Analysis
- max time kernel
76s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 22:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe
- Size 208KB
- Sample260810-2mb37avyh1
- SHA256 e988d7aa8c1d162ac6eb2c7a680378473c26e4879e4b51126c086720ee36ad8a
- MD5 3d3baab9193ad5912bc3a5396b17fde6
- SHA1 e45d6630425cc9f32bb7c8b7f39f56ae9e0e56e7
- SHA512 2bfd0865d507b1d007b5ef843a993701c8d755a5b60ef7bdb41d5ecf7096038c42f38b41903f11704891dc50a1776eec0e5e0b7f1cb2d775c43ddd3d8a026b34
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfO4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOGQEj1
- TLSH T1A3247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4980 YDYPXLY.exe 1360 AMA.exe 2556 MUGLD.exe 3608 EXKP.exe 1084 INRPVN.exe 3320 UVFX.exe 900 TFI.exe 4916 VDOZXUZ.exe 3564 MMQ.exe 4596 THZRMM.exe 6036 WUE.exe 2376 PXIWB.exe 4776 JKNFMBP.exe 4120 BTP.exe 3692 TOTOCXT.exe 1424 XEZW.exe 1328 NUI.exe 5900 HHFXY.exe 1968 PMSD.exe 2892 OKD.exe 3160 SNBBDZ.exe 3952 ABOIO.exe 2440 PWX.exe 4536 GWZS.exe 2248 BREBNQ.exe 1528 QMNN.exe 1008 LASXIK.exe 5960 FNX.exe 2884 PVZL.exe 6048 BDGTIA.exe 4112 ROIJQ.exe 2396 DEX.exe 2720 YSCT.exe 3580 ENFUTM.exe 720 YAK.exe 2972 HOKR.exe 5636 KWRSJS.exe 3664 YGZQXU.exe 3604 HHBVAAN.exe 4484 TXIVN.exe 5952 VNJXT.exe 4928 JSPVA.exe 5596 IIOXM.exe 4468 WOUUTM.exe 468 IGXNBBS.exe 1492 MHZQFYB.exe 4708 JMRFVTW.exe 1848 PIQ.exe 4888 KVNPK.exe 4316 XYD.exe 4872 AOMK.exe 6044 PEZUNI.exe 3088 VEH.exe 124 DKM.exe 5180 NHZJOJ.exe 2412 VVEPZ.exe 460 QIJHJPW.exe 5076 UQPH.exe 4748 NEWFA.exe 1472 APF.exe 4320 TSJZUCL.exe 2928 UNMD.exe 1808 HXDBODI.exe 2496 YGFGR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\PMSD.exe HHFXY.exe File opened for modification C:\windows\SysWOW64\UQPH.exe QIJHJPW.exe File created C:\windows\SysWOW64\IJL.exe.bat TTKQCAZ.exe File created C:\windows\SysWOW64\WOLBIXQ.exe.bat ZJTLRB.exe File opened for modification C:\windows\SysWOW64\SQISQOS.exe XDDJN.exe File created C:\windows\SysWOW64\VDOZXUZ.exe TFI.exe File created C:\windows\SysWOW64\YAK.exe ENFUTM.exe File opened for modification C:\windows\SysWOW64\IJL.exe TTKQCAZ.exe File created C:\windows\SysWOW64\PATOCP.exe UNOF.exe File created C:\windows\SysWOW64\TXIVN.exe.bat HHBVAAN.exe File opened for modification C:\windows\SysWOW64\VVEPZ.exe NHZJOJ.exe File created C:\windows\SysWOW64\WCDPJKL.exe.bat WOLBIXQ.exe File created C:\windows\SysWOW64\RBTIYC.exe SQISQOS.exe File created C:\windows\SysWOW64\ABOIO.exe.bat SNBBDZ.exe File opened for modification C:\windows\SysWOW64\NEWFA.exe UQPH.exe File created C:\windows\SysWOW64\WOLBIXQ.exe ZJTLRB.exe File created C:\windows\SysWOW64\HMTXHDU.exe.bat FPFDSCL.exe File opened for modification C:\windows\SysWOW64\VDOZXUZ.exe TFI.exe File opened for modification C:\windows\SysWOW64\TSJZUCL.exe APF.exe File created C:\windows\SysWOW64\TTKQCAZ.exe.bat YGFGR.exe File opened for modification C:\windows\SysWOW64\KIJ.exe TAHNUE.exe File created C:\windows\SysWOW64\SQISQOS.exe XDDJN.exe File created C:\windows\SysWOW64\HMTXHDU.exe FPFDSCL.exe File created C:\windows\SysWOW64\VVEPZ.exe NHZJOJ.exe File created C:\windows\SysWOW64\UQPH.exe QIJHJPW.exe File created C:\windows\SysWOW64\YDYPXLY.exe 2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe File created C:\windows\SysWOW64\YDYPXLY.exe.bat 2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe File created C:\windows\SysWOW64\JSPVA.exe VNJXT.exe File created C:\windows\SysWOW64\MHZQFYB.exe IGXNBBS.exe