Analysis
- max time kernel
78s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_205a6ed631b2e4604affc17a933ae462_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-30_205a6ed631b2e4604affc17a933ae462_elex_emotet_stop.exe
- Size 208KB
- Sample260730-wpqfpsej4z
- SHA256 69260d79fdcdef2ee8b351049adcc15f817b3761895ba1048a501f7e1444814e
- MD5 205a6ed631b2e4604affc17a933ae462
- SHA1 4b24bdf78068bfa390a9e2afef31bc91cf85c0cb
- SHA512 3f57b8257dc5fb66dd8fa76c3ad5185c71211cfaec1465a451248df559e04c87530b7e6f9593af1d3efcc6778c54d7c3702bb3166370a8a5ed8789fe303c0443
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfB4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOJQEj1
- TLSH T1F0247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2380 ZNSCHC.exe 2524 OWPDSQ.exe 5660 FWEAFH.exe 2940 PUJUUQ.exe 4676 HCYSZH.exe 5296 JADMO.exe 2448 JDHQUFG.exe 4056 TEJV.exe 1428 THNQKSK.exe 4100 MKRU.exe 5020 BFIZBDU.exe 3100 RVJYIY.exe 2052 GQTC.exe 1244 MLSD.exe 4840 QTYLKGV.exe 4256 DEHKYJQ.exe 4940 SUIBE.exe 3472 WCWJJPB.exe 4368 OKYO.exe 5144 SSFOYN.exe 2108 KVJSM.exe 6036 UTO.exe 1576 YBVMF.exe 1152 ZEZI.exe 2868 INBVO.exe 3732 VPR.exe 3112 WSVPQSG.exe 4568 YQBK.exe 2364 ZTF.exe 5984 DBLGPI.exe 1172 JXKO.exe 2416 FCDEKGO.exe 5868 JFBRK.exe 4904 ASLJAW.exe 1712 KTNW.exe 4792 BBPBH.exe 1892 QWZ.exe 2164 JZCJF.exe 4164 USFUNR.exe 5784 VNJXT.exe 4928 PIOHDHG.exe 3640 FDYLO.exe 5856 ODAYSZ.exe 4064 JZE.exe 3060 NHLIO.exe 6012 YXS.exe 4248 TKWZD.exe 4820 EDZKLR.exe 2876 XYD.exe 2004 IQGG.exe 2688 DLDQJO.exe 3392 DHPMO.exe 3004 HXVUBWP.exe 5556 VHEKP.exe 3364 VCIO.exe 2976 BYHPZ.exe 4492 AVA.exe 3052 YJRSRI.exe 5748 ZMD.exe 3512 BKJILGR.exe 4420 BNNM.exe 2972 QIWRCJT.exe 5988 UQDZ.exe 1948 VTG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\QXWVI.exe OZQBBMG.exe File created C:\windows\SysWOW64\JDHQUFG.exe JADMO.exe File opened for modification C:\windows\SysWOW64\JDHQUFG.exe JADMO.exe File opened for modification C:\windows\SysWOW64\SSFOYN.exe OKYO.exe File created C:\windows\SysWOW64\ASLJAW.exe JFBRK.exe File created C:\windows\SysWOW64\ASLJAW.exe.bat JFBRK.exe File opened for modification C:\windows\SysWOW64\UFWWFMF.exe QPP.exe File created C:\windows\SysWOW64\HVFJVC.exe NAAA.exe File opened for modification C:\windows\SysWOW64\HVFJVC.exe NAAA.exe File created C:\windows\SysWOW64\DEHKYJQ.exe.bat QTYLKGV.exe File created C:\windows\SysWOW64\XYD.exe.bat EDZKLR.exe File created C:\windows\SysWOW64\XQWN.exe HVFJVC.exe File opened for modification C:\windows\SysWOW64\XQWN.exe HVFJVC.exe File created C:\windows\SysWOW64\XQWN.exe.bat HVFJVC.exe File opened for modification C:\windows\SysWOW64\GARJR.exe CKK.exe File created C:\windows\SysWOW64\ZCKM.exe.bat IUI.exe File opened for modification C:\windows\SysWOW64\VNJXT.exe USFUNR.exe File opened for modification C:\windows\SysWOW64\JADMO.exe HCYSZH.exe File created C:\windows\SysWOW64\FCDEKGO.exe.bat JXKO.exe File opened for modification C:\windows\SysWOW64\QIWRCJT.exe BNNM.exe File created C:\windows\SysWOW64\OTIN.exe.bat WQERPDE.exe File created C:\windows\SysWOW64\WCWJJPB.exe.bat SUIBE.exe File opened for modification C:\windows\SysWOW64\UTO.exe KVJSM.exe File created C:\windows\SysWOW64\INBVO.exe ZEZI.exe File created C:\windows\SysWOW64\JXKO.exe DBLGPI.exe File created C:\windows\SysWOW64\HVFJVC.exe.bat NAAA.exe File created C:\windows\SysWOW64\DPG.exe NZXAWBA.exe File opened for modification C:\windows\SysWOW64\OEN.exe VBJCIG.exe File created C:\windows\SysWOW64\OWPDSQ.exe.bat ZNSCHC.exe File created C:\windows\SysWOW64\BYHPZ.exe.bat