Analysis
- max time kernel
84s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe
- Size 208KB
- Sample260809-w7qjestdpc
- SHA256 fe0669b38cc7bf924e3f477dde19570b4e77d6071ee9b56cbb28ebc7ec7824bd
- MD5 5b82813934fd4e74b79c819530a49200
- SHA1 1bc492d0cf60599b6ba2cf2e282097407cda756f
- SHA512 50f4e531916c02b390379883cd95ebb53bf5a3efad34bb409ef6fc3f64f9ecbd9981483f1be9089562d33a3ed07549964645f64e01271a66d72dce363f76b49f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOfK4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LOCkEj1
- TLSH T147247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6044 VSZXJ.exe 4088 SIZHAQ.exe 1464 BGTILM.exe 5792 CJX.exe 5060 UEBHWSV.exe 3604 YUHP.exe 4128 MSH.exe 6008 UFU.exe 4820 GIEV.exe 4852 KOX.exe 4844 HOYMGGC.exe 5548 CCDW.exe 5252 GKK.exe 3820 OXX.exe 2376 YVCXV.exe 5332 WGNN.exe 2296 PJRRJB.exe 6016 OTUHR.exe 5888 CPSSGP.exe 3928 RFFJOE.exe 4584 SIJNU.exe 2712 PILP.exe 784 SQZPSJ.exe 1980 KZT.exe 6056 OHICHYY.exe 6032 YEOXP.exe 1224 HFQCSM.exe 1668 LVWCF.exe 3624 CVYPIC.exe 5504 QGHG.exe 4280 AEUA.exe 3348 HUVZKJS.exe 4292 WPF.exe 2584 CKEFAY.exe 4284 MIJZPH.exe 6036 BDTDBB.exe 4336 DBGYIK.exe 4492 EEKBV.exe 5568 ZRPLYAZ.exe 1408 XCSB.exe 5656 SXXKR.exe 4600 WFDKD.exe 3816 WLEZE.exe 3304 QYIIPLP.exe 2412 TTNR.exe 4892 OHSBBK.exe 5396 RPZ.exe 1256 TMEDDD.exe 3252 LVGI.exe 5600 HAY.exe 848 ZASD.exe 4052 DQH.exe 3760 JEYL.exe 5788 DZDVTW.exe 5040 PSSGKX.exe 3876 GSULOVZ.exe 1348 CXAI.exe 3728 QIJHJPW.exe 1960 QOJ.exe 5996 WORJU.exe 572 ZEXJGPO.exe 3868 HKP.exe 5756 CXUHS.exe 1832 IXCUJWH.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\GSULOVZ.exe PSSGKX.exe File created C:\windows\SysWOW64\TDZAF.exe.bat VCS.exe File created C:\windows\SysWOW64\HAY.exe.bat LVGI.exe File created C:\windows\SysWOW64\GSULOVZ.exe.bat PSSGKX.exe File opened for modification C:\windows\SysWOW64\ITAZLQ.exe TDZAF.exe File created C:\windows\SysWOW64\IXMDE.exe.bat TCCYTAY.exe File opened for modification C:\windows\SysWOW64\ZLVE.exe ILTZTGV.exe File created C:\windows\SysWOW64\VSZXJ.exe 2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\GIEV.exe UFU.exe File created C:\windows\SysWOW64\DBGYIK.exe BDTDBB.exe File created C:\windows\SysWOW64\OHSBBK.exe TTNR.exe File created C:\windows\SysWOW64\OGCR.exe.bat IFUDVZ.exe File created C:\windows\SysWOW64\ZLVE.exe.bat ILTZTGV.exe File opened for modification C:\windows\SysWOW64\FRVGPLT.exe UZAWH.exe File created C:\windows\SysWOW64\QYIIPLP.exe.bat WLEZE.exe File opened for modification C:\windows\SysWOW64\TMEDDD.exe RPZ.exe File created C:\windows\SysWOW64\HFXJC.exe MSS.exe File created C:\windows\SysWOW64\ILTZTGV.exe.bat NQOQR.exe File created C:\windows\SysWOW64\FRVGPLT.exe UZAWH.exe File created C:\windows\SysWOW64\GIEV.exe.bat UFU.exe File created C:\windows\SysWOW64\PJRRJB.exe.bat WGNN.exe File created C:\windows\SysWOW64\OHICHYY.exe KZT.exe File opened for modification C:\windows\SysWOW64\HUVZKJS.exe AEUA.exe File opened for modification C:\windows\SysWOW64\DBGYIK.exe BDTDBB.exe File opened for modification C:\windows\SysWOW64\QOJ.exe QIJHJPW.exe File created C:\windows\SysWOW64\TCCYTAY.exe.bat TZYDO.exe File opened for modification C:\windows\SysWOW64\VSZXJ.exe 2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\PJRRJB.exe WGNN.exe File created C:\windows\SysWOW64\OHICHYY.exe.bat KZT.exe File created C:\windows\SysWOW64\TMEDDD.exe.bat RPZ.exe File created