File opened for modification C:\windows\SysWOW64\MHZQFYB.exe IGXNBBS.exe File created C:\windows\SysWOW64\WCDPJKL.exe WOLBIXQ.exe File created C:\windows\SysWOW64\ABOIO.exe SNBBDZ.exe File created C:\windows\SysWOW64\PVZL.exe.bat FNX.exe File created C:\windows\SysWOW64\XYD.exe KVNPK.exe File created C:\windows\SysWOW64\UQPH.exe.bat QIJHJPW.exe File opened for modification C:\windows\SysWOW64\RBTIYC.exe SQISQOS.exe File opened for modification C:\windows\SysWOW64\PXIWB.exe WUE.exe File opened for modification C:\windows\SysWOW64\PVZL.exe FNX.exe File opened for modification C:\windows\SysWOW64\TXIVN.exe HHBVAAN.exe File opened for modification C:\windows\SysWOW64\JSPVA.exe VNJXT.exe File created C:\windows\SysWOW64\NEWFA.exe UQPH.exe File created C:\windows\SysWOW64\IJL.exe TTKQCAZ.exe File opened for modification C:\windows\SysWOW64\HMTXHDU.exe FPFDSCL.exe File opened for modification C:\windows\SysWOW64\YDYPXLY.exe 2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe File created C:\windows\SysWOW64\PMSD.exe.bat HHFXY.exe File opened for modification C:\windows\SysWOW64\ABOIO.exe SNBBDZ.exe File opened for modification C:\windows\SysWOW64\XYD.exe KVNPK.exe File opened for modification C:\windows\SysWOW64\TTKQCAZ.exe YGFGR.exe File opened for modification C:\windows\SysWOW64\PSBF.exe XKZAEG.exe File created C:\windows\SysWOW64\PSBF.exe.bat XKZAEG.exe File opened for modification C:\windows\SysWOW64\WCDPJKL.exe WOLBIXQ.exe File created C:\windows\SysWOW64\TXIVN.exe HHBVAAN.exe File created C:\windows\SysWOW64\VNJXT.exe TXIVN.exe File created C:\windows\SysWOW64\XYD.exe.bat KVNPK.exe File opened for modification C:\windows\SysWOW64\WOLBIXQ.exe ZJTLRB.exe File created C:\windows\SysWOW64\VDOZXUZ.exe.bat TFI.exe File created C:\windows\SysWOW64\PVZL.exe FNX.exe File opened for modification C:\windows\SysWOW64\ENFUTM.exe YSCT.exe File created C:\windows\SysWOW64\NEWFA.exe.bat UQPH.exe File created C:\windows\SysWOW64\KIJ.exe TAHNUE.exe File created C:\windows\SysWOW64\PATOCP.exe.bat UNOF.exe File created C:\windows\SysWOW64\PXIWB.exe WUE.exe File opened for modification C:\windows\SysWOW64\BREBNQ.exe GWZS.exe File created C:\windows\SysWOW64\BREBNQ.exe.bat GWZS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\BTP.exe.bat JKNFMBP.exe File opened for modification C:\windows\BDGTIA.exe PVZL.exe File opened for modification C:\windows\UNMD.exe TSJZUCL.exe File created C:\windows\HXDBODI.exe UNMD.exe File created C:\windows\system\YGFGR.exe HXDBODI.exe File created C:\windows\system\ZATCS.exe.bat UPPWMC.exe File opened for modification C:\windows\system\MUGLD.exe AMA.exe File created C:\windows\PWX.exe ABOIO.exe File opened for modification C:\windows\system\HHBVAAN.exe YGZQXU.exe File opened for modification C:\windows\IGXNBBS.exe WOUUTM.exe File created C:\windows\system\TAHNUE.exe PSBF.exe File created C:\windows\system\ZJTLRB.exe IJRGO.exe File created C:\windows\XDDJN.exe.bat ZSATFI.exe File opened for modification C:\windows\SSANJ.exe ZATCS.exe File opened for modification C:\windows\system\INRPVN.exe EXKP.exe File created C:\windows\system\FNX.exe LASXIK.exe File created C:\windows\VEH.exe PEZUNI.exe File created C:\windows\system\APF.exe.bat NEWFA.exe File opened for modification C:\windows\XDDJN.exe ZSATFI.exe File created C:\windows\ELBZNF.exe RBTIYC.exe File created C:\windows\KVNPK.exe.bat PIQ.exe File created C:\windows\system\MUGLD.exe AMA.exe File opened for modification