Analysis
- max time kernel
78s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe
- Size 282KB
- Sample260804-2wy93saa88
- SHA256 4d7b4dd14abcd1a0de78bc6adfb12b907766b0f080e5accdb2ebce7b4db20cc3
- MD5 5c3d889904b47b7fb496f71dfe8d1790
- SHA1 34c68593d0ee2e976d9f6e8dca0683c4bc8152f0
- SHA512 28a3e64e613968396bec94cd7e92865e14b35187f1ae10c6f89da2257706d070300112e5856211524af087084aab83c6ee908bd5d4f6795aad25c495ad2b6fb6
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOakEjiPISUOgW9X+hOGzC/:RLWI09QZb6LOakmZzcukG2/
- TLSH T143549F1776C28273D5A3037209DAC6E9B73ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4644 HFQCSM.exe 4884 FNX.exe 2768 COHIWGO.exe 2196 ORR.exe 3856 RMBX.exe 2836 OEK.exe 1196 APVVL.exe 1832 ASLJAW.exe 5508 HOXKGTV.exe 4248 EEKBV.exe 3728 DONJEGG.exe 5392 BZCZO.exe 6044 PFK.exe 5588 KQT.exe 5564 WDAIJVO.exe 4996 GBFUQE.exe 2024 YWJ.exe 3912 RPZ.exe 2640 QHBZWJD.exe 1036 PSR.exe 1608 ZQE.exe 5324 CYR.exe 4076 ARCYMCT.exe 2320 HEGZAZ.exe 1164 NXDH.exe 5200 DNEZQM.exe 3644 QYNXEW.exe 840 NQWAI.exe 1604 IBF.exe 5420 PRGYDZ.exe 5128 WPVUW.exe 1952 RSM.exe 4628 FYMXNS.exe 5600 HLDGYLG.exe 3568 JJITNT.exe 5816 AJRMV.exe 1904 UFIO.exe 4844 ZFSYS.exe 5924 DIDEBOK.exe 3064 CTGU.exe 5700 NJBI.exe 2376 AMJHGLQ.exe 4928 IZWORJT.exe 2872 XPXNX.exe 252 ZNCZ.exe 5016 UQTYTQM.exe 3264 IWTKVC.exe 3056 EBLZLX.exe 5672 URM.exe 2496 NMQUXIH.exe 4972 LFTKGO.exe 1268 RGAYPQ.exe 5464 SBEUU.exe 5764 FLV.exe 4164 SRVESD.exe 2016 XPFTJYF.exe 3928 JCMRGA.exe 704 JFQV.exe 5620 IYFDD.exe 5428 MGTDP.exe 5496 MJXHVXQ.exe 2404 GBFSMYG.exe 2580 DCOUQU.exe 3256 BNRKZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\OEK.exe.bat RMBX.exe File opened for modification C:\windows\SysWOW64\IZWORJT.exe AMJHGLQ.exe File opened for modification C:\windows\SysWOW64\FXSETOD.exe XRFXIII.exe File opened for modification C:\windows\SysWOW64\ZFSYS.exe UFIO.exe File created C:\windows\SysWOW64\XRFXIII.exe BMV.exe File opened for modification C:\windows\SysWOW64\XRFXIII.exe BMV.exe File opened for modification C:\windows\SysWOW64\JQFHY.exe LVGY.exe File created C:\windows\SysWOW64\VQXZ.exe.bat TVSPV.exe File created C:\windows\SysWOW64\URM.exe EBLZLX.exe File created C:\windows\SysWOW64\BNRKZ.exe.bat DCOUQU.exe File created C:\windows\SysWOW64\ZFSYS.exe.bat UFIO.exe File created C:\windows\SysWOW64\DONJEGG.exe EEKBV.exe File created C:\windows\SysWOW64\ZQE.exe.bat PSR.exe File opened for modification C:\windows\SysWOW64\AMJHGLQ.exe NJBI.exe File created C:\windows\SysWOW64\GNHLIN.exe.bat YZDXYP.exe File created C:\windows\SysWOW64\PRGYDZ.exe.bat IBF.exe File created C:\windows\SysWOW64\ZFSYS.exe UFIO.exe File opened for modification C:\windows\SysWOW64\EBLZLX.exe IWTKVC.exe File created C:\windows\SysWOW64\EBLZLX.exe.bat IWTKVC.exe File created C:\windows\SysWOW64\URM.exe.bat EBLZLX.exe File created C:\windows\SysWOW64\NMQUXIH.exe URM.exe File created C:\windows\SysWOW64\NMQUXIH.exe.bat URM.exe File created C:\windows\SysWOW64\BNRKZ.exe DCOUQU.exe File created C:\windows\SysWOW64\COHIWGO.exe FNX.exe File opened for modification C:\windows\SysWOW64\COHIWGO.exe FNX.exe File opened for modification C:\windows\SysWOW64\ASLJAW.exe APVVL.exe File created C:\windows\SysWOW64\EBLZLX.exe IWTKVC.exe File opened for modification C:\windows\SysWOW64\GNHLIN.exe YZDXYP.exe File created C:\windows\SysWOW64\ASLJAW.exe APVVL.exe File created C:\windows\SysWOW64\FXSETOD.exe.bat XRFXIII.exe File created C:\windows\SysWOW64\TVSPV.exe