Analysis
- max time kernel
93s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 14:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-04_3384dadc7a540f90dc8f0f8a3732df20_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-04_3384dadc7a540f90dc8f0f8a3732df20_elex_emotet_stop.exe
- Size 208KB
- Sample260905-r2a5bstvb1
- SHA256 d04d796d111d42fe41386d9044cce843fa177c2924dd97a32af68f8994902377
- MD5 3384dadc7a540f90dc8f0f8a3732df20
- SHA1 002036430888ffa02d7594159f2e50c45fc9e7a9
- SHA512 f27722328f5b17a59046f40de12df85efddd665d62fd5c7630de587ed64ea6201c2819ff0d2320a611cbb81b9265fcd774d08b6ffe167afb71f8768d9e9272f7
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOfT4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LOLkEj1
- TLSH T1C6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1128 FPO.exe 828 TFQHJT.exe 860 WAV.exe 4484 FBPWXQ.exe 1200 JRD.exe 3536 ARXJN.exe 2372 JZZOQL.exe 3620 ZURS.exe 2488 DCXSVQ.exe 4380 XQC.exe 5732 IIXU.exe 4872 SGLP.exe 3152 LJPSBW.exe 940 CSRX.exe 4200 WKYIOCL.exe 3028 FKANZ.exe 3860 JAH.exe 1688 EOMF.exe 2080 CYW.exe 5424 MWCHEG.exe 1404 SRO.exe 4316 GCWHGF.exe 5696 GFA.exe 1236 ZAEGRT.exe 1660 ADP.exe 2856 JEJHI.exe 6100 YHBTTTW.exe 4196 NXCLZP.exe 5656 XVIFH.exe 4964 BDO.exe 1840 UGSJY.exe 1324 VBWF.exe 3796 KENRXQ.exe 5932 ZUO.exe 6084 BSUDLMZ.exe 1196 SSWI.exe 4284 LVA.exe 1396 PDGLO.exe 5772 VDOZXUZ.exe 1988 QZTJ.exe 1912 KMYSKT.exe 4120 BMAFVZF.exe 556 RHJJG.exe 5584 PCIKLO.exe 4476 KNRJRR.exe 4660 FBV.exe 4144 ZOAC.exe 5884 KGDUU.exe 2408 JZGKCMG.exe 3592 NHNLHFU.exe 2504 MSXB.exe 3504 EVB.exe 3308 QDIEH.exe 5248 PWLU.exe 5504 KJPEAZ.exe 3732 ZEZI.exe 5172 TSERVT.exe 2584 DAGFZRQ.exe 5500 JANS.exe 2024 DNSCST.exe 3932 YBX.exe 200 GOX.exe 1400 EEIDZLF.exe 1500 ZRNM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HDF.exe RNEPK.exe File created C:\windows\SysWOW64\DCXSVQ.exe.bat ZURS.exe File created C:\windows\SysWOW64\TSERVT.exe.bat ZEZI.exe File created C:\windows\SysWOW64\UGDEKTR.exe QQXE.exe File opened for modification C:\windows\SysWOW64\ZURS.exe JZZOQL.exe File opened for modification C:\windows\SysWOW64\VDOZXUZ.exe PDGLO.exe File created C:\windows\SysWOW64\BMAFVZF.exe KMYSKT.exe File created C:\windows\SysWOW64\JZGKCMG.exe.bat KGDUU.exe File created C:\windows\SysWOW64\MHYQV.exe.bat XMOLCDO.exe File opened for modification C:\windows\SysWOW64\UGDEKTR.exe QQXE.exe File created C:\windows\SysWOW64\HDF.exe.bat RNEPK.exe File created C:\windows\SysWOW64\NXCLZP.exe YHBTTTW.exe File created C:\windows\SysWOW64\JZGKCMG.exe KGDUU.exe File created C:\windows\SysWOW64\XMOLCDO.exe.bat LULTCN.exe File created C:\windows\SysWOW64\THSOSE.exe TEOT.exe File opened for modification C:\windows\SysWOW64\JEJHI.exe ADP.exe File created C:\windows\SysWOW64\NXCLZP.exe.bat YHBTTTW.exe File created C:\windows\SysWOW64\VBWF.exe.bat UGSJY.exe File created C:\windows\SysWOW64\NHNLHFU.exe.bat JZGKCMG.exe File created C:\windows\SysWOW64\XMOLCDO.exe LULTCN.exe File opened for modification C:\windows\SysWOW64\XMOLCDO.exe LULTCN.exe File opened for modification C:\windows\SysWOW64\MHYQV.exe XMOLCDO.exe File opened for modification C:\windows\SysWOW64\HNSBDB.exe HKPXYLN.exe File opened for modification C:\windows\SysWOW64\FBPWXQ.exe WAV.exe File created C:\windows\SysWOW64\XVIFH.exe NXCLZP.exe File opened for modification C:\windows\SysWOW64\JZGKCMG.exe KGDUU.exe File opened for modification C:\windows\SysWOW64\NHNLHFU.exe JZGKCMG.exe File created C:\windows\SysWOW64\EVB.exe MSXB.exe File