Analysis
- max time kernel
74s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 13:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe
- Size 208KB
- Sample260810-qs1sysgd87
- SHA256 fa37cdc35741b6731e85d726f796ae51e9f774d2c3023653c34186bb0cf9ed53
- MD5 b539237eed89c07d8366ce61eb95e047
- SHA1 29706cbf49f8160f19123e888f7d07864b7c4105
- SHA512 16d925a8ed8b20b589f5bf78af090fc6f1f4f39b4c2bb825d6bf4ac448b006dadfaa404002d13911df4fb1dc10249088aad695c4388d8bb2e017f874347ed2be
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOf64pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LOSkEj1
- TLSH T14F247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 592 AQZSL.exe 5972 UOCRVK.exe 5668 FPKCMLJ.exe 5600 YHZNWER.exe 1160 XSCDFS.exe 1860 GSEQIPP.exe 5036 LYW.exe 5152 YEWJAW.exe 2188 CMD.exe 5448 ZMNTYTQ.exe 1248 UXVSE.exe 4720 NSZN.exe 5072 MLK.exe 2508 ZNSCHC.exe 2720 OETUN.exe 5960 EHC.exe 2736 ECGCM.exe 5616 XFK.exe 1208 WPVVA.exe 2640 UAYD.exe 4988 OBNW.exe 1600 IOSGCL.exe 4064 KMYSKT.exe 248 SRYGLG.exe 2324 UPDB.exe 2380 JKNFMBP.exe 6104 XQVRV.exe 6076 STDQC.exe 5008 LWHTPOV.exe 4796 FJMD.exe 2956 EUP.exe 4504 FXSON.exe 4376 QPIZX.exe 2320 CFOHJDM.exe 5812 PDWLLO.exe 4180 KZT.exe 1688 ZULHGB.exe 2012 OKMY.exe 3572 EFVLYJI.exe 3560 YSAU.exe 1752 RVEQO.exe 788 IVGD.exe 1932 SEIID.exe 2808 SHYERL.exe 2584 YHG.exe 1328 TUKBK.exe 2592 ZQC.exe 4508 BNPWX.exe 4916 HOXKGTV.exe 4900 HJBF.exe 5996 PZC.exe 1264 IZR.exe 5824 ZALV.exe 5320 OVDZYPM.exe 3128 WLEZE.exe 4816 LGN.exe 3108 COPQB.exe 4088 OHSBBK.exe 2520 XUCTRHH.exe 3960 IMX.exe 932 JHBPF.exe 1672 DDGZPE.exe 296 HLNZBW.exe 5096 SDQSBEY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RVEQO.exe.bat YSAU.exe File created C:\windows\SysWOW64\BNPWX.exe.bat ZQC.exe File created C:\windows\SysWOW64\QPCOUNK.exe.bat FWZVU.exe File created C:\windows\SysWOW64\EWDJL.exe DTZ.exe File opened for modification C:\windows\SysWOW64\ZYZJKY.exe QQXE.exe File created C:\windows\SysWOW64\XQVRV.exe JKNFMBP.exe File created C:\windows\SysWOW64\XQVRV.exe.bat JKNFMBP.exe File opened for modification C:\windows\SysWOW64\XFK.exe ECGCM.exe File created C:\windows\SysWOW64\UXVSE.exe ZMNTYTQ.exe File created C:\windows\SysWOW64\EHC.exe OETUN.exe File created C:\windows\SysWOW64\RVEQO.exe YSAU.exe File opened for modification C:\windows\SysWOW64\ZALV.exe IZR.exe File created C:\windows\SysWOW64\LGN.exe.bat WLEZE.exe File created C:\windows\SysWOW64\COPQB.exe.bat LGN.exe File opened for modification C:\windows\SysWOW64\EWTKKL.exe SDQSBEY.exe File created C:\windows\SysWOW64\XFK.exe.bat ECGCM.exe File created C:\windows\SysWOW64\ZALV.exe.bat IZR.exe File created C:\windows\SysWOW64\HLNZBW.exe DDGZPE.exe File created C:\windows\SysWOW64\SDQSBEY.exe.bat HLNZBW.exe File opened for modification C:\windows\SysWOW64\EYLFV.exe AIWXJZY.exe File opened for modification C:\windows\SysWOW64\WDIR.exe TNBJ.exe File created C:\windows\SysWOW64\IXETF.exe.bat QPCOUNK.exe File opened for modification C:\windows\SysWOW64\KPPQPYC.exe PCKYN.exe File opened