Analysis
- max time kernel
92s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 11:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe
- Size 208KB
- Sample260809-napa4adr7x
- SHA256 9b8adc5a80119d0a38ae0049bef1bf516707fb84659d281e2dd033f399503d72
- MD5 339a19ec289d29901bb4beac9f40285c
- SHA1 ab10946644a8881ba70452be7fb063696faef58e
- SHA512 af675d10a531cb172a6a85da4e9cba6264ee10a7335c4632a425d0182cd1720f03f0129941951aa7eb792454deb6e0ebd74099c26ccea00c0da7ca8e6cd7cea4
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOf24pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LOekEj1
- TLSH T155247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4876 NQR.exe 4256 GYGND.exe 2476 JLYWWL.exe 2592 RZKDH.exe 3624 VCI.exe 2672 DHV.exe 5652 SKEJCV.exe 2192 CIK.exe 1896 MIMJV.exe 5796 UOZP.exe 4456 QPASK.exe 5744 MZJ.exe 5280 OXX.exe 2040 QFFZMJE.exe 4488 GVTR.exe 956 OJXX.exe 4736 FJMD.exe 4292 XRAA.exe 564 QFZYJ.exe 1244 FVNPZ.exe 2888 XTN.exe 5248 ILWCU.exe 4712 SEGJGMG.exe 5788 URX.exe 4516 KPLCH.exe 5704 NYTROZ.exe 2520 EYAWBQB.exe 1508 MLMDDO.exe 1424 DUBAQF.exe 5904 PHAGVHO.exe 5244 SURIOA.exe 3040 FSRTQM.exe 5700 WAFRDD.exe 5736 VLQHM.exe 1924 OEY.exe 3620 IEN.exe 6080 EXP.exe 4540 WFDKD.exe 2392 LVRCL.exe 4564 HBRN.exe 4076 XMC.exe 2904 TWKUJH.exe 4068 VMYOZ.exe 2732 ZNZR.exe 3204 HAMF.exe 1316 JYS.exe 5572 FBAQJD.exe 1816 SHICT.exe 1956 RRLS.exe 3948 TPQ.exe 2240 XVJCZHZ.exe 208 HVLHC.exe 5260 WLMYJA.exe 5740 EYYNUY.exe 5040 IHF.exe 1992 QUK.exe 6124 RXAPXQ.exe 2760 RSM.exe 1260 ZGQSNNK.exe 5900 BDWMDVL.exe 1104 YWGOHR.exe 6064 DWPZS.exe 2548 UFWWFMF.exe 1764 JAN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\FBAQJD.exe.bat JYS.exe File created C:\windows\SysWOW64\OJXX.exe GVTR.exe File created C:\windows\SysWOW64\NYTROZ.exe KPLCH.exe File opened for modification C:\windows\SysWOW64\TWKUJH.exe XMC.exe File created C:\windows\SysWOW64\FBAQJD.exe JYS.exe File opened for modification C:\windows\SysWOW64\JAN.exe UFWWFMF.exe File opened for modification C:\windows\SysWOW64\NDMVQS.exe JAN.exe File created C:\windows\SysWOW64\MBGQR.exe ZVYEPFJ.exe File created C:\windows\SysWOW64\TWKUJH.exe.bat XMC.exe File opened for modification C:\windows\SysWOW64\UOZP.exe MIMJV.exe File created C:\windows\SysWOW64\OJXX.exe.bat GVTR.exe File created C:\windows\SysWOW64\FSRTQM.exe.bat SURIOA.exe File opened for modification C:\windows\SysWOW64\GNXFH.exe LSS.exe File created C:\windows\SysWOW64\URWXLWA.exe MEWIKJ.exe File created C:\windows\SysWOW64\RZKDH.exe.bat JLYWWL.exe File created C:\windows\SysWOW64\MZJ.exe.bat QPASK.exe File created C:\windows\SysWOW64\QFZYJ.exe.bat XRAA.exe File created C:\windows\SysWOW64\ZNZR.exe.bat VMYOZ.exe File created C:\windows\SysWOW64\QUK.exe IHF.exe File opened for modification C:\windows\SysWOW64\YWGOHR.exe BDWMDVL.exe File created C:\windows\SysWOW64\NDAU.exe.bat CKFB.exe File opened for modification C:\windows\SysWOW64\RJLBI.exe NETMZS.exe File opened for modification C:\windows\SysWOW64\MIMJV.exe CIK.exe File created C:\windows\SysWOW64\JYS.exe.bat HAMF.exe File opened for modification C:\windows\SysWOW64\RRLS.exe SHICT.exe File created C:\windows\SysWOW64\UFWWFMF.exe.bat DWPZS.exe File created C:\windows\SysWOW64\NJN.exe UGJFOE.exe File created C:\windows\SysWOW64\RJLBI.exe.bat NETMZS.exe File created C:\windows\SysWOW64\MLMDDO.exe EYAWBQB.exe File created C:\windows\SysWOW64\FVNPZ.exe.bat QFZYJ.exe File opened for modification