat VJAIHTM.exe File created C:\windows\SysWOW64\IUBQTO.exe CUUCKU.exe File created C:\windows\SysWOW64\LRWTYNK.exe ZYT.exe File created C:\windows\SysWOW64\MJRG.exe.bat RNM.exe File opened for modification C:\windows\SysWOW64\GYXQJ.exe ACY.exe File opened for modification C:\windows\SysWOW64\CQRJGFN.exe XQKVX.exe File created C:\windows\SysWOW64\CQRJGFN.exe.bat XQKVX.exe File created C:\windows\SysWOW64\ZXXGJK.exe FRVGPLT.exe File created C:\windows\SysWOW64\PEIXTN.exe.bat XVOSI.exe File opened for modification C:\windows\SysWOW64\IUBQTO.exe CUUCKU.exe File opened for modification C:\windows\SysWOW64\DCEWOQM.exe UPUE.exe File created C:\windows\SysWOW64\ZNREODW.exe OVW.exe File created C:\windows\SysWOW64\PDAF.exe.bat EKX.exe File created C:\windows\SysWOW64\BJHVQ.exe VJAIHTM.exe File created C:\windows\SysWOW64\JKAG.exe.bat QHWCL.exe File created C:\windows\SysWOW64\YTDDKCI.exe PFTLVG.exe File created C:\windows\SysWOW64\FRVGPLT.exe UZAWH.exe File opened for modification C:\windows\SysWOW64\ZXXGJK.exe FRVGPLT.exe File created C:\windows\SysWOW64\LFWFN.exe NFO.exe File created C:\windows\SysWOW64\LFWFN.exe.bat NFO.exe File opened for modification C:\windows\SysWOW64\JKAG.exe QHWCL.exe File created C:\windows\SysWOW64\WMABLZR.exe.bat ETEB.exe File created C:\windows\SysWOW64\MJRG.exe RNM.exe File created C:\windows\SysWOW64\ZXXGJK.exe.bat FRVGPLT.exe File created C:\windows\SysWOW64\XVOSI.exe TNZ.exe File opened for modification C:\windows\SysWOW64\TYNJRNZ.exe VIC.exe File created C:\windows\SysWOW64\FRVGPLT.exe.bat UZAWH.exe File created C:\windows\SysWOW64\JBXGGO.exe.bat UDSJZ.exe File created C:\windows\SysWOW64\AHOJN.exe HMLFIR.exe File created C:\windows\SysWOW64\ZNREODW.exe.bat OVW.exe File created C:\windows\SysWOW64\UCDZZ.exe JKAG.exe File created C:\windows\SysWOW64\PMR.exe MWKLN.exe File opened for modification C:\windows\SysWOW64\PMR.exe MWKLN.exe File created C:\windows\SysWOW64\GYXQJ.exe ACY.exe File created C:\windows\SysWOW64\CUUCKU.exe LTS.exe File opened for modification C:\windows\SysWOW64\CUUCKU.exe LTS.exe File created C:\windows\SysWOW64\LRWTYNK.exe.bat ZYT.exe File opened for modification C:\windows\SysWOW64\VJAIHTM.exe KQXPZE.exe File created C:\windows\SysWOW64\FSRTQM.exe.bat KFUK.exe File created C:\windows\SysWOW64\JBXGGO.exe UDSJZ.exe File opened for modification C:\windows\SysWOW64\UUJ.exe UOI.exe File created C:\windows\SysWOW64\ZMTQ.exe.bat PMR.exe File created C:\windows\SysWOW64\EAJWW.exe DXFSRR.exe File created C:\windows\SysWOW64\FPBYCB.exe LCWO.exe File created C:\windows\SysWOW64\PEIXTN.exe XVOSI.exe File created C:\windows\SysWOW64\WLV.exe.bat WGVPGHE.exe File opened for modification C:\windows\SysWOW64\LFWFN.exe NFO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\DDLXWQF.exe XDDJN.exe File created C:\windows\system\FUVL.exe.bat VUT.exe File opened for modification C:\windows\LTS.exe ABPXYH.exe File opened for modification C:\windows\system\PSB.exe EZYDHK.exe File created C:\windows\RAIZ.exe.bat RUI.exe File opened for modification C:\windows\TNZ.exe ZAVA.exe File created C:\windows\EESQG.exe YRTPBJM.exe File created C:\windows\RCOKK.exe.bat NUIKYW.exe File opened for modification C:\windows\system\CMHPUBA.exe WMABLZR.exe File created C:\windows\system\MWKLN.exe RIGT.exe File created C:\windows\OUGLB.exe.bat VRCIVJ.exe File created C:\windows\EQQ.exe TYNJRNZ.exe File opened for modification C:\windows\system\KFEG.exe ZXXGJK.exe File opened for modification C:\windows\CFYLYS.exe LFWFN.exe File created C:\windows\PKGYTX.exe LCAYHE.exe File