Analysis
- max time kernel
87s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 19:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_70ca5bda648e22de8c7ea7edd0882ede_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-08-09_70ca5bda648e22de8c7ea7edd0882ede_elex_emotet_stop.exe
- Size 208KB
- Sample260809-yhmscavcld
- SHA256 5641c17b70de67758a292e0776d1aea5079eba894b9fa568da45910db5c7dbdf
- MD5 70ca5bda648e22de8c7ea7edd0882ede
- SHA1 b45caa93fc236deee3711601f0965d3006bb5b47
- SHA512 7add06cbd0dca0a1485eee2025c5f03d1bcc96eeb486e0d0a96521f79b034689506a6f37300bdf4a965f5109db8e6da698bebe59c47704fa39f4162f1b3ba990
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfv4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOHkEj1
- TLSH T169247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4616 WSQRIF.exe 4968 SIKQ.exe 2800 LLO.exe 1520 VJCGPG.exe 2284 IMKFVR.exe 5456 TENXE.exe 5160 OASHOYN.exe 3496 YQYBVG.exe 3876 TLD.exe 2864 BQP.exe 3752 BWH.exe 5788 AXEESN.exe 1256 EADZ.exe 3812 TVMEDT.exe 2116 CDO.exe 2384 QGWHDB.exe 4864 QJADI.exe 4444 AJCQMW.exe 5012 TKSBVX.exe 5236 XSY.exe 4308 DNYC.exe 1368 QYGB.exe 4120 UGNBMNH.exe 2588 XTR.exe 5960 VPRT.exe 5800 VSU.exe 3604 FXFH.exe 2472 NKR.exe 1140 HYWFJ.exe 3452 KLBOUBH.exe 5600 BEEECH.exe 4132 UWTPMI.exe 200 HUTBO.exe 4656 CFCRCWJ.exe 5420 KVDRJS.exe 4720 WDR.exe 5468 FLTWY.exe 1848 GOX.exe 5312 RHFK.exe 5624 IHHQZ.exe 6112 WSX.exe 960 AAEOZ.exe 5472 KYJJG.exe 1652 TGLOKF.exe 4296 UJPRP.exe 3776 RJXFGXM.exe 3004 XXW.exe 3528 SKBPN.exe 2500 NFGZYAF.exe 2544 CAPL.exe 4600 WOUUTM.exe 2016 ETMJUZG.exe 5920 GRAVKH.exe 4392 WUJI.exe 5704 CHIIZ.exe 3396 AFTL.exe 4092 VSYVX.exe 4804 MBAAAID.exe 3060 VBCFE.exe 2136 PTSQV.exe 1120 WKTPCU.exe 2244 EXXWEA.exe 5956 JDQLVVA.exe 6124 WAQXE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HWSKD.exe PTG.exe File created C:\windows\SysWOW64\HKZEZ.exe PCXZ.exe File opened for modification C:\windows\SysWOW64\SSHMSB.exe ZPDQ.exe File created C:\windows\SysWOW64\SSHMSB.exe.bat ZPDQ.exe File created C:\windows\SysWOW64\IIVUQE.exe WAOU.exe File opened for modification C:\windows\SysWOW64\RFCX.exe BPBXN.exe File created C:\windows\SysWOW64\EGJATH.exe.bat DLXF.exe File created C:\windows\SysWOW64\TENXE.exe IMKFVR.exe File opened for modification C:\windows\SysWOW64\WSX.exe IHHQZ.exe File opened for modification C:\windows\SysWOW64\ETMJUZG.exe WOUUTM.exe File created C:\windows\SysWOW64\LWNM.exe AWYB.exe File created C:\windows\SysWOW64\PTG.exe.bat KOWZIAO.exe File opened for modification C:\windows\SysWOW64\HKZEZ.exe PCXZ.exe File created C:\windows\SysWOW64\FVBU.exe.bat HKZEZ.exe File created C:\windows\SysWOW64\ZPDQ.exe IGBLJG.exe File created C:\windows\SysWOW64\HUTBO.exe.bat UWTPMI.exe File created C:\windows\SysWOW64\WSX.exe.bat IHHQZ.exe File created C:\windows\SysWOW64\MBAAAID.exe VSYVX.exe File created C:\windows\SysWOW64\MBAAAID.exe.bat VSYVX.exe File created C:\windows\SysWOW64\HKZEZ.exe.bat PCXZ.exe File created C:\windows\SysWOW64\FVBU.exe HKZEZ.exe File opened for modification C:\windows\SysWOW64\IGBLJG.exe TLKZQ.exe File created C:\windows\SysWOW64\IGBLJG.exe.bat TLKZQ.exe File opened for modification C:\windows\SysWOW64\HUTBO.exe UWTPMI.exe File created C:\windows\SysWOW64\AAEOZ.exe.bat WSX.exe File opened for modification C:\windows\SysWOW64\SKBPN.exe XXW.exe File created C:\windows\SysWOW64\ETMJUZG.exe.bat WOUUTM.exe File created C:\windows\SysWOW64\EXXWEA.exe WKTPCU.exe File created