Analysis
- max time kernel
76s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 13:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe
- Size 208KB
- Sample260809-q5fcsassdx
- SHA256 94e5079e01d864b786a570468977b2c60f7d0cb8e6768442f25045bc1e00c45f
- MD5 afba780caf7842a32eaad601f93989ef
- SHA1 6d42c7b9f4e05303d5691ab785a224426167e118
- SHA512 3f0872e2dd2530fa2578cf9b53eb759122647fd37bf24d4269211513ee38a1fb3fd7db87c0a476363657b5646837ca2f6e067f9ecde8f032c2dc3a0c4f459a9c
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfC4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOKkEj1
- TLSH T1A6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4404 ZDJBBY.exe 1420 VTY.exe 4272 SUACAQP.exe 1088 CRNWHYY.exe 3940 SHO.exe 5564 UFU.exe 5752 NYJ.exe 4492 COKS.exe 1132 RJUWEDB.exe 1144 HZVOL.exe 460 SRKHU.exe 4232 IHLYBNV.exe 4908 SFRSIW.exe 6040 QQUIR.exe 5012 IYIGE.exe 2892 LGP.exe 6108 IHYQUPS.exe 3696 VSHPISN.exe 4452 UCSXRG.exe 5712 GSY.exe 1432 OIZWJ.exe 4212 JLIVQ.exe 2728 STKABU.exe 2860 HOTM.exe 1360 XFUETCH.exe 4264 GFW.exe 4576 ZFMU.exe 3212 DNSCST.exe 5324 TDTTZGC.exe 2904 WMABLZR.exe 4356 KWQAZ.exe 5900 MKVJJJB.exe 2808 FNZ.exe 4960 LIYGTC.exe 5000 PQFO.exe 3796 ETOSRH.exe 5928 ZGT.exe 5668 DJRWBA.exe 1536 SEBB.exe 2816 CCOV.exe 5600 JSPVA.exe 2640 EGUEKRI.exe 6044 QWBE.exe 5748 UEHM.exe 5476 JUIDH.exe 2764 CXMH.exe 4340 XHUYJPE.exe 1644 QCGB.exe 5532 ZLAHSDP.exe 5756 EQSWIG.exe 1080 WTWA.exe 2584 RHBJYW.exe 3428 GXC.exe 3836 HAGEKHZ.exe 4512 UDWVY.exe 3720 VGA.exe 6032 MQDOM.exe 1684 MTHK.exe 1488 FWLOFU.exe 2092 REZO.exe 5556 JIDSXCA.exe 3012 TFJEE.exe 5824 OTNVPKX.exe 5056 SBUVBD.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ZDJBBY.exe 2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\SUACAQP.exe VTY.exe File created C:\windows\SysWOW64\SUACAQP.exe.bat VTY.exe File created C:\windows\SysWOW64\COKS.exe.bat NYJ.exe File created C:\windows\SysWOW64\GFW.exe.bat XFUETCH.exe File opened for modification C:\windows\SysWOW64\WMABLZR.exe TDTTZGC.exe File created C:\windows\SysWOW64\KWQAZ.exe WMABLZR.exe File opened for modification C:\windows\SysWOW64\EQSWIG.exe ZLAHSDP.exe File opened for modification C:\windows\SysWOW64\SRKHU.exe HZVOL.exe File created C:\windows\SysWOW64\IHLYBNV.exe SRKHU.exe File created C:\windows\SysWOW64\IHLYBNV.exe.bat SRKHU.exe File created C:\windows\SysWOW64\ZFMU.exe GFW.exe File opened for modification C:\windows\SysWOW64\TDTTZGC.exe DNSCST.exe File created C:\windows\SysWOW64\EQSWIG.exe.bat ZLAHSDP.exe File created C:\windows\SysWOW64\MQDOM.exe VGA.exe File created C:\windows\SysWOW64\SWG.exe.bat NWZ.exe File opened for modification C:\windows\SysWOW64\COKS.exe NYJ.exe File opened for modification C:\windows\SysWOW64\IHLYBNV.exe SRKHU.exe File created C:\windows\SysWOW64\ZFMU.exe.bat GFW.exe File created C:\windows\SysWOW64\UEHM.exe QWBE.exe File opened for modification C:\windows\SysWOW64\MQDOM.exe VGA.exe File opened for modification C:\windows\SysWOW64\IUATOE.exe VPSHMSR.exe File opened for modification C:\windows\SysWOW64\WAM.exe UCG.exe File created C:\windows\SysWOW64\WAM.exe.bat UCG.exe File created C:\windows\SysWOW64\JSPVA.exe.bat CCOV.exe File created C:\windows\SysWOW64\WTWA.exe EQSWIG.exe File created C:\windows\SysWOW64\SUACAQP.exe VTY.exe File opened for modification C:\windows\SysWOW64\PQFO.exe LIYGTC.exe File created C:\windows\SysWOW64\MTHK.exe MQDOM.exe File created C:\windows\SysWOW64\IUATOE.exe.bat VPSHMSR.exe File opened