Analysis
- max time kernel
94s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 17:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe
- Size 208KB
- Sample260910-vlttaavyft
- SHA256 e4aa40773fd175f83fe1e0a2efe4779831c0c867b13cba0c2bf411a02343caf1
- MD5 4e3bace075106cbfccfdbe7d793aff14
- SHA1 4359cb03ea40d7f8e8451cb9daab2bef8dba9999
- SHA512 8c3aed9c9c62fb972dfba186292a14ecd4022ba60752cabf5be626870af5f986153e50c33edde941ef0c34be594ababcd61995fb98f82e268ec86af5122eddb5
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfy4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LOKkEj1
- TLSH T1A9247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2476 SEPGAHO.exe 3932 GAN.exe 1676 HDRV.exe 2344 HIRJE.exe 4596 CTA.exe 1128 VWEEYLY.exe 1344 QJIV.exe 5436 HKKAL.exe 4876 WFU.exe 1276 AVANI.exe 1456 EYZ.exe 4668 RJP.exe 3900 JJRDA.exe 2376 NZYLMHH.exe 2804 FCBH.exe 1324 RVEAA.exe 5636 DDLAMFM.exe 672 XQQJ.exe 1268 SLVBZE.exe 3264 WTBBL.exe 2628 LJCSSKA.exe 5396 GXHK.exe 2324 AKMTM.exe 1940 VFRCOKA.exe 5464 MKBUE.exe 3568 MYTJGT.exe 5916 SYB.exe 4676 WGIXB.exe 2428 QUMGLFV.exe 4884 LPRP.exe 5248 RCQYA.exe 2280 XDYMJLB.exe 5160 TIEJ.exe 3488 FBZUZ.exe 1228 ZOEDJCH.exe 5792 FOLZSWI.exe 5864 QHO.exe 5888 OHWXJ.exe 4540 PKABPVA.exe 3448 PQAQQ.exe 612 ELJUJV.exe 4844 ZGO.exe 2180 QGQIXA.exe 2456 BZLBXIK.exe 4516 KMW.exe 5824 CNYY.exe 2104 WICQBB.exe 5868 AQJQN.exe 1096 EGQ.exe 5024 WGSD.exe 1796 THZRMM.exe 3352 WUE.exe 4112 FCGF.exe 820 APLPKJ.exe 3320 GQTC.exe 2724 RIWVB.exe 4432 AJYAEY.exe 5176 MZE.exe 3156 WZGNU.exe 52 QUDXEN.exe 5728 LII.exe 2568 CVSYEK.exe 4224 XIX.exe 5612 IBAA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RHVK.exe XUQ.exe File created C:\windows\SysWOW64\YNCE.exe.bat UFWWFMF.exe File created C:\windows\SysWOW64\NVM.exe HVFJVC.exe File created C:\windows\SysWOW64\MYTJGT.exe.bat MKBUE.exe File created C:\windows\SysWOW64\PDQS.exe.bat YSAU.exe File created C:\windows\SysWOW64\DAQDAV.exe RHVK.exe File opened for modification C:\windows\SysWOW64\RRVAXU.exe XDQRN.exe File created C:\windows\SysWOW64\RVEAA.exe.bat FCBH.exe File opened for modification C:\windows\SysWOW64\RWK.exe AJAGG.exe File created C:\windows\SysWOW64\HKP.exe.bat WRUEHMC.exe File opened for modification C:\windows\SysWOW64\NVM.exe HVFJVC.exe File created C:\windows\SysWOW64\WGSD.exe EGQ.exe File opened for modification C:\windows\SysWOW64\RHVK.exe XUQ.exe File created C:\windows\SysWOW64\RHVK.exe.bat XUQ.exe File opened for modification C:\windows\SysWOW64\VVEPZ.exe ZPYAS.exe File created C:\windows\SysWOW64\UFWWFMF.exe DWUR.exe File opened for modification C:\windows\SysWOW64\HVFJVC.exe YNCE.exe File created C:\windows\SysWOW64\RVEAA.exe FCBH.exe File opened for modification C:\windows\SysWOW64\WTBBL.exe SLVBZE.exe File created C:\windows\SysWOW64\MYTJGT.exe MKBUE.exe File opened for modification C:\windows\SysWOW64\XDYMJLB.exe RCQYA.exe File created C:\windows\SysWOW64\RIWVB.exe GQTC.exe File opened for modification C:\windows\SysWOW64\XBK.exe COFKZR.exe File created C:\windows\SysWOW64\JQVBS.exe PDQS.exe File created C:\windows\SysWOW64\RWK.exe.bat AJAGG.exe File created C:\windows\SysWOW64\AVANI.exe WFU.exe File created C:\windows\SysWOW64\ZOEDJCH.exe.bat FBZUZ.exe File created C:\windows\SysWOW64\YSAU.exe ACHRV.exe File created C:\windows\SysWOW64\JXKO.exe DBLGPI.exe File created C:\windows\SysWOW64\RWK.exe AJAGG.exe File created C:\windows\SysWOW64\CWOGS.exe.bat HJJ.exe