Analysis
- max time kernel
92s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_66d0b5055d16e1ebea61b7c52b5f36cb_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-10_66d0b5055d16e1ebea61b7c52b5f36cb_elex_emotet_stop.exe
- Size 208KB
- Sample260810-2b4n3aaq91
- SHA256 564179608089a9c25b14962955dab77c6a0ca49b722a2fe5c16e9ebfc33291ac
- MD5 66d0b5055d16e1ebea61b7c52b5f36cb
- SHA1 2b86e29f3be23b6b77b5a3ff9bacc40f5422a45d
- SHA512 0a908f4fd13d023e1de091710b0d32f2e2d2b44822fb4eda457b5128bb08c19936ff2d72b7ecc9ee9d8a91b0f5c63f39ea643d01ac0904f054dfdda7b507785b
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOft4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOFQEj1
- TLSH T12C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4888 OHLE.exe 3288 USUTUPT.exe 3740 WICQBB.exe 5860 TAMSMGY.exe 1096 JQAKUNN.exe 4252 TOFWCVW.exe 1512 BCSLMT.exe 1124 HXWEAQ.exe 1060 HSHHG.exe 5252 ZAOFS.exe 3536 RDSAYNN.exe 5628 LWHTPOV.exe 1996 VUNGXWE.exe 1696 TEXWFC.exe 1336 SXNEPCP.exe 3380 TSQHC.exe 1676 LVUDIHS.exe 2644 IWEGML.exe 4852 STKABU.exe 596 JUYFOL.exe 6104 WFJ.exe 2132 UQMAXDE.exe 1528 IACZM.exe 5552 XQD.exe 5524 QJK.exe 1156 YOX.exe 2508 VPHSYXJ.exe 2192 YCQ.exe 4792 EXCVXFY.exe 5100 MLOCIMC.exe 5048 EGSFNB.exe 4648 DZVVW.exe 4940 YCL.exe 1532 PUOCLYJ.exe 1952 YXE.exe 5984 FFFPGV.exe 5644 EYIFP.exe 1760 OWW.exe 1212 QJN.exe 1520 VMLWQW.exe 4824 RSVLGZR.exe 4092 ZFISQY.exe 1812 FAUTWM.exe 5916 XLD.exe 6064 ZJJNQXT.exe 1384 TKYYHYB.exe 5556 EXXWEA.exe 1460 OVLQUI.exe 1588 FVRNGZ.exe 5392 ZOHYQS.exe 4684 MTHK.exe 4128 UZTR.exe 4920 CMY.exe 1296 IIK.exe 3180 NNCO.exe 4948 ALCZTEF.exe 5196 OWSYH.exe 5652 KOUALL.exe 4508 UMIV.exe 912 CAM.exe 1616 WSC.exe 3344 JYOQFQ.exe 5388 PLNRCTN.exe 4604 OJZUXYV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JQAKUNN.exe TAMSMGY.exe File created C:\windows\SysWOW64\HSHHG.exe HXWEAQ.exe File created C:\windows\SysWOW64\DZVVW.exe.bat EGSFNB.exe File created C:\windows\SysWOW64\EXXWEA.exe TKYYHYB.exe File created C:\windows\SysWOW64\XFXCVC.exe.bat TPQUJRT.exe File opened for modification C:\windows\SysWOW64\JSQ.exe YAB.exe File created C:\windows\SysWOW64\JSQ.exe.bat YAB.exe File created C:\windows\SysWOW64\DZVVW.exe EGSFNB.exe File opened for modification C:\windows\SysWOW64\USUTUPT.exe OHLE.exe File created C:\windows\SysWOW64\USUTUPT.exe.bat OHLE.exe File created C:\windows\SysWOW64\HXWEAQ.exe.bat BCSLMT.exe File opened for modification C:\windows\SysWOW64\FVRNGZ.exe OVLQUI.exe File opened for modification C:\windows\SysWOW64\ZOHYQS.exe FVRNGZ.exe File created C:\windows\SysWOW64\HUIX.exe XWCD.exe File created C:\windows\SysWOW64\NEZ.exe UBWSPF.exe File opened for modification C:\windows\SysWOW64\EXXWEA.exe TKYYHYB.exe File created C:\windows\SysWOW64\EXXWEA.exe.bat TKYYHYB.exe File created C:\windows\SysWOW64\MTHK.exe.bat ZOHYQS.exe File created C:\windows\SysWOW64\ALCZTEF.exe NNCO.exe File created C:\windows\SysWOW64\HUIX.exe.bat XWCD.exe File opened for modification C:\windows\SysWOW64\TMXX.exe JLV.exe File created C:\windows\SysWOW64\TMXX.exe.bat JLV.exe File created C:\windows\SysWOW64\TKYYHYB.exe.bat ZJJNQXT.exe File created C:\windows\SysWOW64\OVLQUI.exe EXXWEA.exe File created C:\windows\SysWOW64\ZOHYQS.exe.bat FVRNGZ.exe File opened for modification C:\windows\SysWOW64\VPHSYXJ.exe YOX.exe File opened for modification C:\windows\SysWOW64\EXCVXFY.exe YCQ.exe File created C:\windows\SysWOW64\OWW.exe.bat EYIFP.exe File created C:\windows\SysWOW64\OVLQUI.exe.bat EXXWEA.exe File opened for modification