C:\windows\SysWOW64\ZOHYQS.exe.bat WAQXE.exe File created C:\windows\SysWOW64\HVFJVC.exe.bat RCCTMWH.exe File opened for modification C:\windows\SysWOW64\PTG.exe KOWZIAO.exe File opened for modification C:\windows\SysWOW64\LLO.exe SIKQ.exe File created C:\windows\SysWOW64\XSY.exe TKSBVX.exe File created C:\windows\SysWOW64\HUTBO.exe UWTPMI.exe File created C:\windows\SysWOW64\KVDRJS.exe CFCRCWJ.exe File opened for modification C:\windows\SysWOW64\GAMBFAK.exe RFCX.exe File created C:\windows\SysWOW64\YQYBVG.exe.bat OASHOYN.exe File opened for modification C:\windows\SysWOW64\TKSBVX.exe AJCQMW.exe File created C:\windows\SysWOW64\TKSBVX.exe.bat AJCQMW.exe File created C:\windows\SysWOW64\WSX.exe IHHQZ.exe File opened for modification C:\windows\SysWOW64\CHIIZ.exe WUJI.exe File created C:\windows\SysWOW64\WAQXE.exe.bat JDQLVVA.exe File created C:\windows\SysWOW64\LWNM.exe.bat AWYB.exe File created C:\windows\SysWOW64\SSHMSB.exe ZPDQ.exe File opened for modification C:\windows\SysWOW64\YQYBVG.exe OASHOYN.exe File created C:\windows\SysWOW64\SKBPN.exe XXW.exe File created C:\windows\SysWOW64\SKBPN.exe.bat XXW.exe File created C:\windows\SysWOW64\IGBLJG.exe TLKZQ.exe File created C:\windows\SysWOW64\GAMBFAK.exe RFCX.exe File opened for modification C:\windows\SysWOW64\KLBOUBH.exe HYWFJ.exe File opened for modification C:\windows\SysWOW64\CFCRCWJ.exe HUTBO.exe File created C:\windows\SysWOW64\CFCRCWJ.exe.bat HUTBO.exe File opened for modification C:\windows\SysWOW64\RHFK.exe GOX.exe File opened for modification C:\windows\SysWOW64\EGJATH.exe DLXF.exe File created C:\windows\SysWOW64\TKSBVX.exe AJCQMW.exe File opened for modification C:\windows\SysWOW64\XSY.exe TKSBVX.exe File created C:\windows\SysWOW64\AAEOZ.exe WSX.exe File created C:\windows\SysWOW64\VYDHGBO.exe CDZEA.exe File created C:\windows\SysWOW64\GAMBFAK.exe.bat RFCX.exe File created C:\windows\SysWOW64\EGJATH.exe DLXF.exe File opened for modification C:\windows\SysWOW64\TENXE.exe IMKFVR.exe File created C:\windows\SysWOW64\TENXE.exe.bat IMKFVR.exe File created C:\windows\SysWOW64\OASHOYN.exe.bat TENXE.exe File created C:\windows\SysWOW64\RHFK.exe.bat GOX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\YYN.exe.bat FVBU.exe File opened for modification C:\windows\UMK.exe FWJCNK.exe File opened for modification C:\windows\system\DLXF.exe SSC.exe File created C:\windows\system\DLXF.exe.bat SSC.exe File created C:\windows\system\IMKFVR.exe VJCGPG.exe File opened for modification C:\windows\QGWHDB.exe CDO.exe File created C:\windows\VPRT.exe XTR.exe File opened for modification C:\windows\UJPRP.exe TGLOKF.exe File created C:\windows\RJXFGXM.exe.bat UJPRP.exe File opened for modification C:\windows\WUJI.exe GRAVKH.exe File created C:\windows\system\XGKOY.exe ZOHYQS.exe File opened for modification C:\windows\BPBXN.exe UMK.exe File opened for modification C:\windows\system\BWH.exe BQP.exe File created C:\windows\system\AWYB.exe FYYPW.exe File created C:\windows\KOWZIAO.exe RTSDC.exe File opened for modification C:\windows\LGAST.exe GAMBFAK.exe File opened for modification C:\windows\system\IHKL.exe XOH.exe File created C:\windows\system\DLXF.exe SSC.exe File created C:\windows\system\IMKFVR.exe.bat VJCGPG.exe File opened for modification C:\windows\LSIP.exe REZO.exe File created C:\windows\XOH.exe.bat LGAST.exe File opened for modification C:\windows\system\PYETUOC.exe EGJATH.exe File created C:\windows\system\PYETUOC.exe.bat EGJATH.exe