FXSETOD.exe File created C:\windows\SysWOW64\OEK.exe RMBX.exe File opened for modification C:\windows\SysWOW64\ZQE.exe PSR.exe File opened for modification C:\windows\SysWOW64\DIDEBOK.exe ZFSYS.exe File created C:\windows\SysWOW64\IYFDD.exe JFQV.exe File opened for modification C:\windows\SysWOW64\IYFDD.exe JFQV.exe File created C:\windows\SysWOW64\JQFHY.exe.bat LVGY.exe File opened for modification C:\windows\SysWOW64\BNRKZ.exe DCOUQU.exe File created C:\windows\SysWOW64\JQFHY.exe LVGY.exe File created C:\windows\SysWOW64\RMBX.exe.bat ORR.exe File opened for modification C:\windows\SysWOW64\HEGZAZ.exe ARCYMCT.exe File created C:\windows\SysWOW64\HEGZAZ.exe.bat ARCYMCT.exe File created C:\windows\SysWOW64\DIDEBOK.exe.bat ZFSYS.exe File created C:\windows\SysWOW64\FXSETOD.exe XRFXIII.exe File opened for modification C:\windows\SysWOW64\VQXZ.exe TVSPV.exe File created C:\windows\SysWOW64\XOCTMA.exe VQXZ.exe File created C:\windows\SysWOW64\ASLJAW.exe.bat APVVL.exe File created C:\windows\SysWOW64\DONJEGG.exe.bat EEKBV.exe File created C:\windows\SysWOW64\DIDEBOK.exe ZFSYS.exe File created C:\windows\SysWOW64\GNHLIN.exe YZDXYP.exe File created C:\windows\SysWOW64\XRFXIII.exe.bat BMV.exe File created C:\windows\SysWOW64\XOCTMA.exe.bat VQXZ.exe File created C:\windows\SysWOW64\IEIRPR.exe.bat TOHSREU.exe File created C:\windows\SysWOW64\AMJHGLQ.exe.bat NJBI.exe File opened for modification C:\windows\SysWOW64\DONJEGG.exe EEKBV.exe File opened for modification C:\windows\SysWOW64\RMBX.exe ORR.exe File created C:\windows\SysWOW64\PRGYDZ.exe IBF.exe File opened for modification C:\windows\SysWOW64\PRGYDZ.exe IBF.exe File opened for modification C:\windows\SysWOW64\TVSPV.exe FXSETOD.exe File created C:\windows\SysWOW64\RMBX.exe ORR.exe File created C:\windows\SysWOW64\ZQE.exe PSR.exe File created C:\windows\SysWOW64\HEGZAZ.exe ARCYMCT.exe File created C:\windows\SysWOW64\TVSPV.exe.bat FXSETOD.exe File created C:\windows\SysWOW64\VQXZ.exe TVSPV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\ZNCZ.exe XPXNX.exe File created C:\windows\system\BMV.exe.bat URJPMYF.exe File opened for modification C:\windows\system\ESEN.exe VRCIVJ.exe File created C:\windows\QNXBWX.exe XVIRMF.exe File created C:\windows\WDAIJVO.exe.bat KQT.exe File created C:\windows\system\JJITNT.exe HLDGYLG.exe File created C:\windows\system\CTGU.exe DIDEBOK.exe File created C:\windows\YZDXYP.exe OCPKQGN.exe File created C:\windows\system\ESEN.exe VRCIVJ.exe File created C:\windows\system\YWJ.exe GBFUQE.exe File opened for modification C:\windows\system\RPZ.exe YWJ.exe File created C:\windows\system\FYMXNS.exe.bat RSM.exe File opened for modification C:\windows\system\HLDGYLG.exe FYMXNS.exe File created C:\windows\system\XPXNX.exe IZWORJT.exe File created C:\windows\system\IWTKVC.exe.bat UQTYTQM.exe File created C:\windows\system\SBEUU.exe.bat RGAYPQ.exe File created C:\windows\FLV.exe SBEUU.exe File created C:\windows\system\FNX.exe.bat HFQCSM.exe File created C:\windows\system\KQT.exe.bat PFK.exe File created C:\windows\system\GBFUQE.exe.bat WDAIJVO.exe File created C:\windows\system\UQTYTQM.exe ZNCZ.exe File opened for modification C:\windows\system\GBFSMYG.exe MJXHVXQ.exe File opened for modification C:\windows\DCOUQU.exe GBFSMYG.exe File created C:\windows\system\VZLHL.exe JQFHY.exe File created C:\windows\OCPKQGN.exe.bat VZLHL.exe File opened for modification C:\windows\system\FNX.exe HFQCSM.exe File opened for