C:\windows\SysWOW64\NNCO.exe IIK.exe File opened for modification C:\windows\SysWOW64\ALCZTEF.exe NNCO.exe File created C:\windows\SysWOW64\PYGKQWT.exe.bat AVWY.exe File created C:\windows\SysWOW64\XFXCVC.exe TPQUJRT.exe File created C:\windows\SysWOW64\FVRNGZ.exe OVLQUI.exe File opened for modification C:\windows\SysWOW64\JQAKUNN.exe TAMSMGY.exe File opened for modification C:\windows\SysWOW64\HSHHG.exe HXWEAQ.exe File opened for modification C:\windows\SysWOW64\JUYFOL.exe STKABU.exe File created C:\windows\SysWOW64\JUYFOL.exe.bat STKABU.exe File created C:\windows\SysWOW64\WFJ.exe.bat JUYFOL.exe File created C:\windows\SysWOW64\KOUALL.exe.bat OWSYH.exe File created C:\windows\SysWOW64\NEZ.exe.bat UBWSPF.exe File opened for modification C:\windows\SysWOW64\WFJ.exe JUYFOL.exe File created C:\windows\SysWOW64\CFROU.exe CARZ.exe File opened for modification C:\windows\SysWOW64\CFROU.exe CARZ.exe File created C:\windows\SysWOW64\TMXX.exe JLV.exe File created C:\windows\SysWOW64\HSHHG.exe.bat HXWEAQ.exe File created C:\windows\SysWOW64\PYGKQWT.exe AVWY.exe File opened for modification C:\windows\SysWOW64\YAB.exe XFXCVC.exe File opened for modification C:\windows\SysWOW64\CZTYH.exe HMO.exe File created C:\windows\SysWOW64\WFJ.exe JUYFOL.exe File created C:\windows\SysWOW64\NNCO.exe.bat IIK.exe File opened for modification C:\windows\SysWOW64\IGBLJG.exe EYND.exe File opened for modification C:\windows\SysWOW64\XFXCVC.exe TPQUJRT.exe File created C:\windows\SysWOW64\YAB.exe XFXCVC.exe File created C:\windows\SysWOW64\CZTYH.exe HMO.exe File created C:\windows\SysWOW64\CZTYH.exe.bat HMO.exe File created C:\windows\SysWOW64\YAB.exe.bat XFXCVC.exe File created C:\windows\SysWOW64\MTHK.exe ZOHYQS.exe File opened for modification C:\windows\SysWOW64\MTHK.exe ZOHYQS.exe File created C:\windows\SysWOW64\NNCO.exe IIK.exe File created C:\windows\SysWOW64\XWCD.exe.bat IGBLJG.exe File created C:\windows\SysWOW64\JSQ.exe YAB.exe File created C:\windows\SysWOW64\OWW.exe EYIFP.exe File opened for modification C:\windows\SysWOW64\OWW.exe EYIFP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\IUYYSFQ.exe YMELOZ.exe File created C:\windows\system\RSVLGZR.exe VMLWQW.exe File created C:\windows\system\JCJ.exe XMDSNG.exe File created C:\windows\system\CMGBOZ.exe WQHSR.exe File created C:\windows\TEXWFC.exe.bat VUNGXWE.exe File created C:\windows\system\PUOCLYJ.exe.bat YCL.exe File created C:\windows\system\AAJ.exe BHZGZK.exe File created C:\windows\EGSFNB.exe MLOCIMC.exe File created C:\windows\CMY.exe UZTR.exe File created C:\windows\IIK.exe CMY.exe File created C:\windows\AVWY.exe.bat BKMIW.exe File created C:\windows\system\TPQUJRT.exe.bat ZBMLZ.exe File opened for modification C:\windows\CARZ.exe CXNWF.exe File opened for modification C:\windows\PQBLFJ.exe GHZYUMR.exe File opened for modification C:\windows\VMLWQW.exe QJN.exe File created C:\windows\ZFISQY.exe RSVLGZR.exe File opened for modification C:\windows\BHZGZK.exe OJZUXYV.exe File opened for modification C:\windows\system\LWHTPOV.exe RDSAYNN.exe File created C:\windows\system\FFFPGV.exe.bat YXE.exe File opened for modification C:\windows\XMDSNG.exe TEW.exe File opened for modification C:\windows\YMELOZ.exe TMXX.exe File opened for modification C:\windows\TEXWFC.exe VUNGXWE.exe File created C:\windows\system\GHZYUMR.exe.bat CZTYH.exe File created C:\windows\TAMSMGY.exe.bat WICQBB.exe File created C:\windows\system\HTKG.exe PYGKQWT.exe File created C:\windows\system\GVYOYBO.exe.bat CFROU.exe File created C:\windows\UMIV.exe KOUALL.exe