for modification C:\windows\SysWOW64\HUIX.exe ZPI.exe File created C:\windows\SysWOW64\OZDRITB.exe.bat YJCS.exe File created C:\windows\SysWOW64\SRKHU.exe HZVOL.exe File opened for modification C:\windows\SysWOW64\GSY.exe UCSXRG.exe File created C:\windows\SysWOW64\GSY.exe.bat UCSXRG.exe File opened for modification C:\windows\SysWOW64\GFW.exe XFUETCH.exe File created C:\windows\SysWOW64\UEHM.exe.bat QWBE.exe File created C:\windows\SysWOW64\MQDOM.exe.bat VGA.exe File created C:\windows\SysWOW64\NWZ.exe SBUVBD.exe File created C:\windows\SysWOW64\YJCS.exe.bat EWXIRXX.exe File opened for modification C:\windows\SysWOW64\KWQAZ.exe WMABLZR.exe File created C:\windows\SysWOW64\JSPVA.exe CCOV.exe File opened for modification C:\windows\SysWOW64\YKGTZA.exe SWG.exe File opened for modification C:\windows\SysWOW64\KYQJGR.exe AACP.exe File created C:\windows\SysWOW64\OZDRITB.exe YJCS.exe File opened for modification C:\windows\SysWOW64\OZDRITB.exe YJCS.exe File created C:\windows\SysWOW64\QXJDQ.exe.bat OZDRITB.exe File created C:\windows\SysWOW64\JYYOZ.exe.bat QXJDQ.exe File created C:\windows\SysWOW64\ZDJBBY.exe.bat 2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe File created C:\windows\SysWOW64\COKS.exe NYJ.exe File created C:\windows\SysWOW64\GSY.exe UCSXRG.exe File created C:\windows\SysWOW64\EQSWIG.exe ZLAHSDP.exe File opened for modification C:\windows\SysWOW64\JIDSXCA.exe REZO.exe File created C:\windows\SysWOW64\JIDSXCA.exe.bat REZO.exe File created C:\windows\SysWOW64\SWG.exe NWZ.exe File created C:\windows\SysWOW64\VPSHMSR.exe.bat FUIDT.exe File opened for modification C:\windows\SysWOW64\ZDJBBY.exe 2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe File created C:\windows\SysWOW64\XFUETCH.exe.bat HOTM.exe File opened for modification C:\windows\SysWOW64\ZFMU.exe GFW.exe File created C:\windows\SysWOW64\MTHK.exe.bat MQDOM.exe File created C:\windows\SysWOW64\IUATOE.exe VPSHMSR.exe File created C:\windows\SysWOW64\KYQJGR.exe.bat AACP.exe File created C:\windows\SysWOW64\JIDSXCA.exe REZO.exe File opened for modification C:\windows\SysWOW64\QKVSRD.exe MUOS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\LGP.exe IYIGE.exe File created C:\windows\STKABU.exe.bat JLIVQ.exe File created C:\windows\ETOSRH.exe PQFO.exe File opened for modification C:\windows\HAGEKHZ.exe GXC.exe File created C:\windows\system\FWLOFU.exe.bat MTHK.exe File opened for modification C:\windows\SBUVBD.exe OTNVPKX.exe File created C:\windows\ZPI.exe VHBI.exe File opened for modification C:\windows\ZPI.exe VHBI.exe File opened for modification C:\windows\RJUWEDB.exe COKS.exe File opened for modification C:\windows\JLIVQ.exe OIZWJ.exe File created C:\windows\CCOV.exe SEBB.exe File created C:\windows\system\EGUEKRI.exe JSPVA.exe File created C:\windows\system\UDWVY.exe.bat HAGEKHZ.exe File opened for modification C:\windows\VHBI.exe BLWZZEV.exe File opened for modification C:\windows\system\EWXIRXX.exe QTHK.exe File created C:\windows\DZKSXYE.exe MRIMUA.exe File created C:\windows\NYJ.exe UFU.exe File opened for modification C:\windows\ETOSRH.exe PQFO.exe File created C:\windows\system\DJRWBA.exe.bat ZGT.exe File created C:\windows\system\GXC.exe.bat RHBJYW.exe File created C:\windows\TFJEE.exe.bat JIDSXCA.exe File created C:\windows\IJBE.exe.bat JYYOZ.exe File created C:\windows\system\ORZDPYU.exe DZKSXYE.exe File created C:\windows\FNZ.exe.bat MKVJJJB.exe File created C:\windows\system\LIYGTC.exe FNZ.exe