Analysis
- max time kernel
88s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 14:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_c14c361e4409e63ad98e206171b9e23f_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-08_c14c361e4409e63ad98e206171b9e23f_elex_emotet_stop.exe
- Size 208KB
- Sample260808-rkaggadh27
- SHA256 c42dad360d3fa4dca186f2a4d993338491dddda8851ecd5c3c09d7a6df03f378
- MD5 c14c361e4409e63ad98e206171b9e23f
- SHA1 2533261fa723831e10a90586ebb12d2478997e57
- SHA512 87b1f32b7a1769b3c117d7eb04e67607b6c04685ffe670b7991d7e936cc5a3291f4ccc691e2dec9d4a81ee8b44e5b976c5a3d952edf072c79a0e586e6e015ff9
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfi4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO6kEj1
- TLSH T1B1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5612 ZSN.exe 4340 CQBKMJF.exe 3876 UTEG.exe 3280 CZR.exe 4676 ORMFL.exe 696 DHV.exe 4732 CFGAEO.exe 1968 TFI.exe 1420 COKS.exe 4656 VRO.exe 3092 FHUIG.exe 3300 SRKHU.exe 260 IHLYBNV.exe 4624 MNVNRJQ.exe 1836 ATDZTU.exe 4620 NVMY.exe 3936 NYQ.exe 2804 PWDOC.exe 1028 ZUJIK.exe 1668 HANP.exe 1568 MLUKUDM.exe 716 ZNCAI.exe 3524 ZQGE.exe 3408 QBJUWK.exe 3884 YPVBHI.exe 2084 EPD.exe 5520 ONJJFTC.exe 3324 QLWVN.exe 2516 HLY.exe 1776 VWHZFK.exe 5804 VRK.exe 6136 TMKDPD.exe 3820 SKVG.exe 3768 YXUHGLX.exe 2436 CNBHT.exe 3460 CQELYT.exe 6092 GYTL.exe 5000 HBX.exe 2924 UEFFEE.exe 1492 TXIVN.exe 3912 MSUZAIL.exe 5820 DAOEE.exe 3380 HIDEQYB.exe 5852 UTLDE.exe 1432 IRLO.exe 5468 QEY.exe 6052 FZHHBF.exe 5876 FCLDH.exe 1020 PDNISB.exe 1764 IDCTCU.exe 3596 RDE.exe 4240 SHICT.exe 5248 YHQQCJJ.exe 3040 YMI.exe 4876 SANO.exe 2480 NNSXYW.exe 5168 MLLAL.exe 5848 SGCBPEE.exe 1012 LZR.exe 2488 PHYUL.exe 5008 YPAZPV.exe 5340 TCF.exe 200 KDHN.exe 3148 HIZDS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\COKS.exe TFI.exe File created C:\windows\SysWOW64\IHLYBNV.exe SRKHU.exe File created C:\windows\SysWOW64\NYQ.exe NVMY.exe File opened for modification C:\windows\SysWOW64\NYQ.exe NVMY.exe File created C:\windows\SysWOW64\VWHZFK.exe.bat HLY.exe File created C:\windows\SysWOW64\SRKHU.exe.bat FHUIG.exe File created C:\windows\SysWOW64\PDNISB.exe FCLDH.exe File opened for modification C:\windows\SysWOW64\IDCTCU.exe PDNISB.exe File opened for modification C:\windows\SysWOW64\TCF.exe YPAZPV.exe File created C:\windows\SysWOW64\TCF.exe.bat YPAZPV.exe File created C:\windows\SysWOW64\UDFCDZR.exe SQATTZ.exe File created C:\windows\SysWOW64\YNROJ.exe.bat ASSF.exe File created C:\windows\SysWOW64\GUNBA.exe DMEM.exe File created C:\windows\SysWOW64\YXUHGLX.exe.bat SKVG.exe File created C:\windows\SysWOW64\TCF.exe YPAZPV.exe File created C:\windows\SysWOW64\KMM.exe JJITNT.exe File created C:\windows\SysWOW64\MSUZAIL.exe TXIVN.exe File opened for modification C:\windows\SysWOW64\YJYPVJW.exe JIIQEO.exe File created C:\windows\SysWOW64\SEDZ.exe.bat YJYPVJW.exe File opened for modification C:\windows\SysWOW64\DMEM.exe GGU.exe File created C:\windows\SysWOW64\DMEM.exe.bat GGU.exe File opened for modification C:\windows\SysWOW64\CQBKMJF.exe ZSN.exe File created C:\windows\SysWOW64\AZXD.exe QBKJ.exe File opened for modification C:\windows\SysWOW64\HANP.exe ZUJIK.exe File created C:\windows\SysWOW64\SKVG.exe TMKDPD.exe File created C:\windows\SysWOW64\HBX.exe.bat GYTL.exe File created C:\windows\SysWOW64\NDQDXY.exe.bat HIZDS.exe File opened for modification C:\windows\SysWOW64\COKS.exe TFI.exe File created C:\windows\SysWOW64\DMEM.exe GGU.exe File created