File created C:\windows\YCQ.exe VPHSYXJ.exe File opened for modification C:\windows\system\DQEBGZK.exe IFOCSWO.exe File created C:\windows\system\HTKG.exe.bat PYGKQWT.exe File created C:\windows\CARZ.exe.bat CXNWF.exe File created C:\windows\system\XQD.exe IACZM.exe File opened for modification C:\windows\XLD.exe FAUTWM.exe File opened for modification C:\windows\OJZUXYV.exe PLNRCTN.exe File created C:\windows\XMDSNG.exe.bat TEW.exe File created C:\windows\TEW.exe.bat BBSWW.exe File created C:\windows\WQHSR.exe.bat GVYOYBO.exe File opened for modification C:\windows\IUYYSFQ.exe YMELOZ.exe File opened for modification C:\windows\system\CMGBOZ.exe WQHSR.exe File created C:\windows\system\VUNGXWE.exe.bat LWHTPOV.exe File created C:\windows\system\IACZM.exe UQMAXDE.exe File opened for modification C:\windows\system\HTKG.exe PYGKQWT.exe File created C:\windows\SXNEPCP.exe TEXWFC.exe File opened for modification C:\windows\ZNH.exe PQBLFJ.exe File created C:\windows\system\IFOCSWO.exe.bat AAJ.exe File created C:\windows\TOFWCVW.exe JQAKUNN.exe File created C:\windows\system\QJN.exe.bat OWW.exe File created C:\windows\UFQWLMW.exe.bat HUIX.exe File created C:\windows\system\GVYOYBO.exe CFROU.exe File opened for modification C:\windows\system\VUNGXWE.exe LWHTPOV.exe File created C:\windows\PLNRCTN.exe.bat JYOQFQ.exe File created C:\windows\system\LWHTPOV.exe.bat RDSAYNN.exe File created C:\windows\CAM.exe UMIV.exe File opened for modification C:\windows\UBWSPF.exe FLV.exe File created C:\windows\UZTR.exe.bat MTHK.exe File opened for modification C:\windows\TEW.exe BBSWW.exe File created C:\windows\YOX.exe QJK.exe File created C:\windows\FAUTWM.exe.bat ZFISQY.exe File opened for modification C:\windows\CMY.exe UZTR.exe File created C:\windows\CAM.exe.bat UMIV.exe File created C:\windows\system\AAQWQ.exe.bat UFQWLMW.exe File opened for modification C:\windows\AVWY.exe BKMIW.exe File created C:\windows\system\TPQUJRT.exe ZBMLZ.exe File created C:\windows\UMIV.exe.bat KOUALL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1444 cmd.exe 3524 cmd.exe 5992 cmd.exe 3400 cmd.exe 2560 cmd.exe 2252 cmd.exe 4124 cmd.exe 2244 cmd.exe 484 cmd.exe 3308 cmd.exe 4176 cmd.exe 5172 cmd.exe 1004 cmd.exe 1468 cmd.exe 6092 cmd.exe 3028 cmd.exe 1504 cmd.exe 2704 cmd.exe 2812 cmd.exe 5028 cmd.exe 5540 cmd.exe 2640 cmd.exe 6124 cmd.exe 5596 cmd.exe 5784 cmd.exe 1660 cmd.exe 6096 cmd.exe 3012 cmd.exe 2700 cmd.exe 3704 cmd.exe 3448 cmd.exe 1756 cmd.exe 3048 cmd.exe 2996 cmd.exe 2800 cmd.exe 4564 cmd.exe 1288 cmd.exe 4912 cmd.exe 2312 cmd.exe 5140 cmd.exe 5832 cmd.exe 4640 cmd.exe 1736 cmd.exe 2752 cmd.exe 3608 cmd.exe 2880 cmd.exe 4644 cmd.exe 2484 cmd.exe 4480 cmd.exe 4532 cmd.exe 4200 cmd.exe 3520 cmd.exe 1396 cmd.exe 3176 cmd.exe 5268 cmd.exe 2452 cmd.exe 2792 cmd.exe 5892 cmd.exe 3144 cmd.exe 1604 cmd.exe 1584 cmd.exe 1556 cmd.exe 4844 cmd.exe 3280 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1528 4500 WerFault.exe 87 5852 4888 WerFault.exe 93 3228 3288 WerFault.exe 99 1336 3740 WerFault.exe 104 4816 5860 WerFault.exe 109 1224 1096 WerFault.exe 114 3308 4252 WerFault.exe 119 5580 1512 WerFault.exe 124 2200 1124 WerFault.exe 129 4128 1060 WerFault.exe 134 5888 5252 WerFault.exe 138 4796 3536 WerFault.exe 144 2540 5628 WerFault.exe 149 3444 1996 WerFault.exe 154 1384 1696 WerFault.exe 159 2244 1336 WerFault.exe 164 4120 3380 WerFault.exe 169 3060 1676 WerFault.exe 174 2008 2644 WerFault.exe 179 2548 4852 WerFault.exe 184 2072 596 WerFault.exe 189 696 6104 WerFault.exe 194 4224 