Analysis
- max time kernel
66s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 10:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe
- Size 208KB
- Sample260930-mlk75scf47
- SHA256 afa2930f2abbe3eb871ce01162da12035c1df8d1ea6b0408e4b8f53a397600a3
- MD5 6fed3cdd7b59d7616c3e84b39f1ed6f8
- SHA1 837c4cd3124f2d44b03dfb8beb47c5e01541575f
- SHA512 5555112e71b3fa79f8558e347aa8bf86dcaa055c3ea714d18e20b314b8c34ad6d44f1755c363cfb2706b3d68521c7148d76a55c0fb84e06278c7263065d0deab
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb1lldL+LOfN4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb1ll5+LOlkEj1
- TLSH T1C7247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 756 TZFZ.exe 1964 TXZA.exe 480 HVZ.exe 5788 GDO.exe 5668 GJS.exe 1172 JWXZ.exe 3812 API.exe 5884 LXPXLM.exe 6044 DFDVYV.exe 4368 CQGLG.exe 5516 YQIN.exe 5360 PJFMKI.exe 256 YPRSVH.exe 5316 YSV.exe 4976 RVZSGNO.exe 4932 DDGA.exe 5260 MLIFWK.exe 5072 WJNZL.exe 3024 VUYP.exe 4380 IEHGABE.exe 5160 XVIFH.exe 2748 LXQ.exe 780 FTVNF.exe 5500 EDGD.exe 400 ILMDAGO.exe 2976 XBNDZ.exe 5336 WMQL.exe 3056 LPZXAUH.exe 904 NNNR.exe 1956 XDTE.exe 4944 QGWHDB.exe 2836 WBW.exe 4608 NJKN.exe 3464 CEUSFIT.exe 2580 DIX.exe 3256 WDBRQVW.exe 4388 LTKJ.exe 5272 GGHAHJ.exe 3584 CLZPXM.exe 2796 OXXC.exe 2020 YUPPN.exe 3268 RXBT.exe 3264 IYVYWU.exe 5840 BBHTKKT.exe 5172 QWQGV.exe 2840 GMRX.exe 3672 JUYFOL.exe 4836 BCAKRIP.exe 1600 IXKPC.exe 5768 LKOYMDE.exe 5804 JGOHR.exe 6132 TDTTZGC.exe 2996 IYDFK.exe 5520 ACOB.exe 3760 QSP.exe 5408 APVVL.exe 5264 YAYD.exe 4612 CQRDH.exe 2008 RLCEVBD.exe 1232 SJQQ.exe 4920 KEOJD.exe 5428 LHEFRL.exe 3588 PIOHDHG.exe 2784 WDAIJVO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HVZ.exe.bat TXZA.exe File created C:\windows\SysWOW64\FTVNF.exe.bat LXQ.exe File created C:\windows\SysWOW64\RXBT.exe.bat YUPPN.exe File created C:\windows\SysWOW64\ACOB.exe.bat IYDFK.exe File opened for modification C:\windows\SysWOW64\JWUXXC.exe KLRHPWX.exe File opened for modification C:\windows\SysWOW64\TXZA.exe TZFZ.exe File created C:\windows\SysWOW64\YSV.exe YPRSVH.exe File opened for modification C:\windows\SysWOW64\RVZSGNO.exe YSV.exe File created C:\windows\SysWOW64\XVIFH.exe.bat IEHGABE.exe File created C:\windows\SysWOW64\TZFZ.exe 2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\TZFZ.exe 2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe File created C:\windows\SysWOW64\RVZSGNO.exe YSV.exe File created C:\windows\SysWOW64\IDCTCU.exe.bat YXC.exe File created C:\windows\SysWOW64\CMR.exe FWEEGY.exe File opened for modification C:\windows\SysWOW64\CMR.exe FWEEGY.exe File created C:\windows\SysWOW64\TXZA.exe.bat TZFZ.exe File created C:\windows\SysWOW64\EDGD.exe FTVNF.exe File created C:\windows\SysWOW64\JUYFOL.exe GMRX.exe File created C:\windows\SysWOW64\JUYFOL.exe.bat GMRX.exe File opened for modification C:\windows\SysWOW64\ACOB.exe IYDFK.exe File created C:\windows\SysWOW64\FWEEGY.exe IDCTCU.exe File created C:\windows\SysWOW64\CMR.exe.bat FWEEGY.exe File opened for modification C:\windows\SysWOW64\TDTTZGC.exe JGOHR.exe File created C:\windows\SysWOW64\SJQQ.exe RLCEVBD.exe File created C:\windows\SysWOW64\HVZ.exe TXZA.exe File opened for modification C:\windows\SysWOW64\JUYFOL.exe GMRX.exe File created C:\windows\SysWOW64\ACOB.exe IYDFK.exe File created C:\windows\SysWOW64\TZFZ.exe.bat 2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe File created C:\windows\SysWOW64\GJS.exe.bat GDO.exe File created C:\windows\SysWOW64\RVZSGNO.exe.bat