C:\windows\system\BTP.exe JKNFMBP.exe File opened for modification C:\windows\system\GWZS.exe PWX.exe File created C:\windows\system\HOKR.exe.bat YAK.exe File opened for modification C:\windows\WOUUTM.exe IIOXM.exe File created C:\windows\UPPWMC.exe.bat HMTXHDU.exe File created C:\windows\system\PEZUNI.exe AOMK.exe File created C:\windows\system\MMQ.exe.bat VDOZXUZ.exe File created C:\windows\NUI.exe.bat XEZW.exe File created C:\windows\system\FNX.exe.bat LASXIK.exe File created C:\windows\system\MUGLD.exe.bat AMA.exe File created C:\windows\HHFXY.exe NUI.exe File created C:\windows\system\OKD.exe.bat PMSD.exe File opened for modification C:\windows\IIOXM.exe JSPVA.exe File created C:\windows\system\DKM.exe VEH.exe File created C:\windows\system\QIJHJPW.exe VVEPZ.exe File opened for modification C:\windows\THZRMM.exe MMQ.exe File opened for modification C:\windows\system\WUE.exe THZRMM.exe File opened for modification C:\windows\NUI.exe XEZW.exe File created C:\windows\system\LASXIK.exe.bat QMNN.exe File created C:\windows\system\YSCT.exe DEX.exe File created C:\windows\system\KWRSJS.exe HOKR.exe File opened for modification C:\windows\IJRGO.exe KIJ.exe File opened for modification C:\windows\system\ZJTLRB.exe IJRGO.exe File created C:\windows\XEZW.exe TOTOCXT.exe File opened for modification C:\windows\system\OKD.exe PMSD.exe File created C:\windows\system\YGFGR.exe.bat HXDBODI.exe File created C:\windows\system\TAHNUE.exe.bat PSBF.exe File opened for modification C:\windows\system\PCM.exe YBKSY.exe File created C:\windows\RDDD.exe SSANJ.exe File created C:\windows\system\WUE.exe THZRMM.exe File created C:\windows\system\JKNFMBP.exe.bat PXIWB.exe File created C:\windows\HHFXY.exe.bat NUI.exe File opened for modification C:\windows\PWX.exe ABOIO.exe File created C:\windows\system\PIQ.exe.bat JMRFVTW.exe File created C:\windows\UNMD.exe TSJZUCL.exe File created C:\windows\VUT.exe IJL.exe File opened for modification C:\windows\XKZAEG.exe VUT.exe File created C:\windows\system\WUE.exe.bat THZRMM.exe File created C:\windows\system\TOTOCXT.exe BTP.exe File opened for modification C:\windows\system\QMNN.exe BREBNQ.exe File created C:\windows\system\HOKR.exe YAK.exe File opened for modification C:\windows\YGZQXU.exe KWRSJS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4936 cmd.exe 1520 cmd.exe 5804 cmd.exe 3152 cmd.exe 1468 cmd.exe 1956 cmd.exe 3856 cmd.exe 4488 cmd.exe 2328 cmd.exe 4260 cmd.exe 5144 cmd.exe 5408 cmd.exe 1788 cmd.exe 5800 cmd.exe 2836 cmd.exe 4632 cmd.exe 6060 cmd.exe 5628 cmd.exe 5492 cmd.exe 2816 cmd.exe 3176 cmd.exe 2760 cmd.exe 5364 cmd.exe 3716 cmd.exe 3884 cmd.exe 3784 cmd.exe 5944 cmd.exe 2976 cmd.exe 5544 cmd.exe 2132 cmd.exe 2856 cmd.exe 2164 cmd.exe 1980 cmd.exe 4516 cmd.exe 3552 cmd.exe 2564 cmd.exe 3804 cmd.exe 3380 cmd.exe 5728 cmd.exe 2536 cmd.exe 2792 cmd.exe 5732 cmd.exe 5072 cmd.exe 2076 cmd.exe 2800 cmd.exe 2504 cmd.exe 2840 cmd.exe 4508 cmd.exe 2852 cmd.exe 2944 cmd.exe 2820 cmd.exe 4560 cmd.exe 3060 cmd.exe 3356 cmd.exe 4512 cmd.exe 5220 cmd.exe 5388 cmd.exe 3480 cmd.exe 2052 cmd.exe 1172 cmd.exe 1792 cmd.exe 3896 cmd.exe 6132 cmd.exe 4264 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2536 2280 WerFault.exe 87 2588 4980 WerFault.exe 93 5624 1360 WerFault.exe 99 4232 2556 WerFault.exe 104 3112 3608 WerFault.exe 109 796 1084 WerFault.exe 114 3124 3320 WerFault.exe 119 5716 900 WerFault.exe 124 4236 4916 WerFault.exe 129 4660 3564 