VCIO.exe File created C:\windows\SysWOW64\GARJR.exe.bat CKK.exe File opened for modification C:\windows\SysWOW64\NZXAWBA.exe PCM.exe File created C:\windows\SysWOW64\NZXAWBA.exe.bat PCM.exe File opened for modification C:\windows\SysWOW64\OWPDSQ.exe ZNSCHC.exe File created C:\windows\SysWOW64\QTYLKGV.exe MLSD.exe File created C:\windows\SysWOW64\SSFOYN.exe OKYO.exe File created C:\windows\SysWOW64\UTO.exe KVJSM.exe File created C:\windows\SysWOW64\DHPMO.exe DLDQJO.exe File created C:\windows\SysWOW64\QIWRCJT.exe BNNM.exe File opened for modification C:\windows\SysWOW64\NAAA.exe UFWWFMF.exe File created C:\windows\SysWOW64\THNQKSK.exe.bat TEJV.exe File created C:\windows\SysWOW64\THNQKSK.exe TEJV.exe File opened for modification C:\windows\SysWOW64\INBVO.exe ZEZI.exe File created C:\windows\SysWOW64\JFBRK.exe FCDEKGO.exe File created C:\windows\SysWOW64\NAAA.exe UFWWFMF.exe File created C:\windows\SysWOW64\QXWVI.exe.bat OZQBBMG.exe File created C:\windows\SysWOW64\DEHKYJQ.exe QTYLKGV.exe File created C:\windows\SysWOW64\WCWJJPB.exe SUIBE.exe File created C:\windows\SysWOW64\OKYO.exe WCWJJPB.exe File opened for modification C:\windows\SysWOW64\OKYO.exe WCWJJPB.exe File created C:\windows\SysWOW64\INBVO.exe.bat ZEZI.exe File created C:\windows\SysWOW64\JFBRK.exe.bat FCDEKGO.exe File created C:\windows\SysWOW64\DHPMO.exe.bat DLDQJO.exe File created C:\windows\SysWOW64\QIWRCJT.exe.bat BNNM.exe File opened for modification C:\windows\SysWOW64\MLSD.exe GQTC.exe File opened for modification C:\windows\SysWOW64\WSVPQSG.exe VPR.exe File created C:\windows\SysWOW64\FCDEKGO.exe JXKO.exe File opened for modification C:\windows\SysWOW64\FCDEKGO.exe JXKO.exe File created C:\windows\SysWOW64\UFWWFMF.exe.bat QPP.exe File created C:\windows\SysWOW64\NZXAWBA.exe PCM.exe File opened for modification C:\windows\SysWOW64\QXWVI.exe OZQBBMG.exe File opened for modification C:\windows\SysWOW64\DEHKYJQ.exe QTYLKGV.exe File opened for modification C:\windows\SysWOW64\VPR.exe INBVO.exe File opened for modification C:\windows\SysWOW64\JXKO.exe DBLGPI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\HXVUBWP.exe DHPMO.exe File created C:\windows\WQERPDE.exe KIYJDKQ.exe File opened for modification C:\windows\system\ZMD.exe YJRSRI.exe File created C:\windows\BNNM.exe.bat BKJILGR.exe File opened for modification C:\windows\BHZGZK.exe URYGSOI.exe File opened for modification C:\windows\IUI.exe NGDYOX.exe File opened for modification C:\windows\system\JFQV.exe SFOQIS.exe File created C:\windows\system\HCYSZH.exe.bat PUJUUQ.exe File created C:\windows\VYHJ.exe.bat VTG.exe File created C:\windows\system\PCM.exe JGNWF.exe File created C:\windows\ZNSCHC.exe 2026-07-30_205a6ed631b2e4604affc17a933ae462_elex_emotet_stop.exe File created C:\windows\system\HCYSZH.exe PUJUUQ.exe File created C:\windows\NHLIO.exe JZE.exe File created C:\windows\YXS.exe NHLIO.exe File created C:\windows\system\DLDQJO.exe.bat IQGG.exe File created C:\windows\OQQSJ.exe XQWN.exe File created C:\windows\system\SFOQIS.exe ZCKM.exe File created C:\windows\OZQBBMG.exe OEN.exe File created C:\windows\system\GQTC.exe.bat RVJYIY.exe File created C:\windows\system\DLDQJO.exe IQGG.exe File opened for modification C:\windows\YJRSRI.exe AVA.exe File created C:\windows\system\VKKVJMQ.exe.bat DPG.exe File created C:\windows\system\SUIBE.exe DEHKYJQ.exe File opened for modification C:\windows\system\KTNW.exe ASLJAW.exe File created C:\windows\YXS.exe.bat NHLIO.exe File opened for modification C:\windows\system\EDZKLR.exe TKWZD.exe