Analysis
- max time kernel
76s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 14:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe
- Size 208KB
- Sample260808-rm516asvhv
- SHA256 a149c349c4d4af82f1f7eb208b8c5710ae4dd859fe86e519eed2d5c3dfc31f2c
- MD5 a981e87650d35b07e5f21d781f537901
- SHA1 92c65cae17dfaf9a52b29636926fae76b9353bd1
- SHA512 d9472560a25de8f345eca82101dc82ce050ef0c286f40807d7d865532b8a1ca31fa8d8f209618d2756cd9bc39a63529d2df44a9567fa6662c5c7b75658a8f33b
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf24NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOuQEj1
- TLSH T134247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4728 PDWLLO.exe 2812 RZUB.exe 3056 JUYFOL.exe 4744 NKFF.exe 1244 MVIVBJX.exe 1940 QLWVN.exe 1336 RGAZ.exe 1948 BDGTIA.exe 5872 TGJPN.exe 4404 BMWWY.exe 5140 OXSC.exe 4476 DCYZKP.exe 2760 FSRTQM.exe 1084 NLAVEQ.exe 3976 PJBPCFJ.exe 4772 PTBQQRQ.exe 4564 LZHN.exe 824 ECLJLR.exe 432 QKS.exe 5768 DQADZNZ.exe 5352 HYGD.exe 6140 WOHCKBC.exe 1316 VDTXFG.exe 2300 OGWBK.exe 1888 OJIXQMV.exe 5944 SSPF.exe 5460 BARKF.exe 5896 RQSB.exe 4724 KIZM.exe 2752 XTQLKBL.exe 2608 DHPMO.exe 1832 WKTPCU.exe 2968 BPDFKXX.exe 2104 OVLQUI.exe 2212 DQU.exe 1448 TGIM.exe 592 TJM.exe 2156 ZEXJGPO.exe 5496 YPAZPV.exe 4680 XADPX.exe 1076 TFVE.exe 1968 ABUFSHR.exe 5348 NDDEY.exe 760 IJL.exe 1360 AJRMV.exe 2336 GFDFB.exe 1204 ZFSYS.exe 3316 DNZYWUD.exe 5592 SDAYDI.exe 4588 AJMEO.exe 5732 TMQATEX.exe 5972 DKWUIMY.exe 1072 OCLFS.exe 4736 PFPJ.exe 4376 OQS.exe 3804 QOFMV.exe 3332 QRJP.exe 4472 APPCIQE.exe 4620 EXVK.exe 4536 BXFMY.exe 5692 FNM.exe 3132 PDSGAFY.exe 3152 GLGMNWB.exe 2348 VBHD.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\OGWBK.exe VDTXFG.exe File created C:\windows\SysWOW64\XADPX.exe.bat YPAZPV.exe File created C:\windows\SysWOW64\IJL.exe.bat NDDEY.exe File created C:\windows\SysWOW64\PDSGAFY.exe.bat FNM.exe File created C:\windows\SysWOW64\YCTTMYQ.exe.bat ANA.exe File opened for modification C:\windows\SysWOW64\LZHN.exe PTBQQRQ.exe File created C:\windows\SysWOW64\LZHN.exe.bat PTBQQRQ.exe File opened for modification C:\windows\SysWOW64\IJL.exe NDDEY.exe File opened for modification C:\windows\SysWOW64\TMQATEX.exe AJMEO.exe File opened for modification C:\windows\SysWOW64\WCDFKX.exe TMXX.exe File created C:\windows\SysWOW64\KIZM.exe RQSB.exe File created C:\windows\SysWOW64\BPDFKXX.exe.bat WKTPCU.exe File created C:\windows\SysWOW64\DQU.exe OVLQUI.exe File created C:\windows\SysWOW64\PDWLLO.exe.bat 2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe File created C:\windows\SysWOW64\FSRTQM.exe.bat DCYZKP.exe File opened for modification C:\windows\SysWOW64\OGWBK.exe VDTXFG.exe File created C:\windows\SysWOW64\PFPJ.exe OCLFS.exe File created C:\windows\SysWOW64\PDWLLO.exe 2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe File created C:\windows\SysWOW64\AJMEO.exe SDAYDI.exe File created C:\windows\SysWOW64\OELHZHZ.exe VBHD.exe File created C:\windows\SysWOW64\OHRZXX.exe CZLY.exe File created C:\windows\SysWOW64\AKKF.exe.bat WCDFKX.exe File opened for modification C:\windows\SysWOW64\OVLQUI.exe BPDFKXX.exe File created C:\windows\SysWOW64\ZFSYS.exe GFDFB.exe File opened for modification C:\windows\SysWOW64\ZFSYS.exe GFDFB.exe File created C:\windows\SysWOW64\HCA.exe.bat SMRHD.exe File opened for modification C:\windows\SysWOW64\OHRZXX.exe CZLY.exe File created C:\windows\SysWOW64\OHRZXX.exe.bat CZLY.exe File opened for modification C:\windows\SysWOW64\GFDFB.exe AJRMV.exe File created