WerFault.exe 134 1288 4596 WerFault.exe 139 4912 6036 WerFault.exe 144 5872 2376 WerFault.exe 149 2492 4776 WerFault.exe 154 5996 4120 WerFault.exe 159 5964 3692 WerFault.exe 164 2800 1424 WerFault.exe 169 2384 1328 WerFault.exe 174 4720 5900 WerFault.exe 179 5952 1968 WerFault.exe 184 5720 2892 WerFault.exe 189 2796 3160 WerFault.exe 194 3580 3952 WerFault.exe 199 2000 2440 WerFault.exe 204 468 4536 WerFault.exe 209 5580 2248 WerFault.exe 214 4816 1528 WerFault.exe 219 4948 1008 WerFault.exe 224 4564 5960 WerFault.exe 229 1852 2884 WerFault.exe 234 5312 6048 WerFault.exe 239 4184 4112 WerFault.exe 244 6044 2396 WerFault.exe 249 1440 2720 WerFault.exe 254 3144 3580 WerFault.exe 259 4268 720 WerFault.exe 264 252 2972 WerFault.exe 269 4164 5636 WerFault.exe 275 4444 3664 WerFault.exe 280 3696 3604 WerFault.exe 285 4500 4484 WerFault.exe 290 4964 5952 WerFault.exe 295 4884 4928 WerFault.exe 300 2548 5596 WerFault.exe 305 5768 4468 WerFault.exe 310 1332 468 WerFault.exe 315 3436 1492 WerFault.exe 320 4816 4708 WerFault.exe 325 1460 1848 WerFault.exe 330 5984 4888 WerFault.exe 335 2644 4316 WerFault.exe 340 6104 4872 WerFault.exe 345 3844 6044 WerFault.exe 350 1808 3088 WerFault.exe 355 1792 124 WerFault.exe 360 3364 5180 WerFault.exe 365 4256 2412 WerFault.exe 370 4512 460 WerFault.exe 375 5916 5076 WerFault.exe 380 3612 4748 WerFault.exe 385 4964 1472 WerFault.exe 390 1584 4320 WerFault.exe 395 4240 2928 WerFault.exe 400 5392 1808 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BREBNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJRGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQISQOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENFUTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPPWMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROIJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEUTEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCDPJKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBTIYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELBZNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTRDWLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKNFMBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEWFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLBNIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOTOCXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWRSJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNBBDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZATCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHFXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXIVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABOIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHZJOJ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2280 2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe 2280 2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe 4980 YDYPXLY.exe 4980 YDYPXLY.exe 1360 AMA.exe 1360 AMA.exe 2556 MUGLD.exe 2556 MUGLD.exe 3608 EXKP.exe 3608 EXKP.exe 1084 INRPVN.exe 1084 INRPVN.exe 3320 UVFX.exe 3320 UVFX.exe 900 TFI.exe 900 TFI.exe 4916 VDOZXUZ.exe 4916 VDOZXUZ.exe 3564 MMQ.exe 3564 MMQ.exe 4596 THZRMM.exe 4596 THZRMM.exe 6036 WUE.exe 6036 WUE.exe 2376 PXIWB.exe 2376 PXIWB.exe 4776 JKNFMBP.exe 4776 JKNFMBP.exe 4120 BTP.exe 4120 BTP.exe 3692 TOTOCXT.exe 3692 TOTOCXT.exe 1424 XEZW.exe 1424 XEZW.exe 1328 NUI.exe 1328 NUI.exe 5900 HHFXY.exe 5900 HHFXY.exe 1968 PMSD.exe 1968 PMSD.exe 2892 OKD.exe 