opened for modification C:\windows\SysWOW64\EVB.exe MSXB.exe File opened for modification C:\windows\SysWOW64\YBX.exe DNSCST.exe File created C:\windows\SysWOW64\XAZK.exe.bat USSKNP.exe File opened for modification C:\windows\SysWOW64\LJPSBW.exe SGLP.exe File created C:\windows\SysWOW64\VBWF.exe UGSJY.exe File created C:\windows\SysWOW64\VDOZXUZ.exe.bat PDGLO.exe File created C:\windows\SysWOW64\THSOSE.exe.bat TEOT.exe File created C:\windows\SysWOW64\GJELA.exe LVZ.exe File opened for modification C:\windows\SysWOW64\GJELA.exe LVZ.exe File created C:\windows\SysWOW64\JAH.exe FKANZ.exe File opened for modification C:\windows\SysWOW64\XVIFH.exe NXCLZP.exe File opened for modification C:\windows\SysWOW64\KNRJRR.exe PCIKLO.exe File opened for modification C:\windows\SysWOW64\THSOSE.exe TEOT.exe File created C:\windows\SysWOW64\HNSBDB.exe HKPXYLN.exe File created C:\windows\SysWOW64\LVZ.exe HNSBDB.exe File created C:\windows\SysWOW64\AMJHGLQ.exe ZRFDB.exe File created C:\windows\SysWOW64\NZXAWBA.exe TESRM.exe File created C:\windows\SysWOW64\MHYQV.exe XMOLCDO.exe File created C:\windows\SysWOW64\FNJL.exe EJFHD.exe File created C:\windows\SysWOW64\LVZ.exe.bat HNSBDB.exe File opened for modification C:\windows\SysWOW64\ZCAOB.exe RWVHYS.exe File opened for modification C:\windows\SysWOW64\DCXSVQ.exe ZURS.exe File created C:\windows\SysWOW64\JAH.exe.bat FKANZ.exe File opened for modification C:\windows\SysWOW64\VBWF.exe UGSJY.exe File created C:\windows\SysWOW64\KNRJRR.exe.bat PCIKLO.exe File created C:\windows\SysWOW64\EVB.exe.bat MSXB.exe File created C:\windows\SysWOW64\TSERVT.exe ZEZI.exe File opened for modification C:\windows\SysWOW64\TSERVT.exe ZEZI.exe File opened for modification C:\windows\SysWOW64\RHPJPCI.exe UBRUIA.exe File created C:\windows\SysWOW64\ZURS.exe.bat JZZOQL.exe File created C:\windows\SysWOW64\LJPSBW.exe SGLP.exe File created C:\windows\SysWOW64\PCIKLO.exe RHJJG.exe File created C:\windows\SysWOW64\RHPJPCI.exe.bat UBRUIA.exe File created C:\windows\SysWOW64\FNJL.exe.bat EJFHD.exe File opened for modification C:\windows\SysWOW64\VBZ.exe TDT.exe File created C:\windows\SysWOW64\VBZ.exe.bat TDT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\ZOAC.exe.bat FBV.exe File created C:\windows\HYE.exe.bat XAZK.exe File created C:\windows\system\UOHOZW.exe.bat DGF.exe File created C:\windows\SRO.exe.bat MWCHEG.exe File created C:\windows\system\LVA.exe.bat SSWI.exe File created C:\windows\KMYSKT.exe.bat QZTJ.exe File opened for modification C:\windows\CSRX.exe LJPSBW.exe File created C:\windows\JANS.exe DAGFZRQ.exe File created C:\windows\EEIDZLF.exe GOX.exe File created C:\windows\EEIDZLF.exe.bat GOX.exe File created C:\windows\RQOAXU.exe.bat YNCE.exe File created C:\windows\TNWBBEH.exe.bat NZXAWBA.exe File created C:\windows\system\GFA.exe.bat GCWHGF.exe File created C:\windows\RHJJG.exe BMAFVZF.exe File created C:\windows\system\ZRNM.exe EEIDZLF.exe File created C:\windows\HYE.exe XAZK.exe File created C:\windows\DGF.exe.bat UGDEKTR.exe File created C:\windows\system\FBPB.exe GJELA.exe File opened for modification C:\windows\system\AOHCLB.exe BDWMDVL.exe File opened for modification C:\windows\system\ADP.exe ZAEGRT.exe File opened for modification C:\windows\system\BSUDLMZ.exe ZUO.exe File created C:\windows\SSWI.exe BSUDLMZ.exe File created C:\windows\HYGD.exe.bat UNQEXC.exe File opened for modification C:\windows\NYORUH.exe HYGD.exe File opened for modification C:\windows\system\XPGXW.exe THSOSE.exe