Analysis
- max time kernel
80s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 19:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe
- Size 208KB
- Sample260805-xp4trsem5w
- SHA256 048014b2557eba0a25fff892641cb75296ee54b8e06c6352042be66ab96cae39
- MD5 2711e7a7ae137529149ac26a6d779a13
- SHA1 01cc2a1433d20be251578fab37757949e573964c
- SHA512 8866459b5eefed1263525ec738671379e8700cd5a65b4945a2624247aa4fdd3c9d746b96664fed51f6d185e30ae3c814a9e16b5084e9b70b7da452cab3a455a2
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlJdL+LOfk4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlJ5+LOskEj1
- TLSH T143247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5908 PSWM.exe 2500 YQIN.exe 404 BEZWD.exe 4628 JRMD.exe 440 ICO.exe 4536 VNF.exe 1988 KVGJK.exe 3276 YGOAY.exe 3688 QJSEDCE.exe 4808 RMWZ.exe 5952 VUD.exe 4104 TENXE.exe 1600 HKNJF.exe 2916 CNE.exe 2560 VQIDH.exe 584 UBKT.exe 3700 HMTK.exe 2588 PZFZ.exe 1240 CXFKQDT.exe 3372 RSPPB.exe 2808 SVBKHOD.exe 3444 WDHS.exe 2836 RYMCDG.exe 1444 IZO.exe 1776 BCSLMT.exe 636 VPX.exe 2120 QAFLLE.exe 5164 HLIBT.exe 3776 ADXMD.exe 2528 FGW.exe 932 DEHKYJQ.exe 4432 SUIBE.exe 5356 GFY.exe 6012 XFAF.exe 3436 EVB.exe 6072 JBLULE.exe 1412 EOQ.exe 4420 NWSIZB.exe 1084 XUGC.exe 2448 FZLJ.exe 1356 UQMAXDE.exe 3252 AQTO.exe 5480 EYAWBQB.exe 1728 NGC.exe 3652 DBLGPI.exe 4872 DHLURV.exe 2508 YSCT.exe 4260 HAW.exe 4724 UDMWXG.exe 1652 MLOCIMC.exe 560 GYTL.exe 3868 KGA.exe 5688 FCECH.exe 5992 WCGHKB.exe 5084 GKB.exe 4712 JSPVA.exe 1188 TQVH.exe 2672 DYXUTX.exe 828 STGY.exe 6024 OZMVL.exe 2292 EPNNSPW.exe 4852 TKWZD.exe 4756 OXBJNB.exe 2644 GAFEA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\OZMVL.exe.bat STGY.exe File created C:\windows\SysWOW64\LIX.exe.bat FMFCTAZ.exe File opened for modification C:\windows\SysWOW64\YGOAY.exe KVGJK.exe File opened for modification C:\windows\SysWOW64\NWSIZB.exe EOQ.exe File created C:\windows\SysWOW64\OXBJNB.exe TKWZD.exe File opened for modification C:\windows\SysWOW64\IQKWPAW.exe NVGMM.exe File created C:\windows\SysWOW64\TENXE.exe VUD.exe File opened for modification C:\windows\SysWOW64\VPX.exe BCSLMT.exe File created C:\windows\SysWOW64\NWSIZB.exe EOQ.exe File created C:\windows\SysWOW64\FCECH.exe KGA.exe File created C:\windows\SysWOW64\DYXUTX.exe.bat TQVH.exe File created C:\windows\SysWOW64\JJVJNS.exe QGRFHCI.exe File opened for modification C:\windows\SysWOW64\PSWM.exe 2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe File created C:\windows\SysWOW64\VPX.exe.bat BCSLMT.exe File created C:\windows\SysWOW64\XFAF.exe.bat GFY.exe File created C:\windows\SysWOW64\FCECH.exe.bat KGA.exe File opened for modification C:\windows\SysWOW64\OZMVL.exe STGY.exe File opened for modification C:\windows\SysWOW64\OXBJNB.exe TKWZD.exe File created C:\windows\SysWOW64\GAFEA.exe.bat OXBJNB.exe File created C:\windows\SysWOW64\CROR.exe JOKODZJ.exe File opened for modification C:\windows\SysWOW64\BEZWD.exe YQIN.exe File created C:\windows\SysWOW64\BEZWD.exe.bat YQIN.exe File opened for modification C:\windows\SysWOW64\JRMD.exe BEZWD.exe File opened for modification C:\windows\SysWOW64\EPNNSPW.exe OZMVL.exe File created C:\windows\SysWOW64\RRYK.exe CBXLNBD.exe File created C:\windows\SysWOW64\YQVG.exe GITBPK.exe File opened for modification C:\windows\SysWOW64\YQVG.exe GITBPK.exe File created C:\windows\SysWOW64\XWCD.exe OWA.exe File opened for modification C:\windows\SysWOW64\CNE.exe HKNJF.exe File opened for modification C:\windows\SysWOW64\RSPPB.exe CXFKQDT.exe File opened for modification C:\windows\SysWOW64\XFAF.exe GFY.exe File created C:\windows\SysWOW64\EVB.exe.bat XFAF.exe File created C:\windows\SysWOW64\OZMVL.exe STGY.exe File created C:\windows\SysWOW64\OXBJNB.exe.bat TKWZD.exe File created C:\windows\SysWOW64\EXXWEA.exe.bat KCSM.exe File opened for modification C:\windows\SysWOW64\LIX.exe FMFCTAZ.exe File opened for modification