C:\windows\SysWOW64\IHLYBNV.exe.bat SRKHU.exe File created C:\windows\SysWOW64\HANP.exe.bat ZUJIK.exe File created C:\windows\SysWOW64\MRIMUA.exe IJBE.exe File opened for modification C:\windows\SysWOW64\TXIVN.exe UEFFEE.exe File created C:\windows\SysWOW64\TXIVN.exe.bat UEFFEE.exe File opened for modification C:\windows\SysWOW64\QHDN.exe VXUXAH.exe File created C:\windows\SysWOW64\QEY.exe.bat IRLO.exe File created C:\windows\SysWOW64\SEDZ.exe YJYPVJW.exe File opened for modification C:\windows\SysWOW64\SRKHU.exe FHUIG.exe File opened for modification C:\windows\SysWOW64\MLUKUDM.exe HANP.exe File opened for modification C:\windows\SysWOW64\DKQUONO.exe KRJBFUG.exe File opened for modification C:\windows\SysWOW64\GGU.exe JFKN.exe File created C:\windows\SysWOW64\NVMY.exe ATDZTU.exe File created C:\windows\SysWOW64\GGU.exe JFKN.exe File opened for modification C:\windows\SysWOW64\YXUHGLX.exe SKVG.exe File created C:\windows\SysWOW64\YNROJ.exe ASSF.exe File created C:\windows\SysWOW64\DKQUONO.exe KRJBFUG.exe File created C:\windows\SysWOW64\ZKCV.exe KUTWQ.exe File created C:\windows\SysWOW64\YXUHGLX.exe SKVG.exe File opened for modification C:\windows\SysWOW64\MVERKZK.exe VUCMGC.exe File created C:\windows\SysWOW64\ZNCAI.exe.bat MLUKUDM.exe File opened for modification C:\windows\SysWOW64\UTLDE.exe HIDEQYB.exe File created C:\windows\SysWOW64\UDFCDZR.exe.bat SQATTZ.exe File opened for modification C:\windows\SysWOW64\OSKMRI.exe MVERKZK.exe File created C:\windows\SysWOW64\MVERKZK.exe VUCMGC.exe File opened for modification C:\windows\SysWOW64\ZNCAI.exe MLUKUDM.exe File opened for modification C:\windows\SysWOW64\QEY.exe IRLO.exe File created C:\windows\SysWOW64\HFXJC.exe MSS.exe File created C:\windows\SysWOW64\KUTWQ.exe.bat DZKSXYE.exe File opened for modification C:\windows\SysWOW64\ZKCV.exe KUTWQ.exe File created C:\windows\SysWOW64\KMM.exe.bat JJITNT.exe File created C:\windows\SysWOW64\GGU.exe.bat JFKN.exe File created C:\windows\SysWOW64\CQBKMJF.exe ZSN.exe File created C:\windows\SysWOW64\NVMY.exe.bat ATDZTU.exe File opened for modification C:\windows\SysWOW64\SKVG.exe TMKDPD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SANO.exe.bat YMI.exe File created C:\windows\KSML.exe KMM.exe File opened for modification C:\windows\system\XXBE.exe MEYLKFF.exe File opened for modification C:\windows\system\XGGNBWB.exe ILXBQ.exe File created C:\windows\system\QBKJ.exe.bat XGGNBWB.exe File opened for modification C:\windows\system\JIIQEO.exe ZKCV.exe File created C:\windows\system\VRK.exe VWHZFK.exe File created C:\windows\TMKDPD.exe VRK.exe File created C:\windows\GYTL.exe CQELYT.exe File created C:\windows\HIDEQYB.exe.bat DAOEE.exe File opened for modification C:\windows\system\YPAZPV.exe PHYUL.exe File opened for modification C:\windows\system\ILXBQ.exe YNROJ.exe File created C:\windows\system\PSF.exe QHDN.exe File opened for modification C:\windows\system\PSF.exe QHDN.exe File opened for modification C:\windows\system\CZR.exe UTEG.exe File opened for modification C:\windows\system\VRK.exe VWHZFK.exe File created C:\windows\UEFFEE.exe HBX.exe File created C:\windows\FCLDH.exe FZHHBF.exe File created C:\windows\system\SGCBPEE.exe MLLAL.exe File opened for modification C:\windows\system\OIT.exe KSML.exe File created C:\windows\MSS.exe.bat DKQUONO.exe File created C:\windows\system\VXUXAH.exe.bat TZHCLZ.exe File created C:\windows\system\UTEG.exe CQBKMJF.exe File created C:\windows\CFGAEO.exe.bat DHV.exe File created C:\windows\system\MNVNRJQ.exe