Analysis
- max time kernel
77s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 17:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe
- Size 282KB
- Sample260804-whhsaawfpb
- SHA256 02327ec0991e261081e1869a40fa06fef9b0a8c19955854e638f179ac1ae18c1
- MD5 da587603dd69a85458600dcf617069b5
- SHA1 dbbbb2bb118f87f34587ee69e6b84e3f0039139f
- SHA512 e183d80c40bd99f9e8cd674bddbf2059084105d45743ec750130f3099bc50223f7f6d4b7f8c4e3b9778de725ef54ec260785bbb80b40eee3669e3b9a09cc3407
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LO0kEjiPISUOgW9X+hOGzC/:RLWI09QZb6LO0kmZzcukG2/
- TLSH T1FF549F1776C28273D5A3037209DAC6E9B73ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5256 PVKF.exe 3476 LWAOLM.exe 248 QXKZP.exe 3988 HXZWB.exe 6076 YFFBOQN.exe 2680 XQQJ.exe 2828 DLTKCT.exe 1884 GGLMWEY.exe 4652 OMXSYL.exe 1600 ZZWYD.exe 1740 ACN.exe 2332 IIZBDUO.exe 5828 HQOYPDR.exe 3984 HWSFAKM.exe 4092 PJFMKI.exe 3336 FZGLR.exe 4836 HMXNDP.exe 3908 QACTN.exe 1676 WVNUT.exe 2224 EBAB.exe 6096 MOFH.exe 1876 KZP.exe 5968 ESX.exe 5852 PFEGLQH.exe 2468 ZDJBBY.exe 2204 QLYGNP.exe 3452 ABDSVX.exe 1208 OHLE.exe 4372 MXX.exe 4736 ZIHUB.exe 1396 PSKKBHC.exe 5184 ODVAKN.exe 5312 TJFQAI.exe 2876 IZO.exe 464 KWUBOMR.exe 5520 UUZWEUA.exe 5700 WSNI.exe 4776 PGMOQ.exe 680 DQU.exe 5624 BBFVNVW.exe 8 EOWEZHE.exe 1332 DZZMHV.exe 3348 JULNNJ.exe 4292 YKMN.exe 3084 LVUDIHS.exe 2896 TBHKSOO.exe 4852 HWSL.exe 4596 LMZLLV.exe 2080 DUOQXM.exe 4080 HXMD.exe 3772 PDQS.exe 1524 EYAWBQB.exe 3592 SEIID.exe 4532 FOQ.exe 3140 WPF.exe 2944 TFSVLK.exe 5936 HKSH.exe 4848 AOW.exe 5944 CBNM.exe 4160 MZBZBG.exe 4528 AWBKD.exe 2540 YPDA.exe 2740 ANR.exe 1216 JQHR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IVYUR.exe FFRUFW.exe File opened for modification C:\windows\SysWOW64\UUZWEUA.exe KWUBOMR.exe File created C:\windows\SysWOW64\ZZWYD.exe OMXSYL.exe File opened for modification C:\windows\SysWOW64\MOFH.exe EBAB.exe File created C:\windows\SysWOW64\MOFH.exe.bat EBAB.exe File created C:\windows\SysWOW64\PDQS.exe HXMD.exe File created C:\windows\SysWOW64\MEBVA.exe.bat YJX.exe File opened for modification C:\windows\SysWOW64\IVYUR.exe FFRUFW.exe File opened for modification C:\windows\SysWOW64\YBHJEWX.exe EISYMW.exe File opened for modification C:\windows\SysWOW64\HQOYPDR.exe IIZBDUO.exe File created C:\windows\SysWOW64\WVNUT.exe.bat QACTN.exe File opened for modification C:\windows\SysWOW64\YKMN.exe JULNNJ.exe File opened for modification C:\windows\SysWOW64\PDQS.exe HXMD.exe File created C:\windows\SysWOW64\HKSH.exe TFSVLK.exe File created C:\windows\SysWOW64\STKMGRJ.exe IVWSZJB.exe File created C:\windows\SysWOW64\HQOYPDR.exe.bat IIZBDUO.exe File created C:\windows\SysWOW64\MOFH.exe EBAB.exe File opened for modification C:\windows\SysWOW64\AWBKD.exe MZBZBG.exe File created C:\windows\SysWOW64\IURKRKX.exe DUKWI.exe File created C:\windows\SysWOW64\HWSFAKM.exe HQOYPDR.exe File created C:\windows\SysWOW64\ZDJBBY.exe PFEGLQH.exe File created C:\windows\SysWOW64\WPF.exe FOQ.exe File created C:\windows\SysWOW64\AWBKD.exe.bat MZBZBG.exe File created C:\windows\SysWOW64\YBHJEWX.exe EISYMW.exe File created C:\windows\SysWOW64\YKMN.exe JULNNJ.exe File created C:\windows\SysWOW64\YBHJEWX.exe.bat EISYMW.exe File created C:\windows\SysWOW64\PVKF.exe.bat 2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\DLTKCT.exe XQQJ.exe File created C:\windows\SysWOW64\HQOYPDR.exe IIZBDUO.exe File opened for modification C:\windows\SysWOW64\WPF.exe