C:\windows\SysWOW64\FSRTQM.exe SURIOA.exe File created C:\windows\SysWOW64\NDMVQS.exe.bat JAN.exe File opened for modification C:\windows\SysWOW64\LSS.exe TXPSRT.exe File created C:\windows\SysWOW64\NQR.exe 2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe File created C:\windows\SysWOW64\UOZP.exe MIMJV.exe File opened for modification C:\windows\SysWOW64\NYTROZ.exe KPLCH.exe File created C:\windows\SysWOW64\FSRTQM.exe SURIOA.exe File opened for modification C:\windows\SysWOW64\JYS.exe HAMF.exe File created C:\windows\SysWOW64\GES.exe.bat AQTVT.exe File created C:\windows\SysWOW64\LSS.exe TXPSRT.exe File created C:\windows\SysWOW64\LSS.exe.bat TXPSRT.exe File opened for modification C:\windows\SysWOW64\OJXX.exe GVTR.exe File created C:\windows\SysWOW64\NYTROZ.exe.bat KPLCH.exe File created C:\windows\SysWOW64\ZNZR.exe VMYOZ.exe File created C:\windows\SysWOW64\JYS.exe HAMF.exe File opened for modification C:\windows\SysWOW64\IHF.exe EYYNUY.exe File created C:\windows\SysWOW64\JPE.exe.bat FMFCTAZ.exe File opened for modification C:\windows\SysWOW64\GES.exe AQTVT.exe File created C:\windows\SysWOW64\HEO.exe.bat SBEUU.exe File opened for modification C:\windows\SysWOW64\ZNZR.exe VMYOZ.exe File created C:\windows\SysWOW64\RRLS.exe.bat SHICT.exe File created C:\windows\SysWOW64\JAN.exe.bat UFWWFMF.exe File opened for modification C:\windows\SysWOW64\NJN.exe UGJFOE.exe File created C:\windows\SysWOW64\GNXFH.exe LSS.exe File created C:\windows\SysWOW64\GNXFH.exe.bat LSS.exe File opened for modification C:\windows\SysWOW64\WEXZAB.exe CRSPY.exe File opened for modification C:\windows\SysWOW64\URWXLWA.exe MEWIKJ.exe File created C:\windows\SysWOW64\QFZYJ.exe XRAA.exe File created C:\windows\SysWOW64\FVNPZ.exe QFZYJ.exe File created C:\windows\SysWOW64\MLMDDO.exe.bat EYAWBQB.exe File opened for modification C:\windows\SysWOW64\FBAQJD.exe JYS.exe File created C:\windows\SysWOW64\YWGOHR.exe.bat BDWMDVL.exe File created C:\windows\SysWOW64\NDAU.exe CKFB.exe File opened for modification C:\windows\SysWOW64\SJWD.exe NDAU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\PTMFSBI.exe.bat DLXF.exe File opened for modification C:\windows\ZVYEPFJ.exe ALV.exe File created C:\windows\system\XNYHSTR.exe.bat CZTYH.exe File opened for modification C:\windows\system\URX.exe SEGJGMG.exe File created C:\windows\system\URX.exe.bat SEGJGMG.exe File opened for modification C:\windows\system\SHICT.exe FBAQJD.exe File created C:\windows\EYYNUY.exe.bat WLMYJA.exe File created C:\windows\GYGND.exe NQR.exe File opened for modification C:\windows\system\VCI.exe RZKDH.exe File created C:\windows\system\QPASK.exe.bat UOZP.exe File created C:\windows\XVJCZHZ.exe.bat TPQ.exe File created C:\windows\BDWMDVL.exe.bat ZGQSNNK.exe File opened for modification C:\windows\GTX.exe GNXFH.exe File opened for modification C:\windows\system\CRSPY.exe HEO.exe File created C:\windows\system\RRC.exe WEXZAB.exe File opened for modification C:\windows\FJMD.exe OJXX.exe File created C:\windows\SURIOA.exe PHAGVHO.exe File created C:\windows\LVRCL.exe WFDKD.exe File opened for modification C:\windows\HVLHC.exe XVJCZHZ.exe File opened for modification C:\windows\system\RSM.exe RXAPXQ.exe File created C:\windows\system\SBEUU.exe GTX.exe File created C:\windows\system\WDOOU.exe HIFKJMY.exe File opened for modification C:\windows\BIEWFYI.exe RAC.exe File created C:\windows\VLQHM.exe WAFRDD.exe File opened for modification C:\windows\system\RXAPXQ.exe