modification C:\windows\HOXKGTV.exe ASLJAW.exe File created C:\windows\system\EEKBV.exe HOXKGTV.exe File opened for modification C:\windows\system\EEKBV.exe HOXKGTV.exe File opened for modification C:\windows\system\QHBZWJD.exe RPZ.exe File opened for modification C:\windows\system\NQWAI.exe QYNXEW.exe File created C:\windows\FLV.exe.bat SBEUU.exe File created C:\windows\system\JFQV.exe JCMRGA.exe File created C:\windows\HOXKGTV.exe ASLJAW.exe File created C:\windows\system\RSM.exe WPVUW.exe File created C:\windows\LFTKGO.exe NMQUXIH.exe File created C:\windows\system\BWRB.exe XOCTMA.exe File opened for modification C:\windows\system\BWRB.exe XOCTMA.exe File opened for modification C:\windows\VRCIVJ.exe LUX.exe File created C:\windows\RQB.exe QNXBWX.exe File opened for modification C:\windows\IBF.exe NQWAI.exe File created C:\windows\WPVUW.exe.bat QUK.exe File created C:\windows\XPFTJYF.exe.bat SRVESD.exe File opened for modification C:\windows\XNWJVE.exe GNHLIN.exe File created C:\windows\system\WYZZD.exe.bat XNWJVE.exe File created C:\windows\system\RPZ.exe.bat YWJ.exe File opened for modification C:\windows\system\IWTKVC.exe UQTYTQM.exe File opened for modification C:\windows\system\SBEUU.exe RGAYPQ.exe File created C:\windows\XNWJVE.exe GNHLIN.exe File created C:\windows\VRCIVJ.exe.bat LUX.exe File created C:\windows\RQB.exe.bat QNXBWX.exe File created C:\windows\TOHSREU.exe RQB.exe File created C:\windows\TOHSREU.exe.bat RQB.exe File created C:\windows\UFIO.exe.bat AJRMV.exe File opened for modification C:\windows\system\CTGU.exe DIDEBOK.exe File created C:\windows\system\CTGU.exe.bat DIDEBOK.exe File created C:\windows\system\DNEZQM.exe NXDH.exe File created C:\windows\PFK.exe.bat BZCZO.exe File created C:\windows\HFQCSM.exe 2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe File opened for modification C:\windows\WPVUW.exe QUK.exe File created C:\windows\system\JJITNT.exe.bat HLDGYLG.exe File opened for modification C:\windows\system\DNEZQM.exe NXDH.exe File created C:\windows\LFTKGO.exe.bat NMQUXIH.exe File created C:\windows\system\SRVESD.exe.bat FLV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4268 cmd.exe 4384 cmd.exe 4396 cmd.exe 5376 cmd.exe 3496 cmd.exe 3176 cmd.exe 4872 cmd.exe 6068 cmd.exe 1132 cmd.exe 4140 cmd.exe 2692 cmd.exe 1116 cmd.exe 2332 cmd.exe 4864 cmd.exe 900 cmd.exe 6072 cmd.exe 4976 cmd.exe 3184 cmd.exe 5936 cmd.exe 2656 cmd.exe 5436 cmd.exe 5144 cmd.exe 1544 cmd.exe 5208 cmd.exe 916 cmd.exe 2576 cmd.exe 4560 cmd.exe 1104 cmd.exe 4736 cmd.exe 4388 cmd.exe 2052 cmd.exe 6020 cmd.exe 1192 cmd.exe 4664 cmd.exe 2984 cmd.exe 1820 cmd.exe 1016 cmd.exe 3328 cmd.exe 1432 cmd.exe 1720 cmd.exe 2996 cmd.exe 2520 cmd.exe 1072 cmd.exe 1556 cmd.exe 5736 cmd.exe 1380 cmd.exe 5440 cmd.exe 2776 cmd.exe 3636 cmd.exe 2896 cmd.exe 2260 cmd.exe 3408 cmd.exe 4968 cmd.exe 2080 cmd.exe 2932 cmd.exe 4040 cmd.exe 3744 cmd.exe 1740 cmd.exe 1364 cmd.exe 1320 cmd.exe 4636 cmd.exe 2848 cmd.exe 872 cmd.exe 4296 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4076 3452 WerFault.exe 87 5464 4644 WerFault.exe 92 3208 4884 WerFault.exe 98 5972 2768 WerFault.exe 103 2572 2196 WerFault.exe 108 2416 3856 WerFault.exe 113 2924 2836 WerFault.exe 118 1712 1196 WerFault.exe 123 5916 1832 WerFault.exe 128 2776 5508 WerFault.exe 133 5848 4248 WerFault.exe 138 6132 3728 WerFault.exe 143 3468 5392 WerFault.exe 148 980 6044 WerFault.exe 153 5212 5588 WerFault.exe 158 4176 5564 WerFault.exe 163 