C:\windows\SysWOW64\SSPF.exe.bat OJIXQMV.exe File created C:\windows\SysWOW64\DHPMO.exe XTQLKBL.exe File opened for modification C:\windows\SysWOW64\PDWLLO.exe 2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe File created C:\windows\SysWOW64\FSRTQM.exe DCYZKP.exe File opened for modification C:\windows\SysWOW64\OELHZHZ.exe VBHD.exe File created C:\windows\SysWOW64\HCA.exe SMRHD.exe File created C:\windows\SysWOW64\OGWBK.exe.bat VDTXFG.exe File opened for modification C:\windows\SysWOW64\BPDFKXX.exe WKTPCU.exe File opened for modification C:\windows\SysWOW64\DQU.exe OVLQUI.exe File created C:\windows\SysWOW64\GFDFB.exe.bat AJRMV.exe File created C:\windows\SysWOW64\ZFSYS.exe.bat GFDFB.exe File opened for modification C:\windows\SysWOW64\HCA.exe SMRHD.exe File created C:\windows\SysWOW64\FQPGPT.exe VQN.exe File created C:\windows\SysWOW64\YCTTMYQ.exe ANA.exe File created C:\windows\SysWOW64\JUYFOL.exe.bat RZUB.exe File created C:\windows\SysWOW64\XADPX.exe YPAZPV.exe File opened for modification C:\windows\SysWOW64\PFPJ.exe OCLFS.exe File created C:\windows\SysWOW64\OELHZHZ.exe.bat VBHD.exe File opened for modification C:\windows\SysWOW64\GUNBA.exe WTLWXMY.exe File created C:\windows\SysWOW64\TMXX.exe.bat SRLBSPD.exe File opened for modification C:\windows\SysWOW64\AKKF.exe WCDFKX.exe File opened for modification C:\windows\SysWOW64\JUYFOL.exe RZUB.exe File created C:\windows\SysWOW64\OVLQUI.exe BPDFKXX.exe File created C:\windows\SysWOW64\IJL.exe NDDEY.exe File created C:\windows\SysWOW64\TMQATEX.exe.bat AJMEO.exe File created C:\windows\SysWOW64\PFPJ.exe.bat OCLFS.exe File created C:\windows\SysWOW64\PDSGAFY.exe FNM.exe File created C:\windows\SysWOW64\GUNBA.exe WTLWXMY.exe File created C:\windows\SysWOW64\KIZM.exe.bat RQSB.exe File opened for modification C:\windows\SysWOW64\DHPMO.exe XTQLKBL.exe File opened for modification C:\windows\SysWOW64\QKS.exe ECLJLR.exe File created C:\windows\SysWOW64\QKS.exe.bat ECLJLR.exe File opened for modification C:\windows\SysWOW64\SSPF.exe OJIXQMV.exe File created C:\windows\SysWOW64\WCDFKX.exe TMXX.exe File created C:\windows\SysWOW64\QKS.exe ECLJLR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\BMWWY.exe.bat TGJPN.exe File created C:\windows\PTBQQRQ.exe.bat PJBPCFJ.exe File created C:\windows\system\ECLJLR.exe.bat LZHN.exe File opened for modification C:\windows\system\OJIXQMV.exe OGWBK.exe File created C:\windows\SDAYDI.exe.bat DNZYWUD.exe File created C:\windows\QOFMV.exe OQS.exe File created C:\windows\system\OXSC.exe.bat BMWWY.exe File opened for modification C:\windows\BDGTIA.exe RGAZ.exe File created C:\windows\system\YPAZPV.exe ZEXJGPO.exe File created C:\windows\OCLFS.exe.bat DKWUIMY.exe File opened for modification C:\windows\UQVGEYM.exe LITBA.exe File created C:\windows\XNWJVE.exe.bat YCTTMYQ.exe File created C:\windows\system\ECLJLR.exe LZHN.exe File opened for modification C:\windows\HYGD.exe DQADZNZ.exe File created C:\windows\HYGD.exe.bat DQADZNZ.exe File created C:\windows\system\WKTPCU.exe DHPMO.exe File opened for modification C:\windows\system\TJM.exe TGIM.exe File created C:\windows\SRLBSPD.exe.bat QTFHKHC.exe File created C:\windows\DKWUIMY.exe TMQATEX.exe File opened for modification C:\windows\OCLFS.exe DKWUIMY.exe File opened for modification C:\windows\system\JWHVF.exe FQPGPT.exe File created C:\windows\LITBA.exe OHRZXX.exe File created C:\windows\system\AHSKKJP.exe.bat GUNBA.exe File opened for modification C:\windows\system\DQADZNZ.exe QKS.exe File opened for modification