File opened for modification C:\windows\ZARD.exe VKKVJMQ.exe File created C:\windows\NGDYOX.exe.bat PQS.exe File created C:\windows\system\TEJV.exe JDHQUFG.exe File created C:\windows\MKRU.exe THNQKSK.exe File created C:\windows\RVJYIY.exe BFIZBDU.exe File opened for modification C:\windows\YQBK.exe WSVPQSG.exe File created C:\windows\PIOHDHG.exe VNJXT.exe File created C:\windows\system\JFQV.exe.bat SFOQIS.exe File opened for modification C:\windows\OZQBBMG.exe OEN.exe File created C:\windows\RAIZ.exe.bat QXWVI.exe File opened for modification C:\windows\system\TEJV.exe JDHQUFG.exe File created C:\windows\system\ZEZI.exe.bat YBVMF.exe File created C:\windows\JZE.exe.bat ODAYSZ.exe File opened for modification C:\windows\system\QPP.exe ZONJHW.exe File opened for modification C:\windows\system\PCM.exe JGNWF.exe File created C:\windows\system\SFOQIS.exe.bat ZCKM.exe File created C:\windows\YQBK.exe.bat WSVPQSG.exe File created C:\windows\DBLGPI.exe ZTF.exe File created C:\windows\BBPBH.exe.bat KTNW.exe File opened for modification C:\windows\JZCJF.exe QWZ.exe File opened for modification C:\windows\NHLIO.exe JZE.exe File opened for modification C:\windows\VYHJ.exe VTG.exe File created C:\windows\CKK.exe.bat BHZGZK.exe File created C:\windows\JGNWF.exe OTIN.exe File opened for modification C:\windows\PUJUUQ.exe FWEAFH.exe File opened for modification C:\windows\RVJYIY.exe BFIZBDU.exe File created C:\windows\AVA.exe.bat BYHPZ.exe File created C:\windows\URYGSOI.exe.bat OQQSJ.exe File opened for modification C:\windows\system\VBJCIG.exe YAZZECM.exe File created C:\windows\RAIZ.exe QXWVI.exe File created C:\windows\PUJUUQ.exe.bat FWEAFH.exe File created C:\windows\DBLGPI.exe.bat ZTF.exe File opened for modification C:\windows\URYGSOI.exe OQQSJ.exe File created C:\windows\system\PQS.exe.bat ZARD.exe File opened for modification C:\windows\system\SFOQIS.exe ZCKM.exe File opened for modification C:\windows\YAZZECM.exe JFQV.exe File created C:\windows\OZQBBMG.exe.bat OEN.exe File opened for modification C:\windows\system\HCYSZH.exe PUJUUQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1984 cmd.exe 716 cmd.exe 3496 cmd.exe 3664 cmd.exe 4388 cmd.exe 3116 cmd.exe 5732 cmd.exe 1716 cmd.exe 2980 cmd.exe 2244 cmd.exe 5916 cmd.exe 3804 cmd.exe 3152 cmd.exe 796 cmd.exe 6004 cmd.exe 5612 cmd.exe 292 cmd.exe 1776 cmd.exe 2852 cmd.exe 3856 cmd.exe 5600 cmd.exe 5080 cmd.exe 4324 cmd.exe 3064 cmd.exe 5312 cmd.exe 2560 cmd.exe 1500 cmd.exe 2648 cmd.exe 1996 cmd.exe 3180 cmd.exe 4148 cmd.exe 4536 cmd.exe 5844 cmd.exe 1328 cmd.exe 5352 cmd.exe 3400 cmd.exe 4268 cmd.exe 3500 cmd.exe 2968 cmd.exe 5716 cmd.exe 4448 cmd.exe 1036 cmd.exe 2596 cmd.exe 2932 cmd.exe 3396 cmd.exe 2700 cmd.exe 3016 cmd.exe 4152 cmd.exe 5364 cmd.exe 2848 cmd.exe 1040 cmd.exe 5368 cmd.exe 4348 cmd.exe 4564 cmd.exe 5564 cmd.exe 4416 cmd.exe 4508 cmd.exe 4956 cmd.exe 616 cmd.exe 1664 cmd.exe 2512 cmd.exe 5912 cmd.exe 5584 cmd.exe 4232 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4420 5920 WerFault.exe 87 3144 2380 WerFault.exe 93 3732 2524 WerFault.exe 99 2732 5660 WerFault.exe 104 1468 2940 WerFault.exe 109 2776 4676 WerFault.exe 114 3472 5296 WerFault.exe 119 5944 2448 WerFault.exe 124 4116 4056 WerFault.exe 129 2252 1428 WerFault.exe 134 3148 4100 WerFault.exe 139 8 5020 WerFault.exe 144 3144 3100 WerFault.exe 149 1680 2052 WerFault.exe 154 1016 1244 WerFault.exe 159 1460 4840 WerFault.exe 164 3016 4256 WerFault.exe 169 3712 4940 WerFault.exe 174 1064 3472 WerFault.exe 179 5728 4368 WerFault.exe 184 3896 