Analysis
- max time kernel
77s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_03b65dd298cf9dfc8a2d20ec93ba610b_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_03b65dd298cf9dfc8a2d20ec93ba610b_elex_emotet_stop.exe
- Size 208KB
- Sample260809-sdq2bazgpg
- SHA256 eccca94147e74ab9958ac743c8e0b79a6e97cb395739eeb8b0a008c7a08fd7f6
- MD5 03b65dd298cf9dfc8a2d20ec93ba610b
- SHA1 76bcd5a7b5ce7411b40f89bab77cd43cdd28f7d3
- SHA512 25106e39eeec77a050db7f0292e1b8b16a4e3d8ee85eb53a4c6ce8c16eaf21819c1c333d692ce27d911c7849134674133f869b5d10819a8107983dcf90d9eba7
- SSDEEP 3072:cLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfp4pLthEjQT6j:olZtbLWIgd1LZ9oECZbslc5+LOhkEj1
- TLSH T163247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5324 MKXV.exe 260 DLSH.exe 2516 PBYI.exe 5572 WRZHV.exe 5472 IZO.exe 3712 MPVHTWE.exe 5812 BFW.exe 3564 OHE.exe 2132 CNERQGY.exe 5464 IOMEZAZ.exe 5312 VQCVNLU.exe 2928 WTGZ.exe 2960 UPFAXEM.exe 240 GXMI.exe 4576 KNSIWOW.exe 3432 MLYCDP.exe 4948 UQLJOV.exe 2024 PWLU.exe 1072 TERUCRX.exe 4536 VCFPJA.exe 4600 QMNN.exe 2792 JHRJDA.exe 3392 YYSI.exe 2460 NBKNDIA.exe 1448 TOBOZ.exe 1520 OJSX.exe 3004 KHAJ.exe 3512 XSIZJTC.exe 3008 MIJZPH.exe 2080 OGP.exe 4032 NQAJGDW.exe 6028 ZGT.exe 5884 DJRWBA.exe 4144 NHXRII.exe 5616 YAMC.exe 2016 ZDQ.exe 5536 IDSD.exe 4360 NIKSZ.exe 4892 FMOWEQ.exe 4128 XUQ.exe 5300 KXY.exe 256 TFAE.exe 552 XNHEMO.exe 1768 JDOM.exe 1044 EQSWIG.exe 1176 NRUB.exe 3296 OUYFZT.exe 3396 XCAKDZQ.exe 2280 BKHK.exe 5808 CNL.exe 4732 HNSBDB.exe 4976 JLG.exe 1028 KGKRYIZ.exe 264 TOM.exe 5556 USQAH.exe 1088 PFUJRVZ.exe 1660 NVGMM.exe 1856 TQF.exe 4228 QVXCZYR.exe 5648 KJCM.exe 1136 WBXFS.exe 5412 HUAXSV.exe 1532 YCCCDSN.exe 3536 VIM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\NRUB.exe EQSWIG.exe File created C:\windows\SysWOW64\EIOX.exe VIM.exe File created C:\windows\SysWOW64\UQLJOV.exe.bat MLYCDP.exe File created C:\windows\SysWOW64\KHAJ.exe OJSX.exe File created C:\windows\SysWOW64\XNHEMO.exe.bat TFAE.exe File created C:\windows\SysWOW64\NRUB.exe EQSWIG.exe File created C:\windows\SysWOW64\HNSBDB.exe.bat CNL.exe File created C:\windows\SysWOW64\KNSIWOW.exe.bat GXMI.exe File created C:\windows\SysWOW64\OHE.exe.bat BFW.exe File opened for modification C:\windows\SysWOW64\WTGZ.exe VQCVNLU.exe File created C:\windows\SysWOW64\HNSBDB.exe CNL.exe File created C:\windows\SysWOW64\NVGMM.exe.bat PFUJRVZ.exe File created C:\windows\SysWOW64\PBYI.exe.bat DLSH.exe File created C:\windows\SysWOW64\KHAJ.exe.bat OJSX.exe File created C:\windows\SysWOW64\NVGMM.exe PFUJRVZ.exe File created C:\windows\SysWOW64\HUAXSV.exe.bat WBXFS.exe File created C:\windows\SysWOW64\QSXH.exe.bat OVJNYKW.exe File opened for modification C:\windows\SysWOW64\YYSI.exe JHRJDA.exe File opened for modification C:\windows\SysWOW64\UOU.exe FTKCPUN.exe File opened for modification C:\windows\SysWOW64\APJ.exe SJFV.exe File created C:\windows\SysWOW64\OHE.exe BFW.exe File opened for modification C:\windows\SysWOW64\OHE.exe BFW.exe File created C:\windows\SysWOW64\KJCM.exe QVXCZYR.exe File opened for modification C:\windows\SysWOW64\EIOX.exe VIM.exe File created C:\windows\SysWOW64\RUYE.exe CZOAAH.exe File created C:\windows\SysWOW64\JHRJDA.exe.bat QMNN.exe File created C:\windows\SysWOW64\YYSI.exe.bat JHRJDA.exe File created C:\windows\SysWOW64\MIJZPH.exe.bat XSIZJTC.exe File opened for modification C:\windows\SysWOW64\RUYE.exe CZOAAH.exe File