C:\windows\system\WOHCKBC.exe HYGD.exe File created C:\windows\XTQLKBL.exe KIZM.exe File opened for modification C:\windows\system\BXFMY.exe EXVK.exe File opened for modification C:\windows\GLGMNWB.exe PDSGAFY.exe File opened for modification C:\windows\IEYLWNG.exe ORBBL.exe File opened for modification C:\windows\system\RZUB.exe PDWLLO.exe File opened for modification C:\windows\PTBQQRQ.exe PJBPCFJ.exe File created C:\windows\system\DQADZNZ.exe.bat QKS.exe File opened for modification C:\windows\system\BARKF.exe SSPF.exe File opened for modification C:\windows\system\QRJP.exe QOFMV.exe File opened for modification C:\windows\system\EXVK.exe APPCIQE.exe File created C:\windows\RAGAZV.exe.bat HCA.exe File created C:\windows\system\VCXU.exe.bat AHSKKJP.exe File opened for modification C:\windows\XTQLKBL.exe KIZM.exe File opened for modification C:\windows\system\WKTPCU.exe DHPMO.exe File created C:\windows\system\ABUFSHR.exe TFVE.exe File created C:\windows\system\AJRMV.exe IJL.exe File created C:\windows\system\BXFMY.exe EXVK.exe File created C:\windows\system\VQN.exe.bat RAGAZV.exe File opened for modification C:\windows\RGAZ.exe QLWVN.exe File created C:\windows\system\DCYZKP.exe OXSC.exe File created C:\windows\system\EXVK.exe.bat APPCIQE.exe File created C:\windows\system\TGJPN.exe BDGTIA.exe File created C:\windows\system\OXSC.exe BMWWY.exe File created C:\windows\system\YPAZPV.exe.bat ZEXJGPO.exe File created C:\windows\system\TFVE.exe XADPX.exe File opened for modification C:\windows\system\OQS.exe PFPJ.exe File created C:\windows\system\QRJP.exe.bat QOFMV.exe File created C:\windows\system\ANA.exe IEYLWNG.exe File created C:\windows\system\KDEW.exe SAB.exe File opened for modification C:\windows\NKFF.exe JUYFOL.exe File opened for modification C:\windows\BMWWY.exe TGJPN.exe File created C:\windows\system\WKTPCU.exe.bat DHPMO.exe File opened for modification C:\windows\system\AJRMV.exe IJL.exe File created C:\windows\IEYLWNG.exe ORBBL.exe File created C:\windows\HYGD.exe DQADZNZ.exe File created C:\windows\system\OJIXQMV.exe OGWBK.exe File created C:\windows\RQSB.exe.bat BARKF.exe File created C:\windows\ZEXJGPO.exe.bat TJM.exe File opened for modification C:\windows\system\NDDEY.exe ABUFSHR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1596 cmd.exe 2856 cmd.exe 4216 cmd.exe 4336 cmd.exe 4332 cmd.exe 5656 cmd.exe 3000 cmd.exe 4548 cmd.exe 5476 cmd.exe 3236 cmd.exe 1236 cmd.exe 4640 cmd.exe 3360 cmd.exe 2112 cmd.exe 2380 cmd.exe 1420 cmd.exe 3240 cmd.exe 1700 cmd.exe 4532 cmd.exe 2516 cmd.exe 3460 cmd.exe 3592 cmd.exe 408 cmd.exe 1148 cmd.exe 5508 cmd.exe 1956 cmd.exe 5980 cmd.exe 3604 cmd.exe 2908 cmd.exe 1736 cmd.exe 612 cmd.exe 5864 cmd.exe 3928 cmd.exe 2580 cmd.exe 4408 cmd.exe 3168 cmd.exe 5404 cmd.exe 2016 cmd.exe 2204 cmd.exe 2884 cmd.exe 2868 cmd.exe 4280 cmd.exe 4340 cmd.exe 4752 cmd.exe 4604 cmd.exe 3184 cmd.exe 2032 cmd.exe 5372 cmd.exe 2536 cmd.exe 1840 cmd.exe 3376 cmd.exe 5908 cmd.exe 1224 cmd.exe 1984 cmd.exe 5544 cmd.exe 1088 cmd.exe 3100 cmd.exe 2628 cmd.exe 3284 cmd.exe 2396 cmd.exe 5020 cmd.exe 1044 cmd.exe 6020 cmd.exe 6052 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2204 4972 WerFault.exe 87 5956 4728 WerFault.exe 93 424 2812 WerFault.exe 99 692 3056 WerFault.exe 104 5092 4744 WerFault.exe 109 6016 1244 WerFault.exe 114 1640 1940 WerFault.exe 119 1768 1336 WerFault.exe 124 3044 1948 WerFault.exe 129 2752 5872 WerFault.exe 134 2448 4404 WerFault.exe 139 5080 5140 WerFault.exe 144 1580 4476 WerFault.exe 149 