File created C:\windows\SysWOW64\VVEPZ.exe ZPYAS.exe File opened for modification C:\windows\SysWOW64\DWUR.exe ORWU.exe File opened for modification C:\windows\SysWOW64\VWEEYLY.exe CTA.exe File opened for modification C:\windows\SysWOW64\AVANI.exe WFU.exe File created C:\windows\SysWOW64\AVANI.exe.bat WFU.exe File opened for modification C:\windows\SysWOW64\MYTJGT.exe MKBUE.exe File opened for modification C:\windows\SysWOW64\SYB.exe MYTJGT.exe File created C:\windows\SysWOW64\XDYMJLB.exe RCQYA.exe File created C:\windows\SysWOW64\XDYMJLB.exe.bat RCQYA.exe File created C:\windows\SysWOW64\RIWVB.exe.bat GQTC.exe File created C:\windows\SysWOW64\YSAU.exe.bat ACHRV.exe File opened for modification C:\windows\SysWOW64\JQVBS.exe PDQS.exe File created C:\windows\SysWOW64\MIEZW.exe.bat BPJG.exe File opened for modification C:\windows\SysWOW64\WRUEHMC.exe LZR.exe File created C:\windows\SysWOW64\UFWWFMF.exe.bat DWUR.exe File created C:\windows\SysWOW64\HVFJVC.exe.bat YNCE.exe File opened for modification C:\windows\SysWOW64\KGS.exe TWUKN.exe File created C:\windows\SysWOW64\RRVAXU.exe XDQRN.exe File created C:\windows\SysWOW64\SYB.exe MYTJGT.exe File created C:\windows\SysWOW64\OHWXJ.exe.bat QHO.exe File opened for modification C:\windows\SysWOW64\QGQIXA.exe ZGO.exe File created C:\windows\SysWOW64\WGSD.exe.bat EGQ.exe File created C:\windows\SysWOW64\MZE.exe AJYAEY.exe File opened for modification C:\windows\SysWOW64\JXKO.exe DBLGPI.exe File opened for modification C:\windows\SysWOW64\UFWWFMF.exe DWUR.exe File created C:\windows\SysWOW64\YNCE.exe UFWWFMF.exe File opened for modification C:\windows\SysWOW64\RVEAA.exe FCBH.exe File created C:\windows\SysWOW64\OHWXJ.exe QHO.exe File created C:\windows\SysWOW64\DCAOXI.exe XCSB.exe File opened for modification C:\windows\SysWOW64\DCAOXI.exe XCSB.exe File created C:\windows\SysWOW64\MIEZW.exe BPJG.exe File created C:\windows\SysWOW64\WRUEHMC.exe.bat LZR.exe File created C:\windows\SysWOW64\WTBBL.exe SLVBZE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\HIRJE.exe.bat HDRV.exe File created C:\windows\system\WGIXB.exe.bat SYB.exe File created C:\windows\system\TIEJ.exe XDYMJLB.exe File opened for modification C:\windows\system\TIEJ.exe XDYMJLB.exe File opened for modification C:\windows\THZRMM.exe WGSD.exe File created C:\windows\THZRMM.exe.bat WGSD.exe File created C:\windows\system\WQDUTS.exe.bat CUZL.exe File opened for modification C:\windows\system\SEPGAHO.exe 2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe File opened for modification C:\windows\system\HIRJE.exe HDRV.exe File opened for modification C:\windows\system\WFU.exe HKKAL.exe File created C:\windows\system\DDLAMFM.exe.bat RVEAA.exe File created C:\windows\system\PKABPVA.exe OHWXJ.exe File created C:\windows\LII.exe.bat QUDXEN.exe File created C:\windows\system\DAAW.exe.bat UNQEXC.exe File opened for modification C:\windows\XUQ.exe AOK.exe File created C:\windows\QJIV.exe VWEEYLY.exe File created C:\windows\system\GXHK.exe LJCSSKA.exe File opened for modification C:\windows\system\GXHK.exe LJCSSKA.exe File created C:\windows\PQAQQ.exe PKABPVA.exe File created C:\windows\system\WZGNU.exe.bat MZE.exe File opened for modification C:\windows\JVAFJ.exe DAAW.exe File created C:\windows\system\HJJ.exe WQGEZNJ.exe File opened for modification C:\windows\XGLNVV.exe DLHE.exe File opened for modification C:\windows\system\NZYLMHH.exe JJRDA.exe File opened for