Analysis
- max time kernel
81s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 12:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe
- Size 208KB
- Sample260809-pqdd7s1tev
- SHA256 fe234411fd4a083293261f22eed8ec4618c9106592918fcaf4cdecb7c377862a
- MD5 848366347205bf06adf1ca296a50d5d1
- SHA1 bd1a58b8d396554ead5950d72ed3d81855b83c44
- SHA512 e386bbbcad7e0abf5e26b825f72741d73e05c70cd116b7cfc96c1221b3dfe859d0e896153069ce5b06d84dca496e03b5c03f661391d015c820665b9d7db7306b
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlJdL+LOf64pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlJ5+LOykEj1
- TLSH T114247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4276 BAWSN.exe 52 TTA.exe 1088 OGWBK.exe 5940 FPYGOB.exe 3044 ACD.exe 1644 SFHLD.exe 2636 HAY.exe 3948 CNDH.exe 4964 RDE.exe 6092 VMLGS.exe 2676 HCR.exe 4596 CPWQ.exe 1892 AAZ.exe 3068 VVEPZ.exe 2608 ZDLXLAW.exe 2612 FYKYQ.exe 2092 JGQ.exe 1936 PHYUL.exe 4612 YPAZPV.exe 2376 CXHZ.exe 5920 XKLIL.exe 5156 IDOBLUD.exe 2464 ZLQ.exe 3232 DTXOBKB.exe 3288 EWBK.exe 4288 YKGTZA.exe 4452 CAM.exe 4780 VDQXQIP.exe 1132 UNBN.exe 2028 SDMQM.exe 4616 VLVF.exe 4944 QHAODV.exe 3612 WHH.exe 3052 QUMTX.exe 1364 NAKIEZ.exe 1904 SDOPJQ.exe 1392 YYN.exe 3900 PLYI.exe 5428 EJVFKA.exe 1496 GHXZ.exe 2644 CMUWYY.exe 2164 TVJBKP.exe 5872 SFUJL.exe 5704 YBXKZ.exe 572 GLGMNWB.exe 3864 VBHD.exe 1744 FKJIXPS.exe 1348 UFSUI.exe 1100 TPDKQPP.exe 1116 XFKKDI.exe 3728 OGMPGFN.exe 4740 JTV.exe 4368 DOAIC.exe 5812 TEBAIM.exe 5928 TZNEO.exe 2916 MCQZTAR.exe 3816 GQVJ.exe 2880 ODA.exe 4848 TJSN.exe 5216 STV.exe 5292 SZVJ.exe 5584 FKEIDXI.exe 4896 WKG.exe 1884 AAMVSNG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YKGTZA.exe EWBK.exe File opened for modification C:\windows\SysWOW64\EJVFKA.exe PLYI.exe File created C:\windows\SysWOW64\GQVJ.exe.bat MCQZTAR.exe File created C:\windows\SysWOW64\AAZ.exe.bat CPWQ.exe File created C:\windows\SysWOW64\EJVFKA.exe.bat PLYI.exe File created C:\windows\SysWOW64\SZVJ.exe.bat STV.exe File opened for modification C:\windows\SysWOW64\FACOCS.exe AMO.exe File created C:\windows\SysWOW64\FACOCS.exe.bat AMO.exe File created C:\windows\SysWOW64\JALYHI.exe.bat HDFERZV.exe File created C:\windows\SysWOW64\TAYMNS.exe.bat CSWHJ.exe File opened for modification C:\windows\SysWOW64\HAY.exe SFHLD.exe File created C:\windows\SysWOW64\HHBAM.exe.bat XZZV.exe File created C:\windows\SysWOW64\HDFERZV.exe.bat HHBAM.exe File created C:\windows\SysWOW64\CSWHJ.exe.bat YKPZXC.exe File opened for modification C:\windows\SysWOW64\OGWBK.exe TTA.exe File created C:\windows\SysWOW64\HAY.exe SFHLD.exe File created C:\windows\SysWOW64\YKGTZA.exe.bat EWBK.exe File created C:\windows\SysWOW64\VDQXQIP.exe.bat CAM.exe File created C:\windows\SysWOW64\TJSN.exe ODA.exe File opened for modification C:\windows\SysWOW64\NXLW.exe NSKH.exe File created C:\windows\SysWOW64\BAWSN.exe.bat 2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe File created C:\windows\SysWOW64\SFHLD.exe.bat ACD.exe File opened for modification C:\windows\SysWOW64\AAZ.exe CPWQ.exe File opened for modification C:\windows\SysWOW64\QHAODV.exe VLVF.exe File created C:\windows\SysWOW64\UFSUI.exe.bat FKJIXPS.exe File created C:\windows\SysWOW64\OCFK.exe.bat LPB.exe File opened for modification C:\windows\SysWOW64\XZZV.exe KWJX.exe File created C:\windows\SysWOW64\MCQZTAR.exe.bat TZNEO.exe File opened for modification C:\windows\SysWOW64\GQVJ.exe MCQZTAR.exe File created C:\windows\SysWOW64\STV.exe TJSN.exe