QUK.exe File opened for modification C:\windows\AQTVT.exe TNJRICL.exe File opened for modification C:\windows\QDO.exe BIEWFYI.exe File opened for modification C:\windows\system\QPASK.exe UOZP.exe File created C:\windows\FJMD.exe.bat OJXX.exe File created C:\windows\XRAA.exe.bat FJMD.exe File opened for modification C:\windows\KPLCH.exe URX.exe File created C:\windows\system\WAFRDD.exe FSRTQM.exe File created C:\windows\system\SHICT.exe.bat FBAQJD.exe File created C:\windows\GTX.exe GNXFH.exe File created C:\windows\SCNEALU.exe MBGQR.exe File created C:\windows\GYGND.exe.bat NQR.exe File opened for modification C:\windows\BDWMDVL.exe ZGQSNNK.exe File created C:\windows\system\FMFCTAZ.exe.bat RCPLFQE.exe File opened for modification C:\windows\SCNEALU.exe MBGQR.exe File created C:\windows\SCNEALU.exe.bat MBGQR.exe File created C:\windows\system\JLYWWL.exe.bat GYGND.exe File created C:\windows\system\VCI.exe.bat RZKDH.exe File opened for modification C:\windows\CIK.exe SKEJCV.exe File created C:\windows\system\DUBAQF.exe.bat MLMDDO.exe File opened for modification C:\windows\GYGND.exe NQR.exe File created C:\windows\XTN.exe.bat FVNPZ.exe File created C:\windows\system\ZGQSNNK.exe.bat RSM.exe File created C:\windows\system\ALV.exe WDOOU.exe File opened for modification C:\windows\system\XNYHSTR.exe CZTYH.exe File created C:\windows\system\DHV.exe.bat VCI.exe File created C:\windows\CIK.exe.bat SKEJCV.exe File opened for modification C:\windows\XVJCZHZ.exe TPQ.exe File created C:\windows\system\RSM.exe.bat RXAPXQ.exe File opened for modification C:\windows\system\DLXF.exe WVWFHV.exe File opened for modification C:\windows\system\MEWIKJ.exe KGQ.exe File created C:\windows\ZVYEPFJ.exe.bat ALV.exe File created C:\windows\QDO.exe BIEWFYI.exe File opened for modification C:\windows\XTN.exe FVNPZ.exe File created C:\windows\ILWCU.exe.bat XTN.exe File created C:\windows\system\DUBAQF.exe MLMDDO.exe File created C:\windows\PHAGVHO.exe.bat DUBAQF.exe File opened for modification C:\windows\system\WLMYJA.exe HVLHC.exe File created C:\windows\UGJFOE.exe.bat BOUUED.exe File created C:\windows\NETMZS.exe.bat SJWD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5176 cmd.exe 2936 cmd.exe 1736 cmd.exe 3260 cmd.exe 1772 cmd.exe 4240 cmd.exe 520 cmd.exe 2768 cmd.exe 5476 cmd.exe 3108 cmd.exe 2012 cmd.exe 4644 cmd.exe 468 cmd.exe 2756 cmd.exe 5960 cmd.exe 3200 cmd.exe 4660 cmd.exe 3564 cmd.exe 2736 cmd.exe 2496 cmd.exe 3832 cmd.exe 1704 cmd.exe 4684 cmd.exe 1240 cmd.exe 5240 cmd.exe 960 cmd.exe 3496 cmd.exe 4348 cmd.exe 6140 cmd.exe 3300 cmd.exe 5512 cmd.exe 5780 cmd.exe 1228 cmd.exe 3736 cmd.exe 4764 cmd.exe 1312 cmd.exe 6132 cmd.exe 248 cmd.exe 3032 cmd.exe 2344 cmd.exe 1984 cmd.exe 1100 cmd.exe 4756 cmd.exe 1064 cmd.exe 2052 cmd.exe 5020 cmd.exe 1236 cmd.exe 5316 cmd.exe 5156 cmd.exe 2720 cmd.exe 4816 cmd.exe 1432 cmd.exe 5856 cmd.exe 4304 cmd.exe 3320 cmd.exe 4472 cmd.exe 5952 cmd.exe 4740 cmd.exe 3376 cmd.exe 4328 cmd.exe 4768 cmd.exe 1256 cmd.exe 240 cmd.exe 4300 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1204 4116 WerFault.exe 88 5580 4876 WerFault.exe 93 1740 4256 WerFault.exe 99 2984 2476 WerFault.exe 104 3144 2592 WerFault.exe 109 968 3624 WerFault.exe 114 4264 2672 WerFault.exe 119 6036 5652 WerFault.exe 124 5920 2192 WerFault.exe 128 1292 1896 WerFault.exe 134 2568 5796 WerFault.exe 139 2812 4456 WerFault.exe 144 2444 5744 WerFault.exe 149 1016 5280 WerFault.exe 154 3088 2040 