created C:\windows\XDDJN.exe TNWBBEH.exe File created C:\windows\system\ZYT.exe.bat TYMNG.exe File created C:\windows\WGVPGHE.exe.bat ZAXAZY.exe File opened for modification C:\windows\QZAVS.exe WLV.exe File created C:\windows\TTTQ.exe.bat NSMDOR.exe File created C:\windows\VTNWX.exe TGIM.exe File opened for modification C:\windows\system\IWRLY.exe OJM.exe File created C:\windows\FSOY.exe NSMLOXQ.exe File opened for modification C:\windows\TYMNG.exe FSOY.exe File opened for modification C:\windows\HMLFIR.exe QZAVS.exe File created C:\windows\CFYLYS.exe LFWFN.exe File created C:\windows\QHWCL.exe.bat EQQ.exe File opened for modification C:\windows\system\VZFKGP.exe VTNWX.exe File created C:\windows\UZAWH.exe.bat XBUY.exe File created C:\windows\ZAVA.exe.bat PSB.exe File created C:\windows\CAPL.exe.bat JXL.exe File opened for modification C:\windows\XBUY.exe MJRG.exe File created C:\windows\XBUY.exe.bat MJRG.exe File created C:\windows\ETEB.exe BLRVHF.exe File created C:\windows\system\RIGT.exe FSRTQM.exe File created C:\windows\system\VZFKGP.exe.bat VTNWX.exe File created C:\windows\YWQVI.exe.bat YQQG.exe File opened for modification C:\windows\OUGLB.exe VRCIVJ.exe File created C:\windows\QZAVS.exe WLV.exe File opened for modification C:\windows\system\BARKF.exe EAJWW.exe File opened for modification C:\windows\KPIS.exe FOAFKQB.exe File created C:\windows\XBUY.exe MJRG.exe File created C:\windows\system\KFEG.exe.bat ZXXGJK.exe File created C:\windows\system\NUIKYW.exe.bat AJZ.exe File opened for modification C:\windows\IGCKF.exe UBWN.exe File opened for modification C:\windows\JXL.exe PKGYTX.exe File created C:\windows\system\TGIM.exe.bat YTDDKCI.exe File created C:\windows\VTG.exe GYXQJ.exe File created C:\windows\LTS.exe ABPXYH.exe File created C:\windows\system\YKPZXC.exe UUJ.exe File opened for modification C:\windows\VTNWX.exe TGIM.exe File opened for modification C:\windows\system\UPUE.exe IWRLY.exe File created C:\windows\system\MNNJY.exe.bat RAIZ.exe File created C:\windows\system\MBKO.exe BJHVQ.exe File created C:\windows\system\BARKF.exe EAJWW.exe File created C:\windows\VUT.exe BZOWMG.exe File opened for modification C:\windows\system\DVJIRXF.exe JIEYH.exe File opened for modification C:\windows\YWQVI.exe YQQG.exe File created C:\windows\CFYLYS.exe.bat LFWFN.exe File opened for modification C:\windows\system\TGIM.exe YTDDKCI.exe File created C:\windows\TYMNG.exe FSOY.exe File created C:\windows\system\RNM.exe MNNJY.exe File created C:\windows\NFO.exe MBKO.exe File opened for modification C:\windows\system\QGLEE.exe VTG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5516 cmd.exe 472 cmd.exe 7096 cmd.exe 4160 cmd.exe 200 cmd.exe 4352 cmd.exe 6856 cmd.exe 6168 cmd.exe 1608 cmd.exe 6176 cmd.exe 852 cmd.exe 3556 cmd.exe 6432 cmd.exe 3628 cmd.exe 6364 cmd.exe 760 cmd.exe 6136 cmd.exe 6624 cmd.exe 4260 cmd.exe 6832 cmd.exe 2808 cmd.exe 3676 cmd.exe 4492 cmd.exe 4176 cmd.exe 3808 cmd.exe 3604 cmd.exe 2172 cmd.exe 2532 cmd.exe 828 cmd.exe 5924 cmd.exe 1580 cmd.exe 6256 cmd.exe 476 cmd.exe 5024 cmd.exe 1260 cmd.exe 2748 cmd.exe 904 cmd.exe 4200 cmd.exe 6492 cmd.exe 3272 cmd.exe 3668 cmd.exe 3524 cmd.exe 3124 cmd.exe 6756 cmd.exe 6140 cmd.exe 1200 cmd.exe 4840 cmd.exe 4856 cmd.exe 4928 cmd.exe 6816 cmd.exe 1672 cmd.exe 4356 cmd.exe 1204 cmd.exe 5912 cmd.exe 6120 cmd.exe 2056 cmd.exe 4792 cmd.exe 2484 cmd.exe 3020 cmd.exe 480 cmd.exe 5804 cmd.exe 4076 cmd.exe 6536 cmd.exe 5124 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4956 964 WerFault.exe 88 7040 2420 WerFault.exe 94 