File created C:\windows\CXMH.exe JUIDH.exe File created C:\windows\system\FUIDT.exe.bat HYJC.exe File created C:\windows\JLIVQ.exe.bat OIZWJ.exe File opened for modification C:\windows\system\HOTM.exe STKABU.exe File created C:\windows\system\HOTM.exe.bat STKABU.exe File created C:\windows\CXMH.exe.bat JUIDH.exe File created C:\windows\system\EWXIRXX.exe QTHK.exe File created C:\windows\LGP.exe IYIGE.exe File created C:\windows\system\CRNWHYY.exe SUACAQP.exe File created C:\windows\HZVOL.exe.bat RJUWEDB.exe File created C:\windows\IHYQUPS.exe LGP.exe File created C:\windows\CCOV.exe.bat SEBB.exe File created C:\windows\HAGEKHZ.exe GXC.exe File created C:\windows\system\FWLOFU.exe MTHK.exe File opened for modification C:\windows\AACP.exe SNXIGKI.exe File opened for modification C:\windows\system\CRNWHYY.exe SUACAQP.exe File created C:\windows\UCSXRG.exe VSHPISN.exe File created C:\windows\OIZWJ.exe.bat GSY.exe File created C:\windows\ETOSRH.exe.bat PQFO.exe File created C:\windows\ZLAHSDP.exe QCGB.exe File created C:\windows\OTNVPKX.exe.bat TFJEE.exe File created C:\windows\system\ORZDPYU.exe.bat DZKSXYE.exe File created C:\windows\REZO.exe FWLOFU.exe File created C:\windows\QQUIR.exe SFRSIW.exe File created C:\windows\DNSCST.exe ZFMU.exe File opened for modification C:\windows\system\LIYGTC.exe FNZ.exe File opened for modification C:\windows\REZO.exe FWLOFU.exe File opened for modification C:\windows\TFJEE.exe JIDSXCA.exe File created C:\windows\UCG.exe IUATOE.exe File opened for modification C:\windows\IYIGE.exe QQUIR.exe File created C:\windows\JLIVQ.exe OIZWJ.exe File opened for modification C:\windows\MKVJJJB.exe KWQAZ.exe File created C:\windows\system\QWBE.exe.bat EGUEKRI.exe File opened for modification C:\windows\QCGB.exe XHUYJPE.exe File created C:\windows\system\HYJC.exe CYCOFA.exe File created C:\windows\VTY.exe ZDJBBY.exe File created C:\windows\RHBJYW.exe.bat WTWA.exe File opened for modification C:\windows\system\HLXFV.exe QKVSRD.exe File created C:\windows\UFU.exe SHO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 788 cmd.exe 1772 cmd.exe 4440 cmd.exe 4860 cmd.exe 4940 cmd.exe 2268 cmd.exe 1444 cmd.exe 5192 cmd.exe 5328 cmd.exe 2448 cmd.exe 108 cmd.exe 3420 cmd.exe 436 cmd.exe 5304 cmd.exe 5764 cmd.exe 1200 cmd.exe 6028 cmd.exe 1704 cmd.exe 4528 cmd.exe 708 cmd.exe 4484 cmd.exe 3652 cmd.exe 5456 cmd.exe 5424 cmd.exe 5636 cmd.exe 4876 cmd.exe 4852 cmd.exe 4868 cmd.exe 2464 cmd.exe 2364 cmd.exe 2148 cmd.exe 3108 cmd.exe 5688 cmd.exe 5708 cmd.exe 5692 cmd.exe 5812 cmd.exe 2360 cmd.exe 1496 cmd.exe 5588 cmd.exe 3192 cmd.exe 5252 cmd.exe 5560 cmd.exe 4064 cmd.exe 2356 cmd.exe 236 cmd.exe 5352 cmd.exe 1272 cmd.exe 2924 cmd.exe 792 cmd.exe 2236 cmd.exe 4540 cmd.exe 4656 cmd.exe 1788 cmd.exe 1624 cmd.exe 300 cmd.exe 1180 cmd.exe 5704 cmd.exe 2776 cmd.exe 3300 cmd.exe 4532 cmd.exe 5572 cmd.exe 5628 cmd.exe 1048 cmd.exe 2884 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2752 4796 WerFault.exe 87 4392 4404 WerFault.exe 93 6040 1420 WerFault.exe 99 5416 4272 WerFault.exe 104 1624 1088 WerFault.exe 109 3912 3940 WerFault.exe 114 4420 5564 WerFault.exe 119 2308 5752 WerFault.exe 124 4048 4492 WerFault.exe 129 4932 1132 WerFault.exe 134 1960 1144 WerFault.exe 139 1776 460 WerFault.exe 144 5192 4232 WerFault.exe 149 1900 4908 WerFault.exe 154 3404 6040 WerFault.exe 159 3884 5012 WerFault.exe 164 5628 2892 WerFault.exe 169 2692 6108 WerFault.exe 174 2308 3696 WerFault.exe 179 