YSV.exe File opened for modification C:\windows\SysWOW64\FTVNF.exe LXQ.exe File opened for modification C:\windows\SysWOW64\XDTE.exe NNNR.exe File created C:\windows\SysWOW64\FWEEGY.exe.bat IDCTCU.exe File opened for modification C:\windows\SysWOW64\API.exe JWXZ.exe File opened for modification C:\windows\SysWOW64\YSV.exe YPRSVH.exe File created C:\windows\SysWOW64\YSV.exe.bat YPRSVH.exe File opened for modification C:\windows\SysWOW64\GGHAHJ.exe LTKJ.exe File created C:\windows\SysWOW64\YUPPN.exe OXXC.exe File opened for modification C:\windows\SysWOW64\YUPPN.exe OXXC.exe File created C:\windows\SysWOW64\SJQQ.exe.bat RLCEVBD.exe File created C:\windows\SysWOW64\HASWT.exe GXC.exe File opened for modification C:\windows\SysWOW64\XVIFH.exe IEHGABE.exe File created C:\windows\SysWOW64\FTVNF.exe LXQ.exe File created C:\windows\SysWOW64\RXBT.exe YUPPN.exe File opened for modification C:\windows\SysWOW64\WYQ.exe WDAIJVO.exe File created C:\windows\SysWOW64\IDCTCU.exe YXC.exe File opened for modification C:\windows\SysWOW64\HASWT.exe GXC.exe File created C:\windows\SysWOW64\HASWT.exe.bat GXC.exe File created C:\windows\SysWOW64\XVIFH.exe IEHGABE.exe File opened for modification C:\windows\SysWOW64\IYVYWU.exe RXBT.exe File opened for modification C:\windows\SysWOW64\YXC.exe GCEWLIL.exe File opened for modification C:\windows\SysWOW64\FWEEGY.exe IDCTCU.exe File opened for modification C:\windows\SysWOW64\HVZ.exe TXZA.exe File opened for modification C:\windows\SysWOW64\EDGD.exe FTVNF.exe File created C:\windows\SysWOW64\JWUXXC.exe.bat KLRHPWX.exe File created C:\windows\SysWOW64\GGHAHJ.exe.bat LTKJ.exe File created C:\windows\SysWOW64\TDTTZGC.exe.bat JGOHR.exe File opened for modification C:\windows\SysWOW64\GJS.exe GDO.exe File created C:\windows\SysWOW64\API.exe JWXZ.exe File created C:\windows\SysWOW64\API.exe.bat JWXZ.exe File created C:\windows\SysWOW64\EDGD.exe.bat FTVNF.exe File created C:\windows\SysWOW64\XDTE.exe NNNR.exe File created C:\windows\SysWOW64\IYVYWU.exe.bat RXBT.exe File created C:\windows\SysWOW64\WYQ.exe WDAIJVO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\WBW.exe QGWHDB.exe File created C:\windows\CEUSFIT.exe NJKN.exe File opened for modification C:\windows\system\OXXC.exe CLZPXM.exe File created C:\windows\system\QWQGV.exe.bat BBHTKKT.exe File created C:\windows\GMRX.exe.bat QWQGV.exe File opened for modification C:\windows\system\KEOJD.exe SJQQ.exe File created C:\windows\WDAIJVO.exe.bat PIOHDHG.exe File opened for modification C:\windows\system\JWXZ.exe GJS.exe File created C:\windows\CQGLG.exe.bat DFDVYV.exe File created C:\windows\system\ILMDAGO.exe.bat EDGD.exe File created C:\windows\NJKN.exe.bat WBW.exe File created C:\windows\WDBRQVW.exe.bat DIX.exe File created C:\windows\system\CLZPXM.exe.bat GGHAHJ.exe File created C:\windows\system\WMQL.exe XBNDZ.exe File created C:\windows\system\WMQL.exe.bat XBNDZ.exe File created C:\windows\system\NNNR.exe.bat LPZXAUH.exe File opened for modification C:\windows\BCAKRIP.exe JUYFOL.exe File opened for modification C:\windows\YAYD.exe APVVL.exe File created C:\windows\PIOHDHG.exe.bat LHEFRL.exe File created C:\windows\system\TDDJCFU.exe HASWT.exe File created C:\windows\WJNZL.exe MLIFWK.exe File created C:\windows\BCAKRIP.exe.bat JUYFOL.exe File created C:\windows\system\APVVL.exe.bat QSP.exe File opened for modification C:\windows\GRAVKH.exe WYQ.exe File created C:\windows\system\DDGA.exe.bat RVZSGNO.exe File