Analysis
- max time kernel
91s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 07:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe
- Size 208KB
- Sample260804-hyjsmafa25
- SHA256 e595a41e416c019343f7508b8f589400ad6e8ee710c269558855b4b0fbdc56d8
- MD5 5e160ae799c6866102b5b9e6c627949c
- SHA1 5ece231ce98e9f696f55cb064ade0d538a59e0f4
- SHA512 c2d3bb2aecd8368058302a8dbdd405c8771eda43651facc2a952a62865b8110b6fe35a6906b1fe9287b88c237cffe91951865251038523a571e8f136e3f06763
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfP4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOXQEj1
- TLSH T1DA247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1768 ZOEDJCH.exe 5228 GCXZPND.exe 2156 MCFM.exe 428 HPJWJP.exe 2828 BDO.exe 3956 UGSJY.exe 1232 VBWF.exe 2580 KENRXQ.exe 1424 IOQHF.exe 5500 MXX.exe 5344 SSWI.exe 4668 LVA.exe 4340 KLTGPM.exe 948 OWRB.exe 4472 BYZADQI.exe 4420 QPASK.exe 3928 UFH.exe 4396 JAREHJ.exe 1872 QVQFMM.exe 3732 TDWN.exe 5324 SOH.exe 4740 NYQ.exe 3308 RHWBZ.exe 1604 MCBLJNZ.exe 1000 MHB.exe 5044 ZSKQZD.exe 3088 ANNU.exe 4488 ABOIO.exe 5340 PWX.exe 5384 MBD.exe 4272 XUGC.exe 6000 RHLMYJ.exe 1732 HXMD.exe 5376 BLRVHF.exe 1180 TYBNXBA.exe 4604 NLY.exe 4856 WMABLZR.exe 5652 QMPMU.exe 1240 QSP.exe 1196 KFUK.exe 3256 QFUYX.exe 2820 AOW.exe 5328 YDDOEYJ.exe 2776 YOL.exe 612 EJCQX.exe 5488 TEU.exe 5560 CNWZT.exe 3236 DQADZNZ.exe 5092 SLJH.exe 616 EDMASP.exe 2472 NDGFWMR.exe 2884 CYYJH.exe 5428 THSOSE.exe 2612 FZVHSMJ.exe 5988 DACVJ.exe 3740 UAEINL.exe 5892 PVJ.exe 4468 SDQSBEY.exe 3592 NRUB.exe 2724 EZWGP.exe 1876 ZMBXZJD.exe 2952 MXKOO.exe 3144 XQNHWT.exe 2152 BYT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JAN.exe.bat OPXKC.exe File created C:\windows\SysWOW64\ZOEDJCH.exe.bat 2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe File created C:\windows\SysWOW64\OWRB.exe KLTGPM.exe File opened for modification C:\windows\SysWOW64\SNLQF.exe DXKQYDT.exe File created C:\windows\SysWOW64\LSHGWF.exe.bat HCA.exe File created C:\windows\SysWOW64\ABOIO.exe.bat ANNU.exe File created C:\windows\SysWOW64\YOL.exe.bat YDDOEYJ.exe File created C:\windows\SysWOW64\IZOOMU.exe PWCKGFV.exe File opened for modification C:\windows\SysWOW64\IZOOMU.exe PWCKGFV.exe File created C:\windows\SysWOW64\JAN.exe OPXKC.exe File created C:\windows\SysWOW64\SNLQF.exe.bat DXKQYDT.exe File created C:\windows\SysWOW64\HCA.exe BPBXN.exe File created C:\windows\SysWOW64\HCA.exe.bat BPBXN.exe File opened for modification C:\windows\SysWOW64\ZOEDJCH.exe 2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe File created C:\windows\SysWOW64\QVQFMM.exe.bat JAREHJ.exe File created C:\windows\SysWOW64\NYQ.exe.bat SOH.exe File created C:\windows\SysWOW64\MXKOO.exe.bat ZMBXZJD.exe File created C:\windows\SysWOW64\IZOOMU.exe.bat PWCKGFV.exe File created C:\windows\SysWOW64\KEVFHDL.exe WGV.exe File created C:\windows\SysWOW64\MCQZTAR.exe RPMQR.exe File created C:\windows\SysWOW64\AJPN.exe.bat IGMKKSX.exe File created C:\windows\SysWOW64\NLY.exe.bat TYBNXBA.exe File opened for modification C:\windows\SysWOW64\QMPMU.exe WMABLZR.exe File created C:\windows\SysWOW64\QMPMU.exe.bat WMABLZR.exe File created C:\windows\SysWOW64\NRUB.exe.bat SDQSBEY.exe File created C:\windows\SysWOW64\KLTGPM.exe LVA.exe File created C:\windows\SysWOW64\KLTGPM.exe.bat LVA.exe File created C:\windows\SysWOW64\KBQNORU.exe GWGYYV.exe File opened for modification C:\windows\SysWOW64\JAN.exe OPXKC.exe File opened