Analysis
- max time kernel
81s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-04_4adf00c9971451db69ee60ce9c3ee64a_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-04_4adf00c9971451db69ee60ce9c3ee64a_elex_emotet_stop.exe
- Size 208KB
- Sample260905-ntsgvszzd1
- SHA256 967de5ea4399a77f722bdb3bf95f7b65caa9afbc52d90c09ad2c370810cb9168
- MD5 4adf00c9971451db69ee60ce9c3ee64a
- SHA1 8bd9ebe0ed369f0e8a45a8d02417278f9b825faf
- SHA512 4bb37a7118bab6fe2662a9cb3dbe5e9e27ef8d695473f1156ad23c51ec83bf6b0b3ed4ca11e9a5b292886e3530c58fe050187450e7e267a68414b8b74eb71598
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOf04pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOMkEj1
- TLSH T12D247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2328 HZTPOCL.exe 1788 VUR.exe 2788 MFUYMYQ.exe 3012 NIXU.exe 804 RYMCDG.exe 1592 XMDD.exe 4060 MPVHTWE.exe 3960 BFW.exe 2544 FNCGEC.exe 4464 OVET.exe 2172 SDLTUR.exe 4184 CBRO.exe 3080 GJX.exe 5160 YRZTZ.exe 1576 CZOBLIA.exe 5960 UCSXRG.exe 4688 GSY.exe 3660 PTAKG.exe 4452 IWEGML.exe 4952 JRIJZ.exe 4612 WCQ.exe 3360 ASXISW.exe 1856 IXXWBJ.exe 624 TQNHLK.exe 4936 JGOHR.exe 980 EQW.exe 908 GOKSNRY.exe 1464 RHFK.exe 3000 XHMY.exe 1228 QVTW.exe 4972 YAYD.exe 5004 KTNW.exe 3228 YOZP.exe 5864 SJQQ.exe 2764 TEU.exe 3296 DCAOXI.exe 1148 DPMVI.exe 4588 ELQR.exe 3268 DDTHWK.exe 4500 BOWXX.exe 3160 OZMVL.exe 1684 VMLWQW.exe 5332 IXUV.exe 5776 IAX.exe 2568 BVBUX.exe 720 CYFQ.exe 2532 EWTKKL.exe 5464 IMZKWD.exe 2944 IHD.exe 4388 OCPHPQT.exe 2484 WQTOAOO.exe 5976 STKMGRJ.exe 5916 KWOQ.exe 1952 SJS.exe 4720 CZG.exe 5228 MHIW.exe 4756 QPOWBM.exe 1260 DVOID.exe 2740 SQY.exe 4844 EGMUI.exe 2316 ZTJELCA.exe 2564 THON.exe 5496 MKA.exe 4340 WHGDQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\NIXU.exe MFUYMYQ.exe File created C:\windows\SysWOW64\GOKSNRY.exe.bat EQW.exe File created C:\windows\SysWOW64\RHFK.exe.bat GOKSNRY.exe File opened for modification C:\windows\SysWOW64\DCAOXI.exe TEU.exe File created C:\windows\SysWOW64\LEM.exe.bat HWGSCA.exe File created C:\windows\SysWOW64\TCBHCS.exe.bat JPRPM.exe File opened for modification C:\windows\SysWOW64\WHGDQ.exe MKA.exe File created C:\windows\SysWOW64\ZAPB.exe.bat LYHC.exe File created C:\windows\SysWOW64\SDLTUR.exe OVET.exe File created C:\windows\SysWOW64\DCAOXI.exe TEU.exe File created C:\windows\SysWOW64\DCAOXI.exe.bat TEU.exe File created C:\windows\SysWOW64\DPMVI.exe.bat DCAOXI.exe File created C:\windows\SysWOW64\DDTHWK.exe ELQR.exe File created C:\windows\SysWOW64\OCPHPQT.exe IHD.exe File opened for modification C:\windows\SysWOW64\OCPHPQT.exe IHD.exe File opened for modification C:\windows\SysWOW64\THON.exe ZTJELCA.exe File opened for modification C:\windows\SysWOW64\GOKSNRY.exe EQW.exe File created C:\windows\SysWOW64\CYFQ.exe BVBUX.exe File opened for modification C:\windows\SysWOW64\OVET.exe FNCGEC.exe File opened for modification C:\windows\SysWOW64\WCQ.exe JRIJZ.exe File opened for modification C:\windows\SysWOW64\DPMVI.exe DCAOXI.exe File opened for modification C:\windows\SysWOW64\DDTHWK.exe ELQR.exe File created C:\windows\SysWOW64\EWTKKL.exe CYFQ.exe File opened for modification C:\windows\SysWOW64\SQY.exe DVOID.exe File created C:\windows\SysWOW64\ZAPB.exe LYHC.exe File created C:\windows\SysWOW64\FRVGPLT.exe.bat QBU.exe File created C:\windows\SysWOW64\RHFK.exe GOKSNRY.exe File opened for modification