created C:\windows\SysWOW64\RUYE.exe.bat CZOAAH.exe File created C:\windows\SysWOW64\SJFV.exe.bat ZJPK.exe File created C:\windows\SysWOW64\APJ.exe SJFV.exe File created C:\windows\SysWOW64\APJ.exe.bat SJFV.exe File opened for modification C:\windows\SysWOW64\UQLJOV.exe MLYCDP.exe File created C:\windows\SysWOW64\FMOWEQ.exe NIKSZ.exe File created C:\windows\SysWOW64\YYSI.exe JHRJDA.exe File opened for modification C:\windows\SysWOW64\EQSWIG.exe JDOM.exe File created C:\windows\SysWOW64\EQSWIG.exe.bat JDOM.exe File created C:\windows\SysWOW64\KJCM.exe.bat QVXCZYR.exe File created C:\windows\SysWOW64\HUAXSV.exe WBXFS.exe File opened for modification C:\windows\SysWOW64\FLS.exe EIOX.exe File created C:\windows\SysWOW64\WTGZ.exe VQCVNLU.exe File created C:\windows\SysWOW64\WTGZ.exe.bat VQCVNLU.exe File opened for modification C:\windows\SysWOW64\HNSBDB.exe CNL.exe File created C:\windows\SysWOW64\UQLJOV.exe MLYCDP.exe File created C:\windows\SysWOW64\XNHEMO.exe TFAE.exe File opened for modification C:\windows\SysWOW64\XNHEMO.exe TFAE.exe File created C:\windows\SysWOW64\EQSWIG.exe JDOM.exe File created C:\windows\SysWOW64\NRUB.exe.bat EQSWIG.exe File opened for modification C:\windows\SysWOW64\NVGMM.exe PFUJRVZ.exe File opened for modification C:\windows\SysWOW64\HUAXSV.exe WBXFS.exe File opened for modification C:\windows\SysWOW64\SJFV.exe ZJPK.exe File created C:\windows\SysWOW64\EIOX.exe.bat VIM.exe File opened for modification C:\windows\SysWOW64\QSXH.exe OVJNYKW.exe File created C:\windows\SysWOW64\FLS.exe EIOX.exe File created C:\windows\SysWOW64\KNSIWOW.exe GXMI.exe File created C:\windows\SysWOW64\MIJZPH.exe XSIZJTC.exe File opened for modification C:\windows\SysWOW64\MIJZPH.exe XSIZJTC.exe File created C:\windows\SysWOW64\FMOWEQ.exe.bat NIKSZ.exe File opened for modification C:\windows\SysWOW64\KJCM.exe QVXCZYR.exe File created C:\windows\SysWOW64\UOU.exe FTKCPUN.exe File created C:\windows\SysWOW64\UOU.exe.bat FTKCPUN.exe File opened for modification C:\windows\SysWOW64\PBYI.exe DLSH.exe File created C:\windows\SysWOW64\JHRJDA.exe QMNN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\AVVZAU.exe ZARD.exe File created C:\windows\PTKP.exe.bat GLI.exe File created C:\windows\system\CNERQGY.exe OHE.exe File created C:\windows\system\IOMEZAZ.exe CNERQGY.exe File created C:\windows\UPFAXEM.exe.bat WTGZ.exe File created C:\windows\OGP.exe.bat MIJZPH.exe File created C:\windows\system\OUYFZT.exe NRUB.exe File created C:\windows\system\WBXFS.exe KJCM.exe File opened for modification C:\windows\system\WBXFS.exe KJCM.exe File opened for modification C:\windows\system\VIM.exe YCCCDSN.exe File created C:\windows\IZO.exe.bat WRZHV.exe File created C:\windows\system\MPVHTWE.exe IZO.exe File opened for modification C:\windows\system\MLYCDP.exe KNSIWOW.exe File created C:\windows\OJSX.exe TOBOZ.exe File opened for modification C:\windows\OJSX.exe TOBOZ.exe File opened for modification C:\windows\KXY.exe XUQ.exe File created C:\windows\system\XCAKDZQ.exe OUYFZT.exe File created C:\windows\KGKRYIZ.exe JLG.exe File opened for modification C:\windows\system\ZGT.exe NQAJGDW.exe File created C:\windows\system\USQAH.exe TOM.exe File created C:\windows\SDCXAFX.exe MHCODC.exe File opened for modification C:\windows\ZARD.exe VKKVJMQ.exe File opened for modification C:\windows\PEESV.exe GWC.exe File created C:\windows\PEESV.exe.bat GWC.exe File created