for modification C:\windows\SysWOW64\UXVSE.exe ZMNTYTQ.exe File opened for modification C:\windows\SysWOW64\YSAU.exe EFVLYJI.exe File opened for modification C:\windows\SysWOW64\RVEQO.exe YSAU.exe File opened for modification C:\windows\SysWOW64\SHYERL.exe SEIID.exe File created C:\windows\SysWOW64\HLNZBW.exe.bat DDGZPE.exe File created C:\windows\SysWOW64\SDQSBEY.exe HLNZBW.exe File created C:\windows\SysWOW64\MXKOO.exe UUG.exe File created C:\windows\SysWOW64\PDWLLO.exe.bat CFOHJDM.exe File created C:\windows\SysWOW64\SHYERL.exe.bat SEIID.exe File created C:\windows\SysWOW64\YHG.exe SHYERL.exe File created C:\windows\SysWOW64\ZALV.exe IZR.exe File opened for modification C:\windows\SysWOW64\SDQSBEY.exe HLNZBW.exe File opened for modification C:\windows\SysWOW64\AIWXJZY.exe RIUSFU.exe File created C:\windows\SysWOW64\KPPQPYC.exe.bat PCKYN.exe File created C:\windows\SysWOW64\AIWXJZY.exe RIUSFU.exe File created C:\windows\SysWOW64\AIWXJZY.exe.bat RIUSFU.exe File created C:\windows\SysWOW64\QPCOUNK.exe FWZVU.exe File opened for modification C:\windows\SysWOW64\PCKYN.exe VPFP.exe File opened for modification C:\windows\SysWOW64\WPVVA.exe XFK.exe File created C:\windows\SysWOW64\WPVVA.exe.bat XFK.exe File created C:\windows\SysWOW64\YHG.exe.bat SHYERL.exe File created C:\windows\SysWOW64\OHSBBK.exe COPQB.exe File created C:\windows\SysWOW64\EYLFV.exe.bat AIWXJZY.exe File opened for modification C:\windows\SysWOW64\IXETF.exe QPCOUNK.exe File created C:\windows\SysWOW64\PCKYN.exe VPFP.exe File created C:\windows\SysWOW64\ZYZJKY.exe QQXE.exe File created C:\windows\SysWOW64\XFK.exe ECGCM.exe File opened for modification C:\windows\SysWOW64\XSCDFS.exe YHZNWER.exe File created C:\windows\SysWOW64\WPVVA.exe XFK.exe File created C:\windows\SysWOW64\BNPWX.exe ZQC.exe File opened for modification C:\windows\SysWOW64\LGN.exe WLEZE.exe File opened for modification C:\windows\SysWOW64\MXKOO.exe UUG.exe File created C:\windows\SysWOW64\WDIR.exe TNBJ.exe File created C:\windows\SysWOW64\XSCDFS.exe.bat YHZNWER.exe File opened for modification C:\windows\SysWOW64\ZMNTYTQ.exe CMD.exe File created C:\windows\SysWOW64\OBNW.exe UAYD.exe File opened for modification C:\windows\SysWOW64\XQVRV.exe JKNFMBP.exe File opened for modification C:\windows\SysWOW64\PDWLLO.exe CFOHJDM.exe File created C:\windows\SysWOW64\EWDJL.exe.bat DTZ.exe File created C:\windows\SysWOW64\ZMNTYTQ.exe CMD.exe File opened for modification C:\windows\SysWOW64\OBNW.exe UAYD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SEIID.exe IVGD.exe File opened for modification C:\windows\TUKBK.exe YHG.exe File created C:\windows\LCWO.exe HMIOFJB.exe File created C:\windows\WCJQM.exe.bat IXETF.exe File created C:\windows\system\YEWJAW.exe LYW.exe File created C:\windows\system\UAYD.exe.bat WPVVA.exe File created C:\windows\IOSGCL.exe OBNW.exe File opened for modification C:\windows\IOSGCL.exe OBNW.exe File created C:\windows\QPIZX.exe.bat FXSON.exe File created C:\windows\system\HJBF.exe HOXKGTV.exe File created C:\windows\PZC.exe