C:\windows\SysWOW64\RHFK.exe GOKSNRY.exe File created C:\windows\SysWOW64\EWTKKL.exe.bat CYFQ.exe File opened for modification C:\windows\SysWOW64\STKMGRJ.exe WQTOAOO.exe File created C:\windows\SysWOW64\KWOQ.exe.bat STKMGRJ.exe File created C:\windows\SysWOW64\SQY.exe DVOID.exe File created C:\windows\SysWOW64\GSY.exe UCSXRG.exe File created C:\windows\SysWOW64\WCQ.exe JRIJZ.exe File created C:\windows\SysWOW64\ELQR.exe.bat DPMVI.exe File created C:\windows\SysWOW64\OCPHPQT.exe.bat IHD.exe File created C:\windows\SysWOW64\STKMGRJ.exe.bat WQTOAOO.exe File created C:\windows\SysWOW64\KWOQ.exe STKMGRJ.exe File opened for modification C:\windows\SysWOW64\KWOQ.exe STKMGRJ.exe File created C:\windows\SysWOW64\DVOID.exe.bat QPOWBM.exe File created C:\windows\SysWOW64\OVET.exe FNCGEC.exe File created C:\windows\SysWOW64\SDLTUR.exe.bat OVET.exe File created C:\windows\SysWOW64\GSY.exe.bat UCSXRG.exe File created C:\windows\SysWOW64\WCQ.exe.bat JRIJZ.exe File created C:\windows\SysWOW64\OZMVL.exe.bat BOWXX.exe File created C:\windows\SysWOW64\IXUV.exe VMLWQW.exe File created C:\windows\SysWOW64\THON.exe ZTJELCA.exe File opened for modification C:\windows\SysWOW64\LEM.exe HWGSCA.exe File created C:\windows\SysWOW64\OVET.exe.bat FNCGEC.exe File opened for modification C:\windows\SysWOW64\SDLTUR.exe OVET.exe File opened for modification C:\windows\SysWOW64\SJQQ.exe YOZP.exe File created C:\windows\SysWOW64\ELQR.exe DPMVI.exe File created C:\windows\SysWOW64\STKMGRJ.exe WQTOAOO.exe File created C:\windows\SysWOW64\BBGRX.exe OQQSJ.exe File created C:\windows\SysWOW64\SJQQ.exe YOZP.exe File created C:\windows\SysWOW64\SJQQ.exe.bat YOZP.exe File opened for modification C:\windows\SysWOW64\BBGRX.exe OQQSJ.exe File opened for modification C:\windows\SysWOW64\FRVGPLT.exe QBU.exe File opened for modification C:\windows\SysWOW64\IXUV.exe VMLWQW.exe File created C:\windows\SysWOW64\DVOID.exe QPOWBM.exe File created C:\windows\SysWOW64\ZTJELCA.exe EGMUI.exe File opened for modification C:\windows\SysWOW64\ZAPB.exe LYHC.exe File created C:\windows\SysWOW64\LEM.exe HWGSCA.exe File created C:\windows\SysWOW64\TNGHL.exe JXAVE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\WXPL.exe LEM.exe File created C:\windows\system\MAZXIUV.exe WXPL.exe File opened for modification C:\windows\ISCY.exe TCBHCS.exe File opened for modification C:\windows\system\FASQBOS.exe KFVGYO.exe File opened for modification C:\windows\MFUYMYQ.exe VUR.exe File created C:\windows\CZG.exe SJS.exe File created C:\windows\DYMQU.exe.bat LQKL.exe File opened for modification C:\windows\system\QBU.exe DYMQU.exe File opened for modification C:\windows\TQNHLK.exe IXXWBJ.exe File opened for modification C:\windows\GJX.exe CBRO.exe File opened for modification C:\windows\system\JRIJZ.exe IWEGML.exe File created C:\windows\system\KTNW.exe.bat YAYD.exe File opened for modification C:\windows\system\LYHC.exe WHGDQ.exe File opened for modification C:\windows\XNMCTAS.exe ISCY.exe File opened for modification C:\windows\TMYIY.exe ZZU.exe File created C:\windows\system\CZOBLIA.exe.bat YRZTZ.exe File opened for modification C:\windows\EVOYLD.exe UUMT.exe File created C:\windows\XTWXWR.exe.bat RFXW.exe File opened for modification C:\windows\system\JGOHR.exe TQNHLK.exe File created C:\windows\XMDD.exe RYMCDG.exe File created C:\windows\system\VUR.exe HZTPOCL.exe File created