for modification C:\windows\SysWOW64\ZCPUWUK.exe WTG.exe File created C:\windows\SysWOW64\QHDN.exe.bat PEZSBUH.exe File created C:\windows\SysWOW64\FXENNGF.exe QHDN.exe File created C:\windows\SysWOW64\FXENNGF.exe.bat QHDN.exe File opened for modification C:\windows\SysWOW64\HPJWJP.exe MCFM.exe File opened for modification C:\windows\SysWOW64\KLTGPM.exe LVA.exe File opened for modification C:\windows\SysWOW64\NYQ.exe SOH.exe File created C:\windows\SysWOW64\HXMD.exe.bat RHLMYJ.exe File opened for modification C:\windows\SysWOW64\YOL.exe YDDOEYJ.exe File created C:\windows\SysWOW64\PWCKGFV.exe.bat HDBJTS.exe File opened for modification C:\windows\SysWOW64\UGDEKTR.exe KIYJDKQ.exe File created C:\windows\SysWOW64\KEVFHDL.exe.bat WGV.exe File created C:\windows\SysWOW64\ZOEDJCH.exe 2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe File created C:\windows\SysWOW64\VBWF.exe.bat UGSJY.exe File created C:\windows\SysWOW64\ABOIO.exe ANNU.exe File created C:\windows\SysWOW64\NLY.exe TYBNXBA.exe File created C:\windows\SysWOW64\PWCKGFV.exe HDBJTS.exe File opened for modification C:\windows\SysWOW64\WOETU.exe MQQYFQ.exe File created C:\windows\SysWOW64\UGDEKTR.exe.bat KIYJDKQ.exe File created C:\windows\SysWOW64\SNLQF.exe DXKQYDT.exe File created C:\windows\SysWOW64\HPJWJP.exe.bat MCFM.exe File created C:\windows\SysWOW64\ZSKQZD.exe.bat MHB.exe File opened for modification C:\windows\SysWOW64\MXKOO.exe ZMBXZJD.exe File created C:\windows\SysWOW64\LSHGWF.exe HCA.exe File created C:\windows\SysWOW64\DVTGLJ.exe.bat SDYN.exe File created C:\windows\SysWOW64\AJPN.exe IGMKKSX.exe File opened for modification C:\windows\SysWOW64\VBWF.exe UGSJY.exe File created C:\windows\SysWOW64\WMABLZR.exe NLY.exe File created C:\windows\SysWOW64\THSOSE.exe CYYJH.exe File created C:\windows\SysWOW64\NRUB.exe SDQSBEY.exe File opened for modification C:\windows\SysWOW64\KBQNORU.exe GWGYYV.exe File created C:\windows\SysWOW64\VBWF.exe UGSJY.exe File created C:\windows\SysWOW64\NYQ.exe SOH.exe File created C:\windows\SysWOW64\ZCPUWUK.exe WTG.exe File created C:\windows\SysWOW64\UGDEKTR.exe KIYJDKQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\MCFM.exe.bat GCXZPND.exe File created C:\windows\system\AOW.exe.bat QFUYX.exe File created C:\windows\system\TEU.exe.bat EJCQX.exe File created C:\windows\system\MCBLJNZ.exe RHWBZ.exe File created C:\windows\BYT.exe.bat XQNHWT.exe File created C:\windows\system\RBFB.exe.bat RQXZ.exe File opened for modification C:\windows\system\IHKL.exe HMGHAFQ.exe File created C:\windows\QSP.exe.bat QMPMU.exe File created C:\windows\EZWGP.exe NRUB.exe File opened for modification C:\windows\system\KUF.exe ZCPUWUK.exe File created C:\windows\DXKQYDT.exe KEVFHDL.exe File opened for modification C:\windows\system\RHWBZ.exe NYQ.exe File opened for modification C:\windows\system\EJCQX.exe YOL.exe File created C:\windows\RQXZ.exe NAQZHRE.exe File opened for modification C:\windows\system\BYLV.exe RBFB.exe File opened for modification C:\windows\system\EYXKYZJ.exe DVTGLJ.exe File created C:\windows\NWRVLIP.exe TIULB.exe File opened for modification C:\windows\system\LVA.exe SSWI.exe File created C:\windows\system\CYYJH.exe.bat NDGFWMR.exe File created C:\windows\system\JAREHJ.exe.bat UFH.exe File created C:\windows\IIK.exe KMKYWUL.exe File created C:\windows\WGV.exe WDRYAB.exe File created C:\windows\system\MCBLJNZ.exe.bat RHWBZ.exe File created C:\windows\UFH.exe.bat