5612 4996 WerFault.exe 168 3172 2024 WerFault.exe 173 6000 3912 WerFault.exe 178 2332 2640 WerFault.exe 183 1516 1036 WerFault.exe 188 896 1608 WerFault.exe 193 4724 5324 WerFault.exe 198 5000 4076 WerFault.exe 203 3580 2320 WerFault.exe 208 1308 1164 WerFault.exe 213 3836 5200 WerFault.exe 218 5168 3644 WerFault.exe 223 2260 840 WerFault.exe 228 6128 1604 WerFault.exe 233 5440 5420 WerFault.exe 238 4276 4728 WerFault.exe 243 4988 5128 WerFault.exe 248 5744 1952 WerFault.exe 254 2584 4628 WerFault.exe 259 5668 5600 WerFault.exe 264 4268 3568 WerFault.exe 269 3248 5816 WerFault.exe 274 3744 1904 WerFault.exe 279 2776 4844 WerFault.exe 284 4344 5924 WerFault.exe 289 1996 3064 WerFault.exe 294 672 5700 WerFault.exe 299 4760 2376 WerFault.exe 304 4424 4928 WerFault.exe 309 4736 2872 WerFault.exe 314 4792 252 WerFault.exe 319 5704 5016 WerFault.exe 324 2460 3264 WerFault.exe 329 5960 3056 WerFault.exe 334 3128 5672 WerFault.exe 339 5260 2496 WerFault.exe 344 1516 4972 WerFault.exe 349 1788 1268 WerFault.exe 354 4336 5464 WerFault.exe 359 1388 5764 WerFault.exe 364 3620 4164 WerFault.exe 369 5572 2016 WerFault.exe 374 2460 3928 WerFault.exe 379 4044 704 WerFault.exe 384 3348 5620 WerFault.exe 389 4584 5428 WerFault.exe 394 6040 5496 WerFault.exe 399 1912 2404 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRVESD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYZZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JCMRGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYMXNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJXHVXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJRMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFSYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEKBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DONJEGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBFUQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEGZAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWTKVC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGTDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZLHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPFTJYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFTKGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGAYPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNRKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARCYMCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZWORJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBFSMYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVYKLBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVSPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XVIRMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COHIWGO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3452 2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe 3452 2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe 4644 HFQCSM.exe 4644 HFQCSM.exe 4884 FNX.exe 4884 FNX.exe 2768 COHIWGO.exe 2768 COHIWGO.exe 2196 ORR.exe 2196 ORR.exe 3856 RMBX.exe 3856 RMBX.exe 2836 OEK.exe 2836 OEK.exe 1196 APVVL.exe 1196 APVVL.exe 1832 ASLJAW.exe 1832 ASLJAW.exe 5508 HOXKGTV.exe 5508 HOXKGTV.exe 4248 EEKBV.exe 4248 EEKBV.exe 3728 DONJEGG.exe 3728 DONJEGG.exe 5392 BZCZO.exe 5392 BZCZO.exe 6044 PFK.exe 6044 PFK.exe 5588 KQT.exe 5588 KQT.exe 5564 WDAIJVO.exe 5564 WDAIJVO.exe 4996 GBFUQE.exe 4996 GBFUQE.exe 2024 YWJ.exe 2024 YWJ.exe 3912 RPZ.exe 3912 RPZ.exe 2640 QHBZWJD.exe 2640 QHBZWJD.exe 1036 