WerFault.exe 159 3144 4488 WerFault.exe 164 4948 956 WerFault.exe 169 5784 4736 WerFault.exe 174 2136 4292 WerFault.exe 179 1464 564 WerFault.exe 184 2348 1244 WerFault.exe 189 5848 2888 WerFault.exe 194 4944 5248 WerFault.exe 199 5768 4712 WerFault.exe 204 4888 5788 WerFault.exe 209 5084 4516 WerFault.exe 214 3604 5704 WerFault.exe 219 4540 2520 WerFault.exe 224 2496 1508 WerFault.exe 229 4088 1424 WerFault.exe 234 1900 5904 WerFault.exe 239 4884 5244 WerFault.exe 244 3644 3040 WerFault.exe 249 4612 5700 WerFault.exe 255 2364 5736 WerFault.exe 260 1316 1924 WerFault.exe 265 5616 3620 WerFault.exe 270 2856 6080 WerFault.exe 275 5756 4540 WerFault.exe 280 4620 2392 WerFault.exe 285 4892 4564 WerFault.exe 290 5304 4076 WerFault.exe 295 3320 2904 WerFault.exe 300 1748 4068 WerFault.exe 305 5176 2732 WerFault.exe 310 1256 3204 WerFault.exe 315 5600 1316 WerFault.exe 320 2856 5572 WerFault.exe 325 1124 1816 WerFault.exe 330 1260 1956 WerFault.exe 335 1380 3948 WerFault.exe 340 2932 2240 WerFault.exe 345 2440 208 WerFault.exe 350 2268 5260 WerFault.exe 355 5780 5740 WerFault.exe 360 3348 5040 WerFault.exe 365 4900 1992 WerFault.exe 370 2292 6124 WerFault.exe 375 5968 2760 WerFault.exe 380 4400 1260 WerFault.exe 385 2980 5900 WerFault.exe 390 1232 1104 WerFault.exe 395 2268 6064 WerFault.exe 400 3760 2548 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVLHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPSRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIEWFYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFDKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIMJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXAPXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVWFHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSRTQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJLBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEGJGMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLQHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVRCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWKUJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLMYJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBAQJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKFB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RZKDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOUUED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVYEPFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYGND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYYNUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4116 2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe 4116 2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe 4876 NQR.exe 4876 NQR.exe 4256 GYGND.exe 4256 GYGND.exe 2476 JLYWWL.exe 2476 JLYWWL.exe 2592 RZKDH.exe 2592 RZKDH.exe 3624 VCI.exe 3624 VCI.exe 2672 DHV.exe 2672 DHV.exe 5652 SKEJCV.exe 5652 SKEJCV.exe 2192 CIK.exe 2192 CIK.exe 1896 MIMJV.exe 1896 MIMJV.exe 5796 UOZP.exe 5796 UOZP.exe 4456 QPASK.exe 4456 QPASK.exe 5744 MZJ.exe 5744 MZJ.exe 5280 OXX.exe 5280 OXX.exe 2040 QFFZMJE.exe 2040 QFFZMJE.exe 4488 GVTR.exe 4488 GVTR.exe 956 OJXX.exe 956 OJXX.exe 4736 FJMD.exe 4736 FJMD.exe 4292 XRAA.exe 4292 XRAA.exe 564 QFZYJ.exe 564 QFZYJ.exe 1244 FVNPZ.exe 1244 FVNPZ.exe 2888 XTN.exe 2888 XTN.exe 5248 ILWCU.exe 5248 ILWCU.exe 4712 SEGJGMG.exe 4712 SEGJGMG.exe 5788 URX.exe 5788 URX.exe 4516 KPLCH.exe 4516 KPLCH.exe 5704 NYTROZ.exe 5704 NYTROZ.exe 2520 EYAWBQB.exe 