File created C:\windows\SysWOW64\WKG.exe.bat FKEIDXI.exe File created C:\windows\SysWOW64\JALYHI.exe HDFERZV.exe File created C:\windows\SysWOW64\NSKH.exe UZDW.exe File opened for modification C:\windows\SysWOW64\NSKH.exe UZDW.exe File opened for modification C:\windows\SysWOW64\JUOH.exe UZFVGU.exe File created C:\windows\SysWOW64\HAY.exe.bat SFHLD.exe File created C:\windows\SysWOW64\VMLGS.exe RDE.exe File created C:\windows\SysWOW64\QHAODV.exe VLVF.exe File opened for modification C:\windows\SysWOW64\YBXKZ.exe SFUJL.exe File created C:\windows\SysWOW64\STV.exe.bat TJSN.exe File created C:\windows\SysWOW64\OCFK.exe LPB.exe File created C:\windows\SysWOW64\NXLW.exe.bat NSKH.exe File created C:\windows\SysWOW64\JUOH.exe.bat UZFVGU.exe File created C:\windows\SysWOW64\YBXKZ.exe SFUJL.exe File created C:\windows\SysWOW64\VBDBWP.exe BOZS.exe File created C:\windows\SysWOW64\LRETD.exe.bat VBDBWP.exe File created C:\windows\SysWOW64\XZZV.exe.bat KWJX.exe File opened for modification C:\windows\SysWOW64\CSWHJ.exe YKPZXC.exe File opened for modification C:\windows\SysWOW64\TAYMNS.exe CSWHJ.exe File created C:\windows\SysWOW64\TTA.exe.bat BAWSN.exe File created C:\windows\SysWOW64\OGWBK.exe TTA.exe File created C:\windows\SysWOW64\OGWBK.exe.bat TTA.exe File created C:\windows\SysWOW64\SFHLD.exe ACD.exe File opened for modification C:\windows\SysWOW64\VDQXQIP.exe CAM.exe File created C:\windows\SysWOW64\ODA.exe.bat GQVJ.exe File created C:\windows\SysWOW64\VBDBWP.exe.bat BOZS.exe File opened for modification C:\windows\SysWOW64\LRETD.exe VBDBWP.exe File opened for modification C:\windows\SysWOW64\BAWSN.exe 2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe File created C:\windows\SysWOW64\VVEPZ.exe AAZ.exe File opened for modification C:\windows\SysWOW64\YKGTZA.exe EWBK.exe File created C:\windows\SysWOW64\QHAODV.exe.bat VLVF.exe File created C:\windows\SysWOW64\YBXKZ.exe.bat SFUJL.exe File opened for modification C:\windows\SysWOW64\MCQZTAR.exe TZNEO.exe File created C:\windows\SysWOW64\TJSN.exe.bat ODA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\VBHD.exe GLGMNWB.exe File opened for modification C:\windows\OAETG.exe FACOCS.exe File created C:\windows\system\LQU.exe KNQO.exe File opened for modification C:\windows\HCR.exe VMLGS.exe File created C:\windows\HCR.exe VMLGS.exe File opened for modification C:\windows\system\PLYI.exe YYN.exe File created C:\windows\AMO.exe.bat LRETD.exe File created C:\windows\ZYAX.exe.bat ILPFML.exe File created C:\windows\UZFVGU.exe KQDQC.exe File created C:\windows\FYKYQ.exe.bat ZDLXLAW.exe File created C:\windows\DTXOBKB.exe ZLQ.exe File created C:\windows\system\SDMQM.exe.bat UNBN.exe File created C:\windows\VLVF.exe.bat SDMQM.exe File created C:\windows\system\SFUJL.exe.bat TVJBKP.exe File created C:\windows\system\FKEIDXI.exe SZVJ.exe File opened for modification C:\windows\EITVF.exe AAMVSNG.exe File opened for modification C:\windows\VEQL.exe UBMHX.exe File created C:\windows\CNDH.exe HAY.exe File opened for modification C:\windows\CPWQ.exe HCR.exe File created C:\windows\system\XKLIL.exe CXHZ.exe File opened for modification C:\windows\QUMTX.exe WHH.exe File opened for modification C:\windows\VBHD.exe GLGMNWB.exe File opened for modification C:\windows\JTV.exe OGMPGFN.exe File created C:\windows\TEBAIM.exe DOAIC.exe File created C:\windows\AMO.exe LRETD.exe File created C:\windows\system\YPAZPV.exe.bat PHYUL.exe File created C:\windows\system\AAMVSNG.exe.bat