C:\windows\SysWOW64\HKP.exe.bat ZEXJGPO.exe File created C:\windows\SysWOW64\NQOQR.exe CXLX.exe File created C:\windows\SysWOW64\GIEV.exe UFU.exe File created C:\windows\SysWOW64\YVCXV.exe OXX.exe File created C:\windows\SysWOW64\PJRRJB.exe WGNN.exe File opened for modification C:\windows\SysWOW64\OHICHYY.exe KZT.exe File opened for modification C:\windows\SysWOW64\IXMDE.exe TCCYTAY.exe File opened for modification C:\windows\SysWOW64\WPF.exe HUVZKJS.exe File created C:\windows\SysWOW64\SXXKR.exe.bat XCSB.exe File created C:\windows\SysWOW64\TTNR.exe QYIIPLP.exe File created C:\windows\SysWOW64\DQH.exe.bat ZASD.exe File created C:\windows\SysWOW64\JEYL.exe.bat DQH.exe File created C:\windows\SysWOW64\HKP.exe ZEXJGPO.exe File created C:\windows\SysWOW64\ITAZLQ.exe.bat TDZAF.exe File created C:\windows\SysWOW64\LVWCF.exe HFQCSM.exe File created C:\windows\SysWOW64\WPF.exe HUVZKJS.exe File created C:\windows\SysWOW64\WPF.exe.bat HUVZKJS.exe File created C:\windows\SysWOW64\CKEFAY.exe.bat WPF.exe File created C:\windows\SysWOW64\MIJZPH.exe CKEFAY.exe File created C:\windows\SysWOW64\BDTDBB.exe.bat MIJZPH.exe File created C:\windows\SysWOW64\TTNR.exe.bat QYIIPLP.exe File opened for modification C:\windows\SysWOW64\HAY.exe LVGI.exe File created C:\windows\SysWOW64\BGTILM.exe.bat SIZHAQ.exe File created C:\windows\SysWOW64\PILP.exe SIJNU.exe File opened for modification C:\windows\SysWOW64\PILP.exe SIJNU.exe File created C:\windows\SysWOW64\LVWCF.exe.bat HFQCSM.exe File created C:\windows\SysWOW64\HUVZKJS.exe.bat AEUA.exe File opened for modification C:\windows\SysWOW64\QYIIPLP.exe WLEZE.exe File created C:\windows\SysWOW64\QOJ.exe.bat QIJHJPW.exe File opened for modification C:\windows\SysWOW64\KJCM.exe VOK.exe File created C:\windows\SysWOW64\VSZXJ.exe.bat 2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe File created C:\windows\SysWOW64\PILP.exe.bat SIJNU.exe File created C:\windows\SysWOW64\MIJZPH.exe.bat CKEFAY.exe File created C:\windows\SysWOW64\OHSBBK.exe.bat TTNR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\CJX.exe BGTILM.exe File created C:\windows\system\GKK.exe.bat CCDW.exe File opened for modification C:\windows\OXX.exe GKK.exe File created C:\windows\system\RPZ.exe OHSBBK.exe File created C:\windows\system\IXCUJWH.exe.bat CXUHS.exe File opened for modification C:\windows\system\WJZ.exe GTQNZHD.exe File created C:\windows\JHKO.exe.bat FRVGPLT.exe File created C:\windows\CPSSGP.exe OTUHR.exe File created C:\windows\system\EEKBV.exe DBGYIK.exe File created C:\windows\system\BAGY.exe IXCUJWH.exe File created C:\windows\system\VOK.exe BAGY.exe File created C:\windows\AZDLQUV.exe KJCM.exe File opened for modification C:\windows\IFUDVZ.exe CKVV.exe File created C:\windows\CCDW.exe.bat HOYMGGC.exe File opened for modification C:\windows\system\RPZ.exe OHSBBK.exe File created C:\windows\system\RPZ.exe.bat OHSBBK.exe File opened for modification C:\windows\system\SCHHWK.exe AZDLQUV.exe File opened for modification C:\windows\FNM.exe VFKHHZ.exe File created C:\windows\MSS.exe.bat HSL.exe File created C:\windows\UZAWH.exe.bat ZLVE.exe File created C:\windows\UFU.exe MSH.exe File created C:\windows\ZASD.exe.bat HAY.exe File created C:\windows\DZDVTW.exe JEYL.exe File opened for modification C:\windows\UGJFOE.exe OGCR.exe File created C:\windows\system\DODKZBW.exe UGJFOE.exe File opened for modification C:\windows\PWMRI.exe DGF.exe File opened for