modification C:\windows\system\IUFM.exe XBK.exe File created C:\windows\XUQ.exe.bat AOK.exe File opened for modification C:\windows\system\HJJ.exe WQGEZNJ.exe File opened for modification C:\windows\BMDSCP.exe KGS.exe File opened for modification C:\windows\system\WQDUTS.exe CUZL.exe File created C:\windows\GAN.exe SEPGAHO.exe File created C:\windows\system\ACHRV.exe.bat IUFM.exe File created C:\windows\system\RBK.exe RWK.exe File created C:\windows\system\SEPGAHO.exe 2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe File opened for modification C:\windows\QJIV.exe VWEEYLY.exe File opened for modification C:\windows\XQQJ.exe DDLAMFM.exe File created C:\windows\XQQJ.exe.bat DDLAMFM.exe File created C:\windows\DBLGPI.exe.bat ELALCDW.exe File created C:\windows\system\UXAQMI.exe YSCT.exe File opened for modification C:\windows\AJAGG.exe KYJJG.exe File opened for modification C:\windows\system\DLHE.exe LKF.exe File created C:\windows\LPRP.exe.bat QUMGLFV.exe File opened for modification C:\windows\system\CUZL.exe WHH.exe File created C:\windows\FBZUZ.exe.bat TIEJ.exe File created C:\windows\JVAFJ.exe DAAW.exe File created C:\windows\HKKAL.exe QJIV.exe File created C:\windows\FCBH.exe NZYLMHH.exe File created C:\windows\NAD.exe.bat UXAQMI.exe File created C:\windows\EYZ.exe.bat AVANI.exe File created C:\windows\system\WUE.exe.bat THZRMM.exe File created C:\windows\system\GQTC.exe APLPKJ.exe File opened for modification C:\windows\system\ELALCDW.exe JQVBS.exe File created C:\windows\system\TWUKN.exe.bat NVM.exe File created C:\windows\SLVBZE.exe XQQJ.exe File created C:\windows\PQAQQ.exe.bat PKABPVA.exe File opened for modification C:\windows\BZLBXIK.exe QGQIXA.exe File created C:\windows\THZRMM.exe WGSD.exe File created C:\windows\system\FCGF.exe WUE.exe File created C:\windows\system\IUFM.exe.bat XBK.exe File created C:\windows\system\YQJJCPE.exe JVAFJ.exe File created C:\windows\system\WQGEZNJ.exe MIEZW.exe File created C:\windows\system\AKMTM.exe GXHK.exe File opened for modification C:\windows\system\PKABPVA.exe OHWXJ.exe File created C:\windows\system\ELJUJV.exe PQAQQ.exe File created C:\windows\system\ELALCDW.exe.bat JQVBS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5152 cmd.exe 2716 cmd.exe 3112 cmd.exe 3364 cmd.exe 1412 cmd.exe 4152 cmd.exe 2932 cmd.exe 1188 cmd.exe 4868 cmd.exe 4200 cmd.exe 6104 cmd.exe 2816 cmd.exe 5040 cmd.exe 1296 cmd.exe 1652 cmd.exe 5484 cmd.exe 5356 cmd.exe 2076 cmd.exe 2884 cmd.exe 5096 cmd.exe 3668 cmd.exe 2436 cmd.exe 3848 cmd.exe 1204 cmd.exe 2420 cmd.exe 4836 cmd.exe 2588 cmd.exe 752 cmd.exe 4924 cmd.exe 1616 cmd.exe 5220 cmd.exe 5904 cmd.exe 3928 cmd.exe 4360 cmd.exe 5136 cmd.exe 4888 cmd.exe 1180 cmd.exe 5736 cmd.exe 1220 cmd.exe 5920 cmd.exe 256 cmd.exe 5960 cmd.exe 1308 cmd.exe 4500 cmd.exe 616 cmd.exe 2000 cmd.exe 2980 cmd.exe 4384 cmd.exe 3532 cmd.exe 5928 cmd.exe 3188 cmd.exe 2036 cmd.exe 3828 cmd.exe 3892 cmd.exe 4840 cmd.exe 3484 cmd.exe 3652 cmd.exe 4864 cmd.exe 2120 cmd.exe 5264 cmd.exe 2500 cmd.exe 3260 cmd.exe 2388 cmd.exe 1184 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4972 3480 WerFault.exe 87 5840 2476 WerFault.exe 93 6124 3932 WerFault.exe 99 5020 1676 WerFault.exe 104 5656 2344 WerFault.exe 109 3836 4596 WerFault.exe 114 1404 1128 WerFault.exe 119 4536 1344 WerFault.exe 124 1488 5436 WerFault.exe 129 4128 4876 WerFault.exe 134 700 1276 WerFault.exe 139 4696 1456 WerFault.exe 144 4972 4668 