created C:\windows\IYDFK.exe TDTTZGC.exe File created C:\windows\WJNZL.exe.bat MLIFWK.exe File created C:\windows\QGWHDB.exe.bat XDTE.exe File opened for modification C:\windows\system\LTKJ.exe WDBRQVW.exe File created C:\windows\system\APVVL.exe QSP.exe File created C:\windows\WDAIJVO.exe PIOHDHG.exe File created C:\windows\VUYP.exe WJNZL.exe File created C:\windows\system\OXXC.exe CLZPXM.exe File created C:\windows\system\KEOJD.exe.bat SJQQ.exe File created C:\windows\system\LHEFRL.exe.bat KEOJD.exe File opened for modification C:\windows\system\GXC.exe CMR.exe File opened for modification C:\windows\system\BBHTKKT.exe IYVYWU.exe File created C:\windows\GMRX.exe QWQGV.exe File opened for modification C:\windows\system\RLCEVBD.exe CQRDH.exe File opened for modification C:\windows\WDAIJVO.exe PIOHDHG.exe File created C:\windows\system\GXC.exe CMR.exe File created C:\windows\system\GXC.exe.bat CMR.exe File opened for modification C:\windows\system\TDDJCFU.exe HASWT.exe File created C:\windows\system\JWXZ.exe.bat GJS.exe File created C:\windows\system\PJFMKI.exe.bat MTYM.exe File opened for modification C:\windows\GMRX.exe QWQGV.exe File created C:\windows\system\TDDJCFU.exe.bat HASWT.exe File created C:\windows\GDO.exe HVZ.exe File opened for modification C:\windows\LXQ.exe XVIFH.exe File created C:\windows\system\GCEWLIL.exe JMRFVTW.exe File opened for modification C:\windows\system\WMQL.exe XBNDZ.exe File created C:\windows\system\KEOJD.exe SJQQ.exe File opened for modification C:\windows\WDBRQVW.exe DIX.exe File created C:\windows\LKOYMDE.exe IXKPC.exe File opened for modification C:\windows\system\JGOHR.exe LKOYMDE.exe File opened for modification C:\windows\system\APVVL.exe QSP.exe File created C:\windows\system\JMRFVTW.exe GRAVKH.exe File created C:\windows\QGWHDB.exe XDTE.exe File created C:\windows\system\LTKJ.exe WDBRQVW.exe File created C:\windows\system\JGOHR.exe LKOYMDE.exe File created C:\windows\system\JGOHR.exe.bat LKOYMDE.exe File created C:\windows\CQGLG.exe DFDVYV.exe File opened for modification C:\windows\system\MLIFWK.exe DDGA.exe File opened for modification C:\windows\IEHGABE.exe VUYP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5708 cmd.exe 1764 cmd.exe 3008 cmd.exe 4252 cmd.exe 2452 cmd.exe 3352 cmd.exe 2760 cmd.exe 4784 cmd.exe 4964 cmd.exe 5284 cmd.exe 832 cmd.exe 4908 cmd.exe 4876 cmd.exe 5696 cmd.exe 4992 cmd.exe 4320 cmd.exe 4872 cmd.exe 5088 cmd.exe 5828 cmd.exe 4544 cmd.exe 2432 cmd.exe 5868 cmd.exe 3420 cmd.exe 6100 cmd.exe 4348 cmd.exe 5896 cmd.exe 4756 cmd.exe 2168 cmd.exe 1872 cmd.exe 4632 cmd.exe 2444 cmd.exe 3768 cmd.exe 4852 cmd.exe 3320 cmd.exe 828 cmd.exe 6008 cmd.exe 3156 cmd.exe 1588 cmd.exe 2376 cmd.exe 3424 cmd.exe 2328 cmd.exe 3816 cmd.exe 4744 cmd.exe 4184 cmd.exe 404 cmd.exe 3668 cmd.exe 5812 cmd.exe 2920 cmd.exe 4844 cmd.exe 2620 cmd.exe 4176 cmd.exe 6020 cmd.exe 2844 cmd.exe 4180 cmd.exe 3444 cmd.exe 2564 cmd.exe 3596 cmd.exe 5036 cmd.exe 5300 cmd.exe 2600 cmd.exe 3608 cmd.exe 5928 cmd.exe 5684 cmd.exe 2672 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3028 1252 WerFault.exe 87 3488 756 WerFault.exe 93 2760 1964 WerFault.exe 99 5048 480 WerFault.exe 104 2856 5788 WerFault.exe 109 2136 5668 WerFault.exe 114 5936 1172 WerFault.exe 119 1512 3812 WerFault.exe 124 3816 5884 WerFault.exe 129 2644 6044 WerFault.exe 134 1240 4368 WerFault.exe 139 3344 5516 WerFault.exe 144 3468 6116 WerFault.exe 149 2140 5360 WerFault.exe 154 2880 256 WerFault.exe 