4532 2760 WerFault.exe 154 5376 1084 WerFault.exe 159 5984 3976 WerFault.exe 164 4720 4772 WerFault.exe 169 2992 4564 WerFault.exe 174 2008 824 WerFault.exe 179 5628 432 WerFault.exe 184 2072 5768 WerFault.exe 189 5080 5352 WerFault.exe 194 1692 6140 WerFault.exe 199 3568 1316 WerFault.exe 204 4976 2300 WerFault.exe 209 1688 1888 WerFault.exe 214 5900 5944 WerFault.exe 219 4216 5460 WerFault.exe 224 1840 5896 WerFault.exe 229 5592 4724 WerFault.exe 234 6112 2752 WerFault.exe 239 3584 2608 WerFault.exe 244 2756 1832 WerFault.exe 249 4944 2968 WerFault.exe 254 5856 2104 WerFault.exe 259 2828 2212 WerFault.exe 264 2028 1448 WerFault.exe 269 1776 592 WerFault.exe 274 4904 2156 WerFault.exe 280 2420 5496 WerFault.exe 285 4980 4680 WerFault.exe 290 5504 1076 WerFault.exe 295 1432 1968 WerFault.exe 300 4100 5348 WerFault.exe 305 2136 760 WerFault.exe 310 1396 1360 WerFault.exe 315 1552 2336 WerFault.exe 320 5868 1204 WerFault.exe 325 3204 3316 WerFault.exe 330 984 5592 WerFault.exe 335 5852 4588 WerFault.exe 340 5680 5732 WerFault.exe 345 5096 5972 WerFault.exe 350 2424 1072 WerFault.exe 355 4632 4736 WerFault.exe 360 4668 4376 WerFault.exe 365 2744 3804 WerFault.exe 370 2700 3332 WerFault.exe 375 2656 4472 WerFault.exe 380 4964 4620 WerFault.exe 385 2756 4536 WerFault.exe 390 1100 5692 WerFault.exe 395 3916 3132 WerFault.exe 400 1572 3152 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KDEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNWJVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTFHKHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QOFMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQADZNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XADPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABUFSHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEXJGPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDSGAFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLGMNWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKWUIMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPDFKXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCYZKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVLQUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQPGPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORBBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFDFB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQVGEYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCTTMYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMQATEX.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4972 2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe 4972 2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe 4728 PDWLLO.exe 4728 PDWLLO.exe 2812 RZUB.exe 2812 RZUB.exe 3056 JUYFOL.exe 3056 JUYFOL.exe 4744 NKFF.exe 4744 NKFF.exe 1244 MVIVBJX.exe 1244 MVIVBJX.exe 1940 QLWVN.exe 1940 QLWVN.exe 1336 RGAZ.exe 1336 RGAZ.exe 1948 BDGTIA.exe 1948 BDGTIA.exe 5872 TGJPN.exe 5872 TGJPN.exe 4404 BMWWY.exe 4404 BMWWY.exe 5140 OXSC.exe 5140 OXSC.exe 4476 DCYZKP.exe 4476 DCYZKP.exe 2760 FSRTQM.exe 2760 FSRTQM.exe 1084 NLAVEQ.exe 1084 NLAVEQ.exe 3976 PJBPCFJ.exe 3976 PJBPCFJ.exe 4772 PTBQQRQ.exe 4772 PTBQQRQ.exe 4564 LZHN.exe 4564 LZHN.exe 824 ECLJLR.exe 824 ECLJLR.exe 432 QKS.exe 432 QKS.exe 5768 DQADZNZ.exe 5768 DQADZNZ.exe 5352 HYGD.exe 5352 HYGD.exe 6140 WOHCKBC.exe 6140 WOHCKBC.exe 1316 VDTXFG.exe 1316 VDTXFG.exe 2300 OGWBK.exe 2300 OGWBK.exe 1888 OJIXQMV.exe 1888 OJIXQMV.exe 5944 SSPF.exe 5944 SSPF.exe 5460 BARKF.exe 5460 