3460 2552 WerFault.exe 100 5136 2516 WerFault.exe 104 1312 920 WerFault.exe 110 4352 1220 WerFault.exe 115 2784 896 WerFault.exe 120 5280 5476 WerFault.exe 125 2292 2236 WerFault.exe 130 3164 4456 WerFault.exe 135 3528 6948 WerFault.exe 140 6884 292 WerFault.exe 145 1752 5568 WerFault.exe 150 6132 3468 WerFault.exe 155 2856 3064 WerFault.exe 160 2768 6012 WerFault.exe 165 5968 4340 WerFault.exe 170 4212 6828 WerFault.exe 175 3220 6480 WerFault.exe 180 1208 4512 WerFault.exe 185 1224 1420 WerFault.exe 190 2972 4452 WerFault.exe 195 7000 6516 WerFault.exe 200 5280 1960 WerFault.exe 205 4464 1108 WerFault.exe 210 6604 1368 WerFault.exe 215 5720 2904 WerFault.exe 220 4980 5452 WerFault.exe 225 3672 6768 WerFault.exe 230 3280 3212 WerFault.exe 235 4992 2588 WerFault.exe 240 7164 5676 WerFault.exe 245 1620 4228 WerFault.exe 250 3752 3816 WerFault.exe 255 1896 1276 WerFault.exe 260 5784 3984 WerFault.exe 265 468 2880 WerFault.exe 270 204 4496 WerFault.exe 275 3180 2996 WerFault.exe 280 5256 5604 WerFault.exe 285 5104 7072 WerFault.exe 290 5172 908 WerFault.exe 295 5900 6496 WerFault.exe 300 3272 5416 WerFault.exe 305 4876 1160 WerFault.exe 310 864 6660 WerFault.exe 315 3412 3644 WerFault.exe 320 1652 244 WerFault.exe 325 4152 5940 WerFault.exe 330 5072 6796 WerFault.exe 335 6732 3688 WerFault.exe 340 4600 1788 WerFault.exe 345 2240 2824 WerFault.exe 350 6736 2400 WerFault.exe 355 5880 3356 WerFault.exe 360 4480 3372 WerFault.exe 365 6360 1840 WerFault.exe 370 6992 3408 WerFault.exe 375 5144 2896 WerFault.exe 380 6348 2376 WerFault.exe 385 5972 2508 WerFault.exe 390 6408 5160 WerFault.exe 395 4788 5388 WerFault.exe 400 5968 3344 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHHQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHDBKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCVLNRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRWTYNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_6382318c2e7d3175988556f3fb83b73a_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGLEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVJIRXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQRJGFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRTPBJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMLFIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSMDOR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNWBBEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUIKYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJHVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWKLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPBYCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXFSRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZOWMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMTQ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 964 2026-08-25_6382318c2e7d3175988556f3fb83b73a_elex_emotet_stop.exe 964 2026-08-25_6382318c2e7d3175988556f3fb83b73a_elex_emotet_stop.exe 2420 BLRVHF.exe 2420 BLRVHF.exe 2552 ETEB.exe 2552 ETEB.exe 2516 WMABLZR.exe 2516 WMABLZR.exe 920 CMHPUBA.exe 920 CMHPUBA.exe 1220 IHHQZ.exe 1220 IHHQZ.exe 896 KFUK.exe 896 KFUK.exe 5476 FSRTQM.exe 5476 FSRTQM.exe 2236 RIGT.exe 2236 RIGT.exe 4456 MWKLN.exe 4456 MWKLN.exe 6948 PMR.exe 6948 PMR.exe 292 ZMTQ.exe 292 ZMTQ.exe 5568 LCAYHE.exe 5568 LCAYHE.exe 3468 PKGYTX.exe 3468 PKGYTX.exe 3064 JXL.exe 3064 JXL.exe 6012 CAPL.exe 6012 CAPL.exe 4340 OIWLVFC.exe 4340 OIWLVFC.exe 6828 IEAU.exe 6828 IEAU.exe 6480 UWDNN.exe 6480 UWDNN.exe 4512 DXFSRR.exe 4512 DXFSRR.exe 1420 EAJWW.exe 1420 