QPASK.exe File created C:\windows\PVJ.exe UAEINL.exe File created C:\windows\BLRVHF.exe HXMD.exe File opened for modification C:\windows\ZMBXZJD.exe EZWGP.exe File created C:\windows\MQQYFQ.exe IIK.exe File created C:\windows\WDRYAB.exe.bat UGDEKTR.exe File created C:\windows\system\EYXKYZJ.exe.bat DVTGLJ.exe File created C:\windows\system\LVA.exe SSWI.exe File created C:\windows\system\IOQHF.exe KENRXQ.exe File created C:\windows\system\RHLMYJ.exe XUGC.exe File opened for modification C:\windows\BLRVHF.exe HXMD.exe File created C:\windows\system\FZVHSMJ.exe.bat THSOSE.exe File created C:\windows\HZWKVAW.exe KBQNORU.exe File created C:\windows\ZRO.exe BYLV.exe File created C:\windows\XWTAP.exe.bat NWRVLIP.exe File created C:\windows\system\BYZADQI.exe OWRB.exe File opened for modification C:\windows\system\AOW.exe QFUYX.exe File created C:\windows\NDGFWMR.exe.bat EDMASP.exe File opened for modification C:\windows\BYT.exe XQNHWT.exe File opened for modification C:\windows\HMGHAFQ.exe PJC.exe File created C:\windows\PEZSBUH.exe.bat AJPN.exe File created C:\windows\MQQYFQ.exe.bat IIK.exe File opened for modification C:\windows\KIWLGV.exe IKQQZNC.exe File opened for modification C:\windows\RQXZ.exe NAQZHRE.exe File opened for modification C:\windows\BPBXN.exe ZRO.exe File opened for modification C:\windows\system\QFUYX.exe KFUK.exe File created C:\windows\ANNU.exe ZSKQZD.exe File created C:\windows\SOH.exe TDWN.exe File created C:\windows\RPMQR.exe IHKL.exe File created C:\windows\system\SDYN.exe MCQZTAR.exe File created C:\windows\PEZSBUH.exe AJPN.exe File opened for modification C:\windows\system\MCFM.exe GCXZPND.exe File opened for modification C:\windows\TYBNXBA.exe BLRVHF.exe File created C:\windows\DACVJ.exe.bat FZVHSMJ.exe File created C:\windows\GWGYYV.exe WOETU.exe File opened for modification C:\windows\system\OPXKC.exe HZWKVAW.exe File opened for modification C:\windows\NAQZHRE.exe SNLQF.exe File created C:\windows\TYBNXBA.exe.bat BLRVHF.exe File created C:\windows\WLYYK.exe BYT.exe File opened for modification C:\windows\system\SDYN.exe MCQZTAR.exe File created C:\windows\system\IOQHF.exe.bat KENRXQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2932 cmd.exe 6044 cmd.exe 5952 cmd.exe 252 cmd.exe 4936 cmd.exe 2944 cmd.exe 2752 cmd.exe 5456 cmd.exe 2680 cmd.exe 5620 cmd.exe 5392 cmd.exe 2904 cmd.exe 4296 cmd.exe 1060 cmd.exe 5444 cmd.exe 708 cmd.exe 5100 cmd.exe 3304 cmd.exe 1836 cmd.exe 5836 cmd.exe 2516 cmd.exe 4132 cmd.exe 1432 cmd.exe 5716 cmd.exe 3024 cmd.exe 3704 cmd.exe 1212 cmd.exe 3432 cmd.exe 2796 cmd.exe 2728 cmd.exe 5184 cmd.exe 1952 cmd.exe 1220 cmd.exe 2704 cmd.exe 4564 cmd.exe 3324 cmd.exe 6048 cmd.exe 6112 cmd.exe 5296 cmd.exe 6036 cmd.exe 6096 cmd.exe 5844 cmd.exe 5676 cmd.exe 2336 cmd.exe 1516 cmd.exe 4600 cmd.exe 5612 cmd.exe 5596 cmd.exe 1080 cmd.exe 3932 cmd.exe 1596 cmd.exe 2912 cmd.exe 6124 cmd.exe 4252 cmd.exe 2572 cmd.exe 5688 cmd.exe 1960 cmd.exe 4540 cmd.exe 236 cmd.exe 1548 cmd.exe 2716 cmd.exe 2928 cmd.exe 924 cmd.exe 2488 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2592 4960 WerFault.exe 87 3288 1768 WerFault.exe 93 3760 5228 WerFault.exe 99 4536 2156 WerFault.exe 104 4092 428 WerFault.exe 109 5448 2828 WerFault.exe 114 3084 3956 WerFault.exe 119 4980 1232 WerFault.exe 124 6116 2580 WerFault.exe 129 2944 1424 WerFault.exe 134 3256 5500 WerFault.exe 139 5356 5344 WerFault.exe 144 2000 4668 WerFault.exe 149 5176 4340 