File created C:\windows\system\SIKQ.exe WSQRIF.exe File opened for modification C:\windows\system\DNYC.exe XSY.exe File created C:\windows\QYGB.exe.bat DNYC.exe File opened for modification C:\windows\FXFH.exe VSU.exe File created C:\windows\system\FLTWY.exe WDR.exe File created C:\windows\RJXFGXM.exe UJPRP.exe File created C:\windows\system\VBCFE.exe MBAAAID.exe File created C:\windows\TLKZQ.exe.bat YYN.exe File created C:\windows\system\WSQRIF.exe 2026-08-09_70ca5bda648e22de8c7ea7edd0882ede_elex_emotet_stop.exe File opened for modification C:\windows\system\UGNBMNH.exe QYGB.exe File created C:\windows\FXFH.exe VSU.exe File created C:\windows\HYWFJ.exe.bat NKR.exe File created C:\windows\system\KYJJG.exe AAEOZ.exe File created C:\windows\UJPRP.exe.bat TGLOKF.exe File opened for modification C:\windows\WOUUTM.exe CAPL.exe File opened for modification C:\windows\GRAVKH.exe ETMJUZG.exe File opened for modification C:\windows\system\CDO.exe TVMEDT.exe File created C:\windows\UWTPMI.exe.bat BEEECH.exe File opened for modification C:\windows\system\TGLOKF.exe KYJJG.exe File created C:\windows\GRAVKH.exe ETMJUZG.exe File created C:\windows\VSYVX.exe AFTL.exe File created C:\windows\system\WKTPCU.exe PTSQV.exe File opened for modification C:\windows\system\WKTPCU.exe PTSQV.exe File created C:\windows\LSIP.exe.bat REZO.exe File opened for modification C:\windows\WDR.exe KVDRJS.exe File created C:\windows\WUJI.exe GRAVKH.exe File created C:\windows\system\VBCFE.exe.bat MBAAAID.exe File created C:\windows\BOYWLRC.exe XGKOY.exe File opened for modification C:\windows\system\FUVL.exe VUT.exe File created C:\windows\YYN.exe FVBU.exe File created C:\windows\system\CDO.exe.bat TVMEDT.exe File created C:\windows\system\DNYC.exe.bat XSY.exe File created C:\windows\system\UGNBMNH.exe QYGB.exe File created C:\windows\system\TGLOKF.exe KYJJG.exe File created C:\windows\AFTL.exe.bat CHIIZ.exe File created C:\windows\VSYVX.exe.bat AFTL.exe File opened for modification C:\windows\system\BIR.exe LSIP.exe File opened for modification C:\windows\FYYPW.exe BIR.exe File created C:\windows\UJPRP.exe TGLOKF.exe File created C:\windows\TLD.exe.bat YQYBVG.exe File created C:\windows\system\AXEESN.exe.bat WHY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1188 cmd.exe 4896 cmd.exe 4508 cmd.exe 1924 cmd.exe 6128 cmd.exe 6020 cmd.exe 3064 cmd.exe 1988 cmd.exe 4156 cmd.exe 1928 cmd.exe 3584 cmd.exe 5448 cmd.exe 5824 cmd.exe 5552 cmd.exe 5320 cmd.exe 1712 cmd.exe 1360 cmd.exe 2468 cmd.exe 2512 cmd.exe 3896 cmd.exe 4236 cmd.exe 2480 cmd.exe 1284 cmd.exe 3632 cmd.exe 1644 cmd.exe 1336 cmd.exe 708 cmd.exe 2072 cmd.exe 5728 cmd.exe 3948 cmd.exe 4404 cmd.exe 2316 cmd.exe 4148 cmd.exe 4488 cmd.exe 2660 cmd.exe 3944 cmd.exe 2988 cmd.exe 5608 cmd.exe 2868 cmd.exe 1404 cmd.exe 5892 cmd.exe 2336 cmd.exe 6004 cmd.exe 2996 cmd.exe 2464 cmd.exe 4836 cmd.exe 1728 cmd.exe 5792 cmd.exe 2532 cmd.exe 244 cmd.exe 2220 cmd.exe 1060 cmd.exe 5096 cmd.exe 5568 cmd.exe 1208 cmd.exe 5572 cmd.exe 2900 cmd.exe 972 cmd.exe 3080 cmd.exe 6088 cmd.exe 1752 cmd.exe 3208 cmd.exe 5896 cmd.exe 2268 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 260 3280 WerFault.exe 87 1644 4616 WerFault.exe 93 2020 4968 WerFault.exe 99 740 2800 WerFault.exe 104 612 1520 WerFault.exe 109 2540 2284 WerFault.exe 114 4952 5456 WerFault.exe 118 4576 5160 WerFault.exe 124 3084 3496 WerFault.exe 129 4984 3876 WerFault.exe 134 6112 2864 WerFault.exe 139 2144 3752 