IHLYBNV.exe File created C:\windows\system\DAOEE.exe MSUZAIL.exe File created C:\windows\system\SHICT.exe.bat RDE.exe File created C:\windows\system\QBKJ.exe XGGNBWB.exe File created C:\windows\CQELYT.exe.bat CNBHT.exe File created C:\windows\system\ARZX.exe ELHH.exe File created C:\windows\system\SRTCAF.exe.bat ARZX.exe File created C:\windows\system\XGGNBWB.exe ILXBQ.exe File opened for modification C:\windows\system\QBKJ.exe XGGNBWB.exe File opened for modification C:\windows\system\VXUXAH.exe TZHCLZ.exe File created C:\windows\system\DHV.exe ORMFL.exe File created C:\windows\system\PWDOC.exe NYQ.exe File created C:\windows\RDE.exe.bat IDCTCU.exe File created C:\windows\system\MEYLKFF.exe SRTCAF.exe File opened for modification C:\windows\system\ZZU.exe YWQVI.exe File created C:\windows\ORMFL.exe.bat CZR.exe File opened for modification C:\windows\system\PWDOC.exe NYQ.exe File opened for modification C:\windows\system\EPD.exe YPVBHI.exe File created C:\windows\HLY.exe QLWVN.exe File opened for modification C:\windows\KSML.exe KMM.exe File opened for modification C:\windows\system\ARZX.exe ELHH.exe File created C:\windows\CNBHT.exe YXUHGLX.exe File created C:\windows\system\XXBE.exe MEYLKFF.exe File created C:\windows\system\ZZU.exe YWQVI.exe File created C:\windows\system\QBJUWK.exe.bat ZQGE.exe File opened for modification C:\windows\HLY.exe QLWVN.exe File opened for modification C:\windows\system\KDHN.exe TCF.exe File created C:\windows\system\OIT.exe KSML.exe File created C:\windows\CQELYT.exe CNBHT.exe File created C:\windows\system\ILXBQ.exe YNROJ.exe File created C:\windows\VUCMGC.exe.bat AZXD.exe File opened for modification C:\windows\system\SIRU.exe OSKMRI.exe File opened for modification C:\windows\TMKDPD.exe VRK.exe File opened for modification C:\windows\system\TZHCLZ.exe SEDZ.exe File opened for modification C:\windows\system\JFKN.exe PSF.exe File opened for modification C:\windows\system\LZR.exe SGCBPEE.exe File opened for modification C:\windows\system\YPVBHI.exe QBJUWK.exe File created C:\windows\system\EPD.exe.bat YPVBHI.exe File created C:\windows\system\VRK.exe.bat VWHZFK.exe File created C:\windows\system\UTEG.exe.bat CQBKMJF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5292 cmd.exe 4328 cmd.exe 5192 cmd.exe 3588 cmd.exe 6108 cmd.exe 3576 cmd.exe 4152 cmd.exe 4552 cmd.exe 6004 cmd.exe 776 cmd.exe 2992 cmd.exe 5868 cmd.exe 2064 cmd.exe 560 cmd.exe 2372 cmd.exe 904 cmd.exe 5992 cmd.exe 6068 cmd.exe 1112 cmd.exe 728 cmd.exe 5416 cmd.exe 4576 cmd.exe 1940 cmd.exe 1300 cmd.exe 4412 cmd.exe 1480 cmd.exe 1756 cmd.exe 4276 cmd.exe 5560 cmd.exe 4136 cmd.exe 6132 cmd.exe 2400 cmd.exe 1292 cmd.exe 1496 cmd.exe 2060 cmd.exe 4112 cmd.exe 6076 cmd.exe 864 cmd.exe 2660 cmd.exe 3360 cmd.exe 5336 cmd.exe 3204 cmd.exe 2968 cmd.exe 4584 cmd.exe 2288 cmd.exe 3592 cmd.exe 1936 cmd.exe 5208 cmd.exe 1572 cmd.exe 5572 cmd.exe 2908 cmd.exe 1920 cmd.exe 1468 cmd.exe 3044 cmd.exe 5164 cmd.exe 1988 cmd.exe 1160 cmd.exe 1932 cmd.exe 5816 cmd.exe 1520 cmd.exe 3168 cmd.exe 5212 cmd.exe 5480 cmd.exe 1216 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3248 5076 WerFault.exe 87 4088 5612 WerFault.exe 93 3616 4340 WerFault.exe 99 3660 3876 WerFault.exe 104 5000 3280 WerFault.exe 109 780 4676 WerFault.exe 114 1484 696 WerFault.exe 119 5804 4732 WerFault.exe 124 4604 1968 WerFault.exe 129 2816 1420 WerFault.exe 134 3836 4656 WerFault.exe 139 3524 3092 WerFault.exe 144 4136 3300 WerFault.exe 149 4580 260 