FOQ.exe File opened for modification C:\windows\SysWOW64\ZZWYD.exe OMXSYL.exe File opened for modification C:\windows\SysWOW64\FOQ.exe SEIID.exe File opened for modification C:\windows\SysWOW64\MEBVA.exe YJX.exe File created C:\windows\SysWOW64\KWOQ.exe STKMGRJ.exe File created C:\windows\SysWOW64\SWG.exe.bat GGNSZTN.exe File created C:\windows\SysWOW64\FOQ.exe.bat SEIID.exe File created C:\windows\SysWOW64\YPDA.exe.bat AWBKD.exe File created C:\windows\SysWOW64\DLTKCT.exe XQQJ.exe File opened for modification C:\windows\SysWOW64\HWSFAKM.exe HQOYPDR.exe File opened for modification C:\windows\SysWOW64\WVNUT.exe QACTN.exe File created C:\windows\SysWOW64\ZDJBBY.exe.bat PFEGLQH.exe File created C:\windows\SysWOW64\UUZWEUA.exe KWUBOMR.exe File created C:\windows\SysWOW64\IVYUR.exe.bat FFRUFW.exe File created C:\windows\SysWOW64\ZZWYD.exe.bat OMXSYL.exe File created C:\windows\SysWOW64\UUZWEUA.exe.bat KWUBOMR.exe File opened for modification C:\windows\SysWOW64\HXMD.exe DUOQXM.exe File created C:\windows\SysWOW64\PDQS.exe.bat HXMD.exe File created C:\windows\SysWOW64\WPF.exe.bat FOQ.exe File created C:\windows\SysWOW64\AWBKD.exe MZBZBG.exe File created C:\windows\SysWOW64\KWOQ.exe.bat STKMGRJ.exe File created C:\windows\SysWOW64\HKSH.exe.bat TFSVLK.exe File created C:\windows\SysWOW64\SWG.exe GGNSZTN.exe File opened for modification C:\windows\SysWOW64\PVKF.exe 2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe File created C:\windows\SysWOW64\DLTKCT.exe.bat XQQJ.exe File created C:\windows\SysWOW64\DUOQXM.exe LMZLLV.exe File opened for modification C:\windows\SysWOW64\DUOQXM.exe LMZLLV.exe File created C:\windows\SysWOW64\DUOQXM.exe.bat LMZLLV.exe File created C:\windows\SysWOW64\HXMD.exe DUOQXM.exe File created C:\windows\SysWOW64\FOQ.exe SEIID.exe File opened for modification C:\windows\SysWOW64\YPDA.exe AWBKD.exe File created C:\windows\SysWOW64\PVKF.exe 2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe File created C:\windows\SysWOW64\HWSFAKM.exe.bat HQOYPDR.exe File opened for modification C:\windows\SysWOW64\ZDJBBY.exe PFEGLQH.exe File opened for modification C:\windows\SysWOW64\HKSH.exe TFSVLK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\ACN.exe.bat ZZWYD.exe File opened for modification C:\windows\system\PJFMKI.exe HWSFAKM.exe File opened for modification C:\windows\PFEGLQH.exe ESX.exe File created C:\windows\DZZMHV.exe EOWEZHE.exe File opened for modification C:\windows\system\QRZJZ.exe KWOQ.exe File opened for modification C:\windows\DUKWI.exe QRZJZ.exe File opened for modification C:\windows\HXZWB.exe QXKZP.exe File created C:\windows\system\EBAB.exe.bat WVNUT.exe File created C:\windows\system\TFSVLK.exe WPF.exe File opened for modification C:\windows\system\IVWSZJB.exe JKT.exe File created C:\windows\FFRUFW.exe ACT.exe File created C:\windows\FFRUFW.exe.bat ACT.exe File opened for modification C:\windows\system\IIZBDUO.exe ACN.exe File created C:\windows\system\PJFMKI.exe HWSFAKM.exe File opened for modification C:\windows\QXKZP.exe LWAOLM.exe File created C:\windows\system\ZIHUB.exe MXX.exe File created C:\windows\system\IVWSZJB.exe JKT.exe File created C:\windows\VTG.exe.bat LVBA.exe File created C:\windows\LWAOLM.exe.bat PVKF.exe File created C:\windows\OMXSYL.exe.bat GGLMWEY.exe File created C:\windows\QACTN.exe.bat HMXNDP.exe File created C:\windows\ODVAKN.exe.bat PSKKBHC.exe File created C:\windows\system\PGMOQ.exe WSNI.exe File opened for