2132 WerFault.exe 199 1084 1528 WerFault.exe 204 5308 5552 WerFault.exe 209 6136 5524 WerFault.exe 214 2372 1156 WerFault.exe 219 3688 2508 WerFault.exe 224 5580 2192 WerFault.exe 229 912 4792 WerFault.exe 234 5340 5100 WerFault.exe 239 4176 5048 WerFault.exe 244 4320 4648 WerFault.exe 249 3416 4940 WerFault.exe 253 5596 1532 WerFault.exe 259 2900 1952 WerFault.exe 264 2424 5984 WerFault.exe 269 1656 5644 WerFault.exe 274 5020 1760 WerFault.exe 279 4436 1212 WerFault.exe 284 620 1520 WerFault.exe 289 2792 4824 WerFault.exe 294 4796 4092 WerFault.exe 299 3532 1812 WerFault.exe 304 3444 5916 WerFault.exe 309 4644 6064 WerFault.exe 314 2320 1384 WerFault.exe 319 4616 5556 WerFault.exe 324 1716 1460 WerFault.exe 329 4256 1588 WerFault.exe 334 1364 5392 WerFault.exe 339 5876 4684 WerFault.exe 344 5356 4128 WerFault.exe 349 1608 4920 WerFault.exe 354 4984 1296 WerFault.exe 359 2180 3180 WerFault.exe 364 3724 4948 WerFault.exe 369 5020 5196 WerFault.exe 374 3832 5652 WerFault.exe 378 2044 4508 WerFault.exe 384 6032 912 WerFault.exe 389 1924 1616 WerFault.exe 394 3928 3344 WerFault.exe 399 3148 5388 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQEBGZK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUOCLYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOUALL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XWCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZDRITB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVWY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_66d0b5055d16e1ebea61b7c52b5f36cb_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYIFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSVLGZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAUTWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFQWLMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVYOYBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WICQBB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGSFNB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GHZYUMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVRNGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YMELOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEXWFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJZUXYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSQHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNCO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUYYSFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STKABU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IACZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UZTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOFWCVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4500 2026-08-10_66d0b5055d16e1ebea61b7c52b5f36cb_elex_emotet_stop.exe 4500 2026-08-10_66d0b5055d16e1ebea61b7c52b5f36cb_elex_emotet_stop.exe 4888 OHLE.exe 4888 OHLE.exe 3288 USUTUPT.exe 3288 USUTUPT.exe 3740 WICQBB.exe 3740 WICQBB.exe 5860 TAMSMGY.exe 5860 TAMSMGY.exe 1096 JQAKUNN.exe 1096 JQAKUNN.exe 4252 TOFWCVW.exe 4252 TOFWCVW.exe 1512 BCSLMT.exe 1512 BCSLMT.exe 1124 HXWEAQ.exe 1124 HXWEAQ.exe 1060 HSHHG.exe 1060 HSHHG.exe 5252 ZAOFS.exe 5252 ZAOFS.exe 3536 RDSAYNN.exe 3536 RDSAYNN.exe 5628 LWHTPOV.exe 5628 LWHTPOV.exe 1996 VUNGXWE.exe 1996 VUNGXWE.exe 1696 TEXWFC.exe 1696 TEXWFC.exe 1336 SXNEPCP.exe 1336 SXNEPCP.exe 3380 TSQHC.exe 3380 TSQHC.exe 1676 LVUDIHS.exe 1676 LVUDIHS.exe 2644 IWEGML.exe 2644 IWEGML.exe 4852 STKABU.exe 4852 STKABU.exe 596 JUYFOL.exe 596 JUYFOL.exe 6104 WFJ.exe 6104 WFJ.exe 2132 UQMAXDE.exe 