WerFault.exe 144 5016 2584 WerFault.exe 149 4340 5788 WerFault.exe 154 1616 1256 WerFault.exe 159 3008 3812 WerFault.exe 164 1192 2116 WerFault.exe 169 4100 2384 WerFault.exe 174 4768 4864 WerFault.exe 179 4760 4444 WerFault.exe 184 2340 5012 WerFault.exe 189 5592 5236 WerFault.exe 194 1764 4308 WerFault.exe 199 3544 1368 WerFault.exe 204 4748 4120 WerFault.exe 209 708 2588 WerFault.exe 214 5088 5960 WerFault.exe 219 4784 5800 WerFault.exe 224 2764 3604 WerFault.exe 229 4732 2472 WerFault.exe 234 5428 1140 WerFault.exe 239 1348 3452 WerFault.exe 244 6080 5600 WerFault.exe 249 4212 4132 WerFault.exe 254 2124 200 WerFault.exe 259 5140 4656 WerFault.exe 264 2432 5420 WerFault.exe 269 1916 4720 WerFault.exe 275 4044 5468 WerFault.exe 280 1304 1848 WerFault.exe 285 3060 5312 WerFault.exe 290 5044 5624 WerFault.exe 295 5416 6112 WerFault.exe 300 5532 960 WerFault.exe 305 3304 5472 WerFault.exe 310 2196 1652 WerFault.exe 315 4532 4296 WerFault.exe 320 3396 3776 WerFault.exe 325 5376 3004 WerFault.exe 330 1724 3528 WerFault.exe 335 3112 2500 WerFault.exe 340 4568 2544 WerFault.exe 345 4824 4600 WerFault.exe 350 612 2016 WerFault.exe 355 2036 5920 WerFault.exe 360 4620 4392 WerFault.exe 365 4844 5704 WerFault.exe 370 3404 3396 WerFault.exe 375 1260 4092 WerFault.exe 380 1788 4804 WerFault.exe 385 4920 3060 WerFault.exe 390 5564 2136 WerFault.exe 395 3448 1120 WerFault.exe 400 1988 2244 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSYVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDZEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVFJVC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYJJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFGZYAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKSBVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXXWEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGLOKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEEECH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKTPCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETMJUZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCCTMWH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWSKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJPRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAOU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGAST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJCGPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYWFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLTWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAPL.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 2026-08-09_70ca5bda648e22de8c7ea7edd0882ede_elex_emotet_stop.exe 3280 2026-08-09_70ca5bda648e22de8c7ea7edd0882ede_elex_emotet_stop.exe 4616 WSQRIF.exe 4616 WSQRIF.exe 4968 SIKQ.exe 4968 SIKQ.exe 2800 LLO.exe 2800 LLO.exe 1520 VJCGPG.exe 1520 VJCGPG.exe 2284 IMKFVR.exe 2284 IMKFVR.exe 5456 TENXE.exe 5456 TENXE.exe 5160 OASHOYN.exe 5160 OASHOYN.exe 3496 YQYBVG.exe 3496 YQYBVG.exe 3876 TLD.exe 3876 TLD.exe 2864 BQP.exe 2864 BQP.exe 2584 WHY.exe 2584 WHY.exe 5788 AXEESN.exe 5788 AXEESN.exe 1256 EADZ.exe 1256 EADZ.exe 3812 TVMEDT.exe 3812 TVMEDT.exe 2116 CDO.exe 2116 CDO.exe 2384 QGWHDB.exe 2384 QGWHDB.exe 4864 QJADI.exe 4864 QJADI.exe 4444 AJCQMW.exe 4444 AJCQMW.exe 5012 TKSBVX.exe 5012 TKSBVX.exe 5236 XSY.exe 5236 XSY.exe 4308 DNYC.exe 4308 DNYC.exe 1368 QYGB.exe 1368 QYGB.exe 4120 UGNBMNH.exe 4120 UGNBMNH.exe 2588 XTR.exe 2588 XTR.exe 5960 VPRT.exe 5960 VPRT.exe 5800 VSU.exe 5800 VSU.exe 3604 FXFH.exe 3604 FXFH.exe 2472 NKR.exe 2472 NKR.exe 1140 HYWFJ.exe 1140 HYWFJ.exe 3452 KLBOUBH.exe 3452 KLBOUBH.exe 5600 BEEECH.exe 5600 BEEECH.