EAJWW.exe 4452 BARKF.exe 4452 BARKF.exe 6516 NSMDOR.exe 6516 NSMDOR.exe 1960 TTTQ.exe 1960 TTTQ.exe 1108 KTVVI.exe 1108 KTVVI.exe 1368 FOAFKQB.exe 1368 FOAFKQB.exe 2904 KPIS.exe 2904 KPIS.exe 5452 DKM.exe 5452 DKM.exe 6768 JKT.exe 6768 JKT.exe 3212 PFTLVG.exe 3212 PFTLVG.exe 2588 YTDDKCI.exe 2588 YTDDKCI.exe 5676 TGIM.exe 5676 TGIM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 964 2026-08-25_6382318c2e7d3175988556f3fb83b73a_elex_emotet_stop.exe 964 2026-08-25_6382318c2e7d3175988556f3fb83b73a_elex_emotet_stop.exe 2420 BLRVHF.exe 2420 BLRVHF.exe 2552 ETEB.exe 2552 ETEB.exe 2516 WMABLZR.exe 2516 WMABLZR.exe 920 CMHPUBA.exe 920 CMHPUBA.exe 1220 IHHQZ.exe 1220 IHHQZ.exe 896 KFUK.exe 896 KFUK.exe 5476 FSRTQM.exe 5476 FSRTQM.exe 2236 RIGT.exe 2236 RIGT.exe 4456 MWKLN.exe 4456 MWKLN.exe 6948 PMR.exe 6948 PMR.exe 292 ZMTQ.exe 292 ZMTQ.exe 5568 LCAYHE.exe 5568 LCAYHE.exe 3468 PKGYTX.exe 3468 PKGYTX.exe 3064 JXL.exe 3064 JXL.exe 6012 CAPL.exe 6012 CAPL.exe 4340 OIWLVFC.exe 4340 OIWLVFC.exe 6828 IEAU.exe 6828 IEAU.exe 6480 UWDNN.exe 6480 UWDNN.exe 4512 DXFSRR.exe 4512 DXFSRR.exe 1420 EAJWW.exe 1420 EAJWW.exe 4452 BARKF.exe 4452 BARKF.exe 6516 NSMDOR.exe 6516 NSMDOR.exe 1960 TTTQ.exe 1960 TTTQ.exe 1108 KTVVI.exe 1108 KTVVI.exe 1368 FOAFKQB.exe 1368 FOAFKQB.exe 2904 KPIS.exe 2904 KPIS.exe 5452 DKM.exe 5452 DKM.exe 6768 JKT.exe 6768 JKT.exe 3212 PFTLVG.exe 3212 PFTLVG.exe 2588 YTDDKCI.exe 2588 YTDDKCI.exe 5676 TGIM.exe 5676 TGIM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 964 wrote to memory of 4840 964 2026-08-25_6382318c2e7d3175988556f3fb83b73a_elex_emotet_stop.exe 90 PID 4840 wrote to memory of 2420 4840 cmd.exe 94 PID 2420 wrote to memory of 5700 2420 BLRVHF.exe 96 PID 5700 wrote to memory of 2552 5700 cmd.exe 100 PID 2552 wrote to memory of 4260 2552 ETEB.exe 101 PID 4260 wrote to memory of 2516 4260 cmd.exe 104 PID 2516 wrote to memory of 7004 2516 WMABLZR.exe 106 PID 7004 wrote to memory of 920 7004 cmd.exe 110 PID 920 wrote to memory of 5332 920 CMHPUBA.exe 111 PID 5332 wrote to memory of 1220 5332 cmd.exe 115 PID 1220 wrote to memory of 6896 1220 IHHQZ.exe 116 PID 6896 wrote to memory of 896 6896 cmd.exe 120 PID 896 wrote to memory of 5804 896 KFUK.exe 121 PID 5804 wrote to memory of 5476 5804 cmd.exe 125 PID 5476 wrote to memory of 3556 5476 FSRTQM.exe 126 PID 3556 wrote to memory of 2236 3556 cmd.exe 130 PID 2236 wrote to memory of 1372 2236 RIGT.exe 131 PID 1372 wrote to memory of 4456 1372 cmd.exe 135 PID 4456 wrote to memory of 2140 4456 MWKLN.exe 136 PID 2140 wrote to memory of 6948 2140 cmd.exe 140 PID 6948 wrote to memory of 2708 6948 PMR.exe 141 PID 2708 wrote to memory of 292 2708 cmd.exe 145 PID 292 wrote to memory of 4160 292 ZMTQ.exe 146 PID 4160 wrote to memory of 5568 4160 cmd.exe 150 PID 5568 wrote to memory of 1296 5568 LCAYHE.exe 151 PID 1296 wrote to memory of 3468 1296 cmd.exe 155 PID 3468 wrote to memory of 1260 3468 PKGYTX.exe 156 PID 1260 wrote to memory of 3064 1260 cmd.exe 160 PID 3064 wrote to memory of 256 3064 JXL.exe 161 PID 256 wrote to memory of 6012 256 cmd.exe 165 PID 6012 wrote to memory of 200 6012 CAPL.exe 166 PID 200 wrote to memory of 4340 200 cmd.exe 170 PID 4340 wrote to memory of 1492 4340 OIWLVFC.exe 171 PID 1492 wrote to memory of 6828 1492 cmd.exe 175 PID 6828 wrote to memory of 3448 6828 IEAU.exe 176 PID 3448 wrote to memory of 6480 3448 cmd.exe 180 PID 6480 wrote to memory of 2976 6480 UWDNN.exe 181 PID 2976 wrote to memory of 4512 2976 cmd.exe 185 PID 4512 wrote to memory of 7064 4512 DXFSRR.exe 186 PID 7064 wrote to memory