WerFault.exe 154 5504 4624 WerFault.exe 159 5700 1836 WerFault.exe 164 4120 4620 WerFault.exe 169 948 3936 WerFault.exe 174 5460 2804 WerFault.exe 179 1604 1028 WerFault.exe 184 1920 1668 WerFault.exe 189 6036 1568 WerFault.exe 194 4840 716 WerFault.exe 199 4860 3524 WerFault.exe 204 4172 3408 WerFault.exe 209 2480 3884 WerFault.exe 214 5932 2084 WerFault.exe 219 1608 5520 WerFault.exe 224 948 3324 WerFault.exe 229 5460 2516 WerFault.exe 234 2404 1776 WerFault.exe 239 904 5804 WerFault.exe 244 3380 6136 WerFault.exe 249 2780 3820 WerFault.exe 254 1432 3768 WerFault.exe 259 1932 2436 WerFault.exe 264 1388 3460 WerFault.exe 269 5288 6092 WerFault.exe 274 2420 5000 WerFault.exe 279 5800 2924 WerFault.exe 284 4596 1492 WerFault.exe 289 3428 3912 WerFault.exe 294 4160 5820 WerFault.exe 299 5640 3380 WerFault.exe 304 1908 5852 WerFault.exe 309 3764 1432 WerFault.exe 314 3660 5468 WerFault.exe 319 4356 6052 WerFault.exe 324 3132 5876 WerFault.exe 329 4124 1020 WerFault.exe 334 4516 1764 WerFault.exe 339 3428 3596 WerFault.exe 344 904 4240 WerFault.exe 349 5344 5248 WerFault.exe 354 5236 3040 WerFault.exe 359 2560 4876 WerFault.exe 363 240 2480 WerFault.exe 369 4300 5168 WerFault.exe 374 948 5848 WerFault.exe 379 636 1012 WerFault.exe 384 2152 2488 WerFault.exe 389 4400 5008 WerFault.exe 394 2932 5340 WerFault.exe 399 5836 200 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUCMGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFXJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTLDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSUZAIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNSXYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPVBHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGGNBWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNROJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONJJFTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SANO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIIQEO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHLYBNV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZKSXYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJYPVJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORMFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBJUWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLLAL.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5076 2026-08-08_c14c361e4409e63ad98e206171b9e23f_elex_emotet_stop.exe 5076 2026-08-08_c14c361e4409e63ad98e206171b9e23f_elex_emotet_stop.exe 5612 ZSN.exe 5612 ZSN.exe 4340 CQBKMJF.exe 4340 CQBKMJF.exe 3876 UTEG.exe 3876 UTEG.exe 3280 CZR.exe 3280 CZR.exe 4676 ORMFL.exe 4676 ORMFL.exe 696 DHV.exe 696 DHV.exe 4732 CFGAEO.exe 4732 CFGAEO.exe 1968 TFI.exe 1968 TFI.exe 1420 COKS.exe 1420 COKS.exe 4656 VRO.exe 4656 VRO.exe 3092 FHUIG.exe 3092 FHUIG.exe 3300 SRKHU.exe 3300 SRKHU.exe 260 IHLYBNV.exe 260 IHLYBNV.exe 4624 MNVNRJQ.exe 4624 MNVNRJQ.exe 1836 ATDZTU.exe 1836 ATDZTU.exe 4620 NVMY.exe 4620 NVMY.exe 3936 NYQ.exe 3936 NYQ.exe 2804 PWDOC.exe 2804 PWDOC.exe 1028 ZUJIK.exe 1028 ZUJIK.exe 1668 HANP.exe 1668 HANP.exe 1568 MLUKUDM.exe 1568 MLUKUDM.exe 716 ZNCAI.exe 716 ZNCAI.exe 3524 ZQGE.exe 3524 ZQGE.exe 3408 QBJUWK.exe 3408 QBJUWK.exe 3884 YPVBHI.exe 3884 YPVBHI.exe 2084 EPD.exe 2084 EPD.exe 5520 ONJJFTC.exe 5520 ONJJFTC.exe 3324 QLWVN.exe 3324 QLWVN.exe 2516 HLY.exe 2516 HLY.exe 1776 VWHZFK.exe 1776 VWHZFK.exe 5804 VRK.exe 5804 VRK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5076 