C:\windows\YAYD.exe.bat QVTW.exe File created C:\windows\YOZP.exe KTNW.exe File created C:\windows\system\TEU.exe SJQQ.exe File created C:\windows\PWMRI.exe QLJ.exe File created C:\windows\JXAVE.exe TPQUJRT.exe File created C:\windows\TQNHLK.exe IXXWBJ.exe File opened for modification C:\windows\YAYD.exe QVTW.exe File created C:\windows\system\SEUQJQ.exe DJL.exe File created C:\windows\system\HTKG.exe.bat UQBHHJ.exe File opened for modification C:\windows\system\LQKL.exe TNGHL.exe File created C:\windows\system\QBU.exe DYMQU.exe File opened for modification C:\windows\IMZKWD.exe EWTKKL.exe File created C:\windows\system\SJS.exe.bat KWOQ.exe File opened for modification C:\windows\QPOWBM.exe MHIW.exe File created C:\windows\HWGSCA.exe.bat BBGRX.exe File opened for modification C:\windows\DJL.exe XNMCTAS.exe File created C:\windows\system\IHI.exe.bat TMYIY.exe File created C:\windows\system\OOJHAPS.exe.bat HTKG.exe File created C:\windows\UUMT.exe.bat FRVGPLT.exe File opened for modification C:\windows\system\IAX.exe IXUV.exe File opened for modification C:\windows\CZG.exe SJS.exe File created C:\windows\EGMUI.exe SQY.exe File created C:\windows\QLJ.exe BIAOGI.exe File created C:\windows\system\SEUQJQ.exe.bat DJL.exe File created C:\windows\RFXW.exe.bat EVOYLD.exe File opened for modification C:\windows\RYMCDG.exe NIXU.exe File opened for modification C:\windows\IXXWBJ.exe ASXISW.exe File created C:\windows\TQNHLK.exe.bat IXXWBJ.exe File created C:\windows\VMLWQW.exe.bat OZMVL.exe File opened for modification C:\windows\BVBUX.exe IAX.exe File created C:\windows\IHD.exe.bat IMZKWD.exe File created C:\windows\system\SJS.exe KWOQ.exe File created C:\windows\system\WXPL.exe.bat LEM.exe File created C:\windows\system\JRIJZ.exe IWEGML.exe File created C:\windows\MKA.exe THON.exe File created C:\windows\JJRAKIE.exe.bat PWMRI.exe File created C:\windows\DJL.exe.bat XNMCTAS.exe File created C:\windows\TMYIY.exe.bat ZZU.exe File created C:\windows\system\KFVGYO.exe IHI.exe File created C:\windows\system\UQBHHJ.exe.bat FASQBOS.exe File created C:\windows\system\HTKG.exe UQBHHJ.exe File created C:\windows\GJX.exe CBRO.exe File created C:\windows\ASXISW.exe WCQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1028 cmd.exe 3428 cmd.exe 5056 cmd.exe 200 cmd.exe 1212 cmd.exe 1160 cmd.exe 4512 cmd.exe 708 cmd.exe 3220 cmd.exe 2776 cmd.exe 6124 cmd.exe 4312 cmd.exe 2880 cmd.exe 4284 cmd.exe 1128 cmd.exe 5344 cmd.exe 2696 cmd.exe 1944 cmd.exe 4888 cmd.exe 2372 cmd.exe 760 cmd.exe 5068 cmd.exe 5808 cmd.exe 4484 cmd.exe 2604 cmd.exe 5088 cmd.exe 1664 cmd.exe 5752 cmd.exe 5828 cmd.exe 2672 cmd.exe 1276 cmd.exe 5624 cmd.exe 4356 cmd.exe 3444 cmd.exe 6072 cmd.exe 2712 cmd.exe 4256 cmd.exe 3684 cmd.exe 3948 cmd.exe 5588 cmd.exe 1316 cmd.exe 1796 cmd.exe 2124 cmd.exe 4224 cmd.exe 5824 cmd.exe 4244 cmd.exe 2616 cmd.exe 4168 cmd.exe 1676 cmd.exe 3252 cmd.exe 252 cmd.exe 5884 cmd.exe 1244 cmd.exe 4164 cmd.exe 3596 cmd.exe 1312 cmd.exe 1644 cmd.exe 2832 cmd.exe 2432 cmd.exe 1992 cmd.exe 4528 cmd.exe 1656 cmd.exe 3108 cmd.exe 5400 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1828 4632 WerFault.exe 87 3512 2328 WerFault.exe 93 432 1788 WerFault.exe 99 6008 2788 WerFault.exe 104 2804 3012 WerFault.exe 109 1644 804 WerFault.exe 114 5876 1592 WerFault.exe 119 4360 4060 WerFault.exe 124 3496 3960 WerFault.exe 129 5192 2544 