C:\windows\system\ZJPK.exe.bat PTKP.exe File created C:\windows\BFW.exe MPVHTWE.exe File created C:\windows\system\YAMC.exe.bat NHXRII.exe File created C:\windows\KXY.exe XUQ.exe File created C:\windows\system\XCAKDZQ.exe.bat OUYFZT.exe File created C:\windows\TQF.exe.bat NVGMM.exe File created C:\windows\RXDHVHZ.exe PBYXL.exe File created C:\windows\system\VFKHHZ.exe RXDHVHZ.exe File created C:\windows\system\GWC.exe.bat AVVZAU.exe File opened for modification C:\windows\IDSD.exe ZDQ.exe File opened for modification C:\windows\system\OUYFZT.exe NRUB.exe File opened for modification C:\windows\RXDHVHZ.exe PBYXL.exe File opened for modification C:\windows\OVJNYKW.exe APJ.exe File created C:\windows\system\GXMI.exe UPFAXEM.exe File created C:\windows\XUQ.exe FMOWEQ.exe File opened for modification C:\windows\SDCXAFX.exe MHCODC.exe File created C:\windows\system\PBYXL.exe.bat UOU.exe File created C:\windows\OVJNYKW.exe.bat APJ.exe File created C:\windows\PTMFSBI.exe QSXH.exe File created C:\windows\OGFQPY.exe.bat VOPGGY.exe File created C:\windows\system\WRZHV.exe PBYI.exe File opened for modification C:\windows\system\CNERQGY.exe OHE.exe File opened for modification C:\windows\TERUCRX.exe PWLU.exe File created C:\windows\KXY.exe.bat XUQ.exe File created C:\windows\system\TFAE.exe.bat KXY.exe File created C:\windows\QVXCZYR.exe TQF.exe File created C:\windows\QVXCZYR.exe.bat TQF.exe File created C:\windows\system\ZYXKN.exe FLS.exe File created C:\windows\TERUCRX.exe.bat PWLU.exe File created C:\windows\system\ZGT.exe NQAJGDW.exe File opened for modification C:\windows\system\NHXRII.exe DJRWBA.exe File created C:\windows\system\ZDQ.exe YAMC.exe File created C:\windows\ZARD.exe.bat VKKVJMQ.exe File created C:\windows\YFV.exe OHQJJE.exe File opened for modification C:\windows\system\DLSH.exe MKXV.exe File opened for modification C:\windows\system\QMNN.exe VCFPJA.exe File created C:\windows\system\OUYFZT.exe.bat NRUB.exe File created C:\windows\system\USQAH.exe.bat TOM.exe File opened for modification C:\windows\system\ZEG.exe PEESV.exe File opened for modification C:\windows\TQF.exe NVGMM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1004 cmd.exe 5264 cmd.exe 5656 cmd.exe 5220 cmd.exe 4604 cmd.exe 5980 cmd.exe 1848 cmd.exe 5416 cmd.exe 1892 cmd.exe 5900 cmd.exe 5476 cmd.exe 4592 cmd.exe 4640 cmd.exe 5760 cmd.exe 4312 cmd.exe 5740 cmd.exe 1556 cmd.exe 1196 cmd.exe 5552 cmd.exe 4428 cmd.exe 6124 cmd.exe 4264 cmd.exe 3928 cmd.exe 912 cmd.exe 5420 cmd.exe 2116 cmd.exe 4464 cmd.exe 5604 cmd.exe 1748 cmd.exe 3472 cmd.exe 5480 cmd.exe 4084 cmd.exe 5492 cmd.exe 2796 cmd.exe 4332 cmd.exe 3360 cmd.exe 1736 cmd.exe 3868 cmd.exe 4408 cmd.exe 2344 cmd.exe 3400 cmd.exe 1440 cmd.exe 2744 cmd.exe 3420 cmd.exe 4524 cmd.exe 5484 cmd.exe 5372 cmd.exe 824 cmd.exe 5084 cmd.exe 4744 cmd.exe 1404 cmd.exe 4664 cmd.exe 2556 cmd.exe 5112 cmd.exe 4480 cmd.exe 4644 cmd.exe 904 cmd.exe 1432 cmd.exe 5380 cmd.exe 2028 cmd.exe 5328 cmd.exe 3844 cmd.exe 2696 cmd.exe 4108 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5168 928 WerFault.exe 87 5584 5324 WerFault.exe 93 3488 260 WerFault.exe 99 5616 2516 WerFault.exe 104 4020 5572 WerFault.exe 109 3888 5472 WerFault.exe 114 4796 3712 WerFault.exe 119 3680 5812 WerFault.exe 124 1868 3564 WerFault.exe 129 4720 2132 WerFault.exe 134 2612 5464 WerFault.exe 139 4348 5312 WerFault.exe 144 2420 2928 WerFault.exe 149 5212 2960 WerFault.exe 154 5852 