4148 4452 WerFault.exe 184 5480 5712 WerFault.exe 189 5460 1432 WerFault.exe 194 2964 4212 WerFault.exe 199 5484 2728 WerFault.exe 204 2492 2860 WerFault.exe 209 1732 1360 WerFault.exe 214 3576 4264 WerFault.exe 219 4064 4576 WerFault.exe 224 4840 3212 WerFault.exe 229 4204 5324 WerFault.exe 234 1636 2904 WerFault.exe 239 5448 4356 WerFault.exe 244 5164 5900 WerFault.exe 249 5732 2808 WerFault.exe 254 4444 4960 WerFault.exe 259 1000 5000 WerFault.exe 264 2760 3796 WerFault.exe 270 1592 5928 WerFault.exe 275 1684 5668 WerFault.exe 280 4048 1536 WerFault.exe 285 3624 2816 WerFault.exe 290 4760 5600 WerFault.exe 295 4756 2640 WerFault.exe 300 432 6044 WerFault.exe 305 2196 5748 WerFault.exe 310 2452 5476 WerFault.exe 315 5856 2764 WerFault.exe 320 1428 4340 WerFault.exe 325 4728 1644 WerFault.exe 330 5832 5532 WerFault.exe 335 5772 5756 WerFault.exe 340 4160 1080 WerFault.exe 345 5524 2584 WerFault.exe 350 6076 3428 WerFault.exe 355 4432 3836 WerFault.exe 360 2084 4512 WerFault.exe 365 2844 3720 WerFault.exe 370 4348 6032 WerFault.exe 375 2200 1684 WerFault.exe 380 3624 1488 WerFault.exe 385 3452 2092 WerFault.exe 390 1376 5556 WerFault.exe 395 2660 3012 WerFault.exe 400 2960 5824 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYQJGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHYQUPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNXIGKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJUWEDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHLYBNV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSHPISN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLIVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFUETCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNSCST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAGEKHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MQDOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQFO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUATOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AACP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYYOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLXFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYCOFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLWZZEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBUVBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXJDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCSXRG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQTVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIZWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMABLZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJRWBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUACAQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYIGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLAHSDP.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4796 2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe 4796 2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe 4404 ZDJBBY.exe 4404 ZDJBBY.exe 1420 VTY.exe 1420 VTY.exe 4272 SUACAQP.exe 4272 SUACAQP.exe 1088 CRNWHYY.exe 1088 CRNWHYY.exe 3940 SHO.exe 3940 SHO.exe 5564 UFU.exe 5564 UFU.exe 5752 NYJ.exe 5752 NYJ.exe 4492 COKS.exe 4492 COKS.exe 1132 RJUWEDB.exe 1132 RJUWEDB.exe 1144 HZVOL.exe 1144 HZVOL.exe 460 SRKHU.exe 460 SRKHU.exe 4232 IHLYBNV.exe 4232 IHLYBNV.exe 4908 SFRSIW.exe 4908 SFRSIW.exe 6040 QQUIR.exe 6040 QQUIR.exe 5012 IYIGE.exe 5012 IYIGE.exe 2892 LGP.exe 2892 LGP.exe 