2892 OKD.exe 3160 SNBBDZ.exe 3160 SNBBDZ.exe 3952 ABOIO.exe 3952 ABOIO.exe 2440 PWX.exe 2440 PWX.exe 4536 GWZS.exe 4536 GWZS.exe 2248 BREBNQ.exe 2248 BREBNQ.exe 1528 QMNN.exe 1528 QMNN.exe 1008 LASXIK.exe 1008 LASXIK.exe 5960 FNX.exe 5960 FNX.exe 2884 PVZL.exe 2884 PVZL.exe 6048 BDGTIA.exe 6048 BDGTIA.exe 4112 ROIJQ.exe 4112 ROIJQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2280 2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe 2280 2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe 4980 YDYPXLY.exe 4980 YDYPXLY.exe 1360 AMA.exe 1360 AMA.exe 2556 MUGLD.exe 2556 MUGLD.exe 3608 EXKP.exe 3608 EXKP.exe 1084 INRPVN.exe 1084 INRPVN.exe 3320 UVFX.exe 3320 UVFX.exe 900 TFI.exe 900 TFI.exe 4916 VDOZXUZ.exe 4916 VDOZXUZ.exe 3564 MMQ.exe 3564 MMQ.exe 4596 THZRMM.exe 4596 THZRMM.exe 6036 WUE.exe 6036 WUE.exe 2376 PXIWB.exe 2376 PXIWB.exe 4776 JKNFMBP.exe 4776 JKNFMBP.exe 4120 BTP.exe 4120 BTP.exe 3692 TOTOCXT.exe 3692 TOTOCXT.exe 1424 XEZW.exe 1424 XEZW.exe 1328 NUI.exe 1328 NUI.exe 5900 HHFXY.exe 5900 HHFXY.exe 1968 PMSD.exe 1968 PMSD.exe 2892 OKD.exe 2892 OKD.exe 3160 SNBBDZ.exe 3160 SNBBDZ.exe 3952 ABOIO.exe 3952 ABOIO.exe 2440 PWX.exe 2440 PWX.exe 4536 GWZS.exe 4536 GWZS.exe 2248 BREBNQ.exe 2248 BREBNQ.exe 1528 QMNN.exe 1528 QMNN.exe 1008 LASXIK.exe 1008 LASXIK.exe 5960 FNX.exe 5960 FNX.exe 2884 PVZL.exe 2884 PVZL.exe 6048 BDGTIA.exe 6048 BDGTIA.exe 4112 ROIJQ.exe 4112 ROIJQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1788 2280 2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe 89 PID 1788 wrote to memory of 4980 1788 cmd.exe 93 PID 4980 wrote to memory of 4796 4980 YDYPXLY.exe 95 PID 4796 wrote to memory of 1360 4796 cmd.exe 99 PID 1360 wrote to memory of 6004 1360 AMA.exe 100 PID 6004 wrote to memory of 2556 6004 cmd.exe 104 PID 2556 wrote to memory of 1920 2556 MUGLD.exe 105 PID 1920 wrote to memory of 3608 1920 cmd.exe 109 PID 3608 wrote to memory of 2976 3608 EXKP.exe 110 PID 2976 wrote to memory of 1084 2976 cmd.exe 114 PID 1084 wrote to memory of 4492 1084 INRPVN.exe 115 PID 4492 wrote to memory of 3320 4492 cmd.exe 119 PID 3320 wrote to memory of 4820 3320 UVFX.exe 120 PID 4820 wrote to memory of 900 4820 cmd.exe 124 PID 900 wrote to memory of 4368 900 TFI.exe 125 PID 4368 wrote to memory of 4916 4368 cmd.exe 129 PID 4916 wrote to memory of 3176 4916 VDOZXUZ.exe 130 PID 3176 wrote to memory of 3564 3176 cmd.exe 134 PID 3564 wrote to memory of 1696 3564 MMQ.exe 135 PID 1696 wrote to memory of 4596 1696 cmd.exe 139 PID 4596 wrote to memory of 2792 4596 THZRMM.exe 140 PID 2792 wrote to memory of 6036 2792 cmd.exe 144 PID 6036 wrote to memory of 4696 6036 WUE.exe 145 PID 4696 wrote to memory of 2376 4696 cmd.exe 149 PID 2376 wrote to memory of 3276 2376 PXIWB.exe 150 PID 3276 wrote to memory of 4776 3276 cmd.exe 154 PID 4776 wrote to memory of 1148 4776 JKNFMBP.exe 155 PID 1148 wrote to memory of 4120 1148 cmd.exe 159 PID 4120 wrote to memory of 1620 4120 BTP.exe 160 PID 1620 wrote to memory of 3692 1620 cmd.exe 164 PID 3692 wrote to memory of 2316 3692 TOTOCXT.exe 165 PID 2316 wrote to memory of 1424 2316 cmd.exe 169 PID 1424 wrote to memory of 5532 1424 XEZW.exe 170 PID 5532 wrote to memory of 1328 5532 cmd.exe 174 PID 1328 wrote to memory of 3200 1328 NUI.exe 175 PID 3200 wrote to memory of 5900 3200 cmd.exe 179 PID 5900 wrote to memory of 4408 5900 HHFXY.exe 180 PID 4408 wrote to memory of 1968 4408 cmd.exe 184 PID 1968 wrote to memory of 1952 1968 