5144 WerFault.exe 189 4860 2108 WerFault.exe 194 932 6036 WerFault.exe 199 204 1576 WerFault.exe 204 208 1152 WerFault.exe 209 4932 2868 WerFault.exe 214 1816 3732 WerFault.exe 219 760 3112 WerFault.exe 224 4712 4568 WerFault.exe 229 2992 2364 WerFault.exe 234 3904 5984 WerFault.exe 239 5616 1172 WerFault.exe 244 1464 2416 WerFault.exe 249 1928 5868 WerFault.exe 254 4176 4904 WerFault.exe 259 3608 1712 WerFault.exe 264 3752 4792 WerFault.exe 269 2800 1892 WerFault.exe 275 3124 2164 WerFault.exe 280 1376 4164 WerFault.exe 285 2832 5784 WerFault.exe 290 4152 4928 WerFault.exe 295 4848 3640 WerFault.exe 300 3860 5856 WerFault.exe 305 464 4064 WerFault.exe 310 1700 3060 WerFault.exe 315 1120 6012 WerFault.exe 320 980 4248 WerFault.exe 325 4052 4820 WerFault.exe 330 3352 2876 WerFault.exe 334 5616 2004 WerFault.exe 340 1752 2688 WerFault.exe 345 2972 3392 WerFault.exe 350 1640 3004 WerFault.exe 355 4640 5556 WerFault.exe 360 5828 3364 WerFault.exe 365 2680 2976 WerFault.exe 370 2076 4492 WerFault.exe 375 1472 3052 WerFault.exe 380 1804 5748 WerFault.exe 385 5368 3512 WerFault.exe 390 3884 4420 WerFault.exe 395 2228 2972 WerFault.exe 400 4932 5988 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWPDSQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBLGPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDYLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZCKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFBRK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBPBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VYHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYHPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKJILGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVJYIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTYLKGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJRSRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFOQIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INBVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUJUUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFIZBDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEHKYJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIWRCJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVFJVC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFWWFMF.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5920 2026-07-30_205a6ed631b2e4604affc17a933ae462_elex_emotet_stop.exe 5920 2026-07-30_205a6ed631b2e4604affc17a933ae462_elex_emotet_stop.exe 2380 ZNSCHC.exe 2380 ZNSCHC.exe 2524 OWPDSQ.exe 2524 OWPDSQ.exe 5660 FWEAFH.exe 5660 FWEAFH.exe 2940 PUJUUQ.exe 2940 PUJUUQ.exe 4676 HCYSZH.exe 4676 HCYSZH.exe 5296 JADMO.exe 5296 JADMO.exe 2448 JDHQUFG.exe 2448 JDHQUFG.exe 4056 TEJV.exe 4056 TEJV.exe 1428 THNQKSK.exe 1428 THNQKSK.exe 4100 MKRU.exe 4100 MKRU.exe 5020 BFIZBDU.exe 5020 BFIZBDU.exe 3100 RVJYIY.exe 3100 RVJYIY.exe 2052 GQTC.exe 2052 GQTC.exe 1244 MLSD.exe 1244 MLSD.exe 4840 QTYLKGV.exe 4840 QTYLKGV.exe 4256 DEHKYJQ.exe 4256 DEHKYJQ.exe 4940 SUIBE.exe 4940 SUIBE.exe 3472 WCWJJPB.exe 3472 WCWJJPB.exe 4368 OKYO.exe 4368 OKYO.exe 5144 SSFOYN.exe 5144 SSFOYN.exe 2108 KVJSM.exe 2108 KVJSM.exe 6036 UTO.exe 6036 UTO.exe 1576 YBVMF.exe 1576 YBVMF.exe 1152 ZEZI.exe 1152 ZEZI.exe 2868 INBVO.exe 2868 INBVO.exe 3732 VPR.exe 3732 VPR.exe 3112 WSVPQSG.exe 3112 WSVPQSG.exe 4568 YQBK.exe 4568 YQBK.exe 2364 ZTF.exe 2364 ZTF.exe 5984 DBLGPI.exe 5984 DBLGPI.exe 1172 JXKO.exe 1172 JXKO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5920 