6108 IHYQUPS.exe 6108 IHYQUPS.exe 3696 VSHPISN.exe 3696 VSHPISN.exe 4452 UCSXRG.exe 4452 UCSXRG.exe 5712 GSY.exe 5712 GSY.exe 1432 OIZWJ.exe 1432 OIZWJ.exe 4212 JLIVQ.exe 4212 JLIVQ.exe 2728 STKABU.exe 2728 STKABU.exe 2860 HOTM.exe 2860 HOTM.exe 1360 XFUETCH.exe 1360 XFUETCH.exe 4264 GFW.exe 4264 GFW.exe 4576 ZFMU.exe 4576 ZFMU.exe 3212 DNSCST.exe 3212 DNSCST.exe 5324 TDTTZGC.exe 5324 TDTTZGC.exe 2904 WMABLZR.exe 2904 WMABLZR.exe 4356 KWQAZ.exe 4356 KWQAZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4796 2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe 4796 2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe 4404 ZDJBBY.exe 4404 ZDJBBY.exe 1420 VTY.exe 1420 VTY.exe 4272 SUACAQP.exe 4272 SUACAQP.exe 1088 CRNWHYY.exe 1088 CRNWHYY.exe 3940 SHO.exe 3940 SHO.exe 5564 UFU.exe 5564 UFU.exe 5752 NYJ.exe 5752 NYJ.exe 4492 COKS.exe 4492 COKS.exe 1132 RJUWEDB.exe 1132 RJUWEDB.exe 1144 HZVOL.exe 1144 HZVOL.exe 460 SRKHU.exe 460 SRKHU.exe 4232 IHLYBNV.exe 4232 IHLYBNV.exe 4908 SFRSIW.exe 4908 SFRSIW.exe 6040 QQUIR.exe 6040 QQUIR.exe 5012 IYIGE.exe 5012 IYIGE.exe 2892 LGP.exe 2892 LGP.exe 6108 IHYQUPS.exe 6108 IHYQUPS.exe 3696 VSHPISN.exe 3696 VSHPISN.exe 4452 UCSXRG.exe 4452 UCSXRG.exe 5712 GSY.exe 5712 GSY.exe 1432 OIZWJ.exe 1432 OIZWJ.exe 4212 JLIVQ.exe 4212 JLIVQ.exe 2728 STKABU.exe 2728 STKABU.exe 2860 HOTM.exe 2860 HOTM.exe 1360 XFUETCH.exe 1360 XFUETCH.exe 4264 GFW.exe 4264 GFW.exe 4576 ZFMU.exe 4576 ZFMU.exe 3212 DNSCST.exe 3212 DNSCST.exe 5324 TDTTZGC.exe 5324 TDTTZGC.exe 2904 WMABLZR.exe 2904 WMABLZR.exe 4356 KWQAZ.exe 4356 KWQAZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 1772 4796 2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe 89 PID 1772 wrote to memory of 4404 1772 cmd.exe 93 PID 4404 wrote to memory of 4216 4404 ZDJBBY.exe 95 PID 4216 wrote to memory of 1420 4216 cmd.exe 99 PID 1420 wrote to memory of 1904 1420 VTY.exe 100 PID 1904 wrote to memory of 4272 1904 cmd.exe 104 PID 4272 wrote to memory of 5656 4272 SUACAQP.exe 105 PID 5656 wrote to memory of 1088 5656 cmd.exe 109 PID 1088 wrote to memory of 3652 1088 CRNWHYY.exe 110 PID 3652 wrote to memory of 3940 3652 cmd.exe 114 PID 3940 wrote to memory of 888 3940 SHO.exe 115 PID 888 wrote to memory of 5564 888 cmd.exe 119 PID 5564 wrote to memory of 2364 5564 UFU.exe 120 PID 2364 wrote to memory of 5752 2364 cmd.exe 124 PID 5752 wrote to memory of 4440 5752 NYJ.exe 125 PID 4440 wrote to memory of 4492 4440 cmd.exe 129 PID 4492 wrote to memory of 5248 4492 COKS.exe 130 PID 5248 wrote to memory of 1132 5248 cmd.exe 134 PID 1132 wrote to memory of 5588 1132 RJUWEDB.exe 135 PID 5588 wrote to memory of 1144 5588 cmd.exe 139 PID 1144 wrote to memory of 2772 1144 HZVOL.exe 140 PID 2772 wrote to memory of 460 2772 cmd.exe 144 PID 460 wrote to memory of 788 460 SRKHU.exe 145 PID 788 wrote to memory of 4232 788 cmd.exe 149 PID 4232 wrote to memory of 120 4232 IHLYBNV.exe 150 PID 120 wrote to memory of 4908 120 cmd.exe 154 PID 4908 wrote to memory of 2776 4908 SFRSIW.exe 155 PID 2776 wrote to memory of 6040 2776 cmd.exe 159 PID 6040 wrote to memory of 5808 6040 QQUIR.exe 160 PID 5808 wrote to memory of 5012 5808 cmd.exe 164 PID 5012 wrote to memory of 2148 5012 IYIGE.exe 165 PID 2148 wrote to memory of 2892 2148 cmd.exe 169 PID 2892 wrote to memory of 5840 2892 LGP.exe 170 PID 5840 wrote to memory of 6108 5840 cmd.exe 174 PID 6108 wrote to memory of 4860 6108 IHYQUPS.exe 175 PID 4860 wrote to memory of 3696 4860 