HJBF.exe File opened for modification C:\windows\IZR.exe PZC.exe File created C:\windows\system\ECGCM.exe EHC.exe File created C:\windows\system\UDRKCFN.exe ODKXT.exe File created C:\windows\system\UDRKCFN.exe.bat ODKXT.exe File created C:\windows\system\FWZVU.exe.bat UDRKCFN.exe File created C:\windows\DTZ.exe.bat KYNJSJ.exe File created C:\windows\system\LYW.exe.bat GSEQIPP.exe File opened for modification C:\windows\FXSON.exe EUP.exe File opened for modification C:\windows\system\CFOHJDM.exe QPIZX.exe File created C:\windows\system\OVDZYPM.exe ZALV.exe File opened for modification C:\windows\system\WLEZE.exe OVDZYPM.exe File opened for modification C:\windows\RHBJYW.exe EWTKKL.exe File created C:\windows\RIUSFU.exe LIVE.exe File created C:\windows\system\ULDSUYU.exe.bat ZYZJKY.exe File created C:\windows\GSEQIPP.exe XSCDFS.exe File created C:\windows\TUKBK.exe YHG.exe File created C:\windows\system\HMIOFJB.exe.bat EYLFV.exe File created C:\windows\system\ASXOYXM.exe LCWO.exe File created C:\windows\system\AQZSL.exe.bat 2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe File created C:\windows\system\HMIOFJB.exe EYLFV.exe File opened for modification C:\windows\TNBJ.exe ASXOYXM.exe File opened for modification C:\windows\MLK.exe NSZN.exe File created C:\windows\KMYSKT.exe IOSGCL.exe File created C:\windows\FXSON.exe EUP.exe File created C:\windows\system\DDGZPE.exe.bat JHBPF.exe File created C:\windows\system\LIVE.exe MXKOO.exe File created C:\windows\system\ULDSUYU.exe ZYZJKY.exe File opened for modification C:\windows\system\CMD.exe YEWJAW.exe File created C:\windows\MLK.exe NSZN.exe File created C:\windows\FJMD.exe.bat LWHTPOV.exe File created C:\windows\system\KZT.exe.bat PDWLLO.exe File opened for modification C:\windows\system\ULDSUYU.exe ZYZJKY.exe File opened for modification C:\windows\system\AQZSL.exe 2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe File created C:\windows\UPDB.exe SRYGLG.exe File created C:\windows\system\JKNFMBP.exe.bat UPDB.exe File created C:\windows\system\LWHTPOV.exe STDQC.exe File created C:\windows\IZR.exe PZC.exe File created C:\windows\XUCTRHH.exe.bat OHSBBK.exe File created C:\windows\IMX.exe XUCTRHH.exe File created C:\windows\RHBJYW.exe EWTKKL.exe File created C:\windows\system\VPFP.exe JWKWURJ.exe File opened for modification C:\windows\system\VPFP.exe JWKWURJ.exe File opened for modification C:\windows\FPKCMLJ.exe UOCRVK.exe File created C:\windows\system\LYW.exe GSEQIPP.exe File created C:\windows\HOXKGTV.exe BNPWX.exe File created C:\windows\system\WLEZE.exe.bat OVDZYPM.exe File opened for modification C:\windows\RIUSFU.exe LIVE.exe File created C:\windows\ODKXT.exe WDIR.exe File created C:\windows\UOCRVK.exe AQZSL.exe File opened for modification C:\windows\system\JKNFMBP.exe UPDB.exe File created C:\windows\ZQC.exe.bat TUKBK.exe File created C:\windows\JHBPF.exe.bat IMX.exe File created C:\windows\system\DDGZPE.exe JHBPF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4656 cmd.exe 4688 cmd.exe 4544 