WerFault.exe 149 3984 3900 WerFault.exe 154 5972 2376 WerFault.exe 159 4540 2804 WerFault.exe 164 2672 1324 WerFault.exe 169 5780 5636 WerFault.exe 174 1504 672 WerFault.exe 179 3892 1268 WerFault.exe 184 3328 3264 WerFault.exe 189 2228 2628 WerFault.exe 194 5072 5396 WerFault.exe 199 984 2324 WerFault.exe 204 2016 1940 WerFault.exe 209 1616 5464 WerFault.exe 214 3896 3568 WerFault.exe 219 4300 5916 WerFault.exe 224 5492 4676 WerFault.exe 229 356 2428 WerFault.exe 234 1992 4884 WerFault.exe 239 2604 5248 WerFault.exe 244 3424 2280 WerFault.exe 249 5480 5160 WerFault.exe 254 4640 3488 WerFault.exe 259 2028 1228 WerFault.exe 264 3984 5792 WerFault.exe 269 1144 5864 WerFault.exe 274 1868 5888 WerFault.exe 279 5400 4540 WerFault.exe 284 5204 3448 WerFault.exe 289 1504 612 WerFault.exe 294 1780 4844 WerFault.exe 299 2848 2180 WerFault.exe 304 1744 2456 WerFault.exe 309 4592 4516 WerFault.exe 314 2492 5824 WerFault.exe 319 4500 2104 WerFault.exe 324 5992 5868 WerFault.exe 329 4476 1096 WerFault.exe 334 4312 5024 WerFault.exe 339 5220 1796 WerFault.exe 344 1992 3352 WerFault.exe 349 1092 4112 WerFault.exe 354 976 820 WerFault.exe 359 5084 3320 WerFault.exe 364 5956 2724 WerFault.exe 369 3588 4432 WerFault.exe 374 4900 5176 WerFault.exe 379 720 3156 WerFault.exe 384 1492 52 WerFault.exe 389 4344 5728 WerFault.exe 394 3968 2568 WerFault.exe 399 3532 4224 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHWXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TIEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJRDA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQJQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKKAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVGCCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZLBXIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOLZSWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJAGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWUKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBLGPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGQIXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQDUTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFRCOKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAQDAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3480 2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe 3480 2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe 2476 SEPGAHO.exe 2476 SEPGAHO.exe 3932 GAN.exe 3932 GAN.exe 1676 HDRV.exe 1676 HDRV.exe 2344 HIRJE.exe 2344 HIRJE.exe 4596 CTA.exe 4596 CTA.exe 1128 VWEEYLY.exe 1128 VWEEYLY.exe 1344 QJIV.exe 1344 QJIV.exe 5436 HKKAL.exe 5436 HKKAL.exe 4876 WFU.exe 4876 WFU.exe 1276 AVANI.exe 1276 AVANI.exe 1456 EYZ.exe 1456 EYZ.exe 4668 RJP.exe 4668 RJP.exe 3900 JJRDA.exe 3900 JJRDA.exe 2376 NZYLMHH.exe 2376 NZYLMHH.exe 2804 FCBH.exe 2804 FCBH.exe 1324 RVEAA.exe 1324 RVEAA.exe 5636 DDLAMFM.exe 5636 DDLAMFM.exe 672 XQQJ.exe 672 XQQJ.exe 1268 SLVBZE.exe 1268 SLVBZE.exe 3264 WTBBL.exe 3264 WTBBL.exe 2628 LJCSSKA.exe 2628 LJCSSKA.exe 5396 GXHK.exe 5396 GXHK.exe 2324 AKMTM.exe 2324 AKMTM.exe 1940 VFRCOKA.exe 1940 VFRCOKA.exe 5464 MKBUE.exe 5464 MKBUE.exe 3568 MYTJGT.exe 3568 MYTJGT.exe 5916 SYB.exe 5916 SYB.exe 4676 WGIXB.exe 4676 WGIXB.exe 2428 QUMGLFV.exe 2428 QUMGLFV.exe 4884 LPRP.exe 4884 LPRP.exe 5248 RCQYA.exe 5248 RCQYA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3480 2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe 3480 2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe 2476 SEPGAHO.exe 2476 SEPGAHO.exe 3932 GAN.exe 3932 GAN.exe 1676 HDRV.exe 1676 HDRV.exe 2344 HIRJE.exe 2344 HIRJE.exe 4596 CTA.exe 4596 CTA.exe 1128 VWEEYLY.exe 1128 VWEEYLY.exe 1344 QJIV.exe 1344 QJIV.exe 5436 HKKAL.exe 5436 HKKAL.exe 4876 WFU.exe 4876 WFU.exe 1276 AVANI.exe 1276 AVANI.exe 1456 EYZ.exe 1456 EYZ.exe 4668 RJP.exe 4668 RJP.exe 3900 JJRDA.exe 3900 JJRDA.exe 2376 NZYLMHH.exe 2376 NZYLMHH.exe 2804 FCBH.exe 2804 FCBH.exe 1324 RVEAA.exe 1324 RVEAA.exe 5636 DDLAMFM.exe 5636 DDLAMFM.exe 672 XQQJ.exe 672 XQQJ.exe 1268 SLVBZE.exe 1268 SLVBZE.exe 3264 WTBBL.exe 3264 WTBBL.exe 2628 LJCSSKA.exe 2628 LJCSSKA.exe 5396 GXHK.exe 5396 GXHK.exe 2324 AKMTM.exe 2324 AKMTM.exe 1940 VFRCOKA.exe 1940 VFRCOKA.exe 5464 MKBUE.exe 5464 MKBUE.exe 3568 MYTJGT.exe 3568 MYTJGT.exe 5916 SYB.exe 5916 SYB.exe 4676 WGIXB.exe 4676 WGIXB.exe 2428 QUMGLFV.exe 2428 QUMGLFV.exe 4884 LPRP.exe 4884 LPRP.exe 5248 RCQYA.exe 5248 RCQYA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3480 wrote to memory of 4868 3480 2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe 89 PID 4868 wrote to memory of 2476 4868 cmd.exe 93 PID 2476 wrote to memory of 5152 2476 SEPGAHO.exe 95 PID 5152 wrote to memory of 3932 5152 cmd.exe 99 PID 3932 wrote to memory of 1768 3932 GAN.exe 100 PID 1768 wrote to memory of 1676 1768 cmd.exe 104 PID 1676 wrote to memory of 352 1676 HDRV.exe 105 PID 352 wrote to memory of 2344 352 cmd.exe 109 PID 2344 wrote to memory of 5680 2344 HIRJE.exe 110 PID 5680 wrote to memory of 4596 5680 cmd.exe 114 PID 4596 wrote to memory of 4200 4596 CTA.exe 115 PID 4200 wrote to memory of 1128 4200 cmd.exe 119 PID 1128 wrote to memory of 2404 1128 VWEEYLY.exe 120 PID 2404 wrote to memory of 1344 2404 cmd.exe 124 PID 1344 wrote to memory of 3668 1344 QJIV.exe 125 PID 3668 wrote to memory of 5436 3668 cmd.exe 129 PID 5436 wrote to memory of 2008 5436 HKKAL.exe 130 PID 2008 wrote to memory of 4876 2008 cmd.exe 134 PID 4876 wrote to memory of 5620 4876 WFU.exe 135 PID 5620 wrote to memory of 1276 5620 cmd.exe 139 PID 1276 wrote to memory of 3452 1276 AVANI.exe 140 PID 3452 wrote to memory of 1456 3452 cmd.exe 144 PID 1456 wrote to memory of 5356 1456 EYZ.exe 145 PID 5356 wrote to memory of 4668 5356 cmd.exe 149 PID 4668 wrote to memory of 1180 4668 RJP.exe 150 PID 1180 wrote to memory of 3900 1180 cmd.exe 154 PID 3900 wrote to memory of 3656 3900 JJRDA.exe 155 PID 3656 wrote to memory of 2376 3656 cmd.exe 159 PID 2376 wrote to memory of 5828 2376 NZYLMHH.exe 160 PID 5828 wrote to memory of 2804 5828 cmd.exe 164 PID 2804 wrote to memory of 4852 2804 FCBH.exe 165 PID 4852 wrote to memory of 1324 4852 cmd.exe 169 PID 1324 wrote to memory of 3160 1324 RVEAA.exe 170 PID 3160 wrote to memory of 5636 3160 cmd.exe 174 PID 5636 wrote to memory of 6104 5636 DDLAMFM.exe 175 PID 6104 wrote to memory of 672 6104 cmd.exe 179 PID 672 wrote to memory of 2864 672 XQQJ.exe 180 PID 2864 wrote to memory of 1268 2864 cmd.exe 184 PID 1268 wrote to memory of 2816 1268 SLVBZE.exe 185 PID 2816 wrote to memory of 3264 2816 cmd.exe 189 PID 3264 wrote to memory of 896 3264 WTBBL.exe 190 PID 896 wrote to memory of 2628 896 cmd.exe 194 PID 2628 wrote to memory of 4160 2628 LJCSSKA.exe 195 PID 4160 wrote to memory of 5396 4160 cmd.exe 199 PID 5396 wrote to memory of 4924 5396 GXHK.exe 200 PID 4924 wrote to memory of 2324 4924 cmd.exe 204 PID 2324 wrote to memory