2520 EYAWBQB.exe 1508 MLMDDO.exe 1508 MLMDDO.exe 1424 DUBAQF.exe 1424 DUBAQF.exe 5904 PHAGVHO.exe 5904 PHAGVHO.exe 5244 SURIOA.exe 5244 SURIOA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4116 2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe 4116 2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe 4876 NQR.exe 4876 NQR.exe 4256 GYGND.exe 4256 GYGND.exe 2476 JLYWWL.exe 2476 JLYWWL.exe 2592 RZKDH.exe 2592 RZKDH.exe 3624 VCI.exe 3624 VCI.exe 2672 DHV.exe 2672 DHV.exe 5652 SKEJCV.exe 5652 SKEJCV.exe 2192 CIK.exe 2192 CIK.exe 1896 MIMJV.exe 1896 MIMJV.exe 5796 UOZP.exe 5796 UOZP.exe 4456 QPASK.exe 4456 QPASK.exe 5744 MZJ.exe 5744 MZJ.exe 5280 OXX.exe 5280 OXX.exe 2040 QFFZMJE.exe 2040 QFFZMJE.exe 4488 GVTR.exe 4488 GVTR.exe 956 OJXX.exe 956 OJXX.exe 4736 FJMD.exe 4736 FJMD.exe 4292 XRAA.exe 4292 XRAA.exe 564 QFZYJ.exe 564 QFZYJ.exe 1244 FVNPZ.exe 1244 FVNPZ.exe 2888 XTN.exe 2888 XTN.exe 5248 ILWCU.exe 5248 ILWCU.exe 4712 SEGJGMG.exe 4712 SEGJGMG.exe 5788 URX.exe 5788 URX.exe 4516 KPLCH.exe 4516 KPLCH.exe 5704 NYTROZ.exe 5704 NYTROZ.exe 2520 EYAWBQB.exe 2520 EYAWBQB.exe 1508 MLMDDO.exe 1508 MLMDDO.exe 1424 DUBAQF.exe 1424 DUBAQF.exe 5904 PHAGVHO.exe 5904 PHAGVHO.exe 5244 SURIOA.exe 5244 SURIOA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4116 wrote to memory of 1468 4116 2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe 89 PID 1468 wrote to memory of 4876 1468 cmd.exe 93 PID 4876 wrote to memory of 3832 4876 NQR.exe 95 PID 3832 wrote to memory of 4256 3832 cmd.exe 99 PID 4256 wrote to memory of 1312 4256 GYGND.exe 100 PID 1312 wrote to memory of 2476 1312 cmd.exe 104 PID 2476 wrote to memory of 5940 2476 JLYWWL.exe 105 PID 5940 wrote to memory of 2592 5940 cmd.exe 109 PID 2592 wrote to memory of 716 2592 RZKDH.exe 110 PID 716 wrote to memory of 3624 716 cmd.exe 114 PID 3624 wrote to memory of 4332 3624 VCI.exe 115 PID 4332 wrote to memory of 2672 4332 cmd.exe 119 PID 2672 wrote to memory of 1076 2672 DHV.exe 120 PID 1076 wrote to memory of 5652 1076 cmd.exe 124 PID 5652 wrote to memory of 2052 5652 SKEJCV.exe 125 PID 2052 wrote to memory of 2192 2052 cmd.exe 128 PID 2192 wrote to memory of 3280 2192 CIK.exe 130 PID 3280 wrote to memory of 1896 3280 cmd.exe 134 PID 1896 wrote to memory of 1200 1896 MIMJV.exe 135 PID 1200 wrote to memory of 5796 1200 cmd.exe 139 PID 5796 wrote to memory of 4576 5796 UOZP.exe 140 PID 4576 wrote to memory of 4456 4576 cmd.exe 144 PID 4456 wrote to memory of 6140 4456 QPASK.exe 145 PID 6140 wrote to memory of 5744 6140 cmd.exe 149 PID 5744 wrote to memory of 1704 5744 MZJ.exe 150 PID 1704 wrote to memory of 5280 1704 cmd.exe 154 PID 5280 wrote to memory of 4768 5280 OXX.exe 155 PID 4768 wrote to memory of 2040 4768 cmd.exe 159 PID 2040 wrote to memory of 1736 2040 QFFZMJE.exe 160 PID 1736 wrote to memory of 4488 1736 cmd.exe 164 PID 4488 wrote to memory of 3300 4488 GVTR.exe 165 PID 3300 wrote to memory of 956 3300 cmd.exe 169 PID 956 wrote to memory of 5856 956 OJXX.exe 170 PID 5856 wrote to memory of 4736 5856 cmd.exe 174 PID 4736 wrote to memory of 4684 4736 FJMD.exe 175 PID 4684 wrote to memory of 4292 4684 cmd.exe 179 PID 4292 wrote to memory of 1988 4292 XRAA.exe 180 PID 1988 wrote to memory of 564 1988 cmd.exe 184 PID 564 wrote to memory of 5920 564 QFZYJ.exe 185 PID 5920 wrote to memory of 1244 5920 cmd.exe 189 PID 1244 wrote to memory of 468 1244 FVNPZ.exe 190 PID 468 wrote to memory of 2888 468 cmd.exe 194 PID 