C:\windows\SysWOW64\SVBKHOD.exe RSPPB.exe File created C:\windows\SysWOW64\XFAF.exe GFY.exe File opened for modification C:\windows\SysWOW64\NVGMM.exe ASXOYXM.exe File opened for modification C:\windows\SysWOW64\JSPVA.exe GKB.exe File opened for modification C:\windows\SysWOW64\TQVH.exe JSPVA.exe File created C:\windows\SysWOW64\YGOAY.exe.bat KVGJK.exe File opened for modification C:\windows\SysWOW64\TENXE.exe VUD.exe File created C:\windows\SysWOW64\CNE.exe.bat HKNJF.exe File created C:\windows\SysWOW64\RSPPB.exe.bat CXFKQDT.exe File opened for modification C:\windows\SysWOW64\EVB.exe XFAF.exe File created C:\windows\SysWOW64\CROR.exe.bat JOKODZJ.exe File created C:\windows\SysWOW64\PSWM.exe.bat 2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe File created C:\windows\SysWOW64\RSPPB.exe CXFKQDT.exe File opened for modification C:\windows\SysWOW64\WDHS.exe SVBKHOD.exe File opened for modification C:\windows\SysWOW64\DEHKYJQ.exe FGW.exe File opened for modification C:\windows\SysWOW64\EXXWEA.exe KCSM.exe File created C:\windows\SysWOW64\IQKWPAW.exe.bat NVGMM.exe File created C:\windows\SysWOW64\GITBPK.exe.bat ONPG.exe File created C:\windows\SysWOW64\AOBBIQM.exe YQVG.exe File created C:\windows\SysWOW64\JRMD.exe BEZWD.exe File created C:\windows\SysWOW64\YGOAY.exe KVGJK.exe File created C:\windows\SysWOW64\JSPVA.exe.bat GKB.exe File created C:\windows\SysWOW64\JJVJNS.exe.bat QGRFHCI.exe File created C:\windows\SysWOW64\XWCD.exe.bat OWA.exe File created C:\windows\SysWOW64\TENXE.exe.bat VUD.exe File created C:\windows\SysWOW64\DEHKYJQ.exe.bat FGW.exe File created C:\windows\SysWOW64\EPNNSPW.exe.bat OZMVL.exe File created C:\windows\SysWOW64\GAFEA.exe OXBJNB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\YQIN.exe PSWM.exe File created C:\windows\QAFLLE.exe.bat VPX.exe File created C:\windows\system\YSCT.exe DHLURV.exe File created C:\windows\system\YZLRRE.exe.bat AOBBIQM.exe File created C:\windows\YQIN.exe.bat PSWM.exe File created C:\windows\KVGJK.exe.bat VNF.exe File created C:\windows\VUD.exe RMWZ.exe File created C:\windows\HMTK.exe UBKT.exe File opened for modification C:\windows\system\YSCT.exe DHLURV.exe File created C:\windows\KGA.exe GYTL.exe File opened for modification C:\windows\system\WCGHKB.exe FCECH.exe File created C:\windows\KCSM.exe.bat LOB.exe File created C:\windows\HLIBT.exe QAFLLE.exe File opened for modification C:\windows\MLOCIMC.exe UDMWXG.exe File created C:\windows\GKB.exe WCGHKB.exe File created C:\windows\system\CDPF.exe.bat IQKWPAW.exe File opened for modification C:\windows\IZOGDDA.exe CDPF.exe File created C:\windows\YUYKO.exe IZOGDDA.exe File opened for modification C:\windows\YUYKO.exe IZOGDDA.exe File created C:\windows\system\NUV.exe.bat YZLRRE.exe File created C:\windows\IZO.exe RYMCDG.exe File created C:\windows\ADXMD.exe HLIBT.exe File created C:\windows\system\UBKT.exe VQIDH.exe File created C:\windows\PZFZ.exe HMTK.exe File opened for modification C:\windows\PZFZ.exe HMTK.exe File opened for modification C:\windows\system\LOB.exe CROR.exe File created C:\windows\system\VNF.exe ICO.exe File created C:\windows\RYMCDG.exe.bat WDHS.exe File created C:\windows\DHLURV.exe.bat DBLGPI.exe File opened for modification C:\windows\HAW.exe YSCT.exe File opened for modification C:\windows\YLR.exe ZAOVTD.exe File opened for modification C:\windows\system\OZVK.exe NUV.exe File created C:\windows\QVH.exe WDS.exe File created C:\windows\DBLGPI.exe NGC.exe File created C:\windows\system\TKWZD.exe EPNNSPW.exe File created C:\windows\KCSM.exe LOB.exe File opened for modification C:\windows\CBXLNBD.exe YLR.exe File created C:\windows\system\SCHHWK.exe.bat YUYKO.exe File created C:\windows\HMTK.exe.bat UBKT.exe File opened for modification C:\windows\RYMCDG.exe WDHS.exe File opened for modification C:\windows\DBLGPI.exe NGC.exe File opened for modification C:\windows\GYTL.exe MLOCIMC.exe File