modification C:\windows\system\NCCTXE.exe NXKEOZ.exe File created C:\windows\UZAWH.exe ZLVE.exe File created C:\windows\QGHG.exe.bat CVYPIC.exe File created C:\windows\system\LVGI.exe TMEDDD.exe File opened for modification C:\windows\ZEXJGPO.exe WORJU.exe File created C:\windows\system\VOK.exe.bat BAGY.exe File created C:\windows\system\TESRM.exe.bat PWMRI.exe File created C:\windows\HSL.exe.bat IXMDE.exe File created C:\windows\JHKO.exe FRVGPLT.exe File created C:\windows\SIZHAQ.exe VSZXJ.exe File created C:\windows\RFFJOE.exe CPSSGP.exe File opened for modification C:\windows\RFFJOE.exe CPSSGP.exe File created C:\windows\system\KZT.exe.bat SQZPSJ.exe File created C:\windows\WFDKD.exe SXXKR.exe File opened for modification C:\windows\system\TESRM.exe PWMRI.exe File opened for modification C:\windows\system\GTQNZHD.exe HFXJC.exe File created C:\windows\system\NXKEOZ.exe WJZ.exe File created C:\windows\system\MSH.exe YUHP.exe File created C:\windows\system\HOYMGGC.exe KOX.exe File opened for modification C:\windows\CCDW.exe HOYMGGC.exe File opened for modification C:\windows\SIJNU.exe RFFJOE.exe File created C:\windows\UGJFOE.exe OGCR.exe File opened for modification C:\windows\system\AVVZAU.exe JVTUX.exe File created C:\windows\SIZHAQ.exe.bat VSZXJ.exe File created C:\windows\SIJNU.exe RFFJOE.exe File created C:\windows\WFDKD.exe.bat SXXKR.exe File created C:\windows\system\QIJHJPW.exe.bat CXAI.exe File created C:\windows\system\SCHHWK.exe.bat AZDLQUV.exe File created C:\windows\NPL.exe.bat SCHHWK.exe File opened for modification C:\windows\JVTUX.exe FNM.exe File opened for modification C:\windows\system\MSH.exe YUHP.exe File opened for modification C:\windows\UFU.exe MSH.exe File opened for modification C:\windows\YEOXP.exe OHICHYY.exe File created C:\windows\HFQCSM.exe YEOXP.exe File created C:\windows\HFQCSM.exe.bat YEOXP.exe File opened for modification C:\windows\system\ZRPLYAZ.exe EEKBV.exe File opened for modification C:\windows\system\WORJU.exe QOJ.exe File created C:\windows\IFUDVZ.exe.bat CKVV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4392 cmd.exe 2372 cmd.exe 3028 cmd.exe 2136 cmd.exe 2076 cmd.exe 4824 cmd.exe 3552 cmd.exe 5304 cmd.exe 4920 cmd.exe 4220 cmd.exe 4628 cmd.exe 5052 cmd.exe 2532 cmd.exe 2724 cmd.exe 1672 cmd.exe 1500 cmd.exe 1172 cmd.exe 3580 cmd.exe 1616 cmd.exe 5760 cmd.exe 1764 cmd.exe 2536 cmd.exe 5632 cmd.exe 3468 cmd.exe 6004 cmd.exe 2384 cmd.exe 1184 cmd.exe 5220 cmd.exe 1820 cmd.exe 5820 cmd.exe 3144 cmd.exe 4072 cmd.exe 2552 cmd.exe 3856 cmd.exe 1388 cmd.exe 252 cmd.exe 3924 cmd.exe 1948 cmd.exe 2356 cmd.exe 5496 cmd.exe 5900 cmd.exe 2672 cmd.exe 3296 cmd.exe 2176 cmd.exe 2760 cmd.exe 5032 cmd.exe 4312 cmd.exe 4768 cmd.exe 1788 cmd.exe 2924 cmd.exe 944 cmd.exe 5680 cmd.exe 3860 cmd.exe 2980 cmd.exe 624 cmd.exe 2888 cmd.exe 476 cmd.exe 4160 cmd.exe 4252 cmd.exe 5232 cmd.exe 5444 cmd.exe 3248 cmd.exe 4224 cmd.exe 5104 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 932 4304 WerFault.exe 87 5720 6044 WerFault.exe 93 1040 4088 WerFault.exe 99 956 1464 WerFault.exe 104 2076 5792 WerFault.exe 109 3500 5060 WerFault.exe 114 5812 3604 WerFault.exe 119 4568 4128 WerFault.exe 124 1064 6008 WerFault.exe 129 2848 4820 WerFault.exe 134 4256 4852 WerFault.exe 139 1796 4844 WerFault.exe 144 2232 5548 WerFault.exe 149 5928 5252 WerFault.exe 154 4484 3820 WerFault.exe 159 6032 2376 WerFault.exe 164 2440 5332 