2888 wrote to memory of 4808 2888 XTN.exe 195 PID 4808 wrote to memory of 5248 4808 cmd.exe 199 PID 5248 wrote to memory of 2544 5248 ILWCU.exe 200 PID 2544 wrote to memory of 4712 2544 cmd.exe 204 PID 4712 wrote to memory of 3064 4712 SEGJGMG.exe 205 PID 3064 wrote to memory of 5788 3064 cmd.exe 209 PID 5788 wrote to memory of 5880 5788 URX.exe 210 PID 5880 wrote to memory of 4516 5880 cmd.exe 214 PID 4516 wrote to memory of 560 4516 KPLCH.exe 215 PID 560 wrote to memory of 5704 560 cmd.exe 219 PID 5704 wrote to memory of 2168 5704 NYTROZ.exe 220 PID 2168 wrote to memory of 2520 2168 cmd.exe 224 PID 2520 wrote to memory of 3820 2520 EYAWBQB.exe 225 PID 3820 wrote to memory of 1508 3820 cmd.exe 229 PID 1508 wrote to memory of 5752 1508 MLMDDO.exe 230 PID 5752 wrote to memory of 1424 5752 cmd.exe 234 PID 1424 wrote to memory of 4428 1424 DUBAQF.exe 235 PID 4428 wrote to memory of 5904 4428 cmd.exe 239 PID 5904 wrote to memory of 520 5904 PHAGVHO.exe 240 PID 520 wrote to memory of 5244 520 cmd.exe 244 PID 5244 wrote to memory of 2768 5244 SURIOA.exe 245 PID 2768 wrote to memory of 3040 2768 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_339a19ec289d29901bb4beac9f40285c_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NQR.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\windows\SysWOW64\NQR.exeC:\windows\system32\NQR.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYGND.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\windows\GYGND.exeC:\windows\GYGND.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLYWWL.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\system\JLYWWL.exeC:\windows\system\JLYWWL.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RZKDH.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\SysWOW64\RZKDH.exeC:\windows\system32\RZKDH.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCI.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\system\VCI.exeC:\windows\system\VCI.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DHV.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\system\DHV.exeC:\windows\system\DHV.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKEJCV.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\windows\system\SKEJCV.exeC:\windows\system\SKEJCV.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CIK.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\windows\CIK.exeC:\windows\CIK.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIMJV.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\windows\SysWOW64\MIMJV.exeC:\windows\system32\MIMJV.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UOZP.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\windows\SysWOW64\UOZP.exeC:\windows\system32\UOZP.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPASK.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\system\QPASK.exeC:\windows\system\QPASK.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZJ.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\windows\SysWOW64\MZJ.exeC:\windows\system32\MZJ.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXX.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\windows\OXX.exeC:\windows\OXX.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFFZMJE.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\system\QFFZMJE.exeC:\windows\system\QFFZMJE.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVTR.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\GVTR.exeC:\windows\GVTR.