159 2696 5316 WerFault.exe 164 3756 4976 WerFault.exe 169 3236 4932 WerFault.exe 174 2992 5260 WerFault.exe 179 5076 5072 WerFault.exe 184 5656 3024 WerFault.exe 189 2128 4380 WerFault.exe 194 6132 5160 WerFault.exe 199 4956 2748 WerFault.exe 204 4248 780 WerFault.exe 209 4724 5500 WerFault.exe 214 3560 400 WerFault.exe 219 5872 2976 WerFault.exe 224 2892 5336 WerFault.exe 229 3396 3056 WerFault.exe 234 5448 904 WerFault.exe 239 2664 1956 WerFault.exe 244 2392 4944 WerFault.exe 249 3224 2836 WerFault.exe 254 3536 4608 WerFault.exe 259 4152 3464 WerFault.exe 264 3916 2580 WerFault.exe 270 2096 3256 WerFault.exe 275 3512 4388 WerFault.exe 280 1512 5272 WerFault.exe 285 1420 3584 WerFault.exe 290 5828 2796 WerFault.exe 295 724 2020 WerFault.exe 300 3460 3268 WerFault.exe 305 4448 3264 WerFault.exe 310 4296 5840 WerFault.exe 315 5404 5172 WerFault.exe 320 468 2840 WerFault.exe 325 5872 3672 WerFault.exe 330 6124 4836 WerFault.exe 335 1400 1600 WerFault.exe 340 4288 5768 WerFault.exe 345 984 5804 WerFault.exe 350 4640 6132 WerFault.exe 355 4564 2996 WerFault.exe 360 1996 5520 WerFault.exe 365 5432 3760 WerFault.exe 370 4520 5408 WerFault.exe 375 5992 5264 WerFault.exe 380 1324 4612 WerFault.exe 385 3332 2008 WerFault.exe 390 5656 1232 WerFault.exe 395 4344 4920 WerFault.exe 400 5760 5428 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WJNZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJFMKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGOHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQRDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKOYMDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYDFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWEEGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILMDAGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGWHDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEUSFIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYVYWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APVVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHEFRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUYFOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLRHPWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCAKRIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXKPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXPXLM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPRSVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIOHDHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWUXXC.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1252 2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe 1252 2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe 756 TZFZ.exe 756 TZFZ.exe 1964 TXZA.exe 1964 TXZA.exe 480 HVZ.exe 480 HVZ.exe 5788 GDO.exe 5788 GDO.exe 5668 GJS.exe 5668 GJS.exe 1172 JWXZ.exe 1172 JWXZ.exe 3812 API.exe 3812 API.exe 5884 LXPXLM.exe 5884 LXPXLM.exe 6044 DFDVYV.exe 6044 DFDVYV.exe 4368 CQGLG.exe 4368 CQGLG.exe 6116 MTYM.exe 6116 MTYM.exe 5360 PJFMKI.exe 5360 PJFMKI.exe 256 YPRSVH.exe 256 YPRSVH.exe 5316 YSV.exe 5316 YSV.exe 4976 RVZSGNO.exe 4976 RVZSGNO.exe 4932 DDGA.exe 4932 DDGA.exe 5260 MLIFWK.exe 5260 MLIFWK.exe 5072 WJNZL.exe 5072 WJNZL.exe 3024 VUYP.exe 3024 VUYP.exe 4380 IEHGABE.exe 4380 IEHGABE.exe 5160 XVIFH.exe 5160 XVIFH.exe 2748 LXQ.exe 2748 LXQ.exe 780 FTVNF.exe 780 FTVNF.exe 5500 EDGD.exe 5500 EDGD.exe 400 ILMDAGO.exe 400 ILMDAGO.exe 2976 XBNDZ.exe 2976 XBNDZ.exe 5336 WMQL.exe 5336 