WerFault.exe 134 2484 4464 WerFault.exe 139 2992 2172 WerFault.exe 144 2696 4184 WerFault.exe 149 1936 3080 WerFault.exe 154 5100 5160 WerFault.exe 159 2016 1576 WerFault.exe 164 908 5960 WerFault.exe 169 1524 4688 WerFault.exe 174 4484 3660 WerFault.exe 179 1228 4452 WerFault.exe 184 1512 4952 WerFault.exe 189 4240 4612 WerFault.exe 194 3692 3360 WerFault.exe 199 4508 1856 WerFault.exe 204 4968 624 WerFault.exe 209 5324 4936 WerFault.exe 214 4372 980 WerFault.exe 219 5876 908 WerFault.exe 224 1200 1464 WerFault.exe 229 5408 3000 WerFault.exe 234 552 1228 WerFault.exe 239 6108 4972 WerFault.exe 244 4744 5004 WerFault.exe 249 3516 3228 WerFault.exe 254 3948 5864 WerFault.exe 259 5540 2764 WerFault.exe 264 2400 3296 WerFault.exe 269 3140 1148 WerFault.exe 275 3728 4588 WerFault.exe 280 1900 3268 WerFault.exe 285 5576 4500 WerFault.exe 290 4932 3160 WerFault.exe 295 3692 1684 WerFault.exe 299 2616 5332 WerFault.exe 304 1504 5776 WerFault.exe 310 2044 2568 WerFault.exe 315 2612 720 WerFault.exe 320 3508 2532 WerFault.exe 325 3928 5464 WerFault.exe 330 4276 2944 WerFault.exe 335 1596 4388 WerFault.exe 340 1884 2484 WerFault.exe 345 4548 5976 WerFault.exe 350 4996 5916 WerFault.exe 355 5540 1952 WerFault.exe 360 2400 4720 WerFault.exe 365 5392 5228 WerFault.exe 370 3828 4756 WerFault.exe 375 4308 1260 WerFault.exe 380 828 2740 WerFault.exe 385 2408 4844 WerFault.exe 390 5628 2316 WerFault.exe 395 3652 2564 WerFault.exe 400 5964 5496 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPMVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDTHWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-04_4adf00c9971451db69ee60ce9c3ee64a_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRZTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMZKWD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGMUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJRAKIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZMVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWTKKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWGSCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMLWQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTJELCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OOJHAPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MPVHTWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCSXRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXAVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYMCDG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNCGEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZOBLIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASXISW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FASQBOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4632 2026-09-04_4adf00c9971451db69ee60ce9c3ee64a_elex_emotet_stop.exe 4632 2026-09-04_4adf00c9971451db69ee60ce9c3ee64a_elex_emotet_stop.exe 2328 HZTPOCL.exe 2328 HZTPOCL.exe 1788 VUR.exe 1788 VUR.exe 2788 MFUYMYQ.exe 2788 MFUYMYQ.exe 3012 NIXU.exe 3012 NIXU.exe 804 RYMCDG.exe 804 RYMCDG.exe 1592 XMDD.exe 1592 XMDD.exe 4060 MPVHTWE.exe 4060 MPVHTWE.exe 3960 BFW.exe 3960 BFW.exe 2544 FNCGEC.exe 2544 FNCGEC.exe 4464 OVET.exe 4464 OVET.exe 2172 SDLTUR.exe 2172 SDLTUR.exe 4184 CBRO.exe 4184 CBRO.exe 3080 GJX.exe 3080 GJX.exe 5160 YRZTZ.exe 5160 YRZTZ.exe 1576 CZOBLIA.exe 1576 CZOBLIA.exe 5960 UCSXRG.exe 5960 UCSXRG.exe 4688 