PSR.exe 1036 PSR.exe 1608 ZQE.exe 1608 ZQE.exe 5324 CYR.exe 5324 CYR.exe 4076 ARCYMCT.exe 4076 ARCYMCT.exe 2320 HEGZAZ.exe 2320 HEGZAZ.exe 1164 NXDH.exe 1164 NXDH.exe 5200 DNEZQM.exe 5200 DNEZQM.exe 3644 QYNXEW.exe 3644 QYNXEW.exe 840 NQWAI.exe 840 NQWAI.exe 1604 IBF.exe 1604 IBF.exe 4728 QUK.exe 4728 QUK.exe 5128 WPVUW.exe 5128 WPVUW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3452 2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe 3452 2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe 4644 HFQCSM.exe 4644 HFQCSM.exe 4884 FNX.exe 4884 FNX.exe 2768 COHIWGO.exe 2768 COHIWGO.exe 2196 ORR.exe 2196 ORR.exe 3856 RMBX.exe 3856 RMBX.exe 2836 OEK.exe 2836 OEK.exe 1196 APVVL.exe 1196 APVVL.exe 1832 ASLJAW.exe 1832 ASLJAW.exe 5508 HOXKGTV.exe 5508 HOXKGTV.exe 4248 EEKBV.exe 4248 EEKBV.exe 3728 DONJEGG.exe 3728 DONJEGG.exe 5392 BZCZO.exe 5392 BZCZO.exe 6044 PFK.exe 6044 PFK.exe 5588 KQT.exe 5588 KQT.exe 5564 WDAIJVO.exe 5564 WDAIJVO.exe 4996 GBFUQE.exe 4996 GBFUQE.exe 2024 YWJ.exe 2024 YWJ.exe 3912 RPZ.exe 3912 RPZ.exe 2640 QHBZWJD.exe 2640 QHBZWJD.exe 1036 PSR.exe 1036 PSR.exe 1608 ZQE.exe 1608 ZQE.exe 5324 CYR.exe 5324 CYR.exe 4076 ARCYMCT.exe 4076 ARCYMCT.exe 2320 HEGZAZ.exe 2320 HEGZAZ.exe 1164 NXDH.exe 1164 NXDH.exe 5200 DNEZQM.exe 5200 DNEZQM.exe 3644 QYNXEW.exe 3644 QYNXEW.exe 840 NQWAI.exe 840 NQWAI.exe 1604 IBF.exe 1604 IBF.exe 4728 QUK.exe 4728 QUK.exe 5128 WPVUW.exe 5128 WPVUW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 5456 3452 2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe 88 PID 5456 wrote to memory of 4644 5456 cmd.exe 92 PID 4644 wrote to memory of 2820 4644 HFQCSM.exe 94 PID 2820 wrote to memory of 4884 2820 cmd.exe 98 PID 4884 wrote to memory of 1212 4884 FNX.exe 99 PID 1212 wrote to memory of 2768 1212 cmd.exe 103 PID 2768 wrote to memory of 4564 2768 COHIWGO.exe 104 PID 4564 wrote to memory of 2196 4564 cmd.exe 108 PID 2196 wrote to memory of 908 2196 ORR.exe 109 PID 908 wrote to memory of 3856 908 cmd.exe 113 PID 3856 wrote to memory of 5936 3856 RMBX.exe 114 PID 5936 wrote to memory of 2836 5936 cmd.exe 118 PID 2836 wrote to memory of 3124 2836 OEK.exe 119 PID 3124 wrote to memory of 1196 3124 cmd.exe 123 PID 1196 wrote to memory of 1804 1196 APVVL.exe 124 PID 1804 wrote to memory of 1832 1804 cmd.exe 128 PID 1832 wrote to memory of 1256 1832 ASLJAW.exe 129 PID 1256 wrote to memory of 5508 1256 cmd.exe 133 PID 5508 wrote to memory of 2656 5508 HOXKGTV.exe 134 PID 2656 wrote to memory of 4248 2656 cmd.exe 138 PID 4248 wrote to memory of 5436 4248 EEKBV.exe 139 PID 5436 wrote to memory of 3728 5436 cmd.exe 143 PID 3728 wrote to memory of 4836 3728 DONJEGG.exe 144 PID 4836 wrote to memory of 5392 4836 cmd.exe 148 PID 5392 wrote to memory of 3496 5392 BZCZO.exe 149 PID 3496 wrote to memory of 6044 3496 cmd.exe 153 PID 6044 wrote to memory of 4040 6044 PFK.exe 154 PID 4040 wrote to memory of 5588 4040 cmd.exe 158 PID 5588 wrote to memory of 1072 5588 KQT.exe 159 PID 1072 wrote to memory of 5564 1072 cmd.exe 163 PID 5564 wrote to memory of 4704 5564 WDAIJVO.exe 164 PID 4704 wrote to memory of 4996 4704 cmd.exe 168 PID 4996 wrote to memory of 1892 4996 GBFUQE.exe 169 PID 1892 wrote to memory of 2024 1892 cmd.exe 173 PID 2024 wrote to memory of 1784 2024 YWJ.exe 174 PID 1784 wrote to memory of 3912 1784 cmd.exe 178 PID 3912 wrote to memory of 3140 3912 RPZ.exe 179 PID 3140 wrote to memory of 2640 3140 cmd.exe 183 PID 2640 wrote to memory of 3408 