2132 UQMAXDE.exe 1528 IACZM.exe 1528 IACZM.exe 5552 XQD.exe 5552 XQD.exe 5524 QJK.exe 5524 QJK.exe 1156 YOX.exe 1156 YOX.exe 2508 VPHSYXJ.exe 2508 VPHSYXJ.exe 2192 YCQ.exe 2192 YCQ.exe 4792 EXCVXFY.exe 4792 EXCVXFY.exe 5100 MLOCIMC.exe 5100 MLOCIMC.exe 5048 EGSFNB.exe 5048 EGSFNB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4500 2026-08-10_66d0b5055d16e1ebea61b7c52b5f36cb_elex_emotet_stop.exe 4500 2026-08-10_66d0b5055d16e1ebea61b7c52b5f36cb_elex_emotet_stop.exe 4888 OHLE.exe 4888 OHLE.exe 3288 USUTUPT.exe 3288 USUTUPT.exe 3740 WICQBB.exe 3740 WICQBB.exe 5860 TAMSMGY.exe 5860 TAMSMGY.exe 1096 JQAKUNN.exe 1096 JQAKUNN.exe 4252 TOFWCVW.exe 4252 TOFWCVW.exe 1512 BCSLMT.exe 1512 BCSLMT.exe 1124 HXWEAQ.exe 1124 HXWEAQ.exe 1060 HSHHG.exe 1060 HSHHG.exe 5252 ZAOFS.exe 5252 ZAOFS.exe 3536 RDSAYNN.exe 3536 RDSAYNN.exe 5628 LWHTPOV.exe 5628 LWHTPOV.exe 1996 VUNGXWE.exe 1996 VUNGXWE.exe 1696 TEXWFC.exe 1696 TEXWFC.exe 1336 SXNEPCP.exe 1336 SXNEPCP.exe 3380 TSQHC.exe 3380 TSQHC.exe 1676 LVUDIHS.exe 1676 LVUDIHS.exe 2644 IWEGML.exe 2644 IWEGML.exe 4852 STKABU.exe 4852 STKABU.exe 596 JUYFOL.exe 596 JUYFOL.exe 6104 WFJ.exe 6104 WFJ.exe 2132 UQMAXDE.exe 2132 UQMAXDE.exe 1528 IACZM.exe 1528 IACZM.exe 5552 XQD.exe 5552 XQD.exe 5524 QJK.exe 5524 QJK.exe 1156 YOX.exe 1156 YOX.exe 2508 VPHSYXJ.exe 2508 VPHSYXJ.exe 2192 YCQ.exe 2192 YCQ.exe 4792 EXCVXFY.exe 4792 EXCVXFY.exe 5100 MLOCIMC.exe 5100 MLOCIMC.exe 5048 EGSFNB.exe 5048 EGSFNB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4500 wrote to memory of 6092 4500 2026-08-10_66d0b5055d16e1ebea61b7c52b5f36cb_elex_emotet_stop.exe 89 PID 6092 wrote to memory of 4888 6092 cmd.exe 93 PID 4888 wrote to memory of 4296 4888 OHLE.exe 95 PID 4296 wrote to memory of 3288 4296 cmd.exe 99 PID 3288 wrote to memory of 2484 3288 USUTUPT.exe 100 PID 2484 wrote to memory of 3740 2484 cmd.exe 104 PID 3740 wrote to memory of 3652 3740 WICQBB.exe 105 PID 3652 wrote to memory of 5860 3652 cmd.exe 109 PID 5860 wrote to memory of 1104 5860 TAMSMGY.exe 110 PID 1104 wrote to memory of 1096 1104 cmd.exe 114 PID 1096 wrote to memory of 4564 1096 JQAKUNN.exe 115 PID 4564 wrote to memory of 4252 4564 cmd.exe 119 PID 4252 wrote to memory of 1288 4252 TOFWCVW.exe 120 PID 1288 wrote to memory of 1512 1288 cmd.exe 124 PID 1512 wrote to memory of 1584 1512 BCSLMT.exe 125 PID 1584 wrote to memory of 1124 1584 cmd.exe 129 PID 1124 wrote to memory of 1848 1124 HXWEAQ.exe 130 PID 1848 wrote to memory of 1060 1848 cmd.exe 134 PID 1060 wrote to memory of 1852 1060 HSHHG.exe 135 PID 1852 wrote to memory of 5252 1852 cmd.exe 138 PID 5252 wrote to memory of 4676 5252 ZAOFS.exe 140 PID 4676 wrote to memory of 3536 4676 cmd.exe 144 PID 3536 wrote to memory of 2120 3536 RDSAYNN.exe 145 PID 2120 wrote to memory of 5628 2120 cmd.exe 149 PID 5628 wrote to memory of 4912 5628 LWHTPOV.exe 150 PID 4912 wrote to memory of 1996 4912 cmd.exe 154 PID 1996 wrote to memory of 2312 1996 VUNGXWE.exe 155 PID 2312 wrote to memory of 1696 2312 cmd.exe 159 PID 1696 wrote to memory of 4408 1696 TEXWFC.exe 160 PID 4408 wrote to memory of 1336 4408 cmd.exe 164 PID 1336 wrote to memory of 2820 1336 SXNEPCP.exe 165 PID 2820 wrote to memory of 3380 2820 cmd.exe 169 PID 3380 wrote to memory of 3028 3380 TSQHC.exe 170 PID 3028 wrote to memory of 1676 3028 cmd.exe 174 PID 1676 wrote to memory of 3176 1676 LVUDIHS.exe 175 PID 3176 wrote to memory of 2644 3176 cmd.exe 179 PID 2644 wrote to memory of 3796 2644 IWEGML.exe 180 PID 3796 wrote to memory of 4852 3796 cmd.exe 184 PID 4852 wrote to