2026-07-30_205a6ed631b2e4604affc17a933ae462_elex_emotet_stop.exe 5920 2026-07-30_205a6ed631b2e4604affc17a933ae462_elex_emotet_stop.exe 2380 ZNSCHC.exe 2380 ZNSCHC.exe 2524 OWPDSQ.exe 2524 OWPDSQ.exe 5660 FWEAFH.exe 5660 FWEAFH.exe 2940 PUJUUQ.exe 2940 PUJUUQ.exe 4676 HCYSZH.exe 4676 HCYSZH.exe 5296 JADMO.exe 5296 JADMO.exe 2448 JDHQUFG.exe 2448 JDHQUFG.exe 4056 TEJV.exe 4056 TEJV.exe 1428 THNQKSK.exe 1428 THNQKSK.exe 4100 MKRU.exe 4100 MKRU.exe 5020 BFIZBDU.exe 5020 BFIZBDU.exe 3100 RVJYIY.exe 3100 RVJYIY.exe 2052 GQTC.exe 2052 GQTC.exe 1244 MLSD.exe 1244 MLSD.exe 4840 QTYLKGV.exe 4840 QTYLKGV.exe 4256 DEHKYJQ.exe 4256 DEHKYJQ.exe 4940 SUIBE.exe 4940 SUIBE.exe 3472 WCWJJPB.exe 3472 WCWJJPB.exe 4368 OKYO.exe 4368 OKYO.exe 5144 SSFOYN.exe 5144 SSFOYN.exe 2108 KVJSM.exe 2108 KVJSM.exe 6036 UTO.exe 6036 UTO.exe 1576 YBVMF.exe 1576 YBVMF.exe 1152 ZEZI.exe 1152 ZEZI.exe 2868 INBVO.exe 2868 INBVO.exe 3732 VPR.exe 3732 VPR.exe 3112 WSVPQSG.exe 3112 WSVPQSG.exe 4568 YQBK.exe 4568 YQBK.exe 2364 ZTF.exe 2364 ZTF.exe 5984 DBLGPI.exe 5984 DBLGPI.exe 1172 JXKO.exe 1172 JXKO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5920 wrote to memory of 1856 5920 2026-07-30_205a6ed631b2e4604affc17a933ae462_elex_emotet_stop.exe 89 PID 1856 wrote to memory of 2380 1856 cmd.exe 93 PID 2380 wrote to memory of 6108 2380 ZNSCHC.exe 95 PID 6108 wrote to memory of 2524 6108 cmd.exe 99 PID 2524 wrote to memory of 468 2524 OWPDSQ.exe 100 PID 468 wrote to memory of 5660 468 cmd.exe 104 PID 5660 wrote to memory of 5732 5660 FWEAFH.exe 105 PID 5732 wrote to memory of 2940 5732 cmd.exe 109 PID 2940 wrote to memory of 3856 2940 PUJUUQ.exe 110 PID 3856 wrote to memory of 4676 3856 cmd.exe 114 PID 4676 wrote to memory of 2400 4676 HCYSZH.exe 115 PID 2400 wrote to memory of 5296 2400 cmd.exe 119 PID 5296 wrote to memory of 1984 5296 JADMO.exe 120 PID 1984 wrote to memory of 2448 1984 cmd.exe 124 PID 2448 wrote to memory of 5600 2448 JDHQUFG.exe 125 PID 5600 wrote to memory of 4056 5600 cmd.exe 129 PID 4056 wrote to memory of 5952 4056 TEJV.exe 130 PID 5952 wrote to memory of 1428 5952 cmd.exe 134 PID 1428 wrote to memory of 4296 1428 THNQKSK.exe 135 PID 4296 wrote to memory of 4100 4296 cmd.exe 139 PID 4100 wrote to memory of 1964 4100 MKRU.exe 140 PID 1964 wrote to memory of 5020 1964 cmd.exe 144 PID 5020 wrote to memory of 5564 5020 BFIZBDU.exe 145 PID 5564 wrote to memory of 3100 5564 cmd.exe 149 PID 3100 wrote to memory of 4536 3100 RVJYIY.exe 150 PID 4536 wrote to memory of 2052 4536 cmd.exe 154 PID 2052 wrote to memory of 1624 2052 GQTC.exe 155 PID 1624 wrote to memory of 1244 1624 cmd.exe 159 PID 1244 wrote to memory of 4232 1244 MLSD.exe 160 PID 4232 wrote to memory of 4840 4232 cmd.exe 164 PID 4840 wrote to memory of 1848 4840 QTYLKGV.exe 165 PID 1848 wrote to memory of 4256 1848 cmd.exe 169 PID 4256 wrote to memory of 5016 4256 DEHKYJQ.exe 170 PID 5016 wrote to memory of 4940 5016 cmd.exe 174 PID 4940 wrote to memory of 2384 4940 SUIBE.exe 175 PID 2384 wrote to memory of 3472 2384 cmd.exe 179 PID 3472 wrote to memory of 5716 3472 WCWJJPB.exe 180 PID 5716 wrote to memory of 4368 5716 cmd.exe 184 PID 4368 wrote to memory of 716 4368 OKYO.exe 185 PID 716 wrote to memory of 5144 716 cmd.exe 189 PID 5144 wrote to memory of 4416 5144 SSFOYN.exe 190 PID 4416 wrote to memory of 2108 4416 cmd.exe 194 PID 2108 wrote to memory of 2848 2108 KVJSM.exe 195 PID 2848 wrote to memory of 6036 2848 cmd.exe 199 PID 6036 wrote to memory of 1040 6036 UTO.exe 200 PID 1040 wrote to memory of 1576 1040 cmd.exe 204 PID 1576 wrote to memory of 400 