WMQL.exe 3056 LPZXAUH.exe 3056 LPZXAUH.exe 904 NNNR.exe 904 NNNR.exe 1956 XDTE.exe 1956 XDTE.exe 4944 QGWHDB.exe 4944 QGWHDB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1252 2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe 1252 2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe 756 TZFZ.exe 756 TZFZ.exe 1964 TXZA.exe 1964 TXZA.exe 480 HVZ.exe 480 HVZ.exe 5788 GDO.exe 5788 GDO.exe 5668 GJS.exe 5668 GJS.exe 1172 JWXZ.exe 1172 JWXZ.exe 3812 API.exe 3812 API.exe 5884 LXPXLM.exe 5884 LXPXLM.exe 6044 DFDVYV.exe 6044 DFDVYV.exe 4368 CQGLG.exe 4368 CQGLG.exe 6116 MTYM.exe 6116 MTYM.exe 5360 PJFMKI.exe 5360 PJFMKI.exe 256 YPRSVH.exe 256 YPRSVH.exe 5316 YSV.exe 5316 YSV.exe 4976 RVZSGNO.exe 4976 RVZSGNO.exe 4932 DDGA.exe 4932 DDGA.exe 5260 MLIFWK.exe 5260 MLIFWK.exe 5072 WJNZL.exe 5072 WJNZL.exe 3024 VUYP.exe 3024 VUYP.exe 4380 IEHGABE.exe 4380 IEHGABE.exe 5160 XVIFH.exe 5160 XVIFH.exe 2748 LXQ.exe 2748 LXQ.exe 780 FTVNF.exe 780 FTVNF.exe 5500 EDGD.exe 5500 EDGD.exe 400 ILMDAGO.exe 400 ILMDAGO.exe 2976 XBNDZ.exe 2976 XBNDZ.exe 5336 WMQL.exe 5336 WMQL.exe 3056 LPZXAUH.exe 3056 LPZXAUH.exe 904 NNNR.exe 904 NNNR.exe 1956 XDTE.exe 1956 XDTE.exe 4944 QGWHDB.exe 4944 QGWHDB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 2600 1252 2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe 89 PID 2600 wrote to memory of 756 2600 cmd.exe 93 PID 756 wrote to memory of 4212 756 TZFZ.exe 95 PID 4212 wrote to memory of 1964 4212 cmd.exe 99 PID 1964 wrote to memory of 5600 1964 TXZA.exe 100 PID 5600 wrote to memory of 480 5600 cmd.exe 104 PID 480 wrote to memory of 5032 480 HVZ.exe 105 PID 5032 wrote to memory of 5788 5032 cmd.exe 109 PID 5788 wrote to memory of 3652 5788 GDO.exe 110 PID 3652 wrote to memory of 5668 3652 cmd.exe 114 PID 5668 wrote to memory of 828 5668 GJS.exe 115 PID 828 wrote to memory of 1172 828 cmd.exe 119 PID 1172 wrote to memory of 5400 1172 JWXZ.exe 120 PID 5400 wrote to memory of 3812 5400 cmd.exe 124 PID 3812 wrote to memory of 1788 3812 API.exe 125 PID 1788 wrote to memory of 5884 1788 cmd.exe 129 PID 5884 wrote to memory of 2252 5884 LXPXLM.exe 130 PID 2252 wrote to memory of 6044 2252 cmd.exe 134 PID 6044 wrote to memory of 5952 6044 DFDVYV.exe 135 PID 5952 wrote to memory of 4368 5952 cmd.exe 139 PID 4368 wrote to memory of 5888 4368 CQGLG.exe 140 PID 5888 wrote to memory of 5516 5888 cmd.exe 144 PID 2060 wrote to memory of 6116 2060 cmd.exe 149 PID 6116 wrote to memory of 6008 6116 MTYM.exe 150 PID 6008 wrote to memory of 5360 6008 cmd.exe 154 PID 5360 wrote to memory of 5956 5360 PJFMKI.exe 155 PID 5956 wrote to memory of 256 5956 cmd.exe 159 PID 256 wrote to memory of 2444 256 YPRSVH.exe 160 PID 2444 wrote to memory of 5316 2444 cmd.exe 164 PID 5316 wrote to memory of 4176 5316 YSV.exe 165 PID 4176 wrote to memory of 4976 4176 cmd.exe 169 PID 4976 wrote to memory of 4744 4976 RVZSGNO.exe 170 PID 4744 wrote to memory of 4932 4744 cmd.exe 174 PID 4932 wrote to memory of 3768 4932 DDGA.exe 175 PID 3768 wrote to memory of 5260 3768 cmd.exe 179 PID 5260 wrote to memory of 5868 5260 MLIFWK.exe 180 PID 5868 wrote to memory of 5072 5868 cmd.exe 184 PID 5072 wrote to memory of 4320 5072 WJNZL.exe 185 PID 4320 wrote to memory of 3024 4320 cmd.exe 189 PID 3024 wrote to memory of 5052 3024 VUYP.exe 190 PID 5052 wrote to memory of 4380 5052 cmd.exe 194 PID 4380 wrote to memory of 4432 4380 IEHGABE.exe 195 PID 4432 wrote to memory of 5160 4432 cmd.exe 199 PID 5160 wrote to memory