WerFault.exe 154 2888 948 WerFault.exe 159 4092 4472 WerFault.exe 164 4564 4420 WerFault.exe 169 2144 3928 WerFault.exe 174 1240 4396 WerFault.exe 179 1196 1872 WerFault.exe 184 3096 3732 WerFault.exe 189 6000 5324 WerFault.exe 194 2740 4740 WerFault.exe 199 5376 3308 WerFault.exe 204 988 1604 WerFault.exe 209 2716 1000 WerFault.exe 214 748 5044 WerFault.exe 219 4844 3088 WerFault.exe 224 4468 4488 WerFault.exe 229 788 5340 WerFault.exe 234 3400 5384 WerFault.exe 239 5152 4272 WerFault.exe 244 4432 6000 WerFault.exe 249 5660 1732 WerFault.exe 254 988 5376 WerFault.exe 259 5988 1180 WerFault.exe 264 5748 4604 WerFault.exe 269 5136 4856 WerFault.exe 274 4920 5652 WerFault.exe 280 5276 1240 WerFault.exe 285 1684 1196 WerFault.exe 290 3564 3256 WerFault.exe 295 3160 2820 WerFault.exe 300 4972 5328 WerFault.exe 305 5664 2776 WerFault.exe 310 3556 612 WerFault.exe 315 1220 5488 WerFault.exe 320 6028 5560 WerFault.exe 325 4920 3236 WerFault.exe 330 5520 5092 WerFault.exe 335 3408 616 WerFault.exe 340 236 2472 WerFault.exe 345 2328 2884 WerFault.exe 350 1376 5428 WerFault.exe 355 820 2612 WerFault.exe 360 2508 5988 WerFault.exe 365 3280 3740 WerFault.exe 370 4980 5892 WerFault.exe 375 5756 4468 WerFault.exe 380 3028 3592 WerFault.exe 385 1044 2724 WerFault.exe 390 1620 1876 WerFault.exe 395 5928 2952 WerFault.exe 400 4644 3144 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZWKVAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPJWJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMABLZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQADZNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLYYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GCXZPND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPASK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPMQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXKOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SLJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMBXZJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGSJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UAEINL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGDEKTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOEDJCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDQSBEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLTGPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYYJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVTGLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHWBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLRVHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFUYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDMASP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAQZHRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVQFMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXENNGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSKQZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4960 2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe 4960 2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe 1768 ZOEDJCH.exe 1768 ZOEDJCH.exe 5228 GCXZPND.exe 5228 GCXZPND.exe 2156 MCFM.exe 2156 MCFM.exe 428 HPJWJP.exe 428 HPJWJP.exe 2828 BDO.exe 2828 BDO.exe 3956 UGSJY.exe 3956 UGSJY.exe 1232 VBWF.exe 1232 VBWF.exe 2580 KENRXQ.exe 2580 KENRXQ.exe 1424 IOQHF.exe 1424 IOQHF.exe 5500 MXX.exe 5500 MXX.exe 5344 SSWI.exe 5344 SSWI.exe 4668 LVA.exe 4668 LVA.exe 4340 KLTGPM.exe 