WKG.exe File opened for modification C:\windows\AMO.exe LRETD.exe File opened for modification C:\windows\system\UBMHX.exe OAETG.exe File created C:\windows\system\DXPOG.exe OCFK.exe File opened for modification C:\windows\system\LQU.exe KNQO.exe File created C:\windows\TOHSREU.exe PGASE.exe File opened for modification C:\windows\system\YKPZXC.exe JUOH.exe File created C:\windows\system\EWBK.exe DTXOBKB.exe File created C:\windows\system\WHH.exe QHAODV.exe File opened for modification C:\windows\FKJIXPS.exe VBHD.exe File created C:\windows\VEQL.exe UBMHX.exe File created C:\windows\system\YKPZXC.exe.bat JUOH.exe File created C:\windows\system\UOKJGM.exe.bat ZBFA.exe File created C:\windows\CXHZ.exe YPAZPV.exe File opened for modification C:\windows\system\XKLIL.exe CXHZ.exe File created C:\windows\system\OGMPGFN.exe.bat XFKKDI.exe File created C:\windows\EITVF.exe.bat AAMVSNG.exe File created C:\windows\system\KNQO.exe DXPOG.exe File created C:\windows\KWJX.exe.bat TOHSREU.exe File created C:\windows\system\QJWWXN.exe.bat VWSN.exe File opened for modification C:\windows\system\ZBFA.exe TAYMNS.exe File created C:\windows\system\FPYGOB.exe.bat OGWBK.exe File created C:\windows\system\ZDLXLAW.exe.bat VVEPZ.exe File created C:\windows\FYKYQ.exe ZDLXLAW.exe File created C:\windows\system\UBMHX.exe.bat OAETG.exe File created C:\windows\UZDW.exe.bat QJWWXN.exe File created C:\windows\IUXDI.exe.bat DWMOSSQ.exe File created C:\windows\system\ACD.exe.bat FPYGOB.exe File opened for modification C:\windows\RDE.exe CNDH.exe File created C:\windows\CXHZ.exe.bat YPAZPV.exe File created C:\windows\system\XKLIL.exe.bat CXHZ.exe File created C:\windows\CAM.exe YKGTZA.exe File opened for modification C:\windows\system\SDMQM.exe UNBN.exe File created C:\windows\VLVF.exe SDMQM.exe File opened for modification C:\windows\CMUWYY.exe GHXZ.exe File created C:\windows\CPWQ.exe HCR.exe File created C:\windows\ZLQ.exe.bat IDOBLUD.exe File created C:\windows\TZNEO.exe.bat TEBAIM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1248 cmd.exe 4332 cmd.exe 3016 cmd.exe 3028 cmd.exe 4764 cmd.exe 720 cmd.exe 1664 cmd.exe 1000 cmd.exe 2944 cmd.exe 268 cmd.exe 5564 cmd.exe 4600 cmd.exe 5020 cmd.exe 3424 cmd.exe 4184 cmd.exe 940 cmd.exe 4352 cmd.exe 5368 cmd.exe 1716 cmd.exe 4360 cmd.exe 4168 cmd.exe 3144 cmd.exe 6064 cmd.exe 5548 cmd.exe 5748 cmd.exe 5520 cmd.exe 3744 cmd.exe 3524 cmd.exe 3512 cmd.exe 436 cmd.exe 4888 cmd.exe 2272 cmd.exe 3536 cmd.exe 3280 cmd.exe 1416 cmd.exe 5104 cmd.exe 1320 cmd.exe 2136 cmd.exe 2132 cmd.exe 1844 cmd.exe 5784 cmd.exe 5856 cmd.exe 4536 cmd.exe 2828 cmd.exe 4260 cmd.exe 1668 cmd.exe 2440 cmd.exe 2576 cmd.exe 2428 cmd.exe 1172 cmd.exe 2160 cmd.exe 3436 cmd.exe 4920 cmd.exe 3468 cmd.exe 1252 cmd.exe 2852 cmd.exe 2920 cmd.exe 5588 cmd.exe 5228 cmd.exe 1860 cmd.exe 2708 cmd.exe 5072 cmd.exe 1916 cmd.exe 4532 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4672 1836 WerFault.exe 87 4196 4276 WerFault.exe 92 1892 52 WerFault.exe 98 2300 1088 WerFault.exe 103 5160 5940 WerFault.exe 108 2032 3044 WerFault.exe 113 2400 1644 WerFault.exe 118 4468 2636 WerFault.exe 123 2732 3948 WerFault.exe 128 4692 4964 WerFault.exe 133 4992 6092 WerFault.exe 138 2824 2676 WerFault.exe 143 5508 4596 WerFault.exe 148 3424 1892 WerFault.exe 153 3508 3068 WerFault.exe 158 1948 2608 WerFault.exe 163 4836 2612 WerFault.exe 168 1320 2092 WerFault.exe 173 2448 1936 WerFault.exe 178 1516 4612 WerFault.exe 183 5356 2376 