2640 QHBZWJD.exe 184 PID 3408 wrote to memory of 1036 3408 cmd.exe 188 PID 1036 wrote to memory of 2092 1036 PSR.exe 189 PID 2092 wrote to memory of 1608 2092 cmd.exe 193 PID 1608 wrote to memory of 1556 1608 ZQE.exe 194 PID 1556 wrote to memory of 5324 1556 cmd.exe 198 PID 5324 wrote to memory of 5144 5324 CYR.exe 199 PID 5144 wrote to memory of 4076 5144 cmd.exe 203 PID 4076 wrote to memory of 3468 4076 ARCYMCT.exe 204 PID 3468 wrote to memory of 2320 3468 cmd.exe 208 PID 2320 wrote to memory of 3472 2320 HEGZAZ.exe 209 PID 3472 wrote to memory of 1164 3472 cmd.exe 213 PID 1164 wrote to memory of 4968 1164 NXDH.exe 214 PID 4968 wrote to memory of 5200 4968 cmd.exe 218 PID 5200 wrote to memory of 920 5200 DNEZQM.exe 219 PID 920 wrote to memory of 3644 920 cmd.exe 223 PID 3644 wrote to memory of 2984 3644 QYNXEW.exe 224 PID 2984 wrote to memory of 840 2984 cmd.exe 228 PID 840 wrote to memory of 2848 840 NQWAI.exe 229 PID 2848 wrote to memory of 1604 2848 cmd.exe 233 PID 1604 wrote to memory of 1544 1604 IBF.exe 234 PID 1544 wrote to memory of 5420 1544 cmd.exe 238 PID 4560 wrote to memory of 4728 4560 cmd.exe 243 PID 4728 wrote to memory of 1272 4728 QUK.exe 244 PID 1272 wrote to memory of 5128 1272 cmd.exe 248 PID 5128 wrote to memory of 572 5128 WPVUW.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5c3d889904b47b7fb496f71dfe8d1790_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HFQCSM.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\HFQCSM.exeC:\windows\HFQCSM.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNX.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\windows\system\FNX.exeC:\windows\system\FNX.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COHIWGO.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\windows\SysWOW64\COHIWGO.exeC:\windows\system32\COHIWGO.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORR.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\system\ORR.exeC:\windows\system\ORR.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMBX.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:908 -
C:\windows\SysWOW64\RMBX.exeC:\windows\system32\RMBX.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEK.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\SysWOW64\OEK.exeC:\windows\system32\OEK.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APVVL.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\windows\system\APVVL.exeC:\windows\system\APVVL.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASLJAW.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\windows\SysWOW64\ASLJAW.exeC:\windows\system32\ASLJAW.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOXKGTV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\windows\HOXKGTV.exeC:\windows\HOXKGTV.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EEKBV.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\windows\system\EEKBV.exeC:\windows\system\EEKBV.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DONJEGG.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\DONJEGG.exeC:\windows\system32\DONJEGG.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZCZO.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\BZCZO.exeC:\windows\BZCZO.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFK.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\windows\PFK.exeC:\windows\PFK.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\windows\system\KQT.exeC:\windows\system\KQT.