modification C:\windows\system\DQU.exe PGMOQ.exe File created C:\windows\system\EISYMW.exe TVT.exe File created C:\windows\system\QRZJZ.exe.bat KWOQ.exe File created C:\windows\MXX.exe.bat OHLE.exe File created C:\windows\LVUDIHS.exe YKMN.exe File created C:\windows\system\ANR.exe YPDA.exe File created C:\windows\GOUYOV.exe.bat YBHJEWX.exe File created C:\windows\DUKWI.exe.bat QRZJZ.exe File created C:\windows\system\YKSJYG.exe IURKRKX.exe File created C:\windows\system\YKSJYG.exe.bat IURKRKX.exe File opened for modification C:\windows\VTG.exe LVBA.exe File created C:\windows\YFFBOQN.exe.bat HXZWB.exe File created C:\windows\XQQJ.exe YFFBOQN.exe File created C:\windows\system\ESX.exe.bat KZP.exe File created C:\windows\ODVAKN.exe PSKKBHC.exe File created C:\windows\system\DQU.exe.bat PGMOQ.exe File opened for modification C:\windows\system\EYAWBQB.exe PDQS.exe File created C:\windows\system\CBNM.exe AOW.exe File opened for modification C:\windows\system\ANR.exe YPDA.exe File opened for modification C:\windows\XQQJ.exe YFFBOQN.exe File created C:\windows\system\IIZBDUO.exe ACN.exe File created C:\windows\system\PJFMKI.exe.bat HWSFAKM.exe File created C:\windows\system\PSKKBHC.exe ZIHUB.exe File created C:\windows\IZO.exe TJFQAI.exe File created C:\windows\system\DQU.exe PGMOQ.exe File created C:\windows\system\EYAWBQB.exe.bat PDQS.exe File created C:\windows\system\MZBZBG.exe.bat CBNM.exe File created C:\windows\ACN.exe ZZWYD.exe File created C:\windows\FZGLR.exe PJFMKI.exe File created C:\windows\HMXNDP.exe FZGLR.exe File created C:\windows\ABDSVX.exe QLYGNP.exe File opened for modification C:\windows\system\EISYMW.exe TVT.exe File created C:\windows\JKT.exe MEBVA.exe File created C:\windows\system\IVWSZJB.exe.bat JKT.exe File created C:\windows\system\KWUBOMR.exe.bat IZO.exe File created C:\windows\EOWEZHE.exe.bat BBFVNVW.exe File created C:\windows\JULNNJ.exe DZZMHV.exe File created C:\windows\system\HWSL.exe.bat TBHKSOO.exe File opened for modification C:\windows\system\WOHCKBC.exe JQHR.exe File created C:\windows\KTUX.exe MJRHD.exe File opened for modification C:\windows\KTUX.exe MJRHD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2588 cmd.exe 3248 cmd.exe 4208 cmd.exe 2580 cmd.exe 2648 cmd.exe 4576 cmd.exe 1220 cmd.exe 1900 cmd.exe 3416 cmd.exe 4296 cmd.exe 1028 cmd.exe 3208 cmd.exe 3792 cmd.exe 244 cmd.exe 4960 cmd.exe 2868 cmd.exe 3340 cmd.exe 5376 cmd.exe 2548 cmd.exe 1008 cmd.exe 3404 cmd.exe 2440 cmd.exe 3200 cmd.exe 1776 cmd.exe 5792 cmd.exe 3712 cmd.exe 564 cmd.exe 5876 cmd.exe 624 cmd.exe 3800 cmd.exe 2324 cmd.exe 2932 cmd.exe 2108 cmd.exe 5500 cmd.exe 4812 cmd.exe 1532 cmd.exe 5372 cmd.exe 1156 cmd.exe 5880 cmd.exe 4580 cmd.exe 4232 cmd.exe 2816 cmd.exe 1452 cmd.exe 4244 cmd.exe 5980 cmd.exe 4408 cmd.exe 1288 cmd.exe 2388 cmd.exe 1692 cmd.exe 3600 cmd.exe 1252 cmd.exe 1904 cmd.exe 3056 cmd.exe 4684 cmd.exe 632 cmd.exe 5736 cmd.exe 3060 cmd.exe 2708 cmd.exe 5320 cmd.exe 6124 cmd.exe 4184 cmd.exe 3292 cmd.exe 5348 cmd.exe 968 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4260 2976 WerFault.exe 87 3448 5256 WerFault.exe 93 408 3476 WerFault.exe 99 4964 248 WerFault.exe 104 3960 3988 WerFault.exe 109 1648 6076 WerFault.exe 114 5324 2680 WerFault.exe 119 856 2828 WerFault.exe 124 5952 1884 WerFault.exe 129 4216 4652 WerFault.exe 134 4204 1600 WerFault.exe 139 5748 1740 WerFault.exe 144 240 2332 WerFault.exe 149 5816 5828 WerFault.exe 154 5880 3984 WerFault.exe 