2026-08-08_c14c361e4409e63ad98e206171b9e23f_elex_emotet_stop.exe 5076 2026-08-08_c14c361e4409e63ad98e206171b9e23f_elex_emotet_stop.exe 5612 ZSN.exe 5612 ZSN.exe 4340 CQBKMJF.exe 4340 CQBKMJF.exe 3876 UTEG.exe 3876 UTEG.exe 3280 CZR.exe 3280 CZR.exe 4676 ORMFL.exe 4676 ORMFL.exe 696 DHV.exe 696 DHV.exe 4732 CFGAEO.exe 4732 CFGAEO.exe 1968 TFI.exe 1968 TFI.exe 1420 COKS.exe 1420 COKS.exe 4656 VRO.exe 4656 VRO.exe 3092 FHUIG.exe 3092 FHUIG.exe 3300 SRKHU.exe 3300 SRKHU.exe 260 IHLYBNV.exe 260 IHLYBNV.exe 4624 MNVNRJQ.exe 4624 MNVNRJQ.exe 1836 ATDZTU.exe 1836 ATDZTU.exe 4620 NVMY.exe 4620 NVMY.exe 3936 NYQ.exe 3936 NYQ.exe 2804 PWDOC.exe 2804 PWDOC.exe 1028 ZUJIK.exe 1028 ZUJIK.exe 1668 HANP.exe 1668 HANP.exe 1568 MLUKUDM.exe 1568 MLUKUDM.exe 716 ZNCAI.exe 716 ZNCAI.exe 3524 ZQGE.exe 3524 ZQGE.exe 3408 QBJUWK.exe 3408 QBJUWK.exe 3884 YPVBHI.exe 3884 YPVBHI.exe 2084 EPD.exe 2084 EPD.exe 5520 ONJJFTC.exe 5520 ONJJFTC.exe 3324 QLWVN.exe 3324 QLWVN.exe 2516 HLY.exe 2516 HLY.exe 1776 VWHZFK.exe 1776 VWHZFK.exe 5804 VRK.exe 5804 VRK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5076 wrote to memory of 2700 5076 2026-08-08_c14c361e4409e63ad98e206171b9e23f_elex_emotet_stop.exe 89 PID 2700 wrote to memory of 5612 2700 cmd.exe 93 PID 5612 wrote to memory of 120 5612 ZSN.exe 95 PID 120 wrote to memory of 4340 120 cmd.exe 99 PID 4340 wrote to memory of 3360 4340 CQBKMJF.exe 100 PID 3360 wrote to memory of 3876 3360 cmd.exe 104 PID 3876 wrote to memory of 5816 3876 UTEG.exe 105 PID 5816 wrote to memory of 3280 5816 cmd.exe 109 PID 3280 wrote to memory of 4128 3280 CZR.exe 110 PID 4128 wrote to memory of 4676 4128 cmd.exe 114 PID 4676 wrote to memory of 2904 4676 ORMFL.exe 115 PID 2904 wrote to memory of 696 2904 cmd.exe 119 PID 696 wrote to memory of 2880 696 DHV.exe 120 PID 2880 wrote to memory of 4732 2880 cmd.exe 124 PID 4732 wrote to memory of 1940 4732 CFGAEO.exe 125 PID 1940 wrote to memory of 1968 1940 cmd.exe 129 PID 1968 wrote to memory of 1756 1968 TFI.exe 130 PID 1756 wrote to memory of 1420 1756 cmd.exe 134 PID 1420 wrote to memory of 6080 1420 COKS.exe 135 PID 6080 wrote to memory of 4656 6080 cmd.exe 139 PID 4656 wrote to memory of 1328 4656 VRO.exe 140 PID 1328 wrote to memory of 3092 1328 cmd.exe 144 PID 3092 wrote to memory of 4856 3092 FHUIG.exe 145 PID 4856 wrote to memory of 3300 4856 cmd.exe 149 PID 3300 wrote to memory of 412 3300 SRKHU.exe 150 PID 412 wrote to memory of 260 412 cmd.exe 154 PID 260 wrote to memory of 4256 260 IHLYBNV.exe 155 PID 4256 wrote to memory of 4624 4256 cmd.exe 159 PID 4624 wrote to memory of 5704 4624 MNVNRJQ.exe 160 PID 5704 wrote to memory of 1836 5704 cmd.exe 164 PID 1836 wrote to memory of 3600 1836 ATDZTU.exe 165 PID 3600 wrote to memory of 4620 3600 cmd.exe 169 PID 4620 wrote to memory of 1312 4620 NVMY.exe 170 PID 1312 wrote to memory of 3936 1312 cmd.exe 174 PID 3936 wrote to memory of 3592 3936 NYQ.exe 175 PID 3592 wrote to memory of 2804 3592 cmd.exe 179 PID 2804 wrote to memory of 1936 2804 PWDOC.exe 180 PID 1936 wrote to memory of 1028 1936 cmd.exe 184 PID 1028 wrote to memory of 4508 1028 ZUJIK.exe 185 PID 4508 wrote to memory of 1668 4508 cmd.exe 189 PID 1668 wrote to memory of 2980 1668 HANP.exe 190 PID 2980 wrote to memory of 1568 2980 cmd.exe 194 PID 1568 wrote to memory of 3856 1568 MLUKUDM.exe 195 PID 3856 wrote to memory of 716 3856 cmd.exe 199 PID 716 wrote to memory of 4640 716 ZNCAI.exe 200 PID 4640 wrote to memory of 3524 4640 cmd.exe 204 PID 3524 wrote to memory