1576 YBVMF.exe 205 PID 400 wrote to memory of 1152 400 cmd.exe 209 PID 1152 wrote to memory of 6004 1152 ZEZI.exe 210 PID 6004 wrote to memory of 2868 6004 cmd.exe 214 PID 2868 wrote to memory of 3496 2868 INBVO.exe 215 PID 3496 wrote to memory of 3732 3496 cmd.exe 219 PID 3732 wrote to memory of 5080 3732 VPR.exe 220 PID 5080 wrote to memory of 3112 5080 cmd.exe 224 PID 3112 wrote to memory of 1824 3112 WSVPQSG.exe 225 PID 1824 wrote to memory of 4568 1824 cmd.exe 229 PID 4568 wrote to memory of 1500 4568 YQBK.exe 230 PID 1500 wrote to memory of 2364 1500 cmd.exe 234 PID 2364 wrote to memory of 588 2364 ZTF.exe 235 PID 588 wrote to memory of 5984 588 cmd.exe 239 PID 5984 wrote to memory of 3176 5984 DBLGPI.exe 240 PID 3176 wrote to memory of 1172 3176 cmd.exe 244 PID 1172 wrote to memory of 4324 1172 JXKO.exe 245 PID 4324 wrote to memory of 2416 4324 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_205a6ed631b2e4604affc17a933ae462_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_205a6ed631b2e4604affc17a933ae462_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNSCHC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\windows\ZNSCHC.exeC:\windows\ZNSCHC.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWPDSQ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\windows\SysWOW64\OWPDSQ.exeC:\windows\system32\OWPDSQ.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWEAFH.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\windows\FWEAFH.exeC:\windows\FWEAFH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUJUUQ.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\windows\PUJUUQ.exeC:\windows\PUJUUQ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HCYSZH.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\system\HCYSZH.exeC:\windows\system\HCYSZH.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JADMO.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\SysWOW64\JADMO.exeC:\windows\system32\JADMO.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDHQUFG.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\windows\SysWOW64\JDHQUFG.exeC:\windows\system32\JDHQUFG.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEJV.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\windows\system\TEJV.exeC:\windows\system\TEJV.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THNQKSK.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\SysWOW64\THNQKSK.exeC:\windows\system32\THNQKSK.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKRU.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\MKRU.exeC:\windows\MKRU.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFIZBDU.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\system\BFIZBDU.exeC:\windows\system\BFIZBDU.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVJYIY.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\windows\RVJYIY.exeC:\windows\RVJYIY.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GQTC.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\system\GQTC.exeC:\windows\system\GQTC.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLSD.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\windows\SysWOW64\MLSD.exeC:\windows\system32\MLSD.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QTYLKGV.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\windows\SysWOW64\QTYLKGV.exeC:\windows\system32\QTYLKGV.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEHKYJQ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\windows\SysWOW64\DEHKYJQ.exeC:\windows\system32\DEHKYJQ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUIBE.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\windows\system\SUIBE.exeC:\windows\system\SUIBE.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCWJJPB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\windows\SysWOW64\WCWJJPB.exeC:\windows\system32\WCWJJPB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OKYO.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\windows\SysWOW64\OKYO.exeC:\windows\system32\OKYO.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSFOYN.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\SysWOW64\SSFOYN.exeC:\windows\system32\SSFOYN.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVJSM.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\windows\KVJSM.exeC:\windows\KVJSM.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTO.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\windows\SysWOW64\UTO.exeC:\windows\system32\UTO.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBVMF.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\windows\system\YBVMF.exeC:\windows\system\YBVMF.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEZI.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:400 -
C:\windows\system\ZEZI.exeC:\windows\system\ZEZI.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INBVO.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\SysWOW64\INBVO.exeC:\windows\system32\INBVO.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPR.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\windows\SysWOW64\VPR.exeC:\windows\system32\VPR.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSVPQSG.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\windows\SysWOW64\WSVPQSG.exeC:\windows\system32\WSVPQSG.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQBK.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\windows\YQBK.exeC:\windows\YQBK.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTF.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\ZTF.exeC:\windows\ZTF.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DBLGPI.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:588 -
C:\windows\DBLGPI.exeC:\windows\DBLGPI.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXKO.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\windows\SysWOW64\JXKO.exeC:\windows\system32\JXKO.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCDEKGO.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\SysWOW64\FCDEKGO.exeC:\windows\system32\FCDEKGO.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JFBRK.exe.bat" "66⤵PID:4480
-
C:\windows\SysWOW64\JFBRK.exeC:\windows\system32\JFBRK.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASLJAW.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:2440 -
C:\windows\SysWOW64\ASLJAW.exeC:\windows\system32\ASLJAW.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTNW.exe.bat" "70⤵PID:1364
-
C:\windows\system\KTNW.exeC:\windows\system\KTNW.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBPBH.exe.bat" "72⤵PID:5804
-
C:\windows\BBPBH.exeC:\windows\BBPBH.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWZ.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5772 -
C:\windows\system\QWZ.exeC:\windows\system\QWZ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZCJF.exe.bat" "76⤵
- Executes a command shell one-liner
PID:3664 -
C:\windows\JZCJF.exeC:\windows\JZCJF.exe77⤵
- Executes dropped EXE
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USFUNR.exe.bat" "78⤵PID:1304