159 4192 4092 WerFault.exe 164 5308 3336 WerFault.exe 169 5516 4836 WerFault.exe 174 2508 3908 WerFault.exe 179 4608 1676 WerFault.exe 184 5204 2224 WerFault.exe 189 4500 6096 WerFault.exe 194 2540 1876 WerFault.exe 199 3076 5968 WerFault.exe 204 5520 5852 WerFault.exe 209 5880 2468 WerFault.exe 214 5568 2204 WerFault.exe 219 4848 3452 WerFault.exe 224 5624 1208 WerFault.exe 229 1720 4372 WerFault.exe 234 6000 4736 WerFault.exe 239 5412 1396 WerFault.exe 244 5780 5184 WerFault.exe 249 240 5312 WerFault.exe 254 2548 2876 WerFault.exe 260 3440 464 WerFault.exe 265 1204 5520 WerFault.exe 270 3956 5700 WerFault.exe 275 4848 4776 WerFault.exe 280 4660 680 WerFault.exe 285 4384 5624 WerFault.exe 290 2256 8 WerFault.exe 295 3412 1332 WerFault.exe 300 2532 3348 WerFault.exe 305 1448 4292 WerFault.exe 310 5012 3084 WerFault.exe 315 3580 2896 WerFault.exe 320 4684 4852 WerFault.exe 325 3864 4596 WerFault.exe 330 3040 2080 WerFault.exe 335 3888 4080 WerFault.exe 340 4680 3772 WerFault.exe 345 604 1524 WerFault.exe 350 5596 3592 WerFault.exe 355 5908 4532 WerFault.exe 360 3712 3140 WerFault.exe 365 1784 2944 WerFault.exe 370 1512 5936 WerFault.exe 375 4512 4848 WerFault.exe 380 4632 5944 WerFault.exe 385 2716 4160 WerFault.exe 390 2416 4528 WerFault.exe 395 1964 2540 WerFault.exe 400 4116 2740 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGLMWEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWSFAKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSNI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVWSZJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBHKSOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMXNDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MOFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEBVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUKWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWBKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBHJEWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IURKRKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMZLLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOUYOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDJBBY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZZMHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QACTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JULNNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIZBDUO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRZJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFRUFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDQS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe 2976 2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe 5256 PVKF.exe 5256 PVKF.exe 3476 LWAOLM.exe 3476 LWAOLM.exe 248 QXKZP.exe 248 QXKZP.exe 3988 HXZWB.exe 3988 HXZWB.exe 6076 YFFBOQN.exe 6076 YFFBOQN.exe 2680 XQQJ.exe 2680 XQQJ.exe 2828 DLTKCT.exe 2828 DLTKCT.exe 1884 GGLMWEY.exe 1884 GGLMWEY.exe 4652 OMXSYL.exe 4652 OMXSYL.exe 1600 ZZWYD.exe 1600 ZZWYD.exe 1740 ACN.exe 1740 ACN.exe 2332 IIZBDUO.exe 2332 IIZBDUO.exe 5828 HQOYPDR.exe 5828 HQOYPDR.exe 3984 HWSFAKM.exe 3984 HWSFAKM.exe 4092 PJFMKI.exe 4092 PJFMKI.exe 3336 FZGLR.exe 3336 FZGLR.exe 4836 HMXNDP.exe 4836 HMXNDP.exe 3908 QACTN.exe 3908 QACTN.exe 1676 WVNUT.exe 1676 WVNUT.exe 2224 EBAB.exe 2224 EBAB.exe 6096 MOFH.exe 6096 MOFH.exe 1876 KZP.exe 1876 KZP.exe 5968 ESX.exe 5968 ESX.exe 5852 PFEGLQH.exe 5852 PFEGLQH.exe 2468 ZDJBBY.exe 2468 ZDJBBY.exe 