cmd.exe 179 PID 3696 wrote to memory of 4940 3696 VSHPISN.exe 180 PID 4940 wrote to memory of 4452 4940 cmd.exe 184 PID 4452 wrote to memory of 4980 4452 UCSXRG.exe 185 PID 4980 wrote to memory of 5712 4980 cmd.exe 189 PID 5712 wrote to memory of 932 5712 GSY.exe 190 PID 932 wrote to memory of 1432 932 cmd.exe 194 PID 1432 wrote to memory of 3816 1432 OIZWJ.exe 195 PID 3816 wrote to memory of 4212 3816 cmd.exe 199 PID 4212 wrote to memory of 3108 4212 JLIVQ.exe 200 PID 3108 wrote to memory of 2728 3108 cmd.exe 204 PID 2728 wrote to memory of 3800 2728 STKABU.exe 205 PID 3800 wrote to memory of 2860 3800 cmd.exe 209 PID 2860 wrote to memory of 264 2860 HOTM.exe 210 PID 264 wrote to memory of 1360 264 cmd.exe 214 PID 1360 wrote to memory of 2360 1360 XFUETCH.exe 215 PID 2360 wrote to memory of 4264 2360 cmd.exe 219 PID 4264 wrote to memory of 2236 4264 GFW.exe 220 PID 2236 wrote to memory of 4576 2236 cmd.exe 224 PID 4576 wrote to memory of 4248 4576 ZFMU.exe 225 PID 4248 wrote to memory of 3212 4248 cmd.exe 229 PID 3212 wrote to memory of 828 3212 DNSCST.exe 230 PID 828 wrote to memory of 5324 828 cmd.exe 234 PID 5324 wrote to memory of 3348 5324 TDTTZGC.exe 235 PID 3348 wrote to memory of 2904 3348 cmd.exe 239 PID 2904 wrote to memory of 5328 2904 WMABLZR.exe 240 PID 5328 wrote to memory of 4356 5328 cmd.exe 244 PID 4356 wrote to memory of 5688 4356 KWQAZ.exe 245 PID 5688 wrote to memory of 5900 5688 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_afba780caf7842a32eaad601f93989ef_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDJBBY.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\windows\SysWOW64\ZDJBBY.exeC:\windows\system32\ZDJBBY.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTY.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\VTY.exeC:\windows\VTY.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUACAQP.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\windows\SysWOW64\SUACAQP.exeC:\windows\system32\SUACAQP.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRNWHYY.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\system\CRNWHYY.exeC:\windows\system\CRNWHYY.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHO.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\windows\SysWOW64\SHO.exeC:\windows\system32\SHO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\windows\UFU.exeC:\windows\UFU.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NYJ.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\NYJ.exeC:\windows\NYJ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COKS.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\windows\SysWOW64\COKS.exeC:\windows\system32\COKS.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJUWEDB.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\windows\RJUWEDB.exeC:\windows\RJUWEDB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZVOL.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\windows\HZVOL.exeC:\windows\HZVOL.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRKHU.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\SysWOW64\SRKHU.exeC:\windows\system32\SRKHU.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHLYBNV.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:788 -
C:\windows\SysWOW64\IHLYBNV.exeC:\windows\system32\IHLYBNV.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFRSIW.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:120 -