opened for modification C:\windows\KGA.exe GYTL.exe File opened for modification C:\windows\GKB.exe WCGHKB.exe File created C:\windows\system\SCHHWK.exe YUYKO.exe File opened for modification C:\windows\VUD.exe RMWZ.exe File created C:\windows\RYMCDG.exe WDHS.exe File opened for modification C:\windows\IZO.exe RYMCDG.exe File created C:\windows\system\SUIBE.exe.bat DEHKYJQ.exe File created C:\windows\UQMAXDE.exe FZLJ.exe File created C:\windows\system\EYAWBQB.exe.bat AQTO.exe File created C:\windows\system\WAOU.exe.bat MZMPAOA.exe File opened for modification C:\windows\system\JBLULE.exe EVB.exe File opened for modification C:\windows\DHLURV.exe DBLGPI.exe File created C:\windows\system\STGY.exe.bat DYXUTX.exe File created C:\windows\system\IWTKVC.exe.bat HTPG.exe File opened for modification C:\windows\system\WAOU.exe MZMPAOA.exe File created C:\windows\HLIBT.exe.bat QAFLLE.exe File created C:\windows\FGW.exe ADXMD.exe File created C:\windows\YQIN.exe PSWM.exe File created C:\windows\system\RMWZ.exe.bat QJSEDCE.exe File created C:\windows\system\HKNJF.exe TENXE.exe File created C:\windows\system\GFY.exe SUIBE.exe File created C:\windows\system\AQTO.exe.bat UQMAXDE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4268 cmd.exe 3724 cmd.exe 480 cmd.exe 1512 cmd.exe 952 cmd.exe 248 cmd.exe 1656 cmd.exe 1368 cmd.exe 4220 cmd.exe 5816 cmd.exe 4444 cmd.exe 4592 cmd.exe 2848 cmd.exe 4672 cmd.exe 300 cmd.exe 1576 cmd.exe 2592 cmd.exe 4224 cmd.exe 2388 cmd.exe 5588 cmd.exe 1868 cmd.exe 4448 cmd.exe 2900 cmd.exe 4292 cmd.exe 3096 cmd.exe 5488 cmd.exe 5672 cmd.exe 5960 cmd.exe 2116 cmd.exe 3516 cmd.exe 4652 cmd.exe 5936 cmd.exe 5404 cmd.exe 3132 cmd.exe 1960 cmd.exe 4152 cmd.exe 4608 cmd.exe 3524 cmd.exe 5340 cmd.exe 3448 cmd.exe 5472 cmd.exe 4624 cmd.exe 3536 cmd.exe 5216 cmd.exe 2988 cmd.exe 4692 cmd.exe 4700 cmd.exe 3968 cmd.exe 2124 cmd.exe 5448 cmd.exe 2356 cmd.exe 4160 cmd.exe 5832 cmd.exe 2740 cmd.exe 860 cmd.exe 6000 cmd.exe 1080 cmd.exe 2828 cmd.exe 1712 cmd.exe 1212 cmd.exe 2860 cmd.exe 2664 cmd.exe 5504 cmd.exe 6076 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4100 3304 WerFault.exe 87 1860 5908 WerFault.exe 93 2196 2500 WerFault.exe 99 760 404 WerFault.exe 104 2540 4628 WerFault.exe 109 1132 440 WerFault.exe 114 4660 4536 WerFault.exe 119 1684 1988 WerFault.exe 124 5704 3276 WerFault.exe 129 4296 3688 WerFault.exe 134 1980 4808 WerFault.exe 139 5828 5952 WerFault.exe 144 1312 4104 WerFault.exe 149 4856 1600 WerFault.exe 154 1528 2916 WerFault.exe 159 1732 2560 WerFault.exe 164 4640 584 WerFault.exe 169 2040 3700 WerFault.exe 174 1428 2588 WerFault.exe 179 5636 1240 WerFault.exe 184 4296 3372 WerFault.exe 189 6056 2808 WerFault.exe 194 3208 3444 WerFault.exe 199 5460 2836 WerFault.exe 204 5124 1444 WerFault.exe 209 5684 1776 WerFault.exe 214 2216 636 WerFault.exe 219 4440 2120 WerFault.exe 224 2040 5164 WerFault.exe 229 1428 3776 WerFault.exe 234 5656 2528 WerFault.exe 239 3968 932 WerFault.exe 244 2056 4432 WerFault.exe 249 4980 5356 WerFault.exe 254 1136 6012 WerFault.exe 259 952 3436 WerFault.exe 264 1924 6072 WerFault.exe 269 3856 1412 WerFault.exe 275 4660 4420 WerFault.exe 280 4928 1084 WerFault.exe 285 4648 2448 WerFault.exe 290 3720 1356 WerFault.exe 295 4764 3252 WerFault.exe 300 5392 5480 WerFault.exe 305 1836 1728 WerFault.exe 310 1164 3652 WerFault.exe 315 1732 4872 WerFault.exe 320 5972 2508 WerFault.exe 325 1016 4260 WerFault.exe 330 2864 4724 WerFault.exe 335 5940 1652 WerFault.exe 340 2096 560 WerFault.exe 345 5348 3868 WerFault.exe 350 5336 5688 WerFault.exe 355 3236 5992 WerFault.exe 360 2544 5084 WerFault.exe 365 1372 4712 WerFault.exe 370 5388 1188 WerFault.exe 375 5504 2672 WerFault.exe 380 3004 828 WerFault.exe 385 3388 6024 WerFault.exe 390 4980 2292 WerFault.exe 395 4292 4852 WerFault.exe 400 3604 4756 