of 712 3524 ZQGE.exe 205 PID 712 wrote to memory of 3408 712 cmd.exe 209 PID 3408 wrote to memory of 5208 3408 QBJUWK.exe 210 PID 5208 wrote to memory of 3884 5208 cmd.exe 214 PID 3884 wrote to memory of 1520 3884 YPVBHI.exe 215 PID 1520 wrote to memory of 2084 1520 cmd.exe 219 PID 2084 wrote to memory of 5484 2084 EPD.exe 220 PID 5484 wrote to memory of 5520 5484 cmd.exe 224 PID 5520 wrote to memory of 4176 5520 ONJJFTC.exe 225 PID 4176 wrote to memory of 3324 4176 cmd.exe 229 PID 3324 wrote to memory of 1496 3324 QLWVN.exe 230 PID 1496 wrote to memory of 2516 1496 cmd.exe 234 PID 2516 wrote to memory of 3488 2516 HLY.exe 235 PID 3488 wrote to memory of 1776 3488 cmd.exe 239 PID 1776 wrote to memory of 1468 1776 VWHZFK.exe 240 PID 1468 wrote to memory of 5804 1468 cmd.exe 244 PID 5804 wrote to memory of 2060 5804 VRK.exe 245 PID 2060 wrote to memory of 6136 2060 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_c14c361e4409e63ad98e206171b9e23f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_c14c361e4409e63ad98e206171b9e23f_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSN.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\windows\ZSN.exeC:\windows\ZSN.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQBKMJF.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:120 -
C:\windows\SysWOW64\CQBKMJF.exeC:\windows\system32\CQBKMJF.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTEG.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\windows\system\UTEG.exeC:\windows\system\UTEG.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZR.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\system\CZR.exeC:\windows\system\CZR.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ORMFL.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\windows\ORMFL.exeC:\windows\ORMFL.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DHV.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\system\DHV.exeC:\windows\system\DHV.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CFGAEO.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\CFGAEO.exeC:\windows\CFGAEO.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFI.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\windows\system\TFI.exeC:\windows\system\TFI.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COKS.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\windows\SysWOW64\COKS.exeC:\windows\system32\COKS.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRO.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\windows\SysWOW64\VRO.exeC:\windows\system32\VRO.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHUIG.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\FHUIG.exeC:\windows\FHUIG.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRKHU.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\windows\SysWOW64\SRKHU.exeC:\windows\system32\SRKHU.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHLYBNV.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:412 -