C:\windows\SFRSIW.exeC:\windows\SFRSIW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QQUIR.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\QQUIR.exeC:\windows\QQUIR.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYIGE.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\IYIGE.exeC:\windows\IYIGE.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGP.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\LGP.exeC:\windows\LGP.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHYQUPS.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\windows\IHYQUPS.exeC:\windows\IHYQUPS.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSHPISN.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\windows\VSHPISN.exeC:\windows\VSHPISN.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCSXRG.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\UCSXRG.exeC:\windows\UCSXRG.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSY.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\SysWOW64\GSY.exeC:\windows\system32\GSY.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIZWJ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\windows\OIZWJ.exeC:\windows\OIZWJ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLIVQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\windows\JLIVQ.exeC:\windows\JLIVQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STKABU.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\windows\STKABU.exeC:\windows\STKABU.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOTM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\windows\system\HOTM.exeC:\windows\system\HOTM.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFUETCH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:264 -
C:\windows\SysWOW64\XFUETCH.exeC:\windows\system32\XFUETCH.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFW.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\SysWOW64\GFW.exeC:\windows\system32\GFW.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFMU.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\windows\SysWOW64\ZFMU.exeC:\windows\system32\ZFMU.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNSCST.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\DNSCST.exeC:\windows\DNSCST.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDTTZGC.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\windows\SysWOW64\TDTTZGC.exeC:\windows\system32\TDTTZGC.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WMABLZR.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\SysWOW64\WMABLZR.exeC:\windows\system32\WMABLZR.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWQAZ.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\windows\SysWOW64\KWQAZ.exeC:\windows\system32\KWQAZ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKVJJJB.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\MKVJJJB.exeC:\windows\MKVJJJB.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FNZ.exe.bat" "66⤵PID:476
-
C:\windows\FNZ.exeC:\windows\FNZ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIYGTC.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1496 -
C:\windows\system\LIYGTC.exeC:\windows\system\LIYGTC.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQFO.exe.bat" "70⤵PID:1676
-
C:\windows\SysWOW64\PQFO.exeC:\windows\system32\PQFO.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ETOSRH.exe.bat" "72⤵PID:3164
-
C:\windows\ETOSRH.exeC:\windows\ETOSRH.exe73⤵
- Executes dropped EXE