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3280 2026-08-09_70ca5bda648e22de8c7ea7edd0882ede_elex_emotet_stop.exe 3280 2026-08-09_70ca5bda648e22de8c7ea7edd0882ede_elex_emotet_stop.exe 4616 WSQRIF.exe 4616 WSQRIF.exe 4968 SIKQ.exe 4968 SIKQ.exe 2800 LLO.exe 2800 LLO.exe 1520 VJCGPG.exe 1520 VJCGPG.exe 2284 IMKFVR.exe 2284 IMKFVR.exe 5456 TENXE.exe 5456 TENXE.exe 5160 OASHOYN.exe 5160 OASHOYN.exe 3496 YQYBVG.exe 3496 YQYBVG.exe 3876 TLD.exe 3876 TLD.exe 2864 BQP.exe 2864 BQP.exe 2584 WHY.exe 2584 WHY.exe 5788 AXEESN.exe 5788 AXEESN.exe 1256 EADZ.exe 1256 EADZ.exe 3812 TVMEDT.exe 3812 TVMEDT.exe 2116 CDO.exe 2116 CDO.exe 2384 QGWHDB.exe 2384 QGWHDB.exe 4864 QJADI.exe 4864 QJADI.exe 4444 AJCQMW.exe 4444 AJCQMW.exe 5012 TKSBVX.exe 5012 TKSBVX.exe 5236 XSY.exe 5236 XSY.exe 4308 DNYC.exe 4308 DNYC.exe 1368 QYGB.exe 1368 QYGB.exe 4120 UGNBMNH.exe 4120 UGNBMNH.exe 2588 XTR.exe 2588 XTR.exe 5960 VPRT.exe 5960 VPRT.exe 5800 VSU.exe 5800 VSU.exe 3604 FXFH.exe 3604 FXFH.exe 2472 NKR.exe 2472 NKR.exe 1140 HYWFJ.exe 1140 HYWFJ.exe 3452 KLBOUBH.exe 3452 KLBOUBH.exe 5600 BEEECH.exe 5600 BEEECH.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3280 wrote to memory of 2660 3280 2026-08-09_70ca5bda648e22de8c7ea7edd0882ede_elex_emotet_stop.exe 89 PID 2660 wrote to memory of 4616 2660 cmd.exe 93 PID 4616 wrote to memory of 500 4616 WSQRIF.exe 95 PID 500 wrote to memory of 4968 500 cmd.exe 99 PID 4968 wrote to memory of 1928 4968 SIKQ.exe 100 PID 1928 wrote to memory of 2800 1928 cmd.exe 104 PID 2800 wrote to memory of 1188 2800 LLO.exe 105 PID 1188 wrote to memory of 1520 1188 cmd.exe 109 PID 1520 wrote to memory of 3212 1520 VJCGPG.exe 110 PID 3212 wrote to memory of 2284 3212 cmd.exe 114 PID 2284 wrote to memory of 3288 2284 IMKFVR.exe 115 PID 3288 wrote to memory of 5456 3288 cmd.exe 118 PID 5456 wrote to memory of 4428 5456 TENXE.exe 120 PID 4428 wrote to memory of 5160 4428 cmd.exe 124 PID 5160 wrote to memory of 4856 5160 OASHOYN.exe 125 PID 4856 wrote to memory of 3496 4856 cmd.exe 129 PID 3496 wrote to memory of 5984 3496 YQYBVG.exe 130 PID 5984 wrote to memory of 3876 5984 cmd.exe 134 PID 3876 wrote to memory of 2336 3876 TLD.exe 135 PID 2336 wrote to memory of 2864 2336 cmd.exe 139 PID 2864 wrote to memory of 1320 2864 BQP.exe 140 PID 1320 wrote to memory of 3752 1320 cmd.exe 144 PID 4896 wrote to memory of 2584 4896 cmd.exe 149 PID 2584 wrote to memory of 248 2584 WHY.exe 150 PID 248 wrote to memory of 5788 248 cmd.exe 154 PID 5788 wrote to memory of 2828 5788 AXEESN.exe 155 PID 2828 wrote to memory of 1256 2828 cmd.exe 159 PID 1256 wrote to memory of 6004 1256 EADZ.exe 160 PID 6004 wrote to memory of 3812 6004 cmd.exe 164 PID 3812 wrote to memory of 4508 3812 TVMEDT.exe 165 PID 4508 wrote to memory of 2116 4508 cmd.exe 169 PID 2116 wrote to memory of 2996 2116 CDO.exe 170 PID 2996 wrote to memory of 2384 2996 cmd.exe 174 PID 2384 wrote to memory of 4604 2384 QGWHDB.exe 175 PID 4604 wrote to memory of 4864 4604 cmd.exe 179 PID 4864 wrote to memory of 3944 4864 QJADI.exe 180 PID 3944 wrote to memory of 4444 3944 cmd.exe 184 PID 4444 wrote to memory of 2900 4444 AJCQMW.exe 185 PID 2900 wrote to memory of 5012 2900 cmd.exe 189 PID 5012 wrote to memory of 5052 5012 TKSBVX.exe 190 PID 5052 wrote to memory of 5236 