WerFault.exe 188 3000 5920 WerFault.exe 193 1844 5156 WerFault.exe 198 2700 2464 WerFault.exe 203 4400 3232 WerFault.exe 208 2128 3288 WerFault.exe 213 4728 4288 WerFault.exe 218 5732 4452 WerFault.exe 223 5796 4780 WerFault.exe 228 1100 1132 WerFault.exe 233 6128 2028 WerFault.exe 238 4120 4616 WerFault.exe 243 5584 4944 WerFault.exe 248 3188 3612 WerFault.exe 253 1732 3052 WerFault.exe 258 5068 1364 WerFault.exe 262 2664 1904 WerFault.exe 268 3144 1392 WerFault.exe 273 3208 3900 WerFault.exe 278 3136 5428 WerFault.exe 284 5216 1496 WerFault.exe 289 4716 2644 WerFault.exe 294 2868 2164 WerFault.exe 299 4192 5872 WerFault.exe 304 3884 5704 WerFault.exe 309 5844 572 WerFault.exe 314 4308 3864 WerFault.exe 319 5296 1744 WerFault.exe 324 4364 1348 WerFault.exe 329 5552 1100 WerFault.exe 334 5664 1116 WerFault.exe 339 2440 3728 WerFault.exe 344 5416 4740 WerFault.exe 349 1732 4368 WerFault.exe 354 3984 5812 WerFault.exe 359 3964 5928 WerFault.exe 364 3988 2916 WerFault.exe 369 3208 3816 WerFault.exe 374 1900 2880 WerFault.exe 379 728 4848 WerFault.exe 384 4820 5216 WerFault.exe 389 2424 5292 WerFault.exe 394 2660 5584 WerFault.exe 399 5068 4896 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGMPGFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFHLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTXOBKB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAETG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUMTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QJWWXN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UZFVGU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TAYMNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAWSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKGTZA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEBAIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EITVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOHSREU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXLW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPAZPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYKYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TJSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRETD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKPZXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKLIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKJIXPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFKKDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKEIDXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1836 2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe 1836 2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe 4276 BAWSN.exe 4276 BAWSN.exe 52 TTA.exe 52 TTA.exe 1088 OGWBK.exe 1088 OGWBK.exe 5940 FPYGOB.exe 5940 FPYGOB.exe 3044 ACD.exe 3044 ACD.exe 1644 SFHLD.exe 1644 SFHLD.exe 2636 HAY.exe 2636 HAY.exe 3948 CNDH.exe 3948 CNDH.exe 4964 RDE.exe 4964 RDE.exe 6092 VMLGS.exe 6092 VMLGS.exe 2676 HCR.exe 2676 HCR.exe 4596 CPWQ.exe 4596 CPWQ.exe 1892 AAZ.exe 1892 AAZ.exe 3068 VVEPZ.exe 3068 VVEPZ.exe 2608 ZDLXLAW.exe 2608 ZDLXLAW.exe 2612 FYKYQ.exe 2612 FYKYQ.exe 2092 JGQ.exe 2092 JGQ.exe 1936 PHYUL.exe 1936 PHYUL.exe 4612 YPAZPV.exe 4612 YPAZPV.exe 2376 CXHZ.exe 2376 CXHZ.exe 5920 XKLIL.exe 5920 XKLIL.exe 5156 IDOBLUD.exe 5156 IDOBLUD.exe 2464 ZLQ.exe 2464 ZLQ.exe 3232 DTXOBKB.exe 3232 DTXOBKB.exe 3288 EWBK.exe 3288 EWBK.exe 4288 YKGTZA.exe 4288 YKGTZA.exe 4452 CAM.exe 4452 CAM.exe 4780 VDQXQIP.exe 4780 VDQXQIP.exe 