GSY.exe 4688 GSY.exe 3660 PTAKG.exe 3660 PTAKG.exe 4452 IWEGML.exe 4452 IWEGML.exe 4952 JRIJZ.exe 4952 JRIJZ.exe 4612 WCQ.exe 4612 WCQ.exe 3360 ASXISW.exe 3360 ASXISW.exe 1856 IXXWBJ.exe 1856 IXXWBJ.exe 624 TQNHLK.exe 624 TQNHLK.exe 4936 JGOHR.exe 4936 JGOHR.exe 980 EQW.exe 980 EQW.exe 908 GOKSNRY.exe 908 GOKSNRY.exe 1464 RHFK.exe 1464 RHFK.exe 3000 XHMY.exe 3000 XHMY.exe 1228 QVTW.exe 1228 QVTW.exe 4972 YAYD.exe 4972 YAYD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4632 2026-09-04_4adf00c9971451db69ee60ce9c3ee64a_elex_emotet_stop.exe 4632 2026-09-04_4adf00c9971451db69ee60ce9c3ee64a_elex_emotet_stop.exe 2328 HZTPOCL.exe 2328 HZTPOCL.exe 1788 VUR.exe 1788 VUR.exe 2788 MFUYMYQ.exe 2788 MFUYMYQ.exe 3012 NIXU.exe 3012 NIXU.exe 804 RYMCDG.exe 804 RYMCDG.exe 1592 XMDD.exe 1592 XMDD.exe 4060 MPVHTWE.exe 4060 MPVHTWE.exe 3960 BFW.exe 3960 BFW.exe 2544 FNCGEC.exe 2544 FNCGEC.exe 4464 OVET.exe 4464 OVET.exe 2172 SDLTUR.exe 2172 SDLTUR.exe 4184 CBRO.exe 4184 CBRO.exe 3080 GJX.exe 3080 GJX.exe 5160 YRZTZ.exe 5160 YRZTZ.exe 1576 CZOBLIA.exe 1576 CZOBLIA.exe 5960 UCSXRG.exe 5960 UCSXRG.exe 4688 GSY.exe 4688 GSY.exe 3660 PTAKG.exe 3660 PTAKG.exe 4452 IWEGML.exe 4452 IWEGML.exe 4952 JRIJZ.exe 4952 JRIJZ.exe 4612 WCQ.exe 4612 WCQ.exe 3360 ASXISW.exe 3360 ASXISW.exe 1856 IXXWBJ.exe 1856 IXXWBJ.exe 624 TQNHLK.exe 624 TQNHLK.exe 4936 JGOHR.exe 4936 JGOHR.exe 980 EQW.exe 980 EQW.exe 908 GOKSNRY.exe 908 GOKSNRY.exe 1464 RHFK.exe 1464 RHFK.exe 3000 XHMY.exe 3000 XHMY.exe 1228 QVTW.exe 1228 QVTW.exe 4972 YAYD.exe 4972 YAYD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4632 wrote to memory of 6116 4632 2026-09-04_4adf00c9971451db69ee60ce9c3ee64a_elex_emotet_stop.exe 89 PID 6116 wrote to memory of 2328 6116 cmd.exe 93 PID 2328 wrote to memory of 1220 2328 HZTPOCL.exe 95 PID 1220 wrote to memory of 1788 1220 cmd.exe 99 PID 1788 wrote to memory of 2776 1788 VUR.exe 100 PID 2776 wrote to memory of 2788 2776 cmd.exe 104 PID 2788 wrote to memory of 5796 2788 MFUYMYQ.exe 105 PID 5796 wrote to memory of 3012 5796 cmd.exe 109 PID 3012 wrote to memory of 2780 3012 NIXU.exe 110 PID 2780 wrote to memory of 804 2780 cmd.exe 114 PID 804 wrote to memory of 5056 804 RYMCDG.exe 115 PID 5056 wrote to memory of 1592 5056 cmd.exe 119 PID 1592 wrote to memory of 1312 1592 XMDD.exe 120 PID 1312 wrote to memory of 4060 1312 cmd.exe 124 PID 4060 wrote to memory of 2124 4060 MPVHTWE.exe 125 PID 2124 wrote to memory of 3960 2124 cmd.exe 129 PID 3960 wrote to memory of 3528 3960 BFW.exe 130 PID 3528 wrote to memory of 2544 3528 cmd.exe 134 PID 2544 wrote to memory of 4704 2544 FNCGEC.exe 135 PID 4704 wrote to memory of 4464 4704 cmd.exe 139 PID 4464 wrote to memory of 3688 4464 OVET.exe 140 PID 3688 wrote to memory of 2172 3688 cmd.exe 144 PID 2172 wrote to memory of 3576 2172 SDLTUR.exe 145 PID 3576 wrote to memory of 4184 3576 cmd.exe 149 PID 4184 wrote to memory of 4592 4184 CBRO.exe 150 PID 4592 wrote to memory of 3080 4592 cmd.exe 154 PID 3080 wrote to memory of 4224 3080 GJX.exe 155 PID 4224 wrote to memory of 5160 4224 cmd.exe 159 PID 5160 wrote to memory of 5832 5160 YRZTZ.exe 160 PID 5832 wrote to memory of 1576 5832 cmd.exe 164 PID 1576 wrote to memory of 1712 1576 CZOBLIA.exe 165 PID 1712 wrote to memory of 5960 1712 cmd.exe 169 PID 5960 wrote to memory of 4304 5960 UCSXRG.exe 170 PID 4304 wrote to memory of 4688 4304 cmd.exe 