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUIBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCSLMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCECH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZMPAOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QJSEDCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHLURV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CROR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUYKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPNNSPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMFCTAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFKXFMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWSIZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASXOYXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXFKQDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYXUTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZOGDDA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XWCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXXWEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLIBT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSPPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3304 2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe 3304 2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe 5908 PSWM.exe 5908 PSWM.exe 2500 YQIN.exe 2500 YQIN.exe 404 BEZWD.exe 404 BEZWD.exe 4628 JRMD.exe 4628 JRMD.exe 440 ICO.exe 440 ICO.exe 4536 VNF.exe 4536 VNF.exe 1988 KVGJK.exe 1988 KVGJK.exe 3276 YGOAY.exe 3276 YGOAY.exe 3688 QJSEDCE.exe 3688 QJSEDCE.exe 4808 RMWZ.exe 4808 RMWZ.exe 5952 VUD.exe 5952 VUD.exe 4104 TENXE.exe 4104 TENXE.exe 1600 HKNJF.exe 1600 HKNJF.exe 2916 CNE.exe 2916 CNE.exe 2560 VQIDH.exe 2560 VQIDH.exe 584 UBKT.exe 584 UBKT.exe 3700 HMTK.exe 3700 HMTK.exe 2588 PZFZ.exe 2588 PZFZ.exe 1240 CXFKQDT.exe 1240 CXFKQDT.exe 3372 RSPPB.exe 3372 RSPPB.exe 2808 SVBKHOD.exe 2808 SVBKHOD.exe 3444 WDHS.exe 3444 WDHS.exe 2836 RYMCDG.exe 2836 RYMCDG.exe 1444 IZO.exe 1444 IZO.exe 1776 BCSLMT.exe 1776 BCSLMT.exe 636 VPX.exe 636 VPX.exe 2120 QAFLLE.exe 2120 QAFLLE.exe 5164 HLIBT.exe 5164 HLIBT.exe 3776 ADXMD.exe 3776 ADXMD.exe 2528 FGW.exe 2528 FGW.exe 932 DEHKYJQ.exe 932 DEHKYJQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3304 2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe 3304 2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe 5908 PSWM.exe 5908 PSWM.exe 2500 YQIN.exe 2500 YQIN.exe 404 BEZWD.exe 404 BEZWD.exe 4628 JRMD.exe 4628 JRMD.exe 440 ICO.exe 440 ICO.exe 4536 VNF.exe 4536 VNF.exe 1988 KVGJK.exe 1988 KVGJK.exe 3276 YGOAY.exe 3276 YGOAY.exe 3688 QJSEDCE.exe 3688 QJSEDCE.exe 4808 RMWZ.exe 4808 RMWZ.exe 5952 VUD.exe 5952 VUD.exe 4104 TENXE.exe 4104 TENXE.exe 1600 HKNJF.exe 1600 HKNJF.exe 2916 CNE.exe 2916 CNE.exe 2560 VQIDH.exe 2560 VQIDH.exe 584 UBKT.exe 584 UBKT.exe 3700 HMTK.exe 3700 HMTK.exe 2588 PZFZ.exe 2588 PZFZ.exe 1240 CXFKQDT.exe 1240 CXFKQDT.exe 3372 RSPPB.exe 3372 RSPPB.exe 2808 SVBKHOD.exe 2808 SVBKHOD.exe 3444 WDHS.exe 3444 WDHS.exe 2836 RYMCDG.exe 2836 RYMCDG.exe 1444 IZO.exe 1444 IZO.exe 1776 BCSLMT.exe 1776 BCSLMT.exe 636 VPX.exe 636 VPX.exe 2120 QAFLLE.exe 2120 QAFLLE.exe 5164 HLIBT.exe 5164 HLIBT.exe 3776 ADXMD.exe 3776 ADXMD.exe 2528 FGW.exe 2528 FGW.exe 932 DEHKYJQ.exe 932 DEHKYJQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3304 wrote to memory of 4220 3304 2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe 89 PID 4220 wrote to memory of 5908 4220 cmd.exe 93 PID 5908 wrote to memory of 5832 5908 PSWM.exe 95 PID 5832 wrote to memory of 2500 5832 cmd.exe 99 PID 2500 wrote to memory of 3152 2500 YQIN.exe 100 PID 3152 wrote to memory of 404 3152 cmd.exe 104 PID 404 wrote to memory of 4828 404 BEZWD.exe 105 PID 4828 wrote to memory of 4628 4828 cmd.exe 109 PID 4628 wrote to memory of 1984 4628 JRMD.exe 110 PID 1984 wrote to memory of 440 1984 cmd.exe 114 PID 440 wrote to memory of 4692 440 ICO.exe 115 PID 4692 wrote to memory of 4536 