File opened for modification C:\windows\system\PZUVQI.exe FBPB.exe File created C:\windows\system\ZUO.exe KENRXQ.exe File created C:\windows\DGF.exe UGDEKTR.exe File opened for modification C:\windows\system\ZAEGRT.exe GFA.exe File opened for modification C:\windows\QDIEH.exe EVB.exe File created C:\windows\system\ZRNM.exe.bat EEIDZLF.exe File created C:\windows\system\CYW.exe EOMF.exe File created C:\windows\system\ZAEGRT.exe GFA.exe File created C:\windows\system\XPGXW.exe.bat THSOSE.exe File created C:\windows\RWVHYS.exe AOHCLB.exe File opened for modification C:\windows\system\UNQEXC.exe MHYQV.exe File created C:\windows\FTHTVBC.exe OIJDOGH.exe File opened for modification C:\windows\system\UBRUIA.exe UWRFG.exe File created C:\windows\system\TFQHJT.exe FPO.exe File opened for modification C:\windows\system\ARXJN.exe JRD.exe File created C:\windows\system\ZEZI.exe KJPEAZ.exe File created C:\windows\TDT.exe.bat RQOAXU.exe File created C:\windows\system\PVTAT.exe AAJ.exe File opened for modification C:\windows\XQC.exe DCXSVQ.exe File opened for modification C:\windows\FKANZ.exe WKYIOCL.exe File opened for modification C:\windows\system\CYW.exe EOMF.exe File created C:\windows\MWCHEG.exe.bat CYW.exe File created C:\windows\KGDUU.exe.bat ZOAC.exe File created C:\windows\system\QTT.exe BYKXB.exe File opened for modification C:\windows\JANS.exe DAGFZRQ.exe File opened for modification C:\windows\system\USSKNP.exe IAPRM.exe File created C:\windows\system\PZUVQI.exe FBPB.exe File created C:\windows\system\GCWHGF.exe.bat SRO.exe File opened for modification C:\windows\system\DAGFZRQ.exe TSERVT.exe File created C:\windows\FTHTVBC.exe.bat OIJDOGH.exe File opened for modification C:\windows\BDWMDVL.exe IDOBLUD.exe File created C:\windows\JRD.exe.bat FBPWXQ.exe File opened for modification C:\windows\system\ZUO.exe KENRXQ.exe File opened for modification C:\windows\system\TEOT.exe HLT.exe File created C:\windows\GNBHEMU.exe.bat FKXLY.exe File created C:\windows\system\IDOBLUD.exe GNBHEMU.exe File opened for modification C:\windows\ZOAC.exe FBV.exe File created C:\windows\FKANZ.exe.bat WKYIOCL.exe File created C:\windows\system\QZTJ.exe VDOZXUZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1972 cmd.exe 2136 cmd.exe 5064 cmd.exe 4736 cmd.exe 2984 cmd.exe 2244 cmd.exe 4624 cmd.exe 3188 cmd.exe 5516 cmd.exe 5348 cmd.exe 3468 cmd.exe 3948 cmd.exe 3264 cmd.exe 3292 cmd.exe 3284 cmd.exe 5596 cmd.exe 4276 cmd.exe 4780 cmd.exe 1644 cmd.exe 3204 cmd.exe 3688 cmd.exe 248 cmd.exe 4344 cmd.exe 5200 cmd.exe 5044 cmd.exe 2236 cmd.exe 3416 cmd.exe 3984 cmd.exe 5528 cmd.exe 3516 cmd.exe 5920 cmd.exe 4400 cmd.exe 4532 cmd.exe 5752 cmd.exe 6060 cmd.exe 5240 cmd.exe 2744 cmd.exe 1552 cmd.exe 1300 cmd.exe 3496 cmd.exe 5260 cmd.exe 5956 cmd.exe 5604 cmd.exe 5708 cmd.exe 1756 cmd.exe 4596 cmd.exe 5928 cmd.exe 4492 cmd.exe 5060 cmd.exe 4892 cmd.exe 6052 cmd.exe 4852 cmd.exe 5688 cmd.exe 5776 cmd.exe 2724 cmd.exe 1256 cmd.exe 4536 cmd.exe 5644 cmd.exe 2708 cmd.exe 4360 cmd.exe 1876 cmd.exe 4224 cmd.exe 3760 cmd.exe 4760 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3184 5404 WerFault.exe 87 1140 1128 WerFault.exe 93 4608 828 WerFault.exe 99 1552 860 WerFault.exe 104 2920 4484 WerFault.exe 109 5956 1200 WerFault.exe 114 2452 3536 WerFault.exe 119 2260 2372 WerFault.exe 124 4596 3620 WerFault.exe 129 2848 2488 WerFault.exe 134 4800 4380 WerFault.exe 138 2264 5732 WerFault.exe 144 4692 4872 WerFault.exe 149 5748 3152 WerFault.exe 154 4620 940 