1132 UNBN.exe 1132 UNBN.exe 2028 SDMQM.exe 2028 SDMQM.exe 4616 VLVF.exe 4616 VLVF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1836 2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe 1836 2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe 4276 BAWSN.exe 4276 BAWSN.exe 52 TTA.exe 52 TTA.exe 1088 OGWBK.exe 1088 OGWBK.exe 5940 FPYGOB.exe 5940 FPYGOB.exe 3044 ACD.exe 3044 ACD.exe 1644 SFHLD.exe 1644 SFHLD.exe 2636 HAY.exe 2636 HAY.exe 3948 CNDH.exe 3948 CNDH.exe 4964 RDE.exe 4964 RDE.exe 6092 VMLGS.exe 6092 VMLGS.exe 2676 HCR.exe 2676 HCR.exe 4596 CPWQ.exe 4596 CPWQ.exe 1892 AAZ.exe 1892 AAZ.exe 3068 VVEPZ.exe 3068 VVEPZ.exe 2608 ZDLXLAW.exe 2608 ZDLXLAW.exe 2612 FYKYQ.exe 2612 FYKYQ.exe 2092 JGQ.exe 2092 JGQ.exe 1936 PHYUL.exe 1936 PHYUL.exe 4612 YPAZPV.exe 4612 YPAZPV.exe 2376 CXHZ.exe 2376 CXHZ.exe 5920 XKLIL.exe 5920 XKLIL.exe 5156 IDOBLUD.exe 5156 IDOBLUD.exe 2464 ZLQ.exe 2464 ZLQ.exe 3232 DTXOBKB.exe 3232 DTXOBKB.exe 3288 EWBK.exe 3288 EWBK.exe 4288 YKGTZA.exe 4288 YKGTZA.exe 4452 CAM.exe 4452 CAM.exe 4780 VDQXQIP.exe 4780 VDQXQIP.exe 1132 UNBN.exe 1132 UNBN.exe 2028 SDMQM.exe 2028 SDMQM.exe 4616 VLVF.exe 4616 VLVF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1836 wrote to memory of 1252 1836 2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe 88 PID 1252 wrote to memory of 4276 1252 cmd.exe 92 PID 4276 wrote to memory of 1256 4276 BAWSN.exe 94 PID 1256 wrote to memory of 52 1256 cmd.exe 98 PID 52 wrote to memory of 2600 52 TTA.exe 99 PID 2600 wrote to memory of 1088 2600 cmd.exe 103 PID 1088 wrote to memory of 1800 1088 OGWBK.exe 104 PID 1800 wrote to memory of 5940 1800 cmd.exe 108 PID 5940 wrote to memory of 2492 5940 FPYGOB.exe 109 PID 2492 wrote to memory of 3044 2492 cmd.exe 113 PID 3044 wrote to memory of 2816 3044 ACD.exe 114 PID 2816 wrote to memory of 1644 2816 cmd.exe 118 PID 1644 wrote to memory of 2076 1644 SFHLD.exe 119 PID 2076 wrote to memory of 2636 2076 cmd.exe 123 PID 2636 wrote to memory of 1300 2636 HAY.exe 124 PID 1300 wrote to memory of 3948 1300 cmd.exe 128 PID 3948 wrote to memory of 3312 3948 CNDH.exe 129 PID 3312 wrote to memory of 4964 3312 cmd.exe 133 PID 4964 wrote to memory of 1168 4964 RDE.exe 134 PID 1168 wrote to memory of 6092 1168 cmd.exe 138 PID 6092 wrote to memory of 4444 6092 VMLGS.exe 139 PID 4444 wrote to memory of 2676 4444 cmd.exe 143 PID 2676 wrote to memory of 1412 2676 HCR.exe 144 PID 1412 wrote to memory of 4596 1412 cmd.exe 148 PID 4596 wrote to memory of 2852 4596 CPWQ.exe 149 PID 2852 wrote to memory of 1892 2852 cmd.exe 153 PID 1892 wrote to memory of 3744 1892 AAZ.exe 154 PID 3744 wrote to memory of 3068 3744 cmd.exe 158 PID 3068 wrote to memory of 6052 3068 VVEPZ.exe 159 PID 6052 wrote to memory of 2608 6052 cmd.exe 163 PID 2608 wrote to memory of 2312 2608 ZDLXLAW.exe 164 PID 2312 wrote to memory of 2612 2312 cmd.exe 168 PID 2612 wrote to memory of 5784 2612 FYKYQ.exe 169 PID 5784 wrote to memory of 2092 5784 cmd.exe 173 PID 2092 wrote to memory of 3748 2092 JGQ.exe 174 PID 3748 wrote to memory of 1936 3748 cmd.exe 178 PID 1936 wrote to memory of 4468 1936 PHYUL.exe 179 PID 4468 wrote to memory of 4612 4468 cmd.exe 183 PID 4612 wrote to memory of 5072 4612 YPAZPV.exe 184 PID 5072 wrote to memory of 2376 5072 cmd.exe 188 PID 2376 wrote to memory of 5596 2376 CXHZ.exe 189 PID 5596 wrote to memory of 5920 5596 cmd.exe 193 PID 5920 wrote to memory of 4228 5920 XKLIL.exe 194 PID 4228 wrote to memory of 5156 4228 cmd.exe 