4340 KLTGPM.exe 948 OWRB.exe 948 OWRB.exe 4472 BYZADQI.exe 4472 BYZADQI.exe 4420 QPASK.exe 4420 QPASK.exe 3928 UFH.exe 3928 UFH.exe 4396 JAREHJ.exe 4396 JAREHJ.exe 1872 QVQFMM.exe 1872 QVQFMM.exe 3732 TDWN.exe 3732 TDWN.exe 5324 SOH.exe 5324 SOH.exe 4740 NYQ.exe 4740 NYQ.exe 3308 RHWBZ.exe 3308 RHWBZ.exe 1604 MCBLJNZ.exe 1604 MCBLJNZ.exe 1000 MHB.exe 1000 MHB.exe 5044 ZSKQZD.exe 5044 ZSKQZD.exe 3088 ANNU.exe 3088 ANNU.exe 4488 ABOIO.exe 4488 ABOIO.exe 5340 PWX.exe 5340 PWX.exe 5384 MBD.exe 5384 MBD.exe 4272 XUGC.exe 4272 XUGC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4960 2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe 4960 2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe 1768 ZOEDJCH.exe 1768 ZOEDJCH.exe 5228 GCXZPND.exe 5228 GCXZPND.exe 2156 MCFM.exe 2156 MCFM.exe 428 HPJWJP.exe 428 HPJWJP.exe 2828 BDO.exe 2828 BDO.exe 3956 UGSJY.exe 3956 UGSJY.exe 1232 VBWF.exe 1232 VBWF.exe 2580 KENRXQ.exe 2580 KENRXQ.exe 1424 IOQHF.exe 1424 IOQHF.exe 5500 MXX.exe 5500 MXX.exe 5344 SSWI.exe 5344 SSWI.exe 4668 LVA.exe 4668 LVA.exe 4340 KLTGPM.exe 4340 KLTGPM.exe 948 OWRB.exe 948 OWRB.exe 4472 BYZADQI.exe 4472 BYZADQI.exe 4420 QPASK.exe 4420 QPASK.exe 3928 UFH.exe 3928 UFH.exe 4396 JAREHJ.exe 4396 JAREHJ.exe 1872 QVQFMM.exe 1872 QVQFMM.exe 3732 TDWN.exe 3732 TDWN.exe 5324 SOH.exe 5324 SOH.exe 4740 NYQ.exe 4740 NYQ.exe 3308 RHWBZ.exe 3308 RHWBZ.exe 1604 MCBLJNZ.exe 1604 MCBLJNZ.exe 1000 MHB.exe 1000 MHB.exe 5044 ZSKQZD.exe 5044 ZSKQZD.exe 3088 ANNU.exe 3088 ANNU.exe 4488 ABOIO.exe 4488 ABOIO.exe 5340 PWX.exe 5340 PWX.exe 5384 MBD.exe 5384 MBD.exe 4272 XUGC.exe 4272 XUGC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 4772 4960 2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe 89 PID 4772 wrote to memory of 1768 4772 cmd.exe 93 PID 1768 wrote to memory of 6036 1768 ZOEDJCH.exe 95 PID 6036 wrote to memory of 5228 6036 cmd.exe 99 PID 5228 wrote to memory of 1480 5228 GCXZPND.exe 100 PID 1480 wrote to memory of 2156 1480 cmd.exe 104 PID 2156 wrote to memory of 1104 2156 MCFM.exe 105 PID 1104 wrote to memory of 428 1104 cmd.exe 109 PID 428 wrote to memory of 912 428 HPJWJP.exe 110 PID 912 wrote to memory of 2828 912 cmd.exe 114 PID 2828 wrote to memory of 4884 2828 BDO.exe 115 PID 4884 wrote to memory of 3956 4884 cmd.exe 119 PID 3956 wrote to memory of 5940 3956 UGSJY.exe 120 PID 5940 wrote to memory of 1232 5940 cmd.exe 124 PID 1232 wrote to memory of 5096 1232 VBWF.exe 125 PID 5096 wrote to memory of 2580 5096 cmd.exe 129 PID 2580 wrote to memory of 2836 2580 KENRXQ.exe 130 PID 2836 wrote to memory of 1424 2836 cmd.exe 134 PID 1424 wrote to memory of 4296 1424 IOQHF.exe 135 PID 4296 wrote to memory of 5500 4296 cmd.exe 139 PID 5500 wrote to memory of 3388 5500 MXX.exe 140 PID 3388 wrote to memory of 5344 3388 cmd.exe 144 PID 5344 wrote to memory of 5160 5344 SSWI.exe 145 PID 5160 wrote to memory of 4668 5160 cmd.exe 149 PID 4668 wrote to memory of 6060 4668 LVA.exe 150 PID 6060 wrote to memory of 4340 6060 cmd.exe 154 PID 4340 wrote to memory of 2752 4340 KLTGPM.exe 155 PID 2752 wrote to memory of 948 2752 cmd.exe 159 PID 948 wrote to memory of 5644 948 OWRB.exe 160 PID 5644 wrote to memory of 4472 5644 cmd.exe 164 PID 4472 wrote to memory of 3932 4472 BYZADQI.exe 165 PID 3932 wrote to memory of 4420 3932 cmd.exe 169 PID 4420 wrote to memory of 4928 4420 QPASK.exe 170 PID 4928 wrote to memory of 3928 4928 cmd.exe 174 PID 3928 wrote to memory