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJXX.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\windows\SysWOW64\OJXX.exeC:\windows\system32\OJXX.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJMD.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\FJMD.exeC:\windows\FJMD.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRAA.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\XRAA.exeC:\windows\XRAA.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFZYJ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\windows\SysWOW64\QFZYJ.exeC:\windows\system32\QFZYJ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVNPZ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\SysWOW64\FVNPZ.exeC:\windows\system32\FVNPZ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTN.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:468 -
C:\windows\XTN.exeC:\windows\XTN.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILWCU.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\windows\ILWCU.exeC:\windows\ILWCU.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEGJGMG.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\windows\system\SEGJGMG.exeC:\windows\system\SEGJGMG.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URX.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\system\URX.exeC:\windows\system\URX.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPLCH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\windows\KPLCH.exeC:\windows\KPLCH.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EYAWBQB.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\windows\system\EYAWBQB.exeC:\windows\system\EYAWBQB.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLMDDO.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\windows\SysWOW64\MLMDDO.exeC:\windows\system32\MLMDDO.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DUBAQF.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\system\DUBAQF.exeC:\windows\system\DUBAQF.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHAGVHO.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\windows\PHAGVHO.exeC:\windows\PHAGVHO.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SURIOA.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:520 -
C:\windows\SURIOA.exeC:\windows\SURIOA.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSRTQM.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\windows\SysWOW64\FSRTQM.exeC:\windows\system32\FSRTQM.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WAFRDD.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1240 -
C:\windows\system\WAFRDD.exeC:\windows\system\WAFRDD.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLQHM.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1040 -
C:\windows\VLQHM.exeC:\windows\VLQHM.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEY.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2664 -
C:\windows\system\OEY.exeC:\windows\system\OEY.exe71⤵
- Executes dropped EXE
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEN.exe.bat" "72⤵PID:5404
-
C:\windows\system\IEN.exeC:\windows\system\IEN.exe73⤵
- Executes dropped EXE
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXP.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4128 -
C:\windows\system\EXP.exeC:\windows\system\EXP.exe75⤵
- Executes dropped EXE
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFDKD.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1912 -