4692 cmd.exe 119 PID 4536 wrote to memory of 804 4536 VNF.exe 120 PID 804 wrote to memory of 1988 804 cmd.exe 124 PID 1988 wrote to memory of 2388 1988 KVGJK.exe 125 PID 2388 wrote to memory of 3276 2388 cmd.exe 129 PID 3276 wrote to memory of 5404 3276 YGOAY.exe 130 PID 5404 wrote to memory of 3688 5404 cmd.exe 134 PID 3688 wrote to memory of 5076 3688 QJSEDCE.exe 135 PID 5076 wrote to memory of 4808 5076 cmd.exe 139 PID 4808 wrote to memory of 5360 4808 RMWZ.exe 140 PID 5360 wrote to memory of 5952 5360 cmd.exe 144 PID 5952 wrote to memory of 4824 5952 VUD.exe 145 PID 4824 wrote to memory of 4104 4824 cmd.exe 149 PID 4104 wrote to memory of 4248 4104 TENXE.exe 150 PID 4248 wrote to memory of 1600 4248 cmd.exe 154 PID 1600 wrote to memory of 3340 1600 HKNJF.exe 155 PID 3340 wrote to memory of 2916 3340 cmd.exe 159 PID 2916 wrote to memory of 2908 2916 CNE.exe 160 PID 2908 wrote to memory of 2560 2908 cmd.exe 164 PID 2560 wrote to memory of 1408 2560 VQIDH.exe 165 PID 1408 wrote to memory of 584 1408 cmd.exe 169 PID 584 wrote to memory of 1132 584 UBKT.exe 170 PID 1132 wrote to memory of 3700 1132 cmd.exe 174 PID 3700 wrote to memory of 3532 3700 HMTK.exe 175 PID 3532 wrote to memory of 2588 3532 cmd.exe 179 PID 2588 wrote to memory of 2820 2588 PZFZ.exe 180 PID 2820 wrote to memory of 1240 2820 cmd.exe 184 PID 1240 wrote to memory of 3132 1240 CXFKQDT.exe 185 PID 3132 wrote to memory of 3372 3132 cmd.exe 189 PID 3372 wrote to memory of 1880 3372 RSPPB.exe 190 PID 1880 wrote to memory of 2808 1880 cmd.exe 194 PID 2808 wrote to memory of 4964 2808 SVBKHOD.exe 195 PID 4964 wrote to memory of 3444 4964 cmd.exe 199 PID 3444 wrote to memory of 4512 3444 WDHS.exe 200 PID 4512 wrote to memory of 2836 4512 cmd.exe 204 PID 2836 wrote to memory of 5676 2836 RYMCDG.exe 205 PID 5676 wrote to memory of 1444 5676 cmd.exe 209 PID 1444 wrote to memory of 5728 1444 IZO.exe 210 PID 5728 wrote to memory of 1776 5728 cmd.exe 214 PID 1776 wrote to memory of 2980 1776 BCSLMT.exe 215 PID 2980 wrote to memory of 636 2980 cmd.exe 219 PID 636 wrote to memory of 1436 636 VPX.exe 220 PID 1436 wrote to memory of 2120 1436 cmd.exe 224 PID 2120 wrote to memory of 3736 2120 QAFLLE.exe 225 PID 3736 wrote to memory of 5164 3736 cmd.exe 229 PID 5164 wrote to memory of 2860 5164 HLIBT.exe 230 PID 2860 wrote to memory of 3776 2860 cmd.exe 234 PID 3776 wrote to memory of 576 3776 ADXMD.exe 235 PID 576 wrote to memory of 2528 576 cmd.exe 239 PID 2528 wrote to memory of 3392 2528 FGW.exe 240 PID 3392 wrote to memory of 932 3392 cmd.exe 244 PID 932 wrote to memory of 5960 932 DEHKYJQ.exe 245 PID 5960 wrote to memory of 4432 5960 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_2711e7a7ae137529149ac26a6d779a13_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSWM.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\windows\SysWOW64\PSWM.exeC:\windows\system32\PSWM.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQIN.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\YQIN.exeC:\windows\YQIN.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEZWD.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\windows\SysWOW64\BEZWD.exeC:\windows\system32\BEZWD.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRMD.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\SysWOW64\JRMD.exeC:\windows\system32\JRMD.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ICO.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\windows\ICO.exeC:\windows\ICO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNF.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\system\VNF.exeC:\windows\system\VNF.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVGJK.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:804 -