WerFault.exe 159 624 4200 WerFault.exe 164 4204 3028 WerFault.exe 169 3964 3860 WerFault.exe 173 1080 1688 WerFault.exe 179 4780 2080 WerFault.exe 184 4880 5424 WerFault.exe 189 3848 1404 WerFault.exe 194 1736 4316 WerFault.exe 199 5600 5696 WerFault.exe 204 5020 1236 WerFault.exe 209 392 1660 WerFault.exe 214 3024 2856 WerFault.exe 219 5984 6100 WerFault.exe 224 5912 4196 WerFault.exe 229 3000 5656 WerFault.exe 234 3400 4964 WerFault.exe 239 2188 1840 WerFault.exe 244 2020 1324 WerFault.exe 249 6128 3796 WerFault.exe 254 1692 5932 WerFault.exe 259 4728 6084 WerFault.exe 264 3600 1196 WerFault.exe 269 6136 4284 WerFault.exe 274 3592 1396 WerFault.exe 279 2724 5772 WerFault.exe 284 5224 1988 WerFault.exe 289 4580 1912 WerFault.exe 294 1980 4120 WerFault.exe 299 2924 556 WerFault.exe 304 1672 5584 WerFault.exe 309 968 4476 WerFault.exe 314 2716 4660 WerFault.exe 319 124 4144 WerFault.exe 324 2948 5884 WerFault.exe 329 5112 2408 WerFault.exe 334 3040 3592 WerFault.exe 339 2236 2504 WerFault.exe 344 4624 3504 WerFault.exe 349 5072 3308 WerFault.exe 354 5644 5248 WerFault.exe 359 4940 5504 WerFault.exe 364 2560 3732 WerFault.exe 369 1284 5172 WerFault.exe 374 4268 2584 WerFault.exe 379 5112 5500 WerFault.exe 384 5900 2024 WerFault.exe 389 2648 3932 WerFault.exe 394 3392 200 WerFault.exe 399 2500 1400 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QZTJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XVIFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCXSVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOAC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LULTCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PZUVQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAPRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQOAXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMOLCDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHPJPCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JEJHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNWBBEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDIEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTHTVBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAEGRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDOBLUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWRFG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJFHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEIDZLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNSBDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHJJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAGFZRQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5404 2026-09-04_3384dadc7a540f90dc8f0f8a3732df20_elex_emotet_stop.exe 5404 2026-09-04_3384dadc7a540f90dc8f0f8a3732df20_elex_emotet_stop.exe 1128 FPO.exe 1128 FPO.exe 828 TFQHJT.exe 828 TFQHJT.exe 860 WAV.exe 860 WAV.exe 4484 FBPWXQ.exe 4484 FBPWXQ.exe 1200 JRD.exe 1200 JRD.exe 3536 ARXJN.exe 3536 ARXJN.exe 2372 JZZOQL.exe 2372 JZZOQL.exe 3620 ZURS.exe 3620 ZURS.exe 2488 DCXSVQ.exe 2488 DCXSVQ.exe 4380 XQC.exe 4380 XQC.exe 5732 IIXU.exe 5732 IIXU.exe 4872 SGLP.exe 4872 SGLP.exe 3152 LJPSBW.exe 3152 LJPSBW.exe 940 CSRX.exe 940 CSRX.exe 4200 WKYIOCL.exe 4200 WKYIOCL.exe 3028 FKANZ.exe 3028 FKANZ.exe 3860 JAH.exe 3860 JAH.exe 1688 EOMF.exe 1688 EOMF.exe 2080 CYW.exe 2080 CYW.exe 5424 MWCHEG.exe 5424 MWCHEG.exe 1404 SRO.exe 1404 SRO.exe 4316 GCWHGF.exe 4316 GCWHGF.exe 5696 GFA.exe 5696 GFA.exe 1236 ZAEGRT.exe 1236 ZAEGRT.exe 1660 ADP.exe 1660 ADP.exe 2856 JEJHI.exe 2856 JEJHI.exe 6100 YHBTTTW.exe 6100 YHBTTTW.exe 4196 NXCLZP.exe 4196 NXCLZP.exe 5656 XVIFH.exe 5656 XVIFH.exe 4964 BDO.exe 4964 BDO.exe 1840 UGSJY.exe 1840 UGSJY.