240 WerFault.exe 159 4020 4576 WerFault.exe 164 1620 3432 WerFault.exe 169 2440 4948 WerFault.exe 174 2656 2024 WerFault.exe 179 1868 1072 WerFault.exe 184 3256 4536 WerFault.exe 189 5896 4600 WerFault.exe 194 3096 2792 WerFault.exe 199 964 3392 WerFault.exe 204 2652 2460 WerFault.exe 209 1528 1448 WerFault.exe 214 5904 1520 WerFault.exe 219 1084 3004 WerFault.exe 224 1804 3512 WerFault.exe 229 1856 3008 WerFault.exe 234 5968 2080 WerFault.exe 239 932 4032 WerFault.exe 244 5964 6028 WerFault.exe 249 5492 5884 WerFault.exe 254 5392 4144 WerFault.exe 259 5936 5616 WerFault.exe 264 5380 2016 WerFault.exe 269 4184 5536 WerFault.exe 275 1440 4360 WerFault.exe 280 4660 4892 WerFault.exe 285 4424 4128 WerFault.exe 290 960 5300 WerFault.exe 295 4216 256 WerFault.exe 300 3040 552 WerFault.exe 305 2780 1768 WerFault.exe 310 796 1044 WerFault.exe 315 4620 1176 WerFault.exe 320 4104 3296 WerFault.exe 325 884 3396 WerFault.exe 330 5948 2280 WerFault.exe 335 5696 5808 WerFault.exe 340 1136 4732 WerFault.exe 345 4088 4976 WerFault.exe 350 5924 1028 WerFault.exe 355 3056 264 WerFault.exe 360 2524 5556 WerFault.exe 365 3524 1088 WerFault.exe 370 3552 1660 WerFault.exe 375 2504 1856 WerFault.exe 380 1076 4228 WerFault.exe 385 4812 5648 WerFault.exe 390 1608 1136 WerFault.exe 395 1316 5412 WerFault.exe 400 2780 1532 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJRWBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USQAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFKHHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVJNYKW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCCCDSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQSWIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIJZPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNHEMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCAKDZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRZHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOBOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBXFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VKKVJMQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMOWEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZARD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNERQGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUAXSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVVZAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTMFSBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKXV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPFAXEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQF.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 928 2026-08-09_03b65dd298cf9dfc8a2d20ec93ba610b_elex_emotet_stop.exe 928 2026-08-09_03b65dd298cf9dfc8a2d20ec93ba610b_elex_emotet_stop.exe 5324 MKXV.exe 5324 MKXV.exe 260 DLSH.exe 260 DLSH.exe 2516 PBYI.exe 2516 PBYI.exe 5572 WRZHV.exe 5572 WRZHV.exe 5472 IZO.exe 5472 IZO.exe 3712 MPVHTWE.exe 3712 MPVHTWE.exe 5812 BFW.exe 5812 BFW.exe 3564 OHE.exe 3564 OHE.exe 2132 CNERQGY.exe 2132 CNERQGY.exe 5464 IOMEZAZ.exe 5464 IOMEZAZ.exe 5312 VQCVNLU.exe 5312 VQCVNLU.exe 2928 WTGZ.exe 2928 WTGZ.exe 2960 UPFAXEM.exe 2960 UPFAXEM.exe 240 GXMI.exe 240 GXMI.exe 4576 KNSIWOW.exe 4576 KNSIWOW.exe 3432 MLYCDP.exe 3432 MLYCDP.exe 4948 UQLJOV.exe 4948 UQLJOV.exe 2024 PWLU.exe 2024 PWLU.exe 1072 TERUCRX.exe 1072 TERUCRX.exe 4536 VCFPJA.exe 4536 VCFPJA.exe 4600 QMNN.exe 4600 QMNN.exe 2792 