WerFault.exe 169 1620 2296 WerFault.exe 174 5352 6016 WerFault.exe 179 1656 5888 WerFault.exe 184 3344 3928 WerFault.exe 189 5836 4584 WerFault.exe 194 4240 2712 WerFault.exe 199 1672 784 WerFault.exe 204 2872 1980 WerFault.exe 209 1616 6056 WerFault.exe 214 5468 6032 WerFault.exe 219 3004 1224 WerFault.exe 224 3356 1668 WerFault.exe 229 4056 3624 WerFault.exe 234 3344 5504 WerFault.exe 239 5884 4280 WerFault.exe 244 4052 3348 WerFault.exe 249 1240 4292 WerFault.exe 254 3688 2584 WerFault.exe 259 2432 4284 WerFault.exe 264 3876 6036 WerFault.exe 270 1228 4336 WerFault.exe 275 1100 4492 WerFault.exe 280 3196 5568 WerFault.exe 285 2668 1408 WerFault.exe 290 4920 5656 WerFault.exe 295 1304 4600 WerFault.exe 300 2176 3816 WerFault.exe 305 6064 3304 WerFault.exe 310 5720 2412 WerFault.exe 315 3744 4892 WerFault.exe 320 3036 5396 WerFault.exe 325 5352 1256 WerFault.exe 330 4980 3252 WerFault.exe 335 4776 5600 WerFault.exe 340 4076 848 WerFault.exe 345 2232 4052 WerFault.exe 350 1248 3760 WerFault.exe 355 868 5788 WerFault.exe 360 3124 5040 WerFault.exe 365 5976 3876 WerFault.exe 370 4564 1348 WerFault.exe 375 4224 3728 WerFault.exe 380 4956 1960 WerFault.exe 385 1104 5996 WerFault.exe 390 2232 572 WerFault.exe 395 4160 3868 WerFault.exe 400 2944 5756 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXUHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIJHJPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCHHWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIJNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWMRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVWCF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBGYIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WORJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PILP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZASD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGJFOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDZAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIZHAQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFKHHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHSBBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEOXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSZXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQOQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFDKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXCUJWH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4304 2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe 4304 2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe 6044 VSZXJ.exe 6044 VSZXJ.exe 4088 SIZHAQ.exe 4088 SIZHAQ.exe 1464 BGTILM.exe 1464 BGTILM.exe 5792 CJX.exe 5792 CJX.exe 5060 UEBHWSV.exe 5060 UEBHWSV.exe 3604 YUHP.exe 3604 YUHP.exe 4128 MSH.exe 4128 MSH.exe 6008 UFU.exe 6008 UFU.exe 4820 GIEV.exe 4820 GIEV.exe 4852 KOX.exe 4852 KOX.exe 4844 HOYMGGC.exe 4844 HOYMGGC.exe 5548 CCDW.exe 5548 CCDW.exe 5252 GKK.exe 5252 GKK.exe 3820 OXX.exe 3820 OXX.exe 2376 YVCXV.exe 2376 YVCXV.exe 5332 WGNN.exe 5332 WGNN.exe 2296 PJRRJB.exe 2296 PJRRJB.exe 6016 OTUHR.exe 6016 OTUHR.exe 5888 CPSSGP.exe 5888 CPSSGP.exe 3928 RFFJOE.exe 3928 RFFJOE.exe 4584 SIJNU.exe 4584 SIJNU.exe 2712 PILP.exe 2712 PILP.exe 784 SQZPSJ.exe 784 SQZPSJ.exe 1980 KZT.exe 1980 KZT.exe 6056 OHICHYY.exe 6056 OHICHYY.exe 6032 YEOXP.exe 6032 YEOXP.exe 1224 HFQCSM.exe 1224 HFQCSM.exe 1668 LVWCF.exe 1668 LVWCF.exe 3624 CVYPIC.exe 3624 CVYPIC.exe 5504 QGHG.exe 5504 QGHG.exe 4280 AEUA.exe 4280 AEUA.