5052 cmd.exe 194 PID 5236 wrote to memory of 3080 5236 XSY.exe 195 PID 3080 wrote to memory of 4308 3080 cmd.exe 199 PID 4308 wrote to memory of 1308 4308 DNYC.exe 200 PID 1308 wrote to memory of 1368 1308 cmd.exe 204 PID 1368 wrote to memory of 1052 1368 QYGB.exe 205 PID 1052 wrote to memory of 4120 1052 cmd.exe 209 PID 4120 wrote to memory of 2928 4120 UGNBMNH.exe 210 PID 2928 wrote to memory of 2588 2928 cmd.exe 214 PID 2588 wrote to memory of 2464 2588 XTR.exe 215 PID 2464 wrote to memory of 5960 2464 cmd.exe 219 PID 5960 wrote to memory of 4836 5960 VPRT.exe 220 PID 4836 wrote to memory of 5800 4836 cmd.exe 224 PID 5800 wrote to memory of 5880 5800 VSU.exe 225 PID 5880 wrote to memory of 3604 5880 cmd.exe 229 PID 3604 wrote to memory of 4952 3604 FXFH.exe 230 PID 4952 wrote to memory of 2472 4952 cmd.exe 234 PID 2472 wrote to memory of 5872 2472 NKR.exe 235 PID 5872 wrote to memory of 1140 5872 cmd.exe 239 PID 1140 wrote to memory of 6088 1140 HYWFJ.exe 240 PID 6088 wrote to memory of 3452 6088 cmd.exe 244 PID 3452 wrote to memory of 5652 3452 KLBOUBH.exe 245 PID 5652 wrote to memory of 5600 5652 cmd.exe 249 PID 5600 wrote to memory of 4820 5600 BEEECH.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_70ca5bda648e22de8c7ea7edd0882ede_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_70ca5bda648e22de8c7ea7edd0882ede_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSQRIF.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\windows\system\WSQRIF.exeC:\windows\system\WSQRIF.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIKQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:500 -
C:\windows\system\SIKQ.exeC:\windows\system\SIKQ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLO.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\windows\SysWOW64\LLO.exeC:\windows\system32\LLO.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJCGPG.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\windows\VJCGPG.exeC:\windows\VJCGPG.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMKFVR.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\system\IMKFVR.exeC:\windows\system\IMKFVR.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TENXE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\windows\SysWOW64\TENXE.exeC:\windows\system32\TENXE.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OASHOYN.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\windows\SysWOW64\OASHOYN.exeC:\windows\system32\OASHOYN.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YQYBVG.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\windows\SysWOW64\YQYBVG.exeC:\windows\system32\YQYBVG.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TLD.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\windows\TLD.exeC:\windows\TLD.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQP.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\windows\SysWOW64\BQP.exeC:\windows\system32\BQP.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BWH.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\windows\system\BWH.exeC:\windows\system\BWH.exe23⤵
- Executes dropped EXE