JHRJDA.exe 2792 JHRJDA.exe 3392 YYSI.exe 3392 YYSI.exe 2460 NBKNDIA.exe 2460 NBKNDIA.exe 1448 TOBOZ.exe 1448 TOBOZ.exe 1520 OJSX.exe 1520 OJSX.exe 3004 KHAJ.exe 3004 KHAJ.exe 3512 XSIZJTC.exe 3512 XSIZJTC.exe 3008 MIJZPH.exe 3008 MIJZPH.exe 2080 OGP.exe 2080 OGP.exe 4032 NQAJGDW.exe 4032 NQAJGDW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 928 2026-08-09_03b65dd298cf9dfc8a2d20ec93ba610b_elex_emotet_stop.exe 928 2026-08-09_03b65dd298cf9dfc8a2d20ec93ba610b_elex_emotet_stop.exe 5324 MKXV.exe 5324 MKXV.exe 260 DLSH.exe 260 DLSH.exe 2516 PBYI.exe 2516 PBYI.exe 5572 WRZHV.exe 5572 WRZHV.exe 5472 IZO.exe 5472 IZO.exe 3712 MPVHTWE.exe 3712 MPVHTWE.exe 5812 BFW.exe 5812 BFW.exe 3564 OHE.exe 3564 OHE.exe 2132 CNERQGY.exe 2132 CNERQGY.exe 5464 IOMEZAZ.exe 5464 IOMEZAZ.exe 5312 VQCVNLU.exe 5312 VQCVNLU.exe 2928 WTGZ.exe 2928 WTGZ.exe 2960 UPFAXEM.exe 2960 UPFAXEM.exe 240 GXMI.exe 240 GXMI.exe 4576 KNSIWOW.exe 4576 KNSIWOW.exe 3432 MLYCDP.exe 3432 MLYCDP.exe 4948 UQLJOV.exe 4948 UQLJOV.exe 2024 PWLU.exe 2024 PWLU.exe 1072 TERUCRX.exe 1072 TERUCRX.exe 4536 VCFPJA.exe 4536 VCFPJA.exe 4600 QMNN.exe 4600 QMNN.exe 2792 JHRJDA.exe 2792 JHRJDA.exe 3392 YYSI.exe 3392 YYSI.exe 2460 NBKNDIA.exe 2460 NBKNDIA.exe 1448 TOBOZ.exe 1448 TOBOZ.exe 1520 OJSX.exe 1520 OJSX.exe 3004 KHAJ.exe 3004 KHAJ.exe 3512 XSIZJTC.exe 3512 XSIZJTC.exe 3008 MIJZPH.exe 3008 MIJZPH.exe 2080 OGP.exe 2080 OGP.exe 4032 NQAJGDW.exe 4032 NQAJGDW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 928 wrote to memory of 3232 928 2026-08-09_03b65dd298cf9dfc8a2d20ec93ba610b_elex_emotet_stop.exe 89 PID 3232 wrote to memory of 5324 3232 cmd.exe 93 PID 5324 wrote to memory of 5604 5324 MKXV.exe 95 PID 5604 wrote to memory of 260 5604 cmd.exe 99 PID 260 wrote to memory of 3868 260 DLSH.exe 100 PID 3868 wrote to memory of 2516 3868 cmd.exe 104 PID 2516 wrote to memory of 2028 2516 PBYI.exe 105 PID 2028 wrote to memory of 5572 2028 cmd.exe 109 PID 5572 wrote to memory of 4056 5572 WRZHV.exe 110 PID 4056 wrote to memory of 5472 4056 cmd.exe 114 PID 5472 wrote to memory of 6124 5472 IZO.exe 115 PID 6124 wrote to memory of 3712 6124 cmd.exe 119 PID 3712 wrote to memory of 5892 3712 MPVHTWE.exe 120 PID 5892 wrote to memory of 5812 5892 cmd.exe 124 PID 5812 wrote to memory of 2348 5812 BFW.exe 125 PID 2348 wrote to memory of 3564 2348 cmd.exe 129 PID 3564 wrote to memory of 1748 3564 OHE.exe 130 PID 1748 wrote to memory of 2132 1748 cmd.exe 134 PID 2132 wrote to memory of 1892 2132 CNERQGY.exe 135 PID 1892 wrote to memory of 5464 1892 cmd.exe 139 PID 5464 wrote to memory of 2796 5464 IOMEZAZ.exe 140 PID 2796 wrote to memory of 5312 2796 cmd.exe 144 PID 5312 wrote to memory of 5328 5312 VQCVNLU.exe 145 PID 5328 wrote to memory of 2928 5328 cmd.exe 149 PID 2928 wrote to memory of 236 2928 WTGZ.exe 150 PID 236 wrote to memory of 2960 236 cmd.exe 154 PID 2960 wrote to memory of 1060 2960 UPFAXEM.exe 155 PID 1060 wrote to memory of 240 1060 cmd.exe 159 PID 240 wrote to memory of 4640 240 GXMI.exe 160 PID 4640 wrote to memory of 4576 4640 cmd.exe 164 PID 4576 wrote to memory of 4408 4576 KNSIWOW.exe 165 PID 4408 wrote to memory of 3432 4408 cmd.exe 169 PID 3432 wrote to memory of 4264 3432 MLYCDP.exe 170 PID 4264 wrote to memory of 4948 4264 cmd.exe 174 PID 4948 wrote to memory of 3020 4948 UQLJOV.exe 175 PID 3020 wrote to memory of 2024 3020 cmd.exe 179 PID 2024 wrote to memory of 4524 2024 PWLU.exe 180 PID 