174 PID 4688 wrote to memory of 3856 4688 GSY.exe 175 PID 3856 wrote to memory of 3660 3856 cmd.exe 179 PID 3660 wrote to memory of 5068 3660 PTAKG.exe 180 PID 5068 wrote to memory of 4452 5068 cmd.exe 184 PID 4452 wrote to memory of 4284 4452 IWEGML.exe 185 PID 4284 wrote to memory of 4952 4284 cmd.exe 189 PID 4952 wrote to memory of 5756 4952 JRIJZ.exe 190 PID 5756 wrote to memory of 4612 5756 cmd.exe 194 PID 4612 wrote to memory of 2884 4612 WCQ.exe 195 PID 2884 wrote to memory of 3360 2884 cmd.exe 199 PID 3360 wrote to memory of 6124 3360 ASXISW.exe 200 PID 6124 wrote to memory of 1856 6124 cmd.exe 204 PID 1856 wrote to memory of 5808 1856 IXXWBJ.exe 205 PID 5808 wrote to memory of 624 5808 cmd.exe 209 PID 624 wrote to memory of 3536 624 TQNHLK.exe 210 PID 3536 wrote to memory of 4936 3536 cmd.exe 214 PID 4936 wrote to memory of 2672 4936 JGOHR.exe 215 PID 2672 wrote to memory of 980 2672 cmd.exe 219 PID 980 wrote to memory of 3392 980 EQW.exe 220 PID 3392 wrote to memory of 908 3392 cmd.exe 224 PID 908 wrote to memory of 4512 908 GOKSNRY.exe 225 PID 4512 wrote to memory of 1464 4512 cmd.exe 229 PID 1464 wrote to memory of 708 1464 RHFK.exe 230 PID 708 wrote to memory of 3000 708 cmd.exe 234 PID 3000 wrote to memory of 5824 3000 XHMY.exe 235 PID 5824 wrote to memory of 1228 5824 cmd.exe 239 PID 1228 wrote to memory of 4792 1228 QVTW.exe 240 PID 4792 wrote to memory of 4972 4792 cmd.exe 244 PID 4972 wrote to memory of 3812 4972 YAYD.exe 245 PID 3812 wrote to memory of 5004 3812 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_4adf00c9971451db69ee60ce9c3ee64a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_4adf00c9971451db69ee60ce9c3ee64a_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HZTPOCL.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\windows\system\HZTPOCL.exeC:\windows\system\HZTPOCL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUR.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\windows\system\VUR.exeC:\windows\system\VUR.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFUYMYQ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\MFUYMYQ.exeC:\windows\MFUYMYQ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NIXU.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\windows\SysWOW64\NIXU.exeC:\windows\system32\NIXU.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RYMCDG.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\windows\RYMCDG.exeC:\windows\RYMCDG.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMDD.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\windows\XMDD.exeC:\windows\XMDD.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPVHTWE.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\system\MPVHTWE.exeC:\windows\system\MPVHTWE.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BFW.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\BFW.exeC:\windows\BFW.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNCGEC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\system\FNCGEC.exeC:\windows\system\FNCGEC.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVET.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\windows\SysWOW64\OVET.exeC:\windows\system32\OVET.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDLTUR.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\windows\SysWOW64\SDLTUR.exeC:\windows\system32\SDLTUR.