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDAIJVO.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\windows\WDAIJVO.exeC:\windows\WDAIJVO.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBFUQE.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\windows\system\GBFUQE.exeC:\windows\system\GBFUQE.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YWJ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\windows\system\YWJ.exeC:\windows\system\YWJ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPZ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\windows\system\RPZ.exeC:\windows\system\RPZ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHBZWJD.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\windows\system\QHBZWJD.exeC:\windows\system\QHBZWJD.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSR.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\PSR.exeC:\windows\PSR.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQE.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\windows\SysWOW64\ZQE.exeC:\windows\system32\ZQE.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYR.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\windows\system\CYR.exeC:\windows\system\CYR.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ARCYMCT.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\windows\ARCYMCT.exeC:\windows\ARCYMCT.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEGZAZ.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\SysWOW64\HEGZAZ.exeC:\windows\system32\HEGZAZ.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXDH.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\NXDH.exeC:\windows\NXDH.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNEZQM.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\system\DNEZQM.exeC:\windows\system\DNEZQM.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NQWAI.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\windows\system\NQWAI.exeC:\windows\system\NQWAI.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBF.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\windows\IBF.exeC:\windows\IBF.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRGYDZ.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\windows\SysWOW64\PRGYDZ.exeC:\windows\system32\PRGYDZ.exe61⤵
- Executes dropped EXE
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUK.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\SysWOW64\QUK.exeC:\windows\system32\QUK.exe63⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPVUW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\windows\WPVUW.exeC:\windows\WPVUW.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSM.exe.bat" "66⤵PID:572
-
C:\windows\system\RSM.exeC:\windows\system\RSM.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FYMXNS.exe.bat" "68⤵PID:4144
-
C:\windows\system\FYMXNS.exeC:\windows\system\FYMXNS.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLDGYLG.exe.bat" "70⤵PID:5000
-
C:\windows\system\HLDGYLG.exeC:\windows\system\HLDGYLG.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJITNT.exe.bat" "72⤵PID:6052
-
C:\windows\system\JJITNT.exeC:\windows\system\JJITNT.exe73⤵
- Executes dropped EXE
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AJRMV.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2880 -
C:\windows\system\AJRMV.exeC:\windows\system\AJRMV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFIO.exe.bat" "76⤵PID:1312