4524 wrote to memory of 1072 4524 cmd.exe 184 PID 1072 wrote to memory of 4932 1072 TERUCRX.exe 185 PID 4932 wrote to memory of 4536 4932 cmd.exe 189 PID 4536 wrote to memory of 4740 4536 VCFPJA.exe 190 PID 4740 wrote to memory of 4600 4740 cmd.exe 194 PID 4600 wrote to memory of 5656 4600 QMNN.exe 195 PID 5656 wrote to memory of 2792 5656 cmd.exe 199 PID 2792 wrote to memory of 2892 2792 JHRJDA.exe 200 PID 2892 wrote to memory of 3392 2892 cmd.exe 204 PID 3392 wrote to memory of 1840 3392 YYSI.exe 205 PID 1840 wrote to memory of 2460 1840 cmd.exe 209 PID 2460 wrote to memory of 2812 2460 NBKNDIA.exe 210 PID 2812 wrote to memory of 1448 2812 cmd.exe 214 PID 1448 wrote to memory of 2600 1448 TOBOZ.exe 215 PID 2600 wrote to memory of 1520 2600 cmd.exe 219 PID 1520 wrote to memory of 5104 1520 OJSX.exe 220 PID 5104 wrote to memory of 3004 5104 cmd.exe 224 PID 3004 wrote to memory of 5428 3004 KHAJ.exe 225 PID 5428 wrote to memory of 3512 5428 cmd.exe 229 PID 3512 wrote to memory of 5760 3512 XSIZJTC.exe 230 PID 5760 wrote to memory of 3008 5760 cmd.exe 234 PID 3008 wrote to memory of 2916 3008 MIJZPH.exe 235 PID 2916 wrote to memory of 2080 2916 cmd.exe 239 PID 2080 wrote to memory of 4344 2080 OGP.exe 240 PID 4344 wrote to memory of 4032 4344 cmd.exe 244 PID 4032 wrote to memory of 2276 4032 NQAJGDW.exe 245 PID 2276 wrote to memory of 6028 2276 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_03b65dd298cf9dfc8a2d20ec93ba610b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_03b65dd298cf9dfc8a2d20ec93ba610b_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKXV.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\windows\system\MKXV.exeC:\windows\system\MKXV.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLSH.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\windows\system\DLSH.exeC:\windows\system\DLSH.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PBYI.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\windows\SysWOW64\PBYI.exeC:\windows\system32\PBYI.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZO.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\windows\IZO.exeC:\windows\IZO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPVHTWE.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\windows\system\MPVHTWE.exeC:\windows\system\MPVHTWE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BFW.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\windows\BFW.exeC:\windows\BFW.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHE.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\SysWOW64\OHE.exeC:\windows\system32\OHE.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CNERQGY.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\system\CNERQGY.exeC:\windows\system\CNERQGY.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOMEZAZ.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\windows\system\IOMEZAZ.exeC:\windows\system\IOMEZAZ.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQCVNLU.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\windows\VQCVNLU.exeC:\windows\VQCVNLU.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTGZ.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\windows\SysWOW64\WTGZ.exeC:\windows\system32\WTGZ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPFAXEM.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\UPFAXEM.exeC:\windows\UPFAXEM.