of 4080 5160 XVIFH.exe 200 PID 4080 wrote to memory of 2748 4080 cmd.exe 204 PID 2748 wrote to memory of 6096 2748 LXQ.exe 205 PID 6096 wrote to memory of 780 6096 cmd.exe 209 PID 780 wrote to memory of 5692 780 FTVNF.exe 210 PID 5692 wrote to memory of 5500 5692 cmd.exe 214 PID 5500 wrote to memory of 696 5500 EDGD.exe 215 PID 696 wrote to memory of 400 696 cmd.exe 219 PID 400 wrote to memory of 3852 400 ILMDAGO.exe 220 PID 3852 wrote to memory of 2976 3852 cmd.exe 224 PID 2976 wrote to memory of 3156 2976 XBNDZ.exe 225 PID 3156 wrote to memory of 5336 3156 cmd.exe 229 PID 5336 wrote to memory of 2712 5336 WMQL.exe 230 PID 2712 wrote to memory of 3056 2712 cmd.exe 234 PID 3056 wrote to memory of 2820 3056 LPZXAUH.exe 235 PID 2820 wrote to memory of 904 2820 cmd.exe 239 PID 904 wrote to memory of 4284 904 NNNR.exe 240 PID 4284 wrote to memory of 1956 4284 cmd.exe 244 PID 1956 wrote to memory of 2540 1956 XDTE.exe 245 PID 2540 wrote to memory of 4944 2540 cmd.exe 249 PID 4944 wrote to memory of 4908 4944 QGWHDB.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_6fed3cdd7b59d7616c3e84b39f1ed6f8_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZFZ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\SysWOW64\TZFZ.exeC:\windows\system32\TZFZ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXZA.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\SysWOW64\TXZA.exeC:\windows\system32\TXZA.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVZ.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\windows\SysWOW64\HVZ.exeC:\windows\system32\HVZ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GDO.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\GDO.exeC:\windows\GDO.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJS.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\windows\SysWOW64\GJS.exeC:\windows\system32\GJS.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWXZ.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:828 -
C:\windows\system\JWXZ.exeC:\windows\system\JWXZ.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\API.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\SysWOW64\API.exeC:\windows\system32\API.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXPXLM.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\windows\system\LXPXLM.exeC:\windows\system\LXPXLM.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFDVYV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\windows\DFDVYV.exeC:\windows\DFDVYV.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQGLG.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\CQGLG.exeC:\windows\CQGLG.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQIN.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\YQIN.exeC:\windows\YQIN.exe23⤵
- Executes dropped EXE
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTYM.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\windows\SysWOW64\MTYM.exeC:\windows\system32\MTYM.exe25⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJFMKI.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\system\PJFMKI.exeC:\windows\system\PJFMKI.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YPRSVH.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\windows\YPRSVH.exeC:\windows\YPRSVH.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YSV.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\SysWOW64\YSV.exeC:\windows\system32\YSV.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVZSGNO.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\windows\SysWOW64\RVZSGNO.exeC:\windows\system32\RVZSGNO.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDGA.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\windows\system\DDGA.exeC:\windows\system\DDGA.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLIFWK.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\windows\system\MLIFWK.exeC:\windows\system\MLIFWK.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJNZL.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\WJNZL.exeC:\windows\WJNZL.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUYP.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\windows\VUYP.exeC:\windows\VUYP.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IEHGABE.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\windows\IEHGABE.exeC:\windows\IEHGABE.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XVIFH.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\SysWOW64\XVIFH.exeC:\windows\system32\XVIFH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXQ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\windows\LXQ.exeC:\windows\LXQ.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTVNF.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\SysWOW64\FTVNF.exeC:\windows\system32\FTVNF.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDGD.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\SysWOW64\EDGD.exeC:\windows\system32\EDGD.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILMDAGO.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:696 -
C:\windows\system\ILMDAGO.exeC:\windows\system\ILMDAGO.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBNDZ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\windows\XBNDZ.exeC:\windows\XBNDZ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMQL.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\windows\system\WMQL.exeC:\windows\system\WMQL.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPZXAUH.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\windows\system\LPZXAUH.exeC:\windows\system\LPZXAUH.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNNR.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\windows\system\NNNR.exeC:\windows\system\NNNR.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDTE.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\windows\SysWOW64\XDTE.exeC:\windows\system32\XDTE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGWHDB.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\QGWHDB.exeC:\windows\QGWHDB.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WBW.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4908 -
C:\windows\system\WBW.exeC:\windows\system\WBW.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJKN.exe.bat" "68⤵PID:4484
-
C:\windows\NJKN.exeC:\windows\NJKN.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEUSFIT.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2328 -
C:\windows\CEUSFIT.exeC:\windows\CEUSFIT.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DIX.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4876 -
C:\windows\DIX.exeC:\windows\DIX.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDBRQVW.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3420 -
C:\windows\WDBRQVW.exeC:\windows\WDBRQVW.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LTKJ.exe.bat" "76⤵
- Executes a command shell one-liner
PID:3608 -