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4304 2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe 4304 2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe 6044 VSZXJ.exe 6044 VSZXJ.exe 4088 SIZHAQ.exe 4088 SIZHAQ.exe 1464 BGTILM.exe 1464 BGTILM.exe 5792 CJX.exe 5792 CJX.exe 5060 UEBHWSV.exe 5060 UEBHWSV.exe 3604 YUHP.exe 3604 YUHP.exe 4128 MSH.exe 4128 MSH.exe 6008 UFU.exe 6008 UFU.exe 4820 GIEV.exe 4820 GIEV.exe 4852 KOX.exe 4852 KOX.exe 4844 HOYMGGC.exe 4844 HOYMGGC.exe 5548 CCDW.exe 5548 CCDW.exe 5252 GKK.exe 5252 GKK.exe 3820 OXX.exe 3820 OXX.exe 2376 YVCXV.exe 2376 YVCXV.exe 5332 WGNN.exe 5332 WGNN.exe 2296 PJRRJB.exe 2296 PJRRJB.exe 6016 OTUHR.exe 6016 OTUHR.exe 5888 CPSSGP.exe 5888 CPSSGP.exe 3928 RFFJOE.exe 3928 RFFJOE.exe 4584 SIJNU.exe 4584 SIJNU.exe 2712 PILP.exe 2712 PILP.exe 784 SQZPSJ.exe 784 SQZPSJ.exe 1980 KZT.exe 1980 KZT.exe 6056 OHICHYY.exe 6056 OHICHYY.exe 6032 YEOXP.exe 6032 YEOXP.exe 1224 HFQCSM.exe 1224 HFQCSM.exe 1668 LVWCF.exe 1668 LVWCF.exe 3624 CVYPIC.exe 3624 CVYPIC.exe 5504 QGHG.exe 5504 QGHG.exe 4280 AEUA.exe 4280 AEUA.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4304 wrote to memory of 4072 4304 2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe 89 PID 4072 wrote to memory of 6044 4072 cmd.exe 93 PID 6044 wrote to memory of 888 6044 VSZXJ.exe 95 PID 888 wrote to memory of 4088 888 cmd.exe 99 PID 4088 wrote to memory of 4312 4088 SIZHAQ.exe 100 PID 4312 wrote to memory of 1464 4312 cmd.exe 104 PID 1464 wrote to memory of 2728 1464 BGTILM.exe 105 PID 2728 wrote to memory of 5792 2728 cmd.exe 109 PID 5792 wrote to memory of 3572 5792 CJX.exe 110 PID 3572 wrote to memory of 5060 3572 cmd.exe 114 PID 5060 wrote to memory of 5768 5060 UEBHWSV.exe 115 PID 5768 wrote to memory of 3604 5768 cmd.exe 119 PID 3604 wrote to memory of 688 3604 YUHP.exe 120 PID 688 wrote to memory of 4128 688 cmd.exe 124 PID 4128 wrote to memory of 1288 4128 MSH.exe 125 PID 1288 wrote to memory of 6008 1288 cmd.exe 129 PID 6008 wrote to memory of 4740 6008 UFU.exe 130 PID 4740 wrote to memory of 4820 4740 cmd.exe 134 PID 4820 wrote to memory of 3860 4820 GIEV.exe 135 PID 3860 wrote to memory of 4852 3860 cmd.exe 139 PID 4852 wrote to memory of 2620 4852 KOX.exe 140 PID 2620 wrote to memory of 4844 2620 cmd.exe 144 PID 4844 wrote to memory of 5076 4844 HOYMGGC.exe 145 PID 5076 wrote to memory of 5548 5076 cmd.exe 149 PID 5548 wrote to memory of 3144 5548 CCDW.exe 150 PID 3144 wrote to memory of 5252 3144 cmd.exe 154 PID 5252 wrote to memory of 2152 5252 GKK.exe 155 PID 2152 wrote to memory of 3820 2152 cmd.exe 159 PID 3820 wrote to memory of 4516 3820 OXX.exe 160 PID 4516 wrote to memory of 2376 4516 cmd.exe 164 PID 2376 wrote to memory of 4632 2376 YVCXV.exe 165 PID 4632 wrote to memory of 5332 4632 cmd.exe 169 PID 5332 wrote to memory of 2552 5332 WGNN.exe 170 PID 2552 wrote to memory of 2296 2552 cmd.exe 174 PID 2296 wrote to memory of 2356 2296 PJRRJB.exe 175 PID 2356 wrote to memory of 6016 2356 cmd.exe 179 PID 6016 wrote to memory of 5960 6016 OTUHR.exe 180 PID 5960 wrote to memory of 5888 5960 cmd.exe 184 PID 5888 wrote to memory of 4864 5888 CPSSGP.exe 185 PID 4864 wrote to memory of 3928 4864 cmd.exe 189 PID 3928 wrote to memory of 3320 3928 RFFJOE.exe 190 PID 3320 wrote to memory of 4584 3320 cmd.exe 194 PID 4584 wrote to memory of 