2204 QLYGNP.exe 2204 QLYGNP.exe 3452 ABDSVX.exe 3452 ABDSVX.exe 1208 OHLE.exe 1208 OHLE.exe 4372 MXX.exe 4372 MXX.exe 4736 ZIHUB.exe 4736 ZIHUB.exe 1396 PSKKBHC.exe 1396 PSKKBHC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2976 2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe 2976 2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe 5256 PVKF.exe 5256 PVKF.exe 3476 LWAOLM.exe 3476 LWAOLM.exe 248 QXKZP.exe 248 QXKZP.exe 3988 HXZWB.exe 3988 HXZWB.exe 6076 YFFBOQN.exe 6076 YFFBOQN.exe 2680 XQQJ.exe 2680 XQQJ.exe 2828 DLTKCT.exe 2828 DLTKCT.exe 1884 GGLMWEY.exe 1884 GGLMWEY.exe 4652 OMXSYL.exe 4652 OMXSYL.exe 1600 ZZWYD.exe 1600 ZZWYD.exe 1740 ACN.exe 1740 ACN.exe 2332 IIZBDUO.exe 2332 IIZBDUO.exe 5828 HQOYPDR.exe 5828 HQOYPDR.exe 3984 HWSFAKM.exe 3984 HWSFAKM.exe 4092 PJFMKI.exe 4092 PJFMKI.exe 3336 FZGLR.exe 3336 FZGLR.exe 4836 HMXNDP.exe 4836 HMXNDP.exe 3908 QACTN.exe 3908 QACTN.exe 1676 WVNUT.exe 1676 WVNUT.exe 2224 EBAB.exe 2224 EBAB.exe 6096 MOFH.exe 6096 MOFH.exe 1876 KZP.exe 1876 KZP.exe 5968 ESX.exe 5968 ESX.exe 5852 PFEGLQH.exe 5852 PFEGLQH.exe 2468 ZDJBBY.exe 2468 ZDJBBY.exe 2204 QLYGNP.exe 2204 QLYGNP.exe 3452 ABDSVX.exe 3452 ABDSVX.exe 1208 OHLE.exe 1208 OHLE.exe 4372 MXX.exe 4372 MXX.exe 4736 ZIHUB.exe 4736 ZIHUB.exe 1396 PSKKBHC.exe 1396 PSKKBHC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2976 wrote to memory of 4348 2976 2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe 89 PID 4348 wrote to memory of 5256 4348 cmd.exe 93 PID 5256 wrote to memory of 4520 5256 PVKF.exe 95 PID 4520 wrote to memory of 3476 4520 cmd.exe 99 PID 3476 wrote to memory of 1756 3476 LWAOLM.exe 100 PID 1756 wrote to memory of 248 1756 cmd.exe 104 PID 248 wrote to memory of 2924 248 QXKZP.exe 105 PID 2924 wrote to memory of 3988 2924 cmd.exe 109 PID 3988 wrote to memory of 3600 3988 HXZWB.exe 110 PID 3600 wrote to memory of 6076 3600 cmd.exe 114 PID 6076 wrote to memory of 1736 6076 YFFBOQN.exe 115 PID 1736 wrote to memory of 2680 1736 cmd.exe 119 PID 2680 wrote to memory of 3860 2680 XQQJ.exe 120 PID 3860 wrote to memory of 2828 3860 cmd.exe 124 PID 2828 wrote to memory of 2816 2828 DLTKCT.exe 125 PID 2816 wrote to memory of 1884 2816 cmd.exe 129 PID 1884 wrote to memory of 5276 1884 GGLMWEY.exe 130 PID 5276 wrote to memory of 4652 5276 cmd.exe 134 PID 4652 wrote to memory of 3924 4652 OMXSYL.exe 135 PID 3924 wrote to memory of 1600 3924 cmd.exe 139 PID 1600 wrote to memory of 4380 1600 ZZWYD.exe 140 PID 4380 wrote to memory of 1740 4380 cmd.exe 144 PID 1740 wrote to memory of 3392 1740 ACN.exe 145 PID 3392 wrote to memory of 2332 3392 cmd.exe 149 PID 2332 wrote to memory of 3296 2332 IIZBDUO.exe 150 PID 3296 wrote to memory of 5828 3296 cmd.exe 154 PID 5828 wrote to memory of 4552 5828 HQOYPDR.exe 155 PID 4552 wrote to memory of 3984 4552 cmd.exe 159 PID 3984 wrote to memory of 264 3984 HWSFAKM.exe 160 PID 264 wrote to memory of 4092 264 cmd.exe 164 PID 4092 wrote to memory of 3340 4092 PJFMKI.exe 165 PID 3340 wrote to memory of 3336 3340 cmd.exe 169 PID 3336 wrote to memory of 1252 3336 FZGLR.exe 170 PID 1252 wrote to memory of 4836 1252 cmd.exe 174 PID 4836 wrote to memory of 5500 4836 HMXNDP.exe 175 PID 5500 wrote to memory of 3908 5500 cmd.exe 179 PID 3908 wrote to memory of 1244 3908 QACTN.exe 180 PID 1244 wrote to memory of 1676 1244 cmd.exe 184 PID 1676 wrote to memory of 5640 1676 WVNUT.exe 185 PID 5640 wrote to memory of 2224 5640 cmd.exe 189 PID 2224 