of 4920 2324 AKMTM.exe 205 PID 1940 wrote to memory of 4956 1940 VFRCOKA.exe 210 PID 4956 wrote to memory of 5464 4956 cmd.exe 214 PID 5464 wrote to memory of 4544 5464 MKBUE.exe 215 PID 4544 wrote to memory of 3568 4544 cmd.exe 219 PID 3568 wrote to memory of 5040 3568 MYTJGT.exe 220 PID 5040 wrote to memory of 5916 5040 cmd.exe 224 PID 5916 wrote to memory of 616 5916 SYB.exe 225 PID 616 wrote to memory of 4676 616 cmd.exe 229 PID 4676 wrote to memory of 4488 4676 WGIXB.exe 230 PID 4488 wrote to memory of 2428 4488 cmd.exe 234 PID 2428 wrote to memory of 4864 2428 QUMGLFV.exe 235 PID 4864 wrote to memory of 4884 4864 cmd.exe 239 PID 4884 wrote to memory of 3916 4884 LPRP.exe 240 PID 3916 wrote to memory of 5248 3916 cmd.exe 244 PID 5248 wrote to memory of 2504 5248 RCQYA.exe 245 PID 2504 wrote to memory of 2280 2504 cmd.exe 249 PID 2280 wrote to memory of 2000 2280 XDYMJLB.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_4e3bace075106cbfccfdbe7d793aff14_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEPGAHO.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\windows\system\SEPGAHO.exeC:\windows\system\SEPGAHO.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAN.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\windows\GAN.exeC:\windows\GAN.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HDRV.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\windows\SysWOW64\HDRV.exeC:\windows\system32\HDRV.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HIRJE.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:352 -
C:\windows\system\HIRJE.exeC:\windows\system\HIRJE.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CTA.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\windows\system\CTA.exeC:\windows\system\CTA.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWEEYLY.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\windows\SysWOW64\VWEEYLY.exeC:\windows\system32\VWEEYLY.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QJIV.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\QJIV.exeC:\windows\QJIV.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HKKAL.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\windows\HKKAL.exeC:\windows\HKKAL.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFU.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\windows\system\WFU.exeC:\windows\system\WFU.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AVANI.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\windows\SysWOW64\AVANI.exeC:\windows\system32\AVANI.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYZ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\EYZ.exeC:\windows\EYZ.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJP.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\RJP.exeC:\windows\RJP.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJRDA.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\windows\system\JJRDA.exeC:\windows\system\JJRDA.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NZYLMHH.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\windows\system\NZYLMHH.exeC:\windows\system\NZYLMHH.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCBH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\windows\FCBH.exeC:\windows\FCBH.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVEAA.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\windows\SysWOW64\RVEAA.exeC:\windows\system32\RVEAA.