3564 4584 SIJNU.exe 195 PID 3564 wrote to memory of 2712 3564 cmd.exe 199 PID 2712 wrote to memory of 2372 2712 PILP.exe 200 PID 2372 wrote to memory of 784 2372 cmd.exe 204 PID 784 wrote to memory of 560 784 SQZPSJ.exe 205 PID 560 wrote to memory of 1980 560 cmd.exe 209 PID 1980 wrote to memory of 4472 1980 KZT.exe 210 PID 4472 wrote to memory of 6056 4472 cmd.exe 214 PID 6056 wrote to memory of 3480 6056 OHICHYY.exe 215 PID 3480 wrote to memory of 6032 3480 cmd.exe 219 PID 6032 wrote to memory of 2980 6032 YEOXP.exe 220 PID 2980 wrote to memory of 1224 2980 cmd.exe 224 PID 1224 wrote to memory of 4572 1224 HFQCSM.exe 225 PID 4572 wrote to memory of 1668 4572 cmd.exe 229 PID 1668 wrote to memory of 3736 1668 LVWCF.exe 230 PID 3736 wrote to memory of 3624 3736 cmd.exe 234 PID 3624 wrote to memory of 3028 3624 CVYPIC.exe 235 PID 3028 wrote to memory of 5504 3028 cmd.exe 239 PID 5504 wrote to memory of 2848 5504 QGHG.exe 240 PID 2848 wrote to memory of 4280 2848 cmd.exe 244 PID 4280 wrote to memory of 3128 4280 AEUA.exe 245 PID 3128 wrote to memory of 3348 3128 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5b82813934fd4e74b79c819530a49200_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSZXJ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\windows\SysWOW64\VSZXJ.exeC:\windows\system32\VSZXJ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIZHAQ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888 -
C:\windows\SIZHAQ.exeC:\windows\SIZHAQ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BGTILM.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\SysWOW64\BGTILM.exeC:\windows\system32\BGTILM.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJX.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\CJX.exeC:\windows\CJX.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEBHWSV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\windows\UEBHWSV.exeC:\windows\UEBHWSV.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUHP.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\YUHP.exeC:\windows\YUHP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MSH.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\windows\system\MSH.exeC:\windows\system\MSH.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFU.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\UFU.exeC:\windows\UFU.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GIEV.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\SysWOW64\GIEV.exeC:\windows\system32\GIEV.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KOX.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\windows\KOX.exeC:\windows\KOX.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOYMGGC.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\system\HOYMGGC.exeC:\windows\system\HOYMGGC.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCDW.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\windows\CCDW.exeC:\windows\CCDW.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKK.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\windows\system\GKK.exeC:\windows\system\GKK.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXX.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\windows\OXX.exeC:\windows\OXX.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVCXV.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\windows\SysWOW64\YVCXV.exeC:\windows\system32\YVCXV.