198 PID 5156 wrote to memory of 1004 5156 IDOBLUD.exe 199 PID 1004 wrote to memory of 2464 1004 cmd.exe 203 PID 2464 wrote to memory of 1248 2464 ZLQ.exe 204 PID 1248 wrote to memory of 3232 1248 cmd.exe 208 PID 3232 wrote to memory of 4332 3232 DTXOBKB.exe 209 PID 4332 wrote to memory of 3288 4332 cmd.exe 213 PID 3288 wrote to memory of 3120 3288 EWBK.exe 214 PID 3120 wrote to memory of 4288 3120 cmd.exe 218 PID 4288 wrote to memory of 1328 4288 YKGTZA.exe 219 PID 1328 wrote to memory of 4452 1328 cmd.exe 223 PID 4452 wrote to memory of 5544 4452 CAM.exe 224 PID 5544 wrote to memory of 4780 5544 cmd.exe 228 PID 4780 wrote to memory of 4816 4780 VDQXQIP.exe 229 PID 4816 wrote to memory of 1132 4816 cmd.exe 233 PID 1132 wrote to memory of 1656 1132 UNBN.exe 234 PID 1656 wrote to memory of 2028 1656 cmd.exe 238 PID 2028 wrote to memory of 3380 2028 SDMQM.exe 239 PID 3380 wrote to memory of 4616 3380 cmd.exe 243 PID 4616 wrote to memory of 2904 4616 VLVF.exe 244 PID 2904 wrote to memory of 4944 2904 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_848366347205bf06adf1ca296a50d5d1_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAWSN.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\SysWOW64\BAWSN.exeC:\windows\system32\BAWSN.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTA.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\windows\SysWOW64\TTA.exeC:\windows\system32\TTA.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OGWBK.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\SysWOW64\OGWBK.exeC:\windows\system32\OGWBK.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPYGOB.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\windows\system\FPYGOB.exeC:\windows\system\FPYGOB.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACD.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\windows\system\ACD.exeC:\windows\system\ACD.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFHLD.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\SysWOW64\SFHLD.exeC:\windows\system32\SFHLD.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAY.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\windows\SysWOW64\HAY.exeC:\windows\system32\HAY.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNDH.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\CNDH.exeC:\windows\CNDH.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDE.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\windows\RDE.exeC:\windows\RDE.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMLGS.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\windows\SysWOW64\VMLGS.exeC:\windows\system32\VMLGS.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCR.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\windows\HCR.exeC:\windows\HCR.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPWQ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\CPWQ.exeC:\windows\CPWQ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZ.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\SysWOW64\AAZ.exeC:\windows\system32\AAZ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVEPZ.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\windows\SysWOW64\VVEPZ.exeC:\windows\system32\VVEPZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDLXLAW.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\system\ZDLXLAW.exeC:\windows\system\ZDLXLAW.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYKYQ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\windows\FYKYQ.exeC:\windows\FYKYQ.