-
C:\windows\USFUNR.exeC:\windows\USFUNR.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNJXT.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5824 -
C:\windows\SysWOW64\VNJXT.exeC:\windows\system32\VNJXT.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIOHDHG.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1728 -
C:\windows\PIOHDHG.exeC:\windows\PIOHDHG.exe83⤵
- Executes dropped EXE
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDYLO.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4508 -
C:\windows\system\FDYLO.exeC:\windows\system\FDYLO.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ODAYSZ.exe.bat" "86⤵PID:5572
-
C:\windows\system\ODAYSZ.exeC:\windows\system\ODAYSZ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZE.exe.bat" "88⤵PID:1492
-
C:\windows\JZE.exeC:\windows\JZE.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHLIO.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:208 -
C:\windows\NHLIO.exeC:\windows\NHLIO.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YXS.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:1792 -
C:\windows\YXS.exeC:\windows\YXS.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKWZD.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:5436 -
C:\windows\system\TKWZD.exeC:\windows\system\TKWZD.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EDZKLR.exe.bat" "96⤵PID:4484
-
C:\windows\system\EDZKLR.exeC:\windows\system\EDZKLR.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYD.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5612 -
C:\windows\SysWOW64\XYD.exeC:\windows\system32\XYD.exe99⤵
- Executes dropped EXE
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQGG.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5844 -
C:\windows\IQGG.exeC:\windows\IQGG.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDQJO.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5224 -
C:\windows\system\DLDQJO.exeC:\windows\system\DLDQJO.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DHPMO.exe.bat" "104⤵
- Executes a command shell one-liner
PID:616 -
C:\windows\SysWOW64\DHPMO.exeC:\windows\system32\DHPMO.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXVUBWP.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4388 -
C:\windows\system\HXVUBWP.exeC:\windows\system\HXVUBWP.exe107⤵
- Executes dropped EXE
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VHEKP.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1716 -
C:\windows\system\VHEKP.exeC:\windows\system\VHEKP.exe109⤵
- Executes dropped EXE
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCIO.exe.bat" "110⤵PID:1348
-
C:\windows\system\VCIO.exeC:\windows\system\VCIO.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYHPZ.exe.bat" "112⤵PID:2064
-
C:\windows\SysWOW64\BYHPZ.exeC:\windows\system32\BYHPZ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AVA.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3016 -
C:\windows\AVA.exeC:\windows\AVA.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YJRSRI.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3064 -
C:\windows\YJRSRI.exeC:\windows\YJRSRI.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMD.exe.bat" "118⤵
- Executes a command shell one-liner
PID:1664 -
C:\windows\system\ZMD.exeC:\windows\system\ZMD.exe119⤵
- Executes dropped EXE
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKJILGR.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5312 -
C:\windows\BKJILGR.exeC:\windows\BKJILGR.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-