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBRO.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\windows\SysWOW64\CBRO.exeC:\windows\system32\CBRO.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJX.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\GJX.exeC:\windows\GJX.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YRZTZ.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\system\YRZTZ.exeC:\windows\system\YRZTZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZOBLIA.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\system\CZOBLIA.exeC:\windows\system\CZOBLIA.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCSXRG.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\windows\UCSXRG.exeC:\windows\UCSXRG.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\windows\SysWOW64\GSY.exeC:\windows\system32\GSY.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTAKG.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\PTAKG.exeC:\windows\PTAKG.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\IWEGML.exeC:\windows\IWEGML.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCQ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\SysWOW64\WCQ.exeC:\windows\system32\WCQ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASXISW.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\windows\ASXISW.exeC:\windows\ASXISW.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXXWBJ.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\windows\IXXWBJ.exeC:\windows\IXXWBJ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQNHLK.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\TQNHLK.exeC:\windows\TQNHLK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGOHR.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\windows\system\JGOHR.exeC:\windows\system\JGOHR.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQW.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\EQW.exeC:\windows\EQW.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHFK.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\SysWOW64\RHFK.exeC:\windows\system32\RHFK.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:708 -
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVTW.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\QVTW.exeC:\windows\QVTW.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YAYD.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\windows\YAYD.exeC:\windows\YAYD.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTNW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\windows\system\KTNW.exeC:\windows\system\KTNW.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOZP.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1092 -
C:\windows\YOZP.exeC:\windows\YOZP.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJQQ.exe.bat" "68⤵PID:4700
-
C:\windows\SysWOW64\SJQQ.exeC:\windows\system32\SJQQ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEU.exe.bat" "70⤵PID:4212
-
C:\windows\system\TEU.exeC:\windows\system\TEU.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCAOXI.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3684 -
C:\windows\SysWOW64\DCAOXI.exeC:\windows\system32\DCAOXI.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPMVI.exe.bat" "74⤵PID:2236
-
C:\windows\SysWOW64\DPMVI.exeC:\windows\system32\DPMVI.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELQR.exe.bat" "76⤵PID:3504