C:\windows\KVGJK.exeC:\windows\KVGJK.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGOAY.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\windows\SysWOW64\YGOAY.exeC:\windows\system32\YGOAY.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJSEDCE.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\windows\system\QJSEDCE.exeC:\windows\system\QJSEDCE.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RMWZ.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\windows\system\RMWZ.exeC:\windows\system\RMWZ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUD.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\windows\VUD.exeC:\windows\VUD.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TENXE.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SysWOW64\TENXE.exeC:\windows\system32\TENXE.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKNJF.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\system\HKNJF.exeC:\windows\system\HKNJF.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNE.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\windows\SysWOW64\CNE.exeC:\windows\system32\CNE.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQIDH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\system\VQIDH.exeC:\windows\system\VQIDH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBKT.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\windows\system\UBKT.exeC:\windows\system\UBKT.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMTK.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\HMTK.exeC:\windows\HMTK.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZFZ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\windows\PZFZ.exeC:\windows\PZFZ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CXFKQDT.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\windows\SysWOW64\CXFKQDT.exeC:\windows\system32\CXFKQDT.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSPPB.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\SysWOW64\RSPPB.exeC:\windows\system32\RSPPB.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVBKHOD.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\windows\SysWOW64\SVBKHOD.exeC:\windows\system32\SVBKHOD.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDHS.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\windows\SysWOW64\WDHS.exeC:\windows\system32\WDHS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RYMCDG.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\RYMCDG.exeC:\windows\RYMCDG.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\IZO.exeC:\windows\IZO.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCSLMT.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\BCSLMT.exeC:\windows\BCSLMT.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPX.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\SysWOW64\VPX.exeC:\windows\system32\VPX.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QAFLLE.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\windows\QAFLLE.exeC:\windows\QAFLLE.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLIBT.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\windows\HLIBT.exeC:\windows\HLIBT.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADXMD.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\windows\ADXMD.exeC:\windows\ADXMD.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FGW.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\windows\FGW.exeC:\windows\FGW.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DEHKYJQ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\SysWOW64\DEHKYJQ.exeC:\windows\system32\DEHKYJQ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUIBE.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\system\SUIBE.exeC:\windows\system\SUIBE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFY.exe.bat" "66⤵PID:1292
-
C:\windows\system\GFY.exeC:\windows\system\GFY.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFAF.exe.bat" "68⤵
- Executes a command shell one-liner
PID:3448 -