C:\windows\system\LTKJ.exeC:\windows\system\LTKJ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GGHAHJ.exe.bat" "78⤵PID:5084
-
C:\windows\SysWOW64\GGHAHJ.exeC:\windows\system32\GGHAHJ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLZPXM.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5708 -
C:\windows\system\CLZPXM.exeC:\windows\system\CLZPXM.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXXC.exe.bat" "82⤵PID:4676
-
C:\windows\system\OXXC.exeC:\windows\system\OXXC.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YUPPN.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4268 -
C:\windows\SysWOW64\YUPPN.exeC:\windows\system32\YUPPN.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXBT.exe.bat" "86⤵
- Executes a command shell one-liner
PID:6100 -
C:\windows\SysWOW64\RXBT.exeC:\windows\system32\RXBT.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYVYWU.exe.bat" "88⤵PID:2128
-
C:\windows\SysWOW64\IYVYWU.exeC:\windows\system32\IYVYWU.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBHTKKT.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4348 -
C:\windows\system\BBHTKKT.exeC:\windows\system\BBHTKKT.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWQGV.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5928 -
C:\windows\system\QWQGV.exeC:\windows\system\QWQGV.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMRX.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4688 -
C:\windows\GMRX.exeC:\windows\GMRX.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUYFOL.exe.bat" "96⤵PID:4316
-
C:\windows\SysWOW64\JUYFOL.exeC:\windows\system32\JUYFOL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCAKRIP.exe.bat" "98⤵PID:2848
-
C:\windows\BCAKRIP.exeC:\windows\BCAKRIP.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXKPC.exe.bat" "100⤵PID:5592
-
C:\windows\system\IXKPC.exeC:\windows\system\IXKPC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKOYMDE.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5896 -
C:\windows\LKOYMDE.exeC:\windows\LKOYMDE.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGOHR.exe.bat" "104⤵PID:4740
-
C:\windows\system\JGOHR.exeC:\windows\system\JGOHR.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDTTZGC.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4184 -
C:\windows\SysWOW64\TDTTZGC.exeC:\windows\system32\TDTTZGC.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2116 -
C:\windows\IYDFK.exeC:\windows\IYDFK.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ACOB.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5696 -
C:\windows\SysWOW64\ACOB.exeC:\windows\system32\ACOB.exe111⤵
- Executes dropped EXE
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSP.exe.bat" "112⤵
- Executes a command shell one-liner
PID:6020 -
C:\windows\QSP.exeC:\windows\QSP.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APVVL.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\windows\system\APVVL.exeC:\windows\system\APVVL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YAYD.exe.bat" "116⤵
- Executes a command shell one-liner
PID:404 -
C:\windows\YAYD.exeC:\windows\YAYD.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQRDH.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5684 -
C:\windows\CQRDH.exeC:\windows\CQRDH.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLCEVBD.exe.bat" "120⤵PID:2240
-
C:\windows\system\RLCEVBD.exeC:\windows\system\RLCEVBD.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-