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WHY.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\system\WHY.exeC:\windows\system\WHY.exe25⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AXEESN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\system\AXEESN.exeC:\windows\system\AXEESN.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EADZ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\system\EADZ.exeC:\windows\system\EADZ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TVMEDT.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\system\TVMEDT.exeC:\windows\system\TVMEDT.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDO.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\windows\system\CDO.exeC:\windows\system\CDO.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGWHDB.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\QGWHDB.exeC:\windows\QGWHDB.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QJADI.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\QJADI.exeC:\windows\QJADI.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJCQMW.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\windows\SysWOW64\AJCQMW.exeC:\windows\system32\AJCQMW.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKSBVX.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\SysWOW64\TKSBVX.exeC:\windows\system32\TKSBVX.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSY.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\windows\SysWOW64\XSY.exeC:\windows\system32\XSY.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNYC.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\windows\system\DNYC.exeC:\windows\system\DNYC.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYGB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\windows\QYGB.exeC:\windows\QYGB.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGNBMNH.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\windows\system\UGNBMNH.exeC:\windows\system\UGNBMNH.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XTR.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\system\XTR.exeC:\windows\system\XTR.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPRT.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\windows\VPRT.exeC:\windows\VPRT.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSU.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\system\VSU.exeC:\windows\system\VSU.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXFH.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\windows\FXFH.exeC:\windows\FXFH.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKR.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\windows\NKR.exeC:\windows\NKR.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYWFJ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\HYWFJ.exeC:\windows\HYWFJ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLBOUBH.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\windows\SysWOW64\KLBOUBH.exeC:\windows\system32\KLBOUBH.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEEECH.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\BEEECH.exeC:\windows\BEEECH.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWTPMI.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4820 -
C:\windows\UWTPMI.exeC:\windows\UWTPMI.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUTBO.exe.bat" "68⤵PID:4256
-
C:\windows\SysWOW64\HUTBO.exeC:\windows\system32\HUTBO.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CFCRCWJ.exe.bat" "70⤵PID:1576
-
C:\windows\SysWOW64\CFCRCWJ.exeC:\windows\system32\CFCRCWJ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVDRJS.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:708 -