of 1420 7064 cmd.exe 190 PID 1420 wrote to memory of 2620 1420 EAJWW.exe 191 PID 2620 wrote to memory of 4452 2620 cmd.exe 195 PID 4452 wrote to memory of 1720 4452 BARKF.exe 196 PID 1720 wrote to memory of 6516 1720 cmd.exe 200 PID 6516 wrote to memory of 6832 6516 NSMDOR.exe 201 PID 6832 wrote to memory of 1960 6832 cmd.exe 205 PID 1960 wrote to memory of 4772 1960 TTTQ.exe 206 PID 4772 wrote to memory of 1108 4772 cmd.exe 210 PID 1108 wrote to memory of 1204 1108 KTVVI.exe 211 PID 1204 wrote to memory of 1368 1204 cmd.exe 215 PID 1368 wrote to memory of 2684 1368 FOAFKQB.exe 216 PID 2684 wrote to memory of 2904 2684 cmd.exe 220 PID 2904 wrote to memory of 1300 2904 KPIS.exe 221 PID 1300 wrote to memory of 5452 1300 cmd.exe 225 PID 5452 wrote to memory of 5912 5452 DKM.exe 226 PID 5912 wrote to memory of 6768 5912 cmd.exe 230 PID 6768 wrote to memory of 4800 6768 JKT.exe 231 PID 4800 wrote to memory of 3212 4800 cmd.exe 235 PID 3212 wrote to memory of 4120 3212 PFTLVG.exe 236 PID 4120 wrote to memory of 2588 4120 cmd.exe 240 PID 2588 wrote to memory of 4076 2588 YTDDKCI.exe 241 PID 4076 wrote to memory of 5676 4076 cmd.exe 245 PID 5676 wrote to memory of 2164 5676 TGIM.exe 246 PID 2164 wrote to memory of 4228 2164 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_6382318c2e7d3175988556f3fb83b73a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_6382318c2e7d3175988556f3fb83b73a_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BLRVHF.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\BLRVHF.exeC:\windows\BLRVHF.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ETEB.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\ETEB.exeC:\windows\ETEB.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WMABLZR.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\SysWOW64\WMABLZR.exeC:\windows\system32\WMABLZR.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMHPUBA.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:7004 -
C:\windows\system\CMHPUBA.exeC:\windows\system\CMHPUBA.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHHQZ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\windows\system\IHHQZ.exeC:\windows\system\IHHQZ.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KFUK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6896 -
C:\windows\KFUK.exeC:\windows\KFUK.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSRTQM.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\windows\SysWOW64\FSRTQM.exeC:\windows\system32\FSRTQM.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIGT.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\windows\system\RIGT.exeC:\windows\system\RIGT.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWKLN.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\windows\system\MWKLN.exeC:\windows\system\MWKLN.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMR.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\windows\SysWOW64\PMR.exeC:\windows\system32\PMR.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMTQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\windows\SysWOW64\ZMTQ.exeC:\windows\system32\ZMTQ.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCAYHE.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\SysWOW64\LCAYHE.exeC:\windows\system32\LCAYHE.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKGYTX.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\windows\PKGYTX.exeC:\windows\PKGYTX.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXL.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\windows\JXL.exeC:\windows\JXL.