cmd.exe 2168 cmd.exe 1164 cmd.exe 4968 cmd.exe 1900 cmd.exe 1588 cmd.exe 5520 cmd.exe 1440 cmd.exe 1744 cmd.exe 3144 cmd.exe 1036 cmd.exe 5760 cmd.exe 4848 cmd.exe 2388 cmd.exe 5788 cmd.exe 5696 cmd.exe 2580 cmd.exe 2028 cmd.exe 4892 cmd.exe 1360 cmd.exe 4292 cmd.exe 1680 cmd.exe 3764 cmd.exe 3676 cmd.exe 3956 cmd.exe 4692 cmd.exe 4124 cmd.exe 3040 cmd.exe 5204 cmd.exe 2436 cmd.exe 1728 cmd.exe 5740 cmd.exe 4084 cmd.exe 2252 cmd.exe 4624 cmd.exe 3736 cmd.exe 1720 cmd.exe 1276 cmd.exe 2516 cmd.exe 4316 cmd.exe 4668 cmd.exe 416 cmd.exe 6080 cmd.exe 1308 cmd.exe 5692 cmd.exe 2452 cmd.exe 2632 cmd.exe 1176 cmd.exe 5724 cmd.exe 3588 cmd.exe 4392 cmd.exe 2392 cmd.exe 3260 cmd.exe 4296 cmd.exe 2696 cmd.exe 1412 cmd.exe 4672 cmd.exe 3860 cmd.exe 4468 cmd.exe 5172 cmd.exe 4856 cmd.exe 3384 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4532 3968 WerFault.exe 87 4776 592 WerFault.exe 93 5792 5972 WerFault.exe 99 3000 5668 WerFault.exe 104 2096 5600 WerFault.exe 109 4980 1160 WerFault.exe 114 2972 1860 WerFault.exe 119 1104 5036 WerFault.exe 124 5648 5152 WerFault.exe 129 4628 2188 WerFault.exe 134 4528 5448 WerFault.exe 139 1412 1248 WerFault.exe 144 1716 4720 WerFault.exe 149 3644 5072 WerFault.exe 154 5852 2508 WerFault.exe 159 2012 2720 WerFault.exe 164 4380 5960 WerFault.exe 169 1116 2736 WerFault.exe 174 2724 5616 WerFault.exe 179 1476 1208 WerFault.exe 184 4812 2640 WerFault.exe 189 2388 4988 WerFault.exe 194 4116 1600 WerFault.exe 199 4776 4064 WerFault.exe 204 4304 248 WerFault.exe 209 2560 2324 WerFault.exe 214 5568 2380 WerFault.exe 219 3132 6104 WerFault.exe 224 2140 6076 WerFault.exe 229 1312 5008 WerFault.exe 234 5128 4796 WerFault.exe 239 2988 2956 WerFault.exe 244 2008 4504 WerFault.exe 249 1412 4376 WerFault.exe 254 3636 2320 WerFault.exe 259 4724 5812 WerFault.exe 264 2016 4180 WerFault.exe 270 2644 1688 WerFault.exe 275 6096 2012 WerFault.exe 280 4172 3572 WerFault.exe 285 2816 3560 WerFault.exe 290 5248 1752 WerFault.exe 295 4780 788 WerFault.exe 300 4264 1932 WerFault.exe 305 3904 2808 WerFault.exe 310 5088 2584 WerFault.exe 315 2312 1328 WerFault.exe 320 2924 2592 WerFault.exe 325 5992 4508 WerFault.exe 330 5568 4916 WerFault.exe 335 5784 4900 WerFault.exe 340 4372 5996 WerFault.exe 345 5788 1264 WerFault.exe 350 1976 5824 WerFault.exe 355 3380 5320 WerFault.exe 360 1716 3128 WerFault.exe 365 1552 4816 WerFault.exe 370 4844 3108 WerFault.exe 375 2536 4088 WerFault.exe 380 5848 2520 WerFault.exe 385 4316 3960 WerFault.exe 390 5924 932 WerFault.exe 395 3928 1672 WerFault.exe 400 1896 296 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZALV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCJQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWDJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCKYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQZSL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LWHTPOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWTKKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNPWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYLFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPVVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLEZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNSCHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECGCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COPQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIUSFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWZVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UXVSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHBJYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODKXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STDQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPIZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVEQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AIWXJZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKNFMBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXSON.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3968 2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe 3968 2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe 592 AQZSL.exe 592 AQZSL.exe 5972 UOCRVK.exe 5972 UOCRVK.exe 5668 FPKCMLJ.exe 5668 FPKCMLJ.exe 5600 YHZNWER.exe 5600 YHZNWER.exe 1160 XSCDFS.exe 1160 XSCDFS.exe 1860 GSEQIPP.exe 1860 GSEQIPP.exe 5036 LYW.exe 5036 LYW.exe 5152 YEWJAW.exe 5152 YEWJAW.exe 2188 CMD.exe 2188 CMD.exe 5448 ZMNTYTQ.exe 5448 ZMNTYTQ.exe 1248 UXVSE.exe 1248 UXVSE.exe 4720 NSZN.exe 4720 NSZN.exe 5072 MLK.exe 5072 MLK.exe 2508 ZNSCHC.exe 2508 ZNSCHC.exe 2720 OETUN.exe 2720 OETUN.exe 5960 EHC.exe 5960 EHC.exe 2736 ECGCM.exe 2736 ECGCM.exe 5616 XFK.exe 5616 XFK.exe 1208 WPVVA.exe 1208 WPVVA.exe 2640 UAYD.exe 2640 UAYD.exe 4988 OBNW.exe 4988 OBNW.exe 1600 IOSGCL.exe 1600 IOSGCL.exe 4064 KMYSKT.exe 4064 KMYSKT.exe 248 SRYGLG.exe 248 SRYGLG.exe 2324 UPDB.exe 2324 UPDB.exe 2380 JKNFMBP.exe 2380 JKNFMBP.exe 6104 XQVRV.exe 6104 XQVRV.exe 6076 STDQC.exe 6076 STDQC.exe 5008 LWHTPOV.exe 5008 LWHTPOV.exe 4796 FJMD.exe 4796 FJMD.exe 2956 EUP.exe 2956 EUP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3968 2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe 3968 2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe 592 AQZSL.exe 592 AQZSL.exe 5972 UOCRVK.exe 5972 UOCRVK.exe 5668 FPKCMLJ.exe 5668 FPKCMLJ.exe 5600 YHZNWER.exe 5600 YHZNWER.exe 1160 XSCDFS.exe 1160 XSCDFS.exe 1860 GSEQIPP.exe 1860 GSEQIPP.exe 5036 LYW.exe 5036 LYW.exe 5152 YEWJAW.exe 5152 YEWJAW.exe 2188 CMD.exe 2188 CMD.exe 5448 ZMNTYTQ.exe 5448 ZMNTYTQ.exe 1248 UXVSE.exe 1248 UXVSE.exe 4720 NSZN.exe 4720 NSZN.exe 5072 MLK.exe 5072 MLK.exe 2508 ZNSCHC.exe 2508 ZNSCHC.exe 2720 OETUN.exe 2720 OETUN.exe 5960 EHC.exe 5960 EHC.exe 2736 ECGCM.exe 2736 ECGCM.exe 5616 XFK.exe 5616 XFK.exe 1208 WPVVA.exe 1208 WPVVA.exe 2640 UAYD.exe 2640 UAYD.exe 4988 OBNW.exe 4988 OBNW.exe 1600 IOSGCL.exe 1600 IOSGCL.exe 4064 KMYSKT.exe 4064 KMYSKT.exe 248 SRYGLG.exe 248 SRYGLG.exe 2324 UPDB.exe 2324 UPDB.exe 2380 JKNFMBP.exe 2380 JKNFMBP.exe 6104 XQVRV.exe 