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JGQ.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\JGQ.exeC:\windows\JGQ.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHYUL.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\windows\system\PHYUL.exeC:\windows\system\PHYUL.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPAZPV.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\system\YPAZPV.exeC:\windows\system\YPAZPV.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXHZ.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\windows\CXHZ.exeC:\windows\CXHZ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XKLIL.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\windows\system\XKLIL.exeC:\windows\system\XKLIL.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IDOBLUD.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\system\IDOBLUD.exeC:\windows\system\IDOBLUD.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLQ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\windows\ZLQ.exeC:\windows\ZLQ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTXOBKB.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\DTXOBKB.exeC:\windows\DTXOBKB.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWBK.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\system\EWBK.exeC:\windows\system\EWBK.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKGTZA.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\SysWOW64\YKGTZA.exeC:\windows\system32\YKGTZA.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAM.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\CAM.exeC:\windows\CAM.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQXQIP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\SysWOW64\VDQXQIP.exeC:\windows\system32\VDQXQIP.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNBN.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\system\UNBN.exeC:\windows\system\UNBN.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SDMQM.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\windows\system\SDMQM.exeC:\windows\system\SDMQM.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLVF.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\windows\VLVF.exeC:\windows\VLVF.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QHAODV.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\SysWOW64\QHAODV.exeC:\windows\system32\QHAODV.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WHH.exe.bat" "66⤵PID:6120
-
C:\windows\system\WHH.exeC:\windows\system\WHH.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUMTX.exe.bat" "68⤵
- Executes a command shell one-liner
PID:268 -
C:\windows\QUMTX.exeC:\windows\QUMTX.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAKIEZ.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5856 -
C:\windows\NAKIEZ.exeC:\windows\NAKIEZ.exe71⤵
- Executes dropped EXE
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDOPJQ.exe.bat" "72⤵PID:5760
-
C:\windows\SysWOW64\SDOPJQ.exeC:\windows\system32\SDOPJQ.exe73⤵
- Executes dropped EXE
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YYN.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1916 -
C:\windows\YYN.exeC:\windows\YYN.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLYI.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1956 -
C:\windows\system\PLYI.exeC:\windows\system\PLYI.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EJVFKA.exe.bat" "78⤵PID:6096