wrote to memory of 6068 2224 EBAB.exe 190 PID 6068 wrote to memory of 6096 6068 cmd.exe 194 PID 6096 wrote to memory of 5752 6096 MOFH.exe 195 PID 5752 wrote to memory of 1876 5752 cmd.exe 199 PID 1876 wrote to memory of 4312 1876 KZP.exe 200 PID 4312 wrote to memory of 5968 4312 cmd.exe 204 PID 5968 wrote to memory of 244 5968 ESX.exe 205 PID 244 wrote to memory of 5852 244 cmd.exe 209 PID 5852 wrote to memory of 5816 5852 PFEGLQH.exe 210 PID 5816 wrote to memory of 2468 5816 cmd.exe 214 PID 2468 wrote to memory of 3108 2468 ZDJBBY.exe 215 PID 3108 wrote to memory of 2204 3108 cmd.exe 219 PID 2204 wrote to memory of 4960 2204 QLYGNP.exe 220 PID 4960 wrote to memory of 3452 4960 cmd.exe 224 PID 3452 wrote to memory of 5244 3452 ABDSVX.exe 225 PID 5244 wrote to memory of 1208 5244 cmd.exe 229 PID 1208 wrote to memory of 5324 1208 OHLE.exe 230 PID 5324 wrote to memory of 4372 5324 cmd.exe 234 PID 4372 wrote to memory of 4328 4372 MXX.exe 235 PID 4328 wrote to memory of 4736 4328 cmd.exe 239 PID 4736 wrote to memory of 3248 4736 ZIHUB.exe 240 PID 3248 wrote to memory of 1396 3248 cmd.exe 244 PID 1396 wrote to memory of 2868 1396 PSKKBHC.exe 245 PID 2868 wrote to memory of 5184 2868 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_da587603dd69a85458600dcf617069b5_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVKF.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\SysWOW64\PVKF.exeC:\windows\system32\PVKF.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LWAOLM.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\LWAOLM.exeC:\windows\LWAOLM.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QXKZP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\windows\QXKZP.exeC:\windows\QXKZP.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HXZWB.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\HXZWB.exeC:\windows\HXZWB.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFFBOQN.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\windows\YFFBOQN.exeC:\windows\YFFBOQN.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XQQJ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\XQQJ.exeC:\windows\XQQJ.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLTKCT.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\windows\SysWOW64\DLTKCT.exeC:\windows\system32\DLTKCT.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GGLMWEY.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\system\GGLMWEY.exeC:\windows\system\GGLMWEY.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMXSYL.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\windows\OMXSYL.exeC:\windows\OMXSYL.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZWYD.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\windows\SysWOW64\ZZWYD.exeC:\windows\system32\ZZWYD.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACN.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\windows\ACN.exeC:\windows\ACN.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIZBDUO.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\system\IIZBDUO.exeC:\windows\system\IIZBDUO.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HQOYPDR.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\windows\SysWOW64\HQOYPDR.exeC:\windows\system32\HQOYPDR.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWSFAKM.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\windows\SysWOW64\HWSFAKM.exeC:\windows\system32\HWSFAKM.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJFMKI.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:264 -