PMSD.exe 185 PID 1952 wrote to memory of 2892 1952 cmd.exe 189 PID 2892 wrote to memory of 5632 2892 OKD.exe 190 PID 5632 wrote to memory of 3160 5632 cmd.exe 194 PID 3160 wrote to memory of 4152 3160 SNBBDZ.exe 195 PID 4152 wrote to memory of 3952 4152 cmd.exe 199 PID 3952 wrote to memory of 1976 3952 ABOIO.exe 200 PID 1976 wrote to memory of 2440 1976 cmd.exe 204 PID 2440 wrote to memory of 4076 2440 PWX.exe 205 PID 4076 wrote to memory of 4536 4076 cmd.exe 209 PID 4536 wrote to memory of 4812 4536 GWZS.exe 210 PID 4812 wrote to memory of 2248 4812 cmd.exe 214 PID 2248 wrote to memory of 1876 2248 BREBNQ.exe 215 PID 1876 wrote to memory of 1528 1876 cmd.exe 219 PID 1528 wrote to memory of 2504 1528 QMNN.exe 220 PID 2504 wrote to memory of 1008 2504 cmd.exe 224 PID 1008 wrote to memory of 5864 1008 LASXIK.exe 225 PID 5864 wrote to memory of 5960 5864 cmd.exe 229 PID 5960 wrote to memory of 4972 5960 FNX.exe 230 PID 4972 wrote to memory of 2884 4972 cmd.exe 234 PID 2884 wrote to memory of 2448 2884 PVZL.exe 235 PID 2448 wrote to memory of 6048 2448 cmd.exe 239 PID 6048 wrote to memory of 4056 6048 BDGTIA.exe 240 PID 4056 wrote to memory of 4112 4056 cmd.exe 244 PID 4112 wrote to memory of 1428 4112 ROIJQ.exe 245 PID 1428 wrote to memory of 2396 1428 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_3d3baab9193ad5912bc3a5396b17fde6_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDYPXLY.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\windows\SysWOW64\YDYPXLY.exeC:\windows\system32\YDYPXLY.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMA.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\windows\AMA.exeC:\windows\AMA.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MUGLD.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\system\MUGLD.exeC:\windows\system\MUGLD.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXKP.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\windows\EXKP.exeC:\windows\EXKP.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INRPVN.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\system\INRPVN.exeC:\windows\system\INRPVN.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVFX.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\system\UVFX.exeC:\windows\system\UVFX.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFI.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\system\TFI.exeC:\windows\system\TFI.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDOZXUZ.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\SysWOW64\VDOZXUZ.exeC:\windows\system32\VDOZXUZ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MMQ.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\windows\system\MMQ.exeC:\windows\system\MMQ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THZRMM.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\windows\THZRMM.exeC:\windows\THZRMM.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WUE.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\windows\system\WUE.exeC:\windows\system\WUE.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXIWB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\windows\SysWOW64\PXIWB.exeC:\windows\system32\PXIWB.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKNFMBP.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\windows\system\JKNFMBP.exeC:\windows\system\JKNFMBP.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\system\BTP.exeC:\windows\system\BTP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOTOCXT.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\windows\system\TOTOCXT.exeC:\windows\system\TOTOCXT.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XEZW.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\windows\XEZW.exeC:\windows\XEZW.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NUI.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\NUI.exeC:\windows\NUI.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HHFXY.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\windows\HHFXY.exeC:\windows\HHFXY.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMSD.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\SysWOW64\PMSD.exeC:\windows\system32\PMSD.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKD.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\windows\system\OKD.exeC:\windows\system\OKD.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNBBDZ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\SNBBDZ.exeC:\windows\SNBBDZ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABOIO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\SysWOW64\ABOIO.exeC:\windows\system32\ABOIO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWX.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\windows\PWX.exeC:\windows\PWX.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GWZS.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\system\GWZS.exeC:\windows\system\GWZS.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BREBNQ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\windows\SysWOW64\BREBNQ.exeC:\windows\system32\BREBNQ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMNN.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\windows\system\QMNN.exeC:\windows\system\QMNN.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LASXIK.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\windows\system\LASXIK.exeC:\windows\system\LASXIK.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNX.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\system\FNX.exeC:\windows\system\FNX.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVZL.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\SysWOW64\PVZL.exeC:\windows\system32\PVZL.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDGTIA.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\BDGTIA.exeC:\windows\BDGTIA.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROIJQ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\windows\system\ROIJQ.exeC:\windows\system\ROIJQ.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DEX.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\system\DEX.exeC:\windows\system\DEX.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSCT.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3804 -
C:\windows\system\YSCT.exeC:\windows\system\YSCT.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENFUTM.exe.bat" "68⤵PID:2460
-
C:\windows\SysWOW64\ENFUTM.exeC:\windows\system32\ENFUTM.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "70⤵PID:4668
-
C:\windows\SysWOW64\YAK.exeC:\windows\system32\YAK.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOKR.exe.bat" "72⤵PID:1364
-
C:\windows\system\HOKR.exeC:\windows\system\HOKR.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWRSJS.exe.bat" "74⤵PID:5828
-
C:\windows\system\KWRSJS.exeC:\windows\system\KWRSJS.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGZQXU.exe.bat" "76⤵PID:3732