of 3432 3928 UFH.exe 175 PID 3432 wrote to memory of 4396 3432 cmd.exe 179 PID 4396 wrote to memory of 4776 4396 JAREHJ.exe 180 PID 4776 wrote to memory of 1872 4776 cmd.exe 184 PID 1872 wrote to memory of 1516 1872 QVQFMM.exe 185 PID 1516 wrote to memory of 3732 1516 cmd.exe 189 PID 3732 wrote to memory of 1596 3732 TDWN.exe 190 PID 1596 wrote to memory of 5324 1596 cmd.exe 194 PID 5324 wrote to memory of 4196 5324 SOH.exe 195 PID 4196 wrote to memory of 4740 4196 cmd.exe 199 PID 4740 wrote to memory of 4600 4740 NYQ.exe 200 PID 4600 wrote to memory of 3308 4600 cmd.exe 204 PID 3308 wrote to memory of 2396 3308 RHWBZ.exe 205 PID 2396 wrote to memory of 1604 2396 cmd.exe 209 PID 1604 wrote to memory of 2668 1604 MCBLJNZ.exe 210 PID 2668 wrote to memory of 1000 2668 cmd.exe 214 PID 1000 wrote to memory of 4548 1000 MHB.exe 215 PID 4548 wrote to memory of 5044 4548 cmd.exe 219 PID 5044 wrote to memory of 2796 5044 ZSKQZD.exe 220 PID 2796 wrote to memory of 3088 2796 cmd.exe 224 PID 3088 wrote to memory of 5612 3088 ANNU.exe 225 PID 5612 wrote to memory of 4488 5612 cmd.exe 229 PID 4488 wrote to memory of 3324 4488 ABOIO.exe 230 PID 3324 wrote to memory of 5340 3324 cmd.exe 234 PID 5340 wrote to memory of 4328 5340 PWX.exe 235 PID 4328 wrote to memory of 5384 4328 cmd.exe 239 PID 5384 wrote to memory of 2488 5384 MBD.exe 240 PID 2488 wrote to memory of 4272 2488 cmd.exe 244 PID 4272 wrote to memory of 5456 4272 XUGC.exe 245 PID 5456 wrote to memory of 6000 5456 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5e160ae799c6866102b5b9e6c627949c_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOEDJCH.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\SysWOW64\ZOEDJCH.exeC:\windows\system32\ZOEDJCH.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GCXZPND.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\GCXZPND.exeC:\windows\GCXZPND.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCFM.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\windows\system\MCFM.exeC:\windows\system\MCFM.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPJWJP.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\SysWOW64\HPJWJP.exeC:\windows\system32\HPJWJP.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BDO.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912 -
C:\windows\system\BDO.exeC:\windows\system\BDO.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGSJY.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\windows\system\UGSJY.exeC:\windows\system\UGSJY.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBWF.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\SysWOW64\VBWF.exeC:\windows\system32\VBWF.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KENRXQ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\windows\system\KENRXQ.exeC:\windows\system\KENRXQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOQHF.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\windows\system\IOQHF.exeC:\windows\system\IOQHF.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXX.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\MXX.exeC:\windows\MXX.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSWI.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\SSWI.exeC:\windows\SSWI.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVA.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\windows\system\LVA.exeC:\windows\system\LVA.