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGNN.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\windows\SysWOW64\WGNN.exeC:\windows\system32\WGNN.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJRRJB.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\windows\SysWOW64\PJRRJB.exeC:\windows\system32\PJRRJB.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTUHR.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\OTUHR.exeC:\windows\OTUHR.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPSSGP.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\CPSSGP.exeC:\windows\CPSSGP.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFFJOE.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\RFFJOE.exeC:\windows\RFFJOE.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIJNU.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\windows\SIJNU.exeC:\windows\SIJNU.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PILP.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\windows\SysWOW64\PILP.exeC:\windows\system32\PILP.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQZPSJ.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\system\SQZPSJ.exeC:\windows\system\SQZPSJ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZT.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560 -
C:\windows\system\KZT.exeC:\windows\system\KZT.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHICHYY.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\windows\SysWOW64\OHICHYY.exeC:\windows\system32\OHICHYY.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEOXP.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\windows\YEOXP.exeC:\windows\YEOXP.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HFQCSM.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\HFQCSM.exeC:\windows\HFQCSM.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LVWCF.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\SysWOW64\LVWCF.exeC:\windows\system32\LVWCF.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CVYPIC.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\windows\system\CVYPIC.exeC:\windows\system\CVYPIC.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGHG.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\windows\QGHG.exeC:\windows\QGHG.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AEUA.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\windows\system\AEUA.exeC:\windows\system\AEUA.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUVZKJS.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\windows\SysWOW64\HUVZKJS.exeC:\windows\system32\HUVZKJS.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPF.exe.bat" "66⤵PID:5028
-
C:\windows\SysWOW64\WPF.exeC:\windows\system32\WPF.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKEFAY.exe.bat" "68⤵PID:4172
-
C:\windows\SysWOW64\CKEFAY.exeC:\windows\system32\CKEFAY.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIJZPH.exe.bat" "70⤵PID:2308
-
C:\windows\SysWOW64\MIJZPH.exeC:\windows\system32\MIJZPH.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDTDBB.exe.bat" "72⤵
- Executes a command shell one-liner
PID:624 -
C:\windows\SysWOW64\BDTDBB.exeC:\windows\system32\BDTDBB.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4768 -
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EEKBV.exe.bat" "76⤵PID:5944
-