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDLAMFM.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\system\DDLAMFM.exeC:\windows\system\DDLAMFM.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XQQJ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\XQQJ.exeC:\windows\XQQJ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLVBZE.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\windows\SLVBZE.exeC:\windows\SLVBZE.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTBBL.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\SysWOW64\WTBBL.exeC:\windows\system32\WTBBL.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJCSSKA.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:896 -
C:\windows\LJCSSKA.exeC:\windows\LJCSSKA.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXHK.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\system\GXHK.exeC:\windows\system\GXHK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AKMTM.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\system\AKMTM.exeC:\windows\system\AKMTM.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VFRCOKA.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
PID:4920 -
C:\windows\system\VFRCOKA.exeC:\windows\system\VFRCOKA.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKBUE.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\system\MKBUE.exeC:\windows\system\MKBUE.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYTJGT.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\SysWOW64\MYTJGT.exeC:\windows\system32\MYTJGT.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SYB.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\SysWOW64\SYB.exeC:\windows\system32\SYB.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WGIXB.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\system\WGIXB.exeC:\windows\system\WGIXB.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUMGLFV.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\windows\system\QUMGLFV.exeC:\windows\system\QUMGLFV.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LPRP.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\LPRP.exeC:\windows\LPRP.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RCQYA.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\windows\RCQYA.exeC:\windows\RCQYA.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDYMJLB.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\windows\SysWOW64\XDYMJLB.exeC:\windows\system32\XDYMJLB.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TIEJ.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2000 -
C:\windows\system\TIEJ.exeC:\windows\system\TIEJ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBZUZ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2980 -
C:\windows\FBZUZ.exeC:\windows\FBZUZ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOEDJCH.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:4136 -
C:\windows\SysWOW64\ZOEDJCH.exeC:\windows\system32\ZOEDJCH.exe71⤵
- Executes dropped EXE
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOLZSWI.exe.bat" "72⤵PID:984
-
C:\windows\system\FOLZSWI.exeC:\windows\system\FOLZSWI.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHO.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3716 -
C:\windows\system\QHO.exeC:\windows\system\QHO.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHWXJ.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1616 -