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLTGPM.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\SysWOW64\KLTGPM.exeC:\windows\system32\KLTGPM.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWRB.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\windows\SysWOW64\OWRB.exeC:\windows\system32\OWRB.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYZADQI.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\system\BYZADQI.exeC:\windows\system\BYZADQI.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPASK.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\windows\system\QPASK.exeC:\windows\system\QPASK.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\windows\UFH.exeC:\windows\UFH.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JAREHJ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\system\JAREHJ.exeC:\windows\system\JAREHJ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVQFMM.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\SysWOW64\QVQFMM.exeC:\windows\system32\QVQFMM.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDWN.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\system\TDWN.exeC:\windows\system\TDWN.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOH.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\windows\SOH.exeC:\windows\SOH.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\windows\SysWOW64\NYQ.exeC:\windows\system32\NYQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHWBZ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\windows\system\RHWBZ.exeC:\windows\system\RHWBZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCBLJNZ.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\windows\system\MCBLJNZ.exeC:\windows\system\MCBLJNZ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MHB.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\windows\system\MHB.exeC:\windows\system\MHB.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ANNU.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\windows\ANNU.exeC:\windows\ANNU.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABOIO.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\SysWOW64\ABOIO.exeC:\windows\system32\ABOIO.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWX.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\PWX.exeC:\windows\PWX.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\MBD.exeC:\windows\MBD.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHLMYJ.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\windows\system\RHLMYJ.exeC:\windows\system\RHLMYJ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXMD.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5596 -
C:\windows\SysWOW64\HXMD.exeC:\windows\system32\HXMD.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BLRVHF.exe.bat" "68⤵PID:5408
-
C:\windows\BLRVHF.exeC:\windows\BLRVHF.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYBNXBA.exe.bat" "70⤵PID:3036
-
C:\windows\TYBNXBA.exeC:\windows\TYBNXBA.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NLY.exe.bat" "72⤵PID:1796
-
C:\windows\SysWOW64\NLY.exeC:\windows\system32\NLY.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WMABLZR.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2912 -
C:\windows\SysWOW64\WMABLZR.exeC:\windows\system32\WMABLZR.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QMPMU.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2516 -