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXMI.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\system\GXMI.exeC:\windows\system\GXMI.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNSIWOW.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\SysWOW64\KNSIWOW.exeC:\windows\system32\KNSIWOW.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLYCDP.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\system\MLYCDP.exeC:\windows\system\MLYCDP.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQLJOV.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\windows\SysWOW64\UQLJOV.exeC:\windows\system32\UQLJOV.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWLU.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\windows\PWLU.exeC:\windows\PWLU.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCFPJA.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\windows\system\VCFPJA.exeC:\windows\system\VCFPJA.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMNN.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\system\QMNN.exeC:\windows\system\QMNN.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHRJDA.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\SysWOW64\JHRJDA.exeC:\windows\system32\JHRJDA.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YYSI.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\SysWOW64\YYSI.exeC:\windows\system32\YYSI.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBKNDIA.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\windows\NBKNDIA.exeC:\windows\NBKNDIA.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOBOZ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\windows\system\TOBOZ.exeC:\windows\system\TOBOZ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJSX.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\OJSX.exeC:\windows\OJSX.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHAJ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\windows\SysWOW64\KHAJ.exeC:\windows\system32\KHAJ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSIZJTC.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\system\XSIZJTC.exeC:\windows\system\XSIZJTC.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIJZPH.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\windows\SysWOW64\MIJZPH.exeC:\windows\system32\MIJZPH.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\OGP.exeC:\windows\OGP.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NQAJGDW.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\NQAJGDW.exeC:\windows\NQAJGDW.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGT.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\windows\system\ZGT.exeC:\windows\system\ZGT.exe65⤵
- Executes dropped EXE
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJRWBA.exe.bat" "66⤵PID:3024
-
C:\windows\system\DJRWBA.exeC:\windows\system\DJRWBA.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHXRII.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:2804 -
C:\windows\system\NHXRII.exeC:\windows\system\NHXRII.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAMC.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1940 -
C:\windows\system\YAMC.exeC:\windows\system\YAMC.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDQ.exe.bat" "72⤵PID:2828
-
C:\windows\system\ZDQ.exeC:\windows\system\ZDQ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IDSD.exe.bat" "74⤵
- Executes a command shell one-liner