C:\windows\SysWOW64\IHLYBNV.exeC:\windows\system32\IHLYBNV.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNVNRJQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\windows\system\MNVNRJQ.exeC:\windows\system\MNVNRJQ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATDZTU.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\windows\system\ATDZTU.exeC:\windows\system\ATDZTU.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVMY.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\windows\SysWOW64\NVMY.exeC:\windows\system32\NVMY.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYQ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\SysWOW64\NYQ.exeC:\windows\system32\NYQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWDOC.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\windows\system\PWDOC.exeC:\windows\system\PWDOC.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZUJIK.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\windows\SysWOW64\ZUJIK.exeC:\windows\system32\ZUJIK.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HANP.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\windows\SysWOW64\HANP.exeC:\windows\system32\HANP.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLUKUDM.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\SysWOW64\MLUKUDM.exeC:\windows\system32\MLUKUDM.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNCAI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\SysWOW64\ZNCAI.exeC:\windows\system32\ZNCAI.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQGE.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\ZQGE.exeC:\windows\ZQGE.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QBJUWK.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:712 -
C:\windows\system\QBJUWK.exeC:\windows\system\QBJUWK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPVBHI.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\windows\system\YPVBHI.exeC:\windows\system\YPVBHI.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPD.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\windows\system\EPD.exeC:\windows\system\EPD.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ONJJFTC.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\SysWOW64\ONJJFTC.exeC:\windows\system32\ONJJFTC.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLWVN.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\windows\QLWVN.exeC:\windows\QLWVN.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLY.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\windows\HLY.exeC:\windows\HLY.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWHZFK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\windows\SysWOW64\VWHZFK.exeC:\windows\system32\VWHZFK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRK.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\windows\system\VRK.exeC:\windows\system\VRK.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TMKDPD.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\windows\TMKDPD.exeC:\windows\TMKDPD.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKVG.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3044 -
C:\windows\SysWOW64\SKVG.exeC:\windows\system32\SKVG.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXUHGLX.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:2580 -
C:\windows\SysWOW64\YXUHGLX.exeC:\windows\system32\YXUHGLX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNBHT.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4152 -
C:\windows\CNBHT.exeC:\windows\CNBHT.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQELYT.exe.bat" "72⤵PID:2556
-
C:\windows\CQELYT.exeC:\windows\CQELYT.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYTL.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2764 -
C:\windows\GYTL.exeC:\windows\GYTL.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBX.exe.bat" "76⤵PID:4564
-