C:\windows\SysWOW64\OHWXJ.exeC:\windows\system32\OHWXJ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PKABPVA.exe.bat" "78⤵PID:5380
-
C:\windows\system\PKABPVA.exeC:\windows\system\PKABPVA.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQAQQ.exe.bat" "80⤵PID:4300
-
C:\windows\PQAQQ.exeC:\windows\PQAQQ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELJUJV.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2716 -
C:\windows\system\ELJUJV.exeC:\windows\system\ELJUJV.exe83⤵
- Executes dropped EXE
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4648 -
C:\windows\ZGO.exeC:\windows\ZGO.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGQIXA.exe.bat" "86⤵
- Executes a command shell one-liner
PID:1296 -
C:\windows\SysWOW64\QGQIXA.exeC:\windows\system32\QGQIXA.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZLBXIK.exe.bat" "88⤵PID:4416
-
C:\windows\BZLBXIK.exeC:\windows\BZLBXIK.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KMW.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3112 -
C:\windows\system\KMW.exeC:\windows\system\KMW.exe91⤵
- Executes dropped EXE
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNYY.exe.bat" "92⤵PID:3324
-
C:\windows\CNYY.exeC:\windows\CNYY.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WICQBB.exe.bat" "94⤵PID:5352
-
C:\windows\WICQBB.exeC:\windows\WICQBB.exe95⤵
- Executes dropped EXE
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AQJQN.exe.bat" "96⤵
- Executes a command shell one-liner
PID:2120 -
C:\windows\AQJQN.exeC:\windows\AQJQN.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGQ.exe.bat" "98⤵PID:3024
-
C:\windows\system\EGQ.exeC:\windows\system\EGQ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGSD.exe.bat" "100⤵PID:3600
-
C:\windows\SysWOW64\WGSD.exeC:\windows\system32\WGSD.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THZRMM.exe.bat" "102⤵PID:1176
-
C:\windows\THZRMM.exeC:\windows\THZRMM.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WUE.exe.bat" "104⤵PID:692
-
C:\windows\system\WUE.exeC:\windows\system\WUE.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCGF.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4092 -
C:\windows\system\FCGF.exeC:\windows\system\FCGF.exe107⤵
- Executes dropped EXE
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APLPKJ.exe.bat" "108⤵PID:4480
-
C:\windows\APLPKJ.exeC:\windows\APLPKJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GQTC.exe.bat" "110⤵PID:1948
-
C:\windows\system\GQTC.exeC:\windows\system\GQTC.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIWVB.exe.bat" "112⤵
- Executes a command shell one-liner
PID:2436 -
C:\windows\SysWOW64\RIWVB.exeC:\windows\system32\RIWVB.exe113⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJYAEY.exe.bat" "114⤵PID:4732
-
C:\windows\AJYAEY.exeC:\windows\AJYAEY.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZE.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2076 -
C:\windows\SysWOW64\MZE.exeC:\windows\system32\MZE.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZGNU.exe.bat" "118⤵PID:1264
-
C:\windows\system\WZGNU.exeC:\windows\system\WZGNU.exe119⤵
- Executes dropped EXE
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUDXEN.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5264 -
C:\windows\system\QUDXEN.exeC:\windows\system\QUDXEN.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:52
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-