C:\windows\system\PJFMKI.exeC:\windows\system\PJFMKI.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZGLR.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\windows\FZGLR.exeC:\windows\FZGLR.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMXNDP.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\HMXNDP.exeC:\windows\HMXNDP.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QACTN.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\QACTN.exeC:\windows\QACTN.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WVNUT.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\SysWOW64\WVNUT.exeC:\windows\system32\WVNUT.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBAB.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\windows\system\EBAB.exeC:\windows\system\EBAB.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOFH.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\SysWOW64\MOFH.exeC:\windows\system32\MOFH.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZP.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\system\KZP.exeC:\windows\system\KZP.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESX.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\system\ESX.exeC:\windows\system\ESX.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFEGLQH.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\PFEGLQH.exeC:\windows\PFEGLQH.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDJBBY.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\SysWOW64\ZDJBBY.exeC:\windows\system32\ZDJBBY.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QLYGNP.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\windows\system\QLYGNP.exeC:\windows\system\QLYGNP.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ABDSVX.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\windows\ABDSVX.exeC:\windows\ABDSVX.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLE.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\windows\OHLE.exeC:\windows\OHLE.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXX.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\windows\MXX.exeC:\windows\MXX.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIHUB.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\system\ZIHUB.exeC:\windows\system\ZIHUB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSKKBHC.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\windows\system\PSKKBHC.exeC:\windows\system\PSKKBHC.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe65⤵
- Executes dropped EXE
PID:5184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJFQAI.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1900 -
C:\windows\system\TJFQAI.exeC:\windows\system\TJFQAI.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZO.exe.bat" "68⤵PID:1656
-
C:\windows\IZO.exeC:\windows\IZO.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWUBOMR.exe.bat" "70⤵PID:2612
-
C:\windows\system\KWUBOMR.exeC:\windows\system\KWUBOMR.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUZWEUA.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4812 -
C:\windows\SysWOW64\UUZWEUA.exeC:\windows\system32\UUZWEUA.exe73⤵
- Executes dropped EXE
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSNI.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1532 -