C:\windows\SysWOW64\XFAF.exeC:\windows\system32\XFAF.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVB.exe.bat" "70⤵PID:1312
-
C:\windows\SysWOW64\EVB.exeC:\windows\system32\EVB.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBLULE.exe.bat" "72⤵PID:4856
-
C:\windows\system\JBLULE.exeC:\windows\system\JBLULE.exe73⤵
- Executes dropped EXE
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EOQ.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5588 -
C:\windows\system\EOQ.exeC:\windows\system\EOQ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWSIZB.exe.bat" "76⤵PID:5072
-
C:\windows\SysWOW64\NWSIZB.exeC:\windows\system32\NWSIZB.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:948 -
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe79⤵
- Executes dropped EXE
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZLJ.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\windows\system\FZLJ.exeC:\windows\system\FZLJ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQMAXDE.exe.bat" "82⤵PID:1828
-
C:\windows\UQMAXDE.exeC:\windows\UQMAXDE.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQTO.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5600 -
C:\windows\system\AQTO.exeC:\windows\system\AQTO.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EYAWBQB.exe.bat" "86⤵
- Executes a command shell one-liner
PID:480 -
C:\windows\system\EYAWBQB.exeC:\windows\system\EYAWBQB.exe87⤵
- Executes dropped EXE
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGC.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1512 -
C:\windows\NGC.exeC:\windows\NGC.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DBLGPI.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5616 -
C:\windows\DBLGPI.exeC:\windows\DBLGPI.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHLURV.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1960 -
C:\windows\DHLURV.exeC:\windows\DHLURV.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSCT.exe.bat" "94⤵PID:1556
-
C:\windows\system\YSCT.exeC:\windows\system\YSCT.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAW.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4700 -
C:\windows\HAW.exeC:\windows\HAW.exe97⤵
- Executes dropped EXE
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UDMWXG.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5816 -
C:\windows\UDMWXG.exeC:\windows\UDMWXG.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLOCIMC.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3560 -
C:\windows\MLOCIMC.exeC:\windows\MLOCIMC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYTL.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2168 -
C:\windows\GYTL.exeC:\windows\GYTL.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGA.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2116 -
C:\windows\KGA.exeC:\windows\KGA.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCECH.exe.bat" "106⤵PID:3360
-
C:\windows\SysWOW64\FCECH.exeC:\windows\system32\FCECH.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCGHKB.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2664 -
C:\windows\system\WCGHKB.exeC:\windows\system\WCGHKB.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GKB.exe.bat" "110⤵PID:5152
-
C:\windows\GKB.exeC:\windows\GKB.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "112⤵PID:1248
-
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQVH.exe.bat" "114⤵PID:4172
-
C:\windows\SysWOW64\TQVH.exeC:\windows\system32\TQVH.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DYXUTX.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2740 -
C:\windows\SysWOW64\DYXUTX.exeC:\windows\system32\DYXUTX.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STGY.exe.bat" "118⤵PID:5376
-
C:\windows\system\STGY.exeC:\windows\system\STGY.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1868 -
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-