-
C:\windows\SysWOW64\ELQR.exeC:\windows\system32\ELQR.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDTHWK.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1128 -
C:\windows\SysWOW64\DDTHWK.exeC:\windows\system32\DDTHWK.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOWXX.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5380 -
C:\windows\BOWXX.exeC:\windows\BOWXX.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:724 -
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VMLWQW.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5344 -
C:\windows\VMLWQW.exeC:\windows\VMLWQW.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXUV.exe.bat" "86⤵PID:1632
-
C:\windows\SysWOW64\IXUV.exeC:\windows\system32\IXUV.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAX.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4244 -
C:\windows\system\IAX.exeC:\windows\system\IAX.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BVBUX.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:6096 -
C:\windows\BVBUX.exeC:\windows\BVBUX.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYFQ.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1276 -
C:\windows\SysWOW64\CYFQ.exeC:\windows\system32\CYFQ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWTKKL.exe.bat" "94⤵PID:4680
-
C:\windows\SysWOW64\EWTKKL.exeC:\windows\system32\EWTKKL.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMZKWD.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:3676 -
C:\windows\IMZKWD.exeC:\windows\IMZKWD.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHD.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4484 -
C:\windows\IHD.exeC:\windows\IHD.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OCPHPQT.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5268 -
C:\windows\SysWOW64\OCPHPQT.exeC:\windows\system32\OCPHPQT.exe101⤵
- Executes dropped EXE
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQTOAOO.exe.bat" "102⤵PID:4336
-
C:\windows\WQTOAOO.exeC:\windows\WQTOAOO.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "104⤵PID:2456
-
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWOQ.exe.bat" "106⤵
- Executes a command shell one-liner
PID:2696 -
C:\windows\SysWOW64\KWOQ.exeC:\windows\system32\KWOQ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SJS.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2616 -
C:\windows\system\SJS.exeC:\windows\system\SJS.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZG.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4528 -
C:\windows\CZG.exeC:\windows\CZG.exe111⤵
- Executes dropped EXE
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHIW.exe.bat" "112⤵PID:2856
-
C:\windows\MHIW.exeC:\windows\MHIW.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPOWBM.exe.bat" "114⤵PID:5072
-
C:\windows\QPOWBM.exeC:\windows\QPOWBM.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DVOID.exe.bat" "116⤵PID:5076
-
C:\windows\SysWOW64\DVOID.exeC:\windows\system32\DVOID.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQY.exe.bat" "118⤵PID:480
-
C:\windows\SysWOW64\SQY.exeC:\windows\system32\SQY.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGMUI.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3680 -
C:\windows\EGMUI.exeC:\windows\EGMUI.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-