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5404 2026-09-04_3384dadc7a540f90dc8f0f8a3732df20_elex_emotet_stop.exe 5404 2026-09-04_3384dadc7a540f90dc8f0f8a3732df20_elex_emotet_stop.exe 1128 FPO.exe 1128 FPO.exe 828 TFQHJT.exe 828 TFQHJT.exe 860 WAV.exe 860 WAV.exe 4484 FBPWXQ.exe 4484 FBPWXQ.exe 1200 JRD.exe 1200 JRD.exe 3536 ARXJN.exe 3536 ARXJN.exe 2372 JZZOQL.exe 2372 JZZOQL.exe 3620 ZURS.exe 3620 ZURS.exe 2488 DCXSVQ.exe 2488 DCXSVQ.exe 4380 XQC.exe 4380 XQC.exe 5732 IIXU.exe 5732 IIXU.exe 4872 SGLP.exe 4872 SGLP.exe 3152 LJPSBW.exe 3152 LJPSBW.exe 940 CSRX.exe 940 CSRX.exe 4200 WKYIOCL.exe 4200 WKYIOCL.exe 3028 FKANZ.exe 3028 FKANZ.exe 3860 JAH.exe 3860 JAH.exe 1688 EOMF.exe 1688 EOMF.exe 2080 CYW.exe 2080 CYW.exe 5424 MWCHEG.exe 5424 MWCHEG.exe 1404 SRO.exe 1404 SRO.exe 4316 GCWHGF.exe 4316 GCWHGF.exe 5696 GFA.exe 5696 GFA.exe 1236 ZAEGRT.exe 1236 ZAEGRT.exe 1660 ADP.exe 1660 ADP.exe 2856 JEJHI.exe 2856 JEJHI.exe 6100 YHBTTTW.exe 6100 YHBTTTW.exe 4196 NXCLZP.exe 4196 NXCLZP.exe 5656 XVIFH.exe 5656 XVIFH.exe 4964 BDO.exe 4964 BDO.exe 1840 UGSJY.exe 1840 UGSJY.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5404 wrote to memory of 4892 5404 2026-09-04_3384dadc7a540f90dc8f0f8a3732df20_elex_emotet_stop.exe 89 PID 4892 wrote to memory of 1128 4892 cmd.exe 93 PID 1128 wrote to memory of 1256 1128 FPO.exe 95 PID 1256 wrote to memory of 828 1256 cmd.exe 99 PID 828 wrote to memory of 4108 828 TFQHJT.exe 100 PID 4108 wrote to memory of 860 4108 cmd.exe 104 PID 860 wrote to memory of 248 860 WAV.exe 105 PID 248 wrote to memory of 4484 248 cmd.exe 109 PID 4484 wrote to memory of 3900 4484 FBPWXQ.exe 110 PID 3900 wrote to memory of 1200 3900 cmd.exe 114 PID 1200 wrote to memory of 1972 1200 JRD.exe 115 PID 1972 wrote to memory of 3536 1972 cmd.exe 119 PID 3536 wrote to memory of 5516 3536 ARXJN.exe 120 PID 5516 wrote to memory of 2372 5516 cmd.exe 124 PID 2372 wrote to memory of 4400 2372 JZZOQL.exe 125 PID 4400 wrote to memory of 3620 4400 cmd.exe 129 PID 3620 wrote to memory of 5708 3620 ZURS.exe 130 PID 5708 wrote to memory of 2488 5708 cmd.exe 134 PID 2488 wrote to memory of 5348 2488 DCXSVQ.exe 135 PID 5348 wrote to memory of 4380 5348 cmd.exe 138 PID 4380 wrote to memory of 4788 4380 XQC.exe 140 PID 4788 wrote to memory of 5732 4788 cmd.exe 144 PID 5732 wrote to memory of 5668 5732 IIXU.exe 145 PID 5668 wrote to memory of 4872 5668 cmd.exe 149 PID 4872 wrote to memory of 1964 4872 SGLP.exe 150 PID 1964 wrote to memory of 3152 1964 cmd.exe 154 PID 3152 wrote to memory of 2728 3152 LJPSBW.exe 155 PID 2728 wrote to memory of 940 2728 cmd.exe 159 PID 940 wrote to memory of 5968 940 CSRX.exe 160 PID 5968 wrote to memory of 4200 5968 cmd.exe 164 PID 4200 wrote to memory of 1552 4200 WKYIOCL.exe 165 PID 1552 wrote to memory of 3028 1552 cmd.exe 169 PID 3028 wrote to memory of 5092 3028 FKANZ.exe 170 PID 5092 wrote to memory of 3860 5092 cmd.exe 173 PID 3860 wrote to memory of 4916 3860 JAH.exe 175 PID 4916 wrote to memory of 1688 4916 cmd.exe 179 PID 1688 wrote to memory of 4912 1688 EOMF.exe 180 PID 4912 wrote to memory of 2080 4912 cmd.exe 184 PID 2080 wrote to memory of 2004 2080 CYW.exe 185 PID 2004 wrote to memory of 5424 2004 cmd.exe 189 PID 5424 wrote to memory of 1936 5424 MWCHEG.exe 190 PID 1936 wrote to memory of 1404 1936 