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGT.exe.bat" "74⤵PID:4552
-
C:\windows\system\ZGT.exeC:\windows\system\ZGT.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJRWBA.exe.bat" "76⤵PID:1276
-
C:\windows\system\DJRWBA.exeC:\windows\system\DJRWBA.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEBB.exe.bat" "78⤵PID:5920
-
C:\windows\SysWOW64\SEBB.exeC:\windows\system32\SEBB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCOV.exe.bat" "80⤵PID:1924
-
C:\windows\CCOV.exeC:\windows\CCOV.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5612 -
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGUEKRI.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2464 -
C:\windows\system\EGUEKRI.exeC:\windows\system\EGUEKRI.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWBE.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5352 -
C:\windows\system\QWBE.exeC:\windows\system\QWBE.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UEHM.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4540 -
C:\windows\SysWOW64\UEHM.exeC:\windows\system32\UEHM.exe89⤵
- Executes dropped EXE
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JUIDH.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3096 -
C:\windows\system\JUIDH.exeC:\windows\system\JUIDH.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXMH.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3300 -
C:\windows\CXMH.exeC:\windows\CXMH.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHUYJPE.exe.bat" "94⤵PID:2240
-
C:\windows\system\XHUYJPE.exeC:\windows\system\XHUYJPE.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCGB.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1828 -
C:\windows\QCGB.exeC:\windows\QCGB.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "98⤵PID:4496
-
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EQSWIG.exe.bat" "100⤵PID:3660
-
C:\windows\SysWOW64\EQSWIG.exeC:\windows\system32\EQSWIG.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTWA.exe.bat" "102⤵PID:6020
-
C:\windows\SysWOW64\WTWA.exeC:\windows\system32\WTWA.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHBJYW.exe.bat" "104⤵PID:4760
-
C:\windows\RHBJYW.exeC:\windows\RHBJYW.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXC.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1272 -
C:\windows\system\GXC.exeC:\windows\system\GXC.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAGEKHZ.exe.bat" "108⤵PID:3852
-
C:\windows\HAGEKHZ.exeC:\windows\HAGEKHZ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDWVY.exe.bat" "110⤵PID:2012
-
C:\windows\system\UDWVY.exeC:\windows\system\UDWVY.exe111⤵
- Executes dropped EXE
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VGA.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:4612 -
C:\windows\VGA.exeC:\windows\VGA.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MQDOM.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3192 -
C:\windows\SysWOW64\MQDOM.exeC:\windows\system32\MQDOM.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTHK.exe.bat" "116⤵PID:4592
-
C:\windows\SysWOW64\MTHK.exeC:\windows\system32\MTHK.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWLOFU.exe.bat" "118⤵PID:1652
-
C:\windows\system\FWLOFU.exeC:\windows\system\FWLOFU.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REZO.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4656 -
C:\windows\REZO.exeC:\windows\REZO.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-