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAPL.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\CAPL.exeC:\windows\CAPL.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIWLVFC.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\OIWLVFC.exeC:\windows\OIWLVFC.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEAU.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\windows\system\IEAU.exeC:\windows\system\IEAU.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWDNN.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\SysWOW64\UWDNN.exeC:\windows\system32\UWDNN.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DXFSRR.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\DXFSRR.exeC:\windows\DXFSRR.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAJWW.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7064 -
C:\windows\SysWOW64\EAJWW.exeC:\windows\system32\EAJWW.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BARKF.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\system\BARKF.exeC:\windows\system\BARKF.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSMDOR.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\windows\system\NSMDOR.exeC:\windows\system\NSMDOR.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TTTQ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6832 -
C:\windows\TTTQ.exeC:\windows\TTTQ.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTVVI.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\KTVVI.exeC:\windows\KTVVI.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOAFKQB.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\FOAFKQB.exeC:\windows\FOAFKQB.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPIS.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\windows\KPIS.exeC:\windows\KPIS.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\system\DKM.exeC:\windows\system\DKM.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKT.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\JKT.exeC:\windows\JKT.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFTLVG.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\windows\PFTLVG.exeC:\windows\PFTLVG.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTDDKCI.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\SysWOW64\YTDDKCI.exeC:\windows\system32\YTDDKCI.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGIM.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\system\TGIM.exeC:\windows\system\TGIM.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTNWX.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\windows\VTNWX.exeC:\windows\VTNWX.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VZFKGP.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4144 -
C:\windows\system\VZFKGP.exeC:\windows\system\VZFKGP.exe67⤵
- Executes dropped EXE
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCWO.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6432 -
C:\windows\LCWO.exeC:\windows\LCWO.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPBYCB.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3032 -
C:\windows\SysWOW64\FPBYCB.exeC:\windows\system32\FPBYCB.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACY.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3524 -
C:\windows\SysWOW64\ACY.exeC:\windows\system32\ACY.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYXQJ.exe.bat" "74⤵PID:4592
-
C:\windows\SysWOW64\GYXQJ.exeC:\windows\system32\GYXQJ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTG.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4352 -