C:\windows\SysWOW64\KVDRJS.exeC:\windows\system32\KVDRJS.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDR.exe.bat" "74⤵PID:3512
-
C:\windows\WDR.exeC:\windows\WDR.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLTWY.exe.bat" "76⤵PID:4360
-
C:\windows\system\FLTWY.exeC:\windows\system\FLTWY.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GOX.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5968 -
C:\windows\system\GOX.exeC:\windows\system\GOX.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHFK.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4236 -
C:\windows\SysWOW64\RHFK.exeC:\windows\system32\RHFK.exe81⤵
- Executes dropped EXE
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHHQZ.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4268 -
C:\windows\system\IHHQZ.exeC:\windows\system\IHHQZ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5580 -
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAEOZ.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5220 -
C:\windows\SysWOW64\AAEOZ.exeC:\windows\system32\AAEOZ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYJJG.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5868 -
C:\windows\system\KYJJG.exeC:\windows\system\KYJJG.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TGLOKF.exe.bat" "90⤵PID:1164
-
C:\windows\system\TGLOKF.exeC:\windows\system\TGLOKF.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJPRP.exe.bat" "92⤵PID:1876
-
C:\windows\UJPRP.exeC:\windows\UJPRP.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJXFGXM.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2072 -
C:\windows\RJXFGXM.exeC:\windows\RJXFGXM.exe95⤵
- Executes dropped EXE
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXW.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5552 -
C:\windows\system\XXW.exeC:\windows\system\XXW.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKBPN.exe.bat" "98⤵PID:3880
-
C:\windows\SysWOW64\SKBPN.exeC:\windows\system32\SKBPN.exe99⤵
- Executes dropped EXE
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1656 -
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAPL.exe.bat" "102⤵PID:2884
-
C:\windows\CAPL.exeC:\windows\CAPL.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUUTM.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5320 -
C:\windows\WOUUTM.exeC:\windows\WOUUTM.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETMJUZG.exe.bat" "106⤵PID:6120
-
C:\windows\SysWOW64\ETMJUZG.exeC:\windows\system32\ETMJUZG.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRAVKH.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1924 -
C:\windows\GRAVKH.exeC:\windows\GRAVKH.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUJI.exe.bat" "110⤵PID:3476
-
C:\windows\WUJI.exeC:\windows\WUJI.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "112⤵PID:3040
-
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFTL.exe.bat" "114⤵PID:3564
-
C:\windows\AFTL.exeC:\windows\AFTL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSYVX.exe.bat" "116⤵PID:4432
-
C:\windows\VSYVX.exeC:\windows\VSYVX.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBAAAID.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5740 -
C:\windows\SysWOW64\MBAAAID.exeC:\windows\system32\MBAAAID.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBCFE.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5988 -
C:\windows\system\VBCFE.exeC:\windows\system\VBCFE.exe121⤵
- Executes dropped EXE
PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-