C:\windows\WFDKD.exeC:\windows\WFDKD.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVRCL.exe.bat" "78⤵PID:3720
-
C:\windows\LVRCL.exeC:\windows\LVRCL.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBRN.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5240 -
C:\windows\system\HBRN.exeC:\windows\system\HBRN.exe81⤵
- Executes dropped EXE
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMC.exe.bat" "82⤵PID:5308
-
C:\windows\XMC.exeC:\windows\XMC.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWKUJH.exe.bat" "84⤵PID:4236
-
C:\windows\SysWOW64\TWKUJH.exeC:\windows\system32\TWKUJH.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMYOZ.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:1136 -
C:\windows\system\VMYOZ.exeC:\windows\system\VMYOZ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNZR.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1100 -
C:\windows\SysWOW64\ZNZR.exeC:\windows\system32\ZNZR.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAMF.exe.bat" "90⤵PID:1536
-
C:\windows\HAMF.exeC:\windows\HAMF.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYS.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:2944 -
C:\windows\SysWOW64\JYS.exeC:\windows\system32\JYS.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBAQJD.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:932 -
C:\windows\SysWOW64\FBAQJD.exeC:\windows\system32\FBAQJD.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SHICT.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4172 -
C:\windows\system\SHICT.exeC:\windows\system\SHICT.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRLS.exe.bat" "98⤵PID:2652
-
C:\windows\SysWOW64\RRLS.exeC:\windows\system32\RRLS.exe99⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TPQ.exe.bat" "100⤵PID:4352
-
C:\windows\SysWOW64\TPQ.exeC:\windows\system32\TPQ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XVJCZHZ.exe.bat" "102⤵PID:4164
-
C:\windows\XVJCZHZ.exeC:\windows\XVJCZHZ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVLHC.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5512 -
C:\windows\HVLHC.exeC:\windows\HVLHC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLMYJA.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\windows\system\WLMYJA.exeC:\windows\system\WLMYJA.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYYNUY.exe.bat" "108⤵PID:5916
-
C:\windows\EYYNUY.exeC:\windows\EYYNUY.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHF.exe.bat" "110⤵PID:5768
-
C:\windows\SysWOW64\IHF.exeC:\windows\system32\IHF.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUK.exe.bat" "112⤵PID:3176
-
C:\windows\SysWOW64\QUK.exeC:\windows\system32\QUK.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXAPXQ.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1400 -
C:\windows\system\RXAPXQ.exeC:\windows\system\RXAPXQ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSM.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3260 -
C:\windows\system\RSM.exeC:\windows\system\RSM.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGQSNNK.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3416 -
C:\windows\system\ZGQSNNK.exeC:\windows\system\ZGQSNNK.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDWMDVL.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1772 -
C:\windows\BDWMDVL.exeC:\windows\BDWMDVL.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-