BARKF.exe 5896 RQSB.exe 5896 RQSB.exe 4724 KIZM.exe 4724 KIZM.exe 2752 XTQLKBL.exe 2752 XTQLKBL.exe 2608 DHPMO.exe 2608 DHPMO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4972 2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe 4972 2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe 4728 PDWLLO.exe 4728 PDWLLO.exe 2812 RZUB.exe 2812 RZUB.exe 3056 JUYFOL.exe 3056 JUYFOL.exe 4744 NKFF.exe 4744 NKFF.exe 1244 MVIVBJX.exe 1244 MVIVBJX.exe 1940 QLWVN.exe 1940 QLWVN.exe 1336 RGAZ.exe 1336 RGAZ.exe 1948 BDGTIA.exe 1948 BDGTIA.exe 5872 TGJPN.exe 5872 TGJPN.exe 4404 BMWWY.exe 4404 BMWWY.exe 5140 OXSC.exe 5140 OXSC.exe 4476 DCYZKP.exe 4476 DCYZKP.exe 2760 FSRTQM.exe 2760 FSRTQM.exe 1084 NLAVEQ.exe 1084 NLAVEQ.exe 3976 PJBPCFJ.exe 3976 PJBPCFJ.exe 4772 PTBQQRQ.exe 4772 PTBQQRQ.exe 4564 LZHN.exe 4564 LZHN.exe 824 ECLJLR.exe 824 ECLJLR.exe 432 QKS.exe 432 QKS.exe 5768 DQADZNZ.exe 5768 DQADZNZ.exe 5352 HYGD.exe 5352 HYGD.exe 6140 WOHCKBC.exe 6140 WOHCKBC.exe 1316 VDTXFG.exe 1316 VDTXFG.exe 2300 OGWBK.exe 2300 OGWBK.exe 1888 OJIXQMV.exe 1888 OJIXQMV.exe 5944 SSPF.exe 5944 SSPF.exe 5460 BARKF.exe 5460 BARKF.exe 5896 RQSB.exe 5896 RQSB.exe 4724 KIZM.exe 4724 KIZM.exe 2752 XTQLKBL.exe 2752 XTQLKBL.exe 2608 DHPMO.exe 2608 DHPMO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4972 wrote to memory of 3292 4972 2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe 89 PID 3292 wrote to memory of 4728 3292 cmd.exe 93 PID 4728 wrote to memory of 3928 4728 PDWLLO.exe 95 PID 3928 wrote to memory of 2812 3928 cmd.exe 99 PID 2812 wrote to memory of 3184 2812 RZUB.exe 100 PID 3184 wrote to memory of 3056 3184 cmd.exe 104 PID 3056 wrote to memory of 2380 3056 JUYFOL.exe 105 PID 2380 wrote to memory of 4744 2380 cmd.exe 109 PID 4744 wrote to memory of 5844 4744 NKFF.exe 110 PID 5844 wrote to memory of 1244 5844 cmd.exe 114 PID 1244 wrote to memory of 6052 1244 MVIVBJX.exe 115 PID 6052 wrote to memory of 1940 6052 cmd.exe 119 PID 1940 wrote to memory of 5424 1940 QLWVN.exe 120 PID 5424 wrote to memory of 1336 5424 cmd.exe 124 PID 1336 wrote to memory of 1260 1336 RGAZ.exe 125 PID 1260 wrote to memory of 1948 1260 cmd.exe 129 PID 1948 wrote to memory of 3952 1948 BDGTIA.exe 130 PID 3952 wrote to memory of 5872 3952 cmd.exe 134 PID 5872 wrote to memory of 2312 5872 TGJPN.exe 135 PID 2312 wrote to memory of 4404 2312 cmd.exe 139 PID 4404 wrote to memory of 5688 4404 BMWWY.exe 140 PID 5688 wrote to memory of 5140 5688 cmd.exe 144 PID 5140 wrote to memory of 2580 5140 OXSC.exe 145 PID 2580 wrote to memory of 4476 2580 cmd.exe 149 PID 4476 wrote to memory of 2880 4476 DCYZKP.exe 150 PID 2880 wrote to memory of 2760 2880 cmd.exe 154 PID 2760 wrote to memory of 3744 2760 FSRTQM.exe 155 PID 3744 wrote to memory of 1084 3744 cmd.exe 159 PID 1084 wrote to memory of 1816 1084 NLAVEQ.exe 160 PID 1816 wrote to memory of 3976 1816 cmd.exe 164 PID 3976 wrote to memory of 4408 3976 PJBPCFJ.exe 165 PID 4408 wrote to memory of 4772 4408 cmd.exe 169 PID 4772 wrote to memory of 1892 4772 PTBQQRQ.exe 170 PID 1892 wrote to memory of 4564 1892 cmd.exe 174 PID 4564 wrote to memory of 1224 4564 LZHN.exe 175 PID 1224 wrote to memory of 824 1224 cmd.exe 179 PID 824 wrote to memory of 3756 824 ECLJLR.exe 180 PID 3756 wrote to memory of 432 3756 cmd.exe 184 PID 432 wrote to memory of 1420 432 QKS.exe 185 PID 1420 wrote to memory of 5768 1420 cmd.exe 189 PID 5768 wrote to memory of 480 5768 DQADZNZ.exe 190 PID 480 wrote to memory of 5352 480 cmd.exe 194 PID 5352 wrote to memory of 2204 