-
C:\windows\SysWOW64\EJVFKA.exeC:\windows\system32\EJVFKA.exe79⤵
- Executes dropped EXE
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHXZ.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5444 -
C:\windows\GHXZ.exeC:\windows\GHXZ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMUWYY.exe.bat" "82⤵PID:6128
-
C:\windows\CMUWYY.exeC:\windows\CMUWYY.exe83⤵
- Executes dropped EXE
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TVJBKP.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4672 -
C:\windows\SysWOW64\TVJBKP.exeC:\windows\system32\TVJBKP.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFUJL.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3536 -
C:\windows\system\SFUJL.exeC:\windows\system\SFUJL.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBXKZ.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4536 -
C:\windows\SysWOW64\YBXKZ.exeC:\windows\system32\YBXKZ.exe89⤵
- Executes dropped EXE
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLGMNWB.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3424 -
C:\windows\GLGMNWB.exeC:\windows\GLGMNWB.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VBHD.exe.bat" "92⤵PID:1232
-
C:\windows\VBHD.exeC:\windows\VBHD.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKJIXPS.exe.bat" "94⤵PID:4540
-
C:\windows\FKJIXPS.exeC:\windows\FKJIXPS.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFSUI.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3144 -
C:\windows\SysWOW64\UFSUI.exeC:\windows\system32\UFSUI.exe97⤵
- Executes dropped EXE
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TPDKQPP.exe.bat" "98⤵PID:2724
-
C:\windows\TPDKQPP.exeC:\windows\TPDKQPP.exe99⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFKKDI.exe.bat" "100⤵PID:5404
-
C:\windows\XFKKDI.exeC:\windows\XFKKDI.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGMPGFN.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3280 -
C:\windows\system\OGMPGFN.exeC:\windows\system\OGMPGFN.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JTV.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2920 -
C:\windows\JTV.exeC:\windows\JTV.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOAIC.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4560 -
C:\windows\system\DOAIC.exeC:\windows\system\DOAIC.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEBAIM.exe.bat" "108⤵PID:4552
-
C:\windows\TEBAIM.exeC:\windows\TEBAIM.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TZNEO.exe.bat" "110⤵PID:3884
-
C:\windows\TZNEO.exeC:\windows\TZNEO.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MCQZTAR.exe.bat" "112⤵PID:5844
-
C:\windows\SysWOW64\MCQZTAR.exeC:\windows\system32\MCQZTAR.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GQVJ.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4532 -
C:\windows\SysWOW64\GQVJ.exeC:\windows\system32\GQVJ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ODA.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2428 -
C:\windows\SysWOW64\ODA.exeC:\windows\system32\ODA.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TJSN.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2084 -
C:\windows\SysWOW64\TJSN.exeC:\windows\system32\TJSN.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STV.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3524 -
C:\windows\SysWOW64\STV.exeC:\windows\system32\STV.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-