C:\windows\system\WSNI.exeC:\windows\system\WSNI.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGMOQ.exe.bat" "76⤵PID:4792
-
C:\windows\system\PGMOQ.exeC:\windows\system\PGMOQ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQU.exe.bat" "78⤵PID:2556
-
C:\windows\system\DQU.exeC:\windows\system\DQU.exe79⤵
- Executes dropped EXE
PID:680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBFVNVW.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3172 -
C:\windows\system\BBFVNVW.exeC:\windows\system\BBFVNVW.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EOWEZHE.exe.bat" "82⤵PID:3236
-
C:\windows\EOWEZHE.exeC:\windows\EOWEZHE.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZZMHV.exe.bat" "84⤵PID:2916
-
C:\windows\DZZMHV.exeC:\windows\DZZMHV.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JULNNJ.exe.bat" "86⤵PID:5652
-
C:\windows\JULNNJ.exeC:\windows\JULNNJ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKMN.exe.bat" "88⤵PID:2372
-
C:\windows\SysWOW64\YKMN.exeC:\windows\system32\YKMN.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVUDIHS.exe.bat" "90⤵
- Executes a command shell one-liner
PID:624 -
C:\windows\LVUDIHS.exeC:\windows\LVUDIHS.exe91⤵
- Executes dropped EXE
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TBHKSOO.exe.bat" "92⤵PID:1140
-
C:\windows\system\TBHKSOO.exeC:\windows\system\TBHKSOO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWSL.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3200 -
C:\windows\system\HWSL.exeC:\windows\system\HWSL.exe95⤵
- Executes dropped EXE
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LMZLLV.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:712 -
C:\windows\LMZLLV.exeC:\windows\LMZLLV.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DUOQXM.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4208 -
C:\windows\SysWOW64\DUOQXM.exeC:\windows\system32\DUOQXM.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXMD.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1464 -
C:\windows\SysWOW64\HXMD.exeC:\windows\system32\HXMD.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDQS.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3800 -
C:\windows\SysWOW64\PDQS.exeC:\windows\system32\PDQS.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EYAWBQB.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2588 -
C:\windows\system\EYAWBQB.exeC:\windows\system\EYAWBQB.exe105⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SEIID.exe.bat" "106⤵PID:5540
-
C:\windows\SEIID.exeC:\windows\SEIID.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOQ.exe.bat" "108⤵PID:2100
-
C:\windows\SysWOW64\FOQ.exeC:\windows\system32\FOQ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPF.exe.bat" "110⤵PID:2208
-
C:\windows\SysWOW64\WPF.exeC:\windows\system32\WPF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFSVLK.exe.bat" "112⤵PID:408
-
C:\windows\system\TFSVLK.exeC:\windows\system\TFSVLK.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4184 -
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOW.exe.bat" "116⤵PID:2560
-
C:\windows\system\AOW.exeC:\windows\system\AOW.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CBNM.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1776 -
C:\windows\system\CBNM.exeC:\windows\system\CBNM.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MZBZBG.exe.bat" "120⤵PID:6128
-
C:\windows\system\MZBZBG.exeC:\windows\system\MZBZBG.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-