memory of 1056 4852 STKABU.exe 185 PID 1056 wrote to memory of 596 1056 cmd.exe 189 PID 596 wrote to memory of 4412 596 JUYFOL.exe 190 PID 4412 wrote to memory of 6104 4412 cmd.exe 194 PID 6104 wrote to memory of 2744 6104 WFJ.exe 195 PID 2744 wrote to memory of 2132 2744 cmd.exe 199 PID 2132 wrote to memory of 2640 2132 UQMAXDE.exe 200 PID 2640 wrote to memory of 1528 2640 cmd.exe 204 PID 1528 wrote to memory of 1072 1528 IACZM.exe 205 PID 1072 wrote to memory of 5552 1072 cmd.exe 209 PID 5552 wrote to memory of 2732 5552 XQD.exe 210 PID 2732 wrote to memory of 5524 2732 cmd.exe 214 PID 5524 wrote to memory of 3520 5524 QJK.exe 215 PID 3520 wrote to memory of 1156 3520 cmd.exe 219 PID 1156 wrote to memory of 1372 1156 YOX.exe 220 PID 1372 wrote to memory of 2508 1372 cmd.exe 224 PID 2508 wrote to memory of 2064 2508 VPHSYXJ.exe 225 PID 2064 wrote to memory of 2192 2064 cmd.exe 229 PID 2192 wrote to memory of 4768 2192 YCQ.exe 230 PID 4768 wrote to memory of 4792 4768 cmd.exe 234 PID 4792 wrote to memory of 1736 4792 EXCVXFY.exe 235 PID 1736 wrote to memory of 5100 1736 cmd.exe 239 PID 5100 wrote to memory of 8 5100 MLOCIMC.exe 240 PID 8 wrote to memory of 5048 8 cmd.exe 244 PID 5048 wrote to memory of 5888 5048 EGSFNB.exe 245 PID 5888 wrote to memory of 4648 5888 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_66d0b5055d16e1ebea61b7c52b5f36cb_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_66d0b5055d16e1ebea61b7c52b5f36cb_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLE.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\windows\OHLE.exeC:\windows\OHLE.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USUTUPT.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\windows\SysWOW64\USUTUPT.exeC:\windows\system32\USUTUPT.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WICQBB.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\WICQBB.exeC:\windows\WICQBB.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAMSMGY.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\windows\TAMSMGY.exeC:\windows\TAMSMGY.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JQAKUNN.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\SysWOW64\JQAKUNN.exeC:\windows\system32\JQAKUNN.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TOFWCVW.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\TOFWCVW.exeC:\windows\TOFWCVW.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCSLMT.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\BCSLMT.exeC:\windows\BCSLMT.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXWEAQ.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\windows\SysWOW64\HXWEAQ.exeC:\windows\system32\HXWEAQ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HSHHG.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\windows\SysWOW64\HSHHG.exeC:\windows\system32\HSHHG.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAOFS.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\windows\SysWOW64\ZAOFS.exeC:\windows\system32\ZAOFS.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDSAYNN.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\RDSAYNN.exeC:\windows\RDSAYNN.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWHTPOV.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\windows\system\LWHTPOV.exeC:\windows\system\LWHTPOV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUNGXWE.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\windows\system\VUNGXWE.exeC:\windows\system\VUNGXWE.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEXWFC.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\windows\TEXWFC.exeC:\windows\TEXWFC.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXNEPCP.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\SXNEPCP.exeC:\windows\SXNEPCP.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSQHC.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\windows\TSQHC.exeC:\windows\TSQHC.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVUDIHS.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\windows\LVUDIHS.exeC:\windows\LVUDIHS.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IWEGML.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\windows\IWEGML.exeC:\windows\IWEGML.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STKABU.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\windows\STKABU.exeC:\windows\STKABU.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUYFOL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\SysWOW64\JUYFOL.exeC:\windows\system32\JUYFOL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFJ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\SysWOW64\WFJ.exeC:\windows\system32\WFJ.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQMAXDE.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\windows\UQMAXDE.exeC:\windows\UQMAXDE.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IACZM.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\windows\system\IACZM.exeC:\windows\system\IACZM.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XQD.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\windows\system\XQD.exeC:\windows\system\XQD.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJK.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\system\QJK.exeC:\windows\system\QJK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOX.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\windows\YOX.exeC:\windows\YOX.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPHSYXJ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\windows\SysWOW64\VPHSYXJ.exeC:\windows\system32\VPHSYXJ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCQ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\windows\YCQ.exeC:\windows\YCQ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXCVXFY.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\SysWOW64\EXCVXFY.exeC:\windows\system32\EXCVXFY.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLOCIMC.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\MLOCIMC.exeC:\windows\MLOCIMC.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGSFNB.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8 -
C:\windows\EGSFNB.exeC:\windows\EGSFNB.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DZVVW.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\SysWOW64\DZVVW.exeC:\windows\system32\DZVVW.exe65⤵
- Executes dropped EXE
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCL.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2752 -
C:\windows\YCL.exeC:\windows\YCL.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PUOCLYJ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:1444 -
C:\windows\system\PUOCLYJ.exeC:\windows\system\PUOCLYJ.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YXE.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1180 -
C:\windows\system\YXE.exeC:\windows\system\YXE.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFFPGV.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4876 -
C:\windows\system\FFFPGV.exeC:\windows\system\FFFPGV.exe73⤵