-
C:\windows\UFIO.exeC:\windows\UFIO.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFSYS.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:108 -
C:\windows\SysWOW64\ZFSYS.exeC:\windows\system32\ZFSYS.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DIDEBOK.exe.bat" "80⤵PID:1444
-
C:\windows\SysWOW64\DIDEBOK.exeC:\windows\system32\DIDEBOK.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CTGU.exe.bat" "82⤵PID:4552
-
C:\windows\system\CTGU.exeC:\windows\system\CTGU.exe83⤵
- Executes dropped EXE
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJBI.exe.bat" "84⤵PID:4308
-
C:\windows\NJBI.exeC:\windows\NJBI.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMJHGLQ.exe.bat" "86⤵PID:5064
-
C:\windows\SysWOW64\AMJHGLQ.exeC:\windows\system32\AMJHGLQ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZWORJT.exe.bat" "88⤵PID:5380
-
C:\windows\SysWOW64\IZWORJT.exeC:\windows\system32\IZWORJT.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPXNX.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3748 -
C:\windows\system\XPXNX.exeC:\windows\system\XPXNX.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNCZ.exe.bat" "92⤵PID:4956
-
C:\windows\ZNCZ.exeC:\windows\ZNCZ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UQTYTQM.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:5592 -
C:\windows\system\UQTYTQM.exeC:\windows\system\UQTYTQM.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWTKVC.exe.bat" "96⤵PID:5196
-
C:\windows\system\IWTKVC.exeC:\windows\system\IWTKVC.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBLZLX.exe.bat" "98⤵PID:5980
-
C:\windows\SysWOW64\EBLZLX.exeC:\windows\system32\EBLZLX.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URM.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5028 -
C:\windows\SysWOW64\URM.exeC:\windows\system32\URM.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMQUXIH.exe.bat" "102⤵PID:5680
-
C:\windows\SysWOW64\NMQUXIH.exeC:\windows\system32\NMQUXIH.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFTKGO.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4864 -
C:\windows\LFTKGO.exeC:\windows\LFTKGO.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGAYPQ.exe.bat" "106⤵PID:4256
-
C:\windows\RGAYPQ.exeC:\windows\RGAYPQ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SBEUU.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3332 -
C:\windows\system\SBEUU.exeC:\windows\system\SBEUU.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLV.exe.bat" "110⤵
- Executes a command shell one-liner
PID:872 -
C:\windows\FLV.exeC:\windows\FLV.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SRVESD.exe.bat" "112⤵PID:3160
-
C:\windows\system\SRVESD.exeC:\windows\system\SRVESD.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPFTJYF.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4268 -
C:\windows\XPFTJYF.exeC:\windows\XPFTJYF.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JCMRGA.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3828 -
C:\windows\system\JCMRGA.exeC:\windows\system\JCMRGA.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JFQV.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3744 -
C:\windows\system\JFQV.exeC:\windows\system\JFQV.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYFDD.exe.bat" "120⤵PID:2732
-
C:\windows\SysWOW64\IYFDD.exeC:\windows\system32\IYFDD.exe121⤵
- Executes dropped EXE
PID:5620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-