5352 HYGD.exe 195 PID 2204 wrote to memory of 6140 2204 cmd.exe 199 PID 6140 wrote to memory of 4656 6140 WOHCKBC.exe 200 PID 4656 wrote to memory of 1316 4656 cmd.exe 204 PID 1316 wrote to memory of 4828 1316 VDTXFG.exe 205 PID 4828 wrote to memory of 2300 4828 cmd.exe 209 PID 2300 wrote to memory of 2596 2300 OGWBK.exe 210 PID 2596 wrote to memory of 1888 2596 cmd.exe 214 PID 1888 wrote to memory of 256 1888 OJIXQMV.exe 215 PID 256 wrote to memory of 5944 256 cmd.exe 219 PID 5944 wrote to memory of 1596 5944 SSPF.exe 220 PID 1596 wrote to memory of 5460 1596 cmd.exe 224 PID 5460 wrote to memory of 4820 5460 BARKF.exe 225 PID 4820 wrote to memory of 5896 4820 cmd.exe 229 PID 5896 wrote to memory of 2628 5896 RQSB.exe 230 PID 2628 wrote to memory of 4724 2628 cmd.exe 234 PID 4724 wrote to memory of 4160 4724 KIZM.exe 235 PID 4160 wrote to memory of 2752 4160 cmd.exe 239 PID 2752 wrote to memory of 2032 2752 XTQLKBL.exe 240 PID 2032 wrote to memory of 2608 2032 cmd.exe 244 PID 2608 wrote to memory of 5664 2608 DHPMO.exe 245 PID 5664 wrote to memory of 1832 5664 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a981e87650d35b07e5f21d781f537901_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDWLLO.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\windows\SysWOW64\PDWLLO.exeC:\windows\system32\PDWLLO.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZUB.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\windows\system\RZUB.exeC:\windows\system\RZUB.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUYFOL.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\windows\SysWOW64\JUYFOL.exeC:\windows\system32\JUYFOL.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKFF.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\windows\NKFF.exeC:\windows\NKFF.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVIVBJX.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\system\MVIVBJX.exeC:\windows\system\MVIVBJX.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLWVN.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\QLWVN.exeC:\windows\QLWVN.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGAZ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\RGAZ.exeC:\windows\RGAZ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGTIA.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\windows\BDGTIA.exeC:\windows\BDGTIA.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGJPN.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\system\TGJPN.exeC:\windows\system\TGJPN.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMWWY.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\windows\BMWWY.exeC:\windows\BMWWY.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXSC.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\system\OXSC.exeC:\windows\system\OXSC.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCYZKP.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\windows\system\DCYZKP.exeC:\windows\system\DCYZKP.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSRTQM.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\SysWOW64\FSRTQM.exeC:\windows\system32\FSRTQM.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJBPCFJ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\system\PJBPCFJ.exeC:\windows\system\PJBPCFJ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTBQQRQ.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\PTBQQRQ.exeC:\windows\PTBQQRQ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZHN.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\windows\SysWOW64\LZHN.exeC:\windows\system32\LZHN.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECLJLR.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\system\ECLJLR.exeC:\windows\system\ECLJLR.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKS.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\windows\SysWOW64\QKS.exeC:\windows\system32\QKS.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQADZNZ.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\windows\system\DQADZNZ.exeC:\windows\system\DQADZNZ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYGD.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:480 -
C:\windows\HYGD.exeC:\windows\HYGD.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOHCKBC.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\windows\system\WOHCKBC.exeC:\windows\system\WOHCKBC.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VDTXFG.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\windows\system\VDTXFG.exeC:\windows\system\VDTXFG.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGWBK.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\SysWOW64\OGWBK.exeC:\windows\system32\OGWBK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJIXQMV.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\system\OJIXQMV.exeC:\windows\system\OJIXQMV.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSPF.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\SysWOW64\SSPF.exeC:\windows\system32\SSPF.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BARKF.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\windows\system\BARKF.exeC:\windows\system\BARKF.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RQSB.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\RQSB.exeC:\windows\RQSB.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIZM.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\windows\SysWOW64\KIZM.exeC:\windows\system32\KIZM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTQLKBL.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\XTQLKBL.exeC:\windows\XTQLKBL.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DHPMO.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\SysWOW64\DHPMO.exeC:\windows\system32\DHPMO.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKTPCU.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\windows\system\WKTPCU.exeC:\windows\system\WKTPCU.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPDFKXX.exe.bat" "66⤵PID:424
-
C:\windows\SysWOW64\BPDFKXX.exeC:\windows\system32\BPDFKXX.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVLQUI.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2884 -
C:\windows\SysWOW64\OVLQUI.exeC:\windows\system32\OVLQUI.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQU.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3320 -
C:\windows\SysWOW64\DQU.exeC:\windows\system32\DQU.exe71⤵
- Executes dropped EXE
PID:2212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGIM.exe.bat" "72⤵PID:6016
-
C:\windows\system\TGIM.exeC:\windows\system\TGIM.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJM.exe.bat" "74⤵PID:4720
-
C:\windows\system\TJM.exeC:\windows\system\TJM.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZEXJGPO.exe.bat" "76⤵PID:2636
-
C:\windows\ZEXJGPO.exeC:\windows\ZEXJGPO.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPAZPV.exe.bat" "78⤵PID:5164
-
C:\windows\system\YPAZPV.exeC:\windows\system\YPAZPV.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XADPX.exe.bat" "80⤵PID:4152