- Executes dropped EXE
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYIFP.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3524 -
C:\windows\EYIFP.exeC:\windows\EYIFP.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWW.exe.bat" "76⤵PID:2544
-
C:\windows\SysWOW64\OWW.exeC:\windows\system32\OWW.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJN.exe.bat" "78⤵PID:3212
-
C:\windows\system\QJN.exeC:\windows\system\QJN.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VMLWQW.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:900 -
C:\windows\VMLWQW.exeC:\windows\VMLWQW.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSVLGZR.exe.bat" "82⤵PID:5900
-
C:\windows\system\RSVLGZR.exeC:\windows\system\RSVLGZR.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFISQY.exe.bat" "84⤵PID:1436
-
C:\windows\ZFISQY.exeC:\windows\ZFISQY.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "86⤵
- Executes a command shell one-liner
PID:6124 -
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLD.exe.bat" "88⤵PID:3000
-
C:\windows\XLD.exeC:\windows\XLD.exe89⤵
- Executes dropped EXE
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJJNQXT.exe.bat" "90⤵PID:4536
-
C:\windows\ZJJNQXT.exeC:\windows\ZJJNQXT.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKYYHYB.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5140 -
C:\windows\SysWOW64\TKYYHYB.exeC:\windows\system32\TKYYHYB.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXXWEA.exe.bat" "94⤵PID:4836
-
C:\windows\SysWOW64\EXXWEA.exeC:\windows\system32\EXXWEA.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVLQUI.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1556 -
C:\windows\SysWOW64\OVLQUI.exeC:\windows\system32\OVLQUI.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVRNGZ.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4844 -
C:\windows\SysWOW64\FVRNGZ.exeC:\windows\system32\FVRNGZ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOHYQS.exe.bat" "100⤵PID:2008
-
C:\windows\SysWOW64\ZOHYQS.exeC:\windows\system32\ZOHYQS.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTHK.exe.bat" "102⤵PID:2368
-
C:\windows\SysWOW64\MTHK.exeC:\windows\system32\MTHK.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UZTR.exe.bat" "104⤵PID:2036
-
C:\windows\UZTR.exeC:\windows\UZTR.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMY.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:484 -
C:\windows\CMY.exeC:\windows\CMY.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIK.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4224 -
C:\windows\IIK.exeC:\windows\IIK.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NNCO.exe.bat" "110⤵PID:2796
-
C:\windows\SysWOW64\NNCO.exeC:\windows\system32\NNCO.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ALCZTEF.exe.bat" "112⤵PID:548
-
C:\windows\SysWOW64\ALCZTEF.exeC:\windows\system32\ALCZTEF.exe113⤵
- Executes dropped EXE
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OWSYH.exe.bat" "114⤵PID:5996
-
C:\windows\system\OWSYH.exeC:\windows\system\OWSYH.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KOUALL.exe.bat" "116⤵PID:2012
-
C:\windows\SysWOW64\KOUALL.exeC:\windows\system32\KOUALL.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UMIV.exe.bat" "118⤵PID:3432
-
C:\windows\UMIV.exeC:\windows\UMIV.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAM.exe.bat" "120⤵PID:3872
-
C:\windows\CAM.exeC:\windows\CAM.exe121⤵
- Executes dropped EXE
PID:912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-