C:\windows\SysWOW64\HBX.exeC:\windows\system32\HBX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEFFEE.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:1632 -
C:\windows\UEFFEE.exeC:\windows\UEFFEE.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXIVN.exe.bat" "80⤵PID:5664
-
C:\windows\SysWOW64\TXIVN.exeC:\windows\system32\TXIVN.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSUZAIL.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4112 -
C:\windows\SysWOW64\MSUZAIL.exeC:\windows\system32\MSUZAIL.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "84⤵PID:4828
-
C:\windows\system\DAOEE.exeC:\windows\system\DAOEE.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIDEQYB.exe.bat" "86⤵
- Executes a command shell one-liner
PID:728 -
C:\windows\HIDEQYB.exeC:\windows\HIDEQYB.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTLDE.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5656 -
C:\windows\SysWOW64\UTLDE.exeC:\windows\system32\UTLDE.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRLO.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1120 -
C:\windows\system\IRLO.exeC:\windows\system\IRLO.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEY.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1572 -
C:\windows\SysWOW64\QEY.exeC:\windows\system32\QEY.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZHHBF.exe.bat" "94⤵PID:1640
-
C:\windows\FZHHBF.exeC:\windows\FZHHBF.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCLDH.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4552 -
C:\windows\FCLDH.exeC:\windows\FCLDH.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDNISB.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1300 -
C:\windows\SysWOW64\PDNISB.exeC:\windows\system32\PDNISB.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IDCTCU.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:940 -
C:\windows\SysWOW64\IDCTCU.exeC:\windows\system32\IDCTCU.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDE.exe.bat" "102⤵PID:4180
-
C:\windows\RDE.exeC:\windows\RDE.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SHICT.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4276 -
C:\windows\system\SHICT.exeC:\windows\system\SHICT.exe105⤵
- Executes dropped EXE
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHQQCJJ.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:560 -
C:\windows\system\YHQQCJJ.exeC:\windows\system\YHQQCJJ.exe107⤵
- Executes dropped EXE
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMI.exe.bat" "108⤵PID:2596
-
C:\windows\system\YMI.exeC:\windows\system\YMI.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SANO.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4892 -
C:\windows\SANO.exeC:\windows\SANO.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNSXYW.exe.bat" "112⤵PID:6032
-
C:\windows\system\NNSXYW.exeC:\windows\system\NNSXYW.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLLAL.exe.bat" "114⤵PID:2876
-
C:\windows\system\MLLAL.exeC:\windows\system\MLLAL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGCBPEE.exe.bat" "116⤵PID:4228
-
C:\windows\system\SGCBPEE.exeC:\windows\system\SGCBPEE.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZR.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5164 -
C:\windows\system\LZR.exeC:\windows\system\LZR.exe119⤵
- Executes dropped EXE
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHYUL.exe.bat" "120⤵PID:4124
-
C:\windows\system\PHYUL.exeC:\windows\system\PHYUL.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-