-
C:\windows\SysWOW64\XADPX.exeC:\windows\system32\XADPX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFVE.exe.bat" "82⤵
- Executes a command shell one-liner
PID:408 -
C:\windows\system\TFVE.exeC:\windows\system\TFVE.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABUFSHR.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2868 -
C:\windows\system\ABUFSHR.exeC:\windows\system\ABUFSHR.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NDDEY.exe.bat" "86⤵PID:2552
-
C:\windows\system\NDDEY.exeC:\windows\system\NDDEY.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IJL.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5580 -
C:\windows\SysWOW64\IJL.exeC:\windows\system32\IJL.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AJRMV.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5920 -
C:\windows\system\AJRMV.exeC:\windows\system\AJRMV.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFDFB.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3428 -
C:\windows\SysWOW64\GFDFB.exeC:\windows\system32\GFDFB.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFSYS.exe.bat" "94⤵PID:1900
-
C:\windows\SysWOW64\ZFSYS.exeC:\windows\system32\ZFSYS.exe95⤵
- Executes dropped EXE
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNZYWUD.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5892 -
C:\windows\DNZYWUD.exeC:\windows\DNZYWUD.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SDAYDI.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3168 -
C:\windows\SDAYDI.exeC:\windows\SDAYDI.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJMEO.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5404 -
C:\windows\SysWOW64\AJMEO.exeC:\windows\system32\AJMEO.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TMQATEX.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4548 -
C:\windows\SysWOW64\TMQATEX.exeC:\windows\system32\TMQATEX.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKWUIMY.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5476 -
C:\windows\DKWUIMY.exeC:\windows\DKWUIMY.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OCLFS.exe.bat" "106⤵
- Executes a command shell one-liner
PID:3284 -
C:\windows\OCLFS.exeC:\windows\OCLFS.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PFPJ.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4508 -
C:\windows\SysWOW64\PFPJ.exeC:\windows\system32\PFPJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OQS.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4988 -
C:\windows\system\OQS.exeC:\windows\system\OQS.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QOFMV.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\windows\QOFMV.exeC:\windows\QOFMV.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QRJP.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3856 -
C:\windows\system\QRJP.exeC:\windows\system\QRJP.exe115⤵
- Executes dropped EXE
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APPCIQE.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4904 -
C:\windows\APPCIQE.exeC:\windows\APPCIQE.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXVK.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2016 -
C:\windows\system\EXVK.exeC:\windows\system\EXVK.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BXFMY.exe.bat" "120⤵PID:1952
-
C:\windows\system\BXFMY.exeC:\windows\system\BXFMY.exe121⤵
- Executes dropped EXE
PID:4536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-