PID:4312 -
C:\windows\IDSD.exeC:\windows\IDSD.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NIKSZ.exe.bat" "76⤵PID:2764
-
C:\windows\system\NIKSZ.exeC:\windows\system\NIKSZ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMOWEQ.exe.bat" "78⤵PID:2972
-
C:\windows\SysWOW64\FMOWEQ.exeC:\windows\system32\FMOWEQ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUQ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5484 -
C:\windows\XUQ.exeC:\windows\XUQ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXY.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5220 -
C:\windows\KXY.exeC:\windows\KXY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4604 -
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNHEMO.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5168 -
C:\windows\SysWOW64\XNHEMO.exeC:\windows\system32\XNHEMO.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDOM.exe.bat" "88⤵PID:2640
-
C:\windows\JDOM.exeC:\windows\JDOM.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EQSWIG.exe.bat" "90⤵PID:200
-
C:\windows\SysWOW64\EQSWIG.exeC:\windows\system32\EQSWIG.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRUB.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5936 -
C:\windows\SysWOW64\NRUB.exeC:\windows\system32\NRUB.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUYFZT.exe.bat" "94⤵PID:4468
-
C:\windows\system\OUYFZT.exeC:\windows\system\OUYFZT.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCAKDZQ.exe.bat" "96⤵PID:4200
-
C:\windows\system\XCAKDZQ.exeC:\windows\system\XCAKDZQ.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKHK.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5372 -
C:\windows\BKHK.exeC:\windows\BKHK.exe99⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNL.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4660 -
C:\windows\CNL.exeC:\windows\CNL.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNSBDB.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4332 -
C:\windows\SysWOW64\HNSBDB.exeC:\windows\system32\HNSBDB.exe103⤵
- Executes dropped EXE
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLG.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5728 -
C:\windows\JLG.exeC:\windows\JLG.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGKRYIZ.exe.bat" "106⤵PID:5320
-
C:\windows\KGKRYIZ.exeC:\windows\KGKRYIZ.exe107⤵
- Executes dropped EXE
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOM.exe.bat" "108⤵PID:3436
-
C:\windows\system\TOM.exeC:\windows\system\TOM.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USQAH.exe.bat" "110⤵PID:4912
-
C:\windows\system\USQAH.exeC:\windows\system\USQAH.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFUJRVZ.exe.bat" "112⤵PID:4560
-
C:\windows\PFUJRVZ.exeC:\windows\PFUJRVZ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVGMM.exe.bat" "114⤵PID:1276
-
C:\windows\SysWOW64\NVGMM.exeC:\windows\system32\NVGMM.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQF.exe.bat" "116⤵PID:3036
-
C:\windows\TQF.exeC:\windows\TQF.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVXCZYR.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4856 -
C:\windows\QVXCZYR.exeC:\windows\QVXCZYR.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCM.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2344 -
C:\windows\SysWOW64\KJCM.exeC:\windows\system32\KJCM.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-