cmd.exe 194 PID 1404 wrote to memory of 4172 1404 SRO.exe 195 PID 4172 wrote to memory of 4316 4172 cmd.exe 199 PID 4316 wrote to memory of 4344 4316 GCWHGF.exe 200 PID 4344 wrote to memory of 5696 4344 cmd.exe 204 PID 5696 wrote to memory of 2136 5696 GFA.exe 205 PID 2136 wrote to memory of 1236 2136 cmd.exe 209 PID 1236 wrote to memory of 3760 1236 ZAEGRT.exe 210 PID 3760 wrote to memory of 1660 3760 cmd.exe 214 PID 1660 wrote to memory of 5232 1660 ADP.exe 215 PID 5232 wrote to memory of 2856 5232 cmd.exe 219 PID 2856 wrote to memory of 5676 2856 JEJHI.exe 220 PID 5676 wrote to memory of 6100 5676 cmd.exe 224 PID 6100 wrote to memory of 1756 6100 YHBTTTW.exe 225 PID 1756 wrote to memory of 4196 1756 cmd.exe 229 PID 4196 wrote to memory of 6052 4196 NXCLZP.exe 230 PID 6052 wrote to memory of 5656 6052 cmd.exe 234 PID 5656 wrote to memory of 4760 5656 XVIFH.exe 235 PID 4760 wrote to memory of 4964 4760 cmd.exe 239 PID 4964 wrote to memory of 2476 4964 BDO.exe 240 PID 2476 wrote to memory of 1840 2476 cmd.exe 244 PID 1840 wrote to memory of 4844 1840 UGSJY.exe 245 PID 4844 wrote to memory of 1324 4844 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_3384dadc7a540f90dc8f0f8a3732df20_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_3384dadc7a540f90dc8f0f8a3732df20_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPO.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\windows\system\FPO.exeC:\windows\system\FPO.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFQHJT.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\windows\system\TFQHJT.exeC:\windows\system\TFQHJT.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WAV.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\WAV.exeC:\windows\WAV.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBPWXQ.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\SysWOW64\FBPWXQ.exeC:\windows\system32\FBPWXQ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JRD.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\windows\JRD.exeC:\windows\JRD.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARXJN.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\system\ARXJN.exeC:\windows\system\ARXJN.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JZZOQL.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\system\JZZOQL.exeC:\windows\system\JZZOQL.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZURS.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\SysWOW64\ZURS.exeC:\windows\system32\ZURS.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCXSVQ.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\windows\SysWOW64\DCXSVQ.exeC:\windows\system32\DCXSVQ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XQC.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\XQC.exeC:\windows\XQC.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIXU.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\IIXU.exeC:\windows\IIXU.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGLP.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\windows\system\SGLP.exeC:\windows\system\SGLP.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJPSBW.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\SysWOW64\LJPSBW.exeC:\windows\system32\LJPSBW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CSRX.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\CSRX.exeC:\windows\CSRX.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKYIOCL.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\system\WKYIOCL.exeC:\windows\system\WKYIOCL.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKANZ.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\windows\FKANZ.exeC:\windows\FKANZ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\windows\SysWOW64\JAH.exeC:\windows\system32\JAH.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EOMF.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\windows\system\EOMF.exeC:\windows\system\EOMF.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYW.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\windows\system\CYW.exeC:\windows\system\CYW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWCHEG.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\MWCHEG.exeC:\windows\MWCHEG.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRO.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\windows\SRO.exeC:\windows\SRO.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCWHGF.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\system\GCWHGF.exeC:\windows\system\GCWHGF.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFA.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\system\GFA.exeC:\windows\system\GFA.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZAEGRT.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\windows\system\ZAEGRT.exeC:\windows\system\ZAEGRT.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADP.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\windows\system\ADP.exeC:\windows\system\ADP.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEJHI.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\windows\SysWOW64\JEJHI.exeC:\windows\system32\JEJHI.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHBTTTW.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\YHBTTTW.exeC:\windows\YHBTTTW.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NXCLZP.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\windows\SysWOW64\NXCLZP.exeC:\windows\system32\NXCLZP.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XVIFH.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\SysWOW64\XVIFH.exeC:\windows\system32\XVIFH.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BDO.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\windows\system\BDO.exeC:\windows\system\BDO.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGSJY.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\windows\system\UGSJY.exeC:\windows\system\UGSJY.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBWF.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\windows\SysWOW64\VBWF.exeC:\windows\system32\VBWF.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KENRXQ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:3372 -
C:\windows\system\KENRXQ.exeC:\windows\system\KENRXQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZUO.exe.bat" "68⤵PID:4132
-
C:\windows\system\ZUO.exeC:\windows\system\ZUO.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BSUDLMZ.exe.bat" "70⤵PID:5648
-
C:\windows\system\BSUDLMZ.exeC:\windows\system\BSUDLMZ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSWI.exe.bat" "72⤵PID:1960
-
C:\windows\SSWI.exeC:\windows\SSWI.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVA.exe.bat" "74⤵PID:1156
-
C:\windows\system\LVA.exeC:\windows\system\LVA.exe75⤵
- Executes dropped EXE
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PDGLO.exe.bat" "76⤵PID:4748
-