C:\windows\system\EEKBV.exeC:\windows\system\EEKBV.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRPLYAZ.exe.bat" "78⤵PID:5128
-
C:\windows\system\ZRPLYAZ.exeC:\windows\system\ZRPLYAZ.exe79⤵
- Executes dropped EXE
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCSB.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5632 -
C:\windows\system\XCSB.exeC:\windows\system\XCSB.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SXXKR.exe.bat" "82⤵PID:5660
-
C:\windows\SysWOW64\SXXKR.exeC:\windows\system32\SXXKR.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFDKD.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5304 -
C:\windows\WFDKD.exeC:\windows\WFDKD.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLEZE.exe.bat" "86⤵PID:4872
-
C:\windows\system\WLEZE.exeC:\windows\system\WLEZE.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYIIPLP.exe.bat" "88⤵PID:1796
-
C:\windows\SysWOW64\QYIIPLP.exeC:\windows\system32\QYIIPLP.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTNR.exe.bat" "90⤵PID:3912
-
C:\windows\SysWOW64\TTNR.exeC:\windows\system32\TTNR.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHSBBK.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5496 -
C:\windows\SysWOW64\OHSBBK.exeC:\windows\system32\OHSBBK.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPZ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:3468 -
C:\windows\system\RPZ.exeC:\windows\system\RPZ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TMEDDD.exe.bat" "96⤵PID:4792
-
C:\windows\SysWOW64\TMEDDD.exeC:\windows\system32\TMEDDD.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVGI.exe.bat" "98⤵PID:3436
-
C:\windows\system\LVGI.exeC:\windows\system\LVGI.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAY.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3616 -
C:\windows\SysWOW64\HAY.exeC:\windows\system32\HAY.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZASD.exe.bat" "102⤵PID:4608
-
C:\windows\ZASD.exeC:\windows\ZASD.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQH.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4920 -
C:\windows\SysWOW64\DQH.exeC:\windows\system32\DQH.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEYL.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4220 -
C:\windows\SysWOW64\JEYL.exeC:\windows\system32\JEYL.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZDVTW.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1772 -
C:\windows\DZDVTW.exeC:\windows\DZDVTW.exe109⤵
- Executes dropped EXE
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSSGKX.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2888 -
C:\windows\PSSGKX.exeC:\windows\PSSGKX.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSULOVZ.exe.bat" "112⤵PID:3244
-
C:\windows\SysWOW64\GSULOVZ.exeC:\windows\system32\GSULOVZ.exe113⤵
- Executes dropped EXE
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXAI.exe.bat" "114⤵PID:3140
-
C:\windows\system\CXAI.exeC:\windows\system\CXAI.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIJHJPW.exe.bat" "116⤵PID:5848
-
C:\windows\system\QIJHJPW.exeC:\windows\system\QIJHJPW.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QOJ.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3856 -
C:\windows\SysWOW64\QOJ.exeC:\windows\system32\QOJ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WORJU.exe.bat" "120⤵PID:5112
-
C:\windows\system\WORJU.exeC:\windows\system\WORJU.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-