C:\windows\VTG.exeC:\windows\VTG.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGLEE.exe.bat" "78⤵PID:4744
-
C:\windows\system\QGLEE.exeC:\windows\system\QGLEE.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BZOWMG.exe.bat" "80⤵PID:2920
-
C:\windows\system\BZOWMG.exeC:\windows\system\BZOWMG.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUT.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2748 -
C:\windows\VUT.exeC:\windows\VUT.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUVL.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3628 -
C:\windows\system\FUVL.exeC:\windows\system\FUVL.exe85⤵
- Executes dropped EXE
PID:6496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFEMO.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4856 -
C:\windows\NFEMO.exeC:\windows\NFEMO.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAJWQI.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\windows\SysWOW64\HAJWQI.exeC:\windows\system32\HAJWQI.exe89⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XQKVX.exe.bat" "90⤵PID:6908
-
C:\windows\XQKVX.exeC:\windows\XQKVX.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQRJGFN.exe.bat" "92⤵PID:5192
-
C:\windows\SysWOW64\CQRJGFN.exeC:\windows\system32\CQRJGFN.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJM.exe.bat" "94⤵
- Executes a command shell one-liner
PID:6536 -
C:\windows\OJM.exeC:\windows\OJM.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWRLY.exe.bat" "96⤵PID:5660
-
C:\windows\system\IWRLY.exeC:\windows\system\IWRLY.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UPUE.exe.bat" "98⤵PID:2284
-
C:\windows\system\UPUE.exeC:\windows\system\UPUE.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCEWOQM.exe.bat" "100⤵PID:6472
-
C:\windows\SysWOW64\DCEWOQM.exeC:\windows\system32\DCEWOQM.exe101⤵
- Executes dropped EXE
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPJF.exe.bat" "102⤵PID:3940
-
C:\windows\system\XPJF.exeC:\windows\system\XPJF.exe103⤵
- Executes dropped EXE
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIEYH.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2888 -
C:\windows\JIEYH.exeC:\windows\JIEYH.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DVJIRXF.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1972 -
C:\windows\system\DVJIRXF.exeC:\windows\system\DVJIRXF.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABPXYH.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5840 -
C:\windows\system\ABPXYH.exeC:\windows\system\ABPXYH.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LTS.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:6088 -
C:\windows\LTS.exeC:\windows\LTS.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUUCKU.exe.bat" "112⤵PID:6092
-
C:\windows\SysWOW64\CUUCKU.exeC:\windows\system32\CUUCKU.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IUBQTO.exe.bat" "114⤵PID:3868
-
C:\windows\SysWOW64\IUBQTO.exeC:\windows\system32\IUBQTO.exe115⤵
- Executes dropped EXE
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNWBBEH.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2024 -
C:\windows\TNWBBEH.exeC:\windows\TNWBBEH.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDDJN.exe.bat" "118⤵PID:3732
-
C:\windows\XDDJN.exeC:\windows\XDDJN.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DDLXWQF.exe.bat" "120⤵PID:6608
-
C:\windows\DDLXWQF.exeC:\windows\DDLXWQF.exe121⤵
- Executes dropped EXE
PID:2508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-