C:\windows\SysWOW64\QMPMU.exeC:\windows\system32\QMPMU.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSP.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4132 -
C:\windows\QSP.exeC:\windows\QSP.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KFUK.exe.bat" "80⤵
- Executes a command shell one-liner
PID:6124 -
C:\windows\KFUK.exeC:\windows\KFUK.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFUYX.exe.bat" "82⤵PID:5820
-
C:\windows\system\QFUYX.exeC:\windows\system\QFUYX.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOW.exe.bat" "84⤵
- Executes a command shell one-liner
PID:1432 -
C:\windows\system\AOW.exeC:\windows\system\AOW.exe85⤵
- Executes dropped EXE
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDDOEYJ.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5024 -
C:\windows\system\YDDOEYJ.exeC:\windows\system\YDDOEYJ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOL.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5896 -
C:\windows\SysWOW64\YOL.exeC:\windows\system32\YOL.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "90⤵
- Executes a command shell one-liner
PID:1960 -
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEU.exe.bat" "92⤵PID:2656
-
C:\windows\system\TEU.exeC:\windows\system\TEU.exe93⤵
- Executes dropped EXE
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNWZT.exe.bat" "94⤵PID:5748
-
C:\windows\CNWZT.exeC:\windows\CNWZT.exe95⤵
- Executes dropped EXE
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQADZNZ.exe.bat" "96⤵PID:5448
-
C:\windows\system\DQADZNZ.exeC:\windows\system\DQADZNZ.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLJH.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5800 -
C:\windows\SLJH.exeC:\windows\SLJH.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDMASP.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4180 -
C:\windows\EDMASP.exeC:\windows\EDMASP.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDGFWMR.exe.bat" "102⤵PID:5164
-
C:\windows\NDGFWMR.exeC:\windows\NDGFWMR.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYYJH.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:464 -
C:\windows\system\CYYJH.exeC:\windows\system\CYYJH.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THSOSE.exe.bat" "106⤵PID:6024
-
C:\windows\SysWOW64\THSOSE.exeC:\windows\system32\THSOSE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZVHSMJ.exe.bat" "108⤵
- Executes a command shell one-liner
PID:6096 -
C:\windows\system\FZVHSMJ.exeC:\windows\system\FZVHSMJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DACVJ.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1060 -
C:\windows\DACVJ.exeC:\windows\DACVJ.exe111⤵
- Executes dropped EXE
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAEINL.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2772 -
C:\windows\UAEINL.exeC:\windows\UAEINL.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PVJ.exe.bat" "114⤵PID:748
-
C:\windows\PVJ.exeC:\windows\PVJ.exe115⤵
- Executes dropped EXE
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDQSBEY.exe.bat" "116⤵PID:2484
-
C:\windows\SysWOW64\SDQSBEY.exeC:\windows\system32\SDQSBEY.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRUB.exe.bat" "118⤵PID:1528
-
C:\windows\SysWOW64\NRUB.exeC:\windows\system32\NRUB.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZWGP.exe.bat" "120⤵PID:788
-
C:\windows\EZWGP.exeC:\windows\EZWGP.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-