-
C:\windows\YGZQXU.exeC:\windows\YGZQXU.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HHBVAAN.exe.bat" "78⤵PID:4616
-
C:\windows\system\HHBVAAN.exeC:\windows\system\HHBVAAN.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXIVN.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4052 -
C:\windows\SysWOW64\TXIVN.exeC:\windows\system32\TXIVN.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNJXT.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1520 -
C:\windows\SysWOW64\VNJXT.exeC:\windows\system32\VNJXT.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2840 -
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIOXM.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4508 -
C:\windows\IIOXM.exeC:\windows\IIOXM.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUUTM.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5388 -
C:\windows\WOUUTM.exeC:\windows\WOUUTM.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IGXNBBS.exe.bat" "90⤵PID:4600
-
C:\windows\IGXNBBS.exeC:\windows\IGXNBBS.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHZQFYB.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3480 -
C:\windows\SysWOW64\MHZQFYB.exeC:\windows\system32\MHZQFYB.exe93⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JMRFVTW.exe.bat" "94⤵PID:1712
-
C:\windows\system\JMRFVTW.exeC:\windows\system\JMRFVTW.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PIQ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\windows\system\PIQ.exeC:\windows\system\PIQ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVNPK.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4260 -
C:\windows\KVNPK.exeC:\windows\KVNPK.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYD.exe.bat" "100⤵PID:5612
-
C:\windows\SysWOW64\XYD.exeC:\windows\system32\XYD.exe101⤵
- Executes dropped EXE
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOMK.exe.bat" "102⤵PID:4732
-
C:\windows\system\AOMK.exeC:\windows\system\AOMK.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEZUNI.exe.bat" "104⤵PID:2032
-
C:\windows\system\PEZUNI.exeC:\windows\system\PEZUNI.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEH.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4284 -
C:\windows\VEH.exeC:\windows\VEH.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "108⤵PID:6108
-
C:\windows\system\DKM.exeC:\windows\system\DKM.exe109⤵
- Executes dropped EXE
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NHZJOJ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2052 -
C:\windows\SysWOW64\NHZJOJ.exeC:\windows\system32\NHZJOJ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVEPZ.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3552 -
C:\windows\SysWOW64\VVEPZ.exeC:\windows\system32\VVEPZ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIJHJPW.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5732 -
C:\windows\system\QIJHJPW.exeC:\windows\system\QIJHJPW.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQPH.exe.bat" "116⤵PID:4136
-
C:\windows\SysWOW64\UQPH.exeC:\windows\system32\UQPH.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEWFA.exe.bat" "118⤵PID:4068
-
C:\windows\SysWOW64\NEWFA.exeC:\windows\system32\NEWFA.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APF.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1172 -
C:\windows\system\APF.exeC:\windows\system\APF.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-