C:\windows\PDGLO.exeC:\windows\PDGLO.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDOZXUZ.exe.bat" "78⤵PID:1436
-
C:\windows\SysWOW64\VDOZXUZ.exeC:\windows\system32\VDOZXUZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QZTJ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5200 -
C:\windows\system\QZTJ.exeC:\windows\system\QZTJ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMYSKT.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5064 -
C:\windows\KMYSKT.exeC:\windows\KMYSKT.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMAFVZF.exe.bat" "84⤵PID:4296
-
C:\windows\SysWOW64\BMAFVZF.exeC:\windows\system32\BMAFVZF.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHJJG.exe.bat" "86⤵PID:4636
-
C:\windows\RHJJG.exeC:\windows\RHJJG.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCIKLO.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4596 -
C:\windows\SysWOW64\PCIKLO.exeC:\windows\system32\PCIKLO.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNRJRR.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3208 -
C:\windows\SysWOW64\KNRJRR.exeC:\windows\system32\KNRJRR.exe91⤵
- Executes dropped EXE
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBV.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:804 -
C:\windows\system\FBV.exeC:\windows\system\FBV.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOAC.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5044 -
C:\windows\ZOAC.exeC:\windows\ZOAC.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGDUU.exe.bat" "96⤵PID:3408
-
C:\windows\KGDUU.exeC:\windows\KGDUU.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZGKCMG.exe.bat" "98⤵PID:4504
-
C:\windows\SysWOW64\JZGKCMG.exeC:\windows\system32\JZGKCMG.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NHNLHFU.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1172 -
C:\windows\SysWOW64\NHNLHFU.exeC:\windows\system32\NHNLHFU.exe101⤵
- Executes dropped EXE
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MSXB.exe.bat" "102⤵PID:4668
-
C:\windows\system\MSXB.exeC:\windows\system\MSXB.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVB.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3420 -
C:\windows\SysWOW64\EVB.exeC:\windows\system32\EVB.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QDIEH.exe.bat" "106⤵PID:3424
-
C:\windows\QDIEH.exeC:\windows\QDIEH.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWLU.exe.bat" "108⤵PID:1080
-
C:\windows\PWLU.exeC:\windows\PWLU.exe109⤵
- Executes dropped EXE
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJPEAZ.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4948 -
C:\windows\system\KJPEAZ.exeC:\windows\system\KJPEAZ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEZI.exe.bat" "112⤵
- Executes a command shell one-liner
PID:5920 -
C:\windows\system\ZEZI.exeC:\windows\system\ZEZI.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TSERVT.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3292 -
C:\windows\SysWOW64\TSERVT.exeC:\windows\system32\TSERVT.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAGFZRQ.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4532 -
C:\windows\system\DAGFZRQ.exeC:\windows\system\DAGFZRQ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JANS.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:296 -
C:\windows\JANS.exeC:\windows\JANS.exe119⤵
- Executes dropped EXE
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "120⤵PID:696
-
C:\windows\DNSCST.exeC:\windows\DNSCST.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-