6104 XQVRV.exe 6076 STDQC.exe 6076 STDQC.exe 5008 LWHTPOV.exe 5008 LWHTPOV.exe 4796 FJMD.exe 4796 FJMD.exe 2956 EUP.exe 2956 EUP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3968 wrote to memory of 4436 3968 2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe 89 PID 4436 wrote to memory of 592 4436 cmd.exe 93 PID 592 wrote to memory of 3384 592 AQZSL.exe 95 PID 3384 wrote to memory of 5972 3384 cmd.exe 99 PID 5972 wrote to memory of 4292 5972 UOCRVK.exe 100 PID 4292 wrote to memory of 5668 4292 cmd.exe 104 PID 5668 wrote to memory of 4576 5668 FPKCMLJ.exe 105 PID 4576 wrote to memory of 5600 4576 cmd.exe 109 PID 5600 wrote to memory of 1680 5600 YHZNWER.exe 110 PID 1680 wrote to memory of 1160 1680 cmd.exe 114 PID 1160 wrote to memory of 2452 1160 XSCDFS.exe 115 PID 2452 wrote to memory of 1860 2452 cmd.exe 119 PID 1860 wrote to memory of 2632 1860 GSEQIPP.exe 120 PID 2632 wrote to memory of 5036 2632 cmd.exe 124 PID 5036 wrote to memory of 5676 5036 LYW.exe 125 PID 5676 wrote to memory of 5152 5676 cmd.exe 129 PID 5152 wrote to memory of 1748 5152 YEWJAW.exe 130 PID 1748 wrote to memory of 2188 1748 cmd.exe 134 PID 2188 wrote to memory of 4620 2188 CMD.exe 135 PID 4620 wrote to memory of 5448 4620 cmd.exe 139 PID 5448 wrote to memory of 4060 5448 ZMNTYTQ.exe 140 PID 4060 wrote to memory of 1248 4060 cmd.exe 144 PID 1248 wrote to memory of 2492 1248 UXVSE.exe 145 PID 2492 wrote to memory of 4720 2492 cmd.exe 149 PID 4720 wrote to memory of 2616 4720 NSZN.exe 150 PID 2616 wrote to memory of 5072 2616 cmd.exe 154 PID 5072 wrote to memory of 4600 5072 MLK.exe 155 PID 4600 wrote to memory of 2508 4600 cmd.exe 159 PID 2508 wrote to memory of 4544 2508 ZNSCHC.exe 160 PID 4544 wrote to memory of 2720 4544 cmd.exe 164 PID 2720 wrote to memory of 1744 2720 OETUN.exe 165 PID 1744 wrote to memory of 5960 1744 cmd.exe 169 PID 5960 wrote to memory of 4256 5960 EHC.exe 170 PID 4256 wrote to memory of 2736 4256 cmd.exe 174 PID 2736 wrote to memory of 3832 2736 ECGCM.exe 175 PID 3832 wrote to memory of 5616 3832 cmd.exe 179 PID 5616 wrote to memory of 5872 5616 XFK.exe 180 PID 5872 wrote to memory of 1208 5872 cmd.exe 184 PID 1208 wrote to memory of 1308 1208 WPVVA.exe 185 PID 1308 wrote to memory of 2640 1308 cmd.exe 189 PID 2640 wrote to memory of 5436 2640 UAYD.exe 190 PID 5436 wrote to memory of 4988 5436 cmd.exe 194 PID 4988 wrote to memory of 2928 4988 OBNW.exe 195 PID 1600 wrote to memory of 2460 1600 IOSGCL.exe 200 PID 2460 wrote to memory of 4064 2460 cmd.exe 204 PID 4064 wrote to memory of 4688 4064 KMYSKT.exe 205 PID 4688 wrote to memory of 248 4688 cmd.exe 209 PID 248 wrote to memory of 4692 248 SRYGLG.exe 210 PID 4692 wrote to memory of 2324 4692 cmd.exe 214 PID 2324 wrote to memory of 2876 2324 UPDB.exe 215 PID 2876 wrote to memory of 2380 2876 cmd.exe 219 PID 2380 wrote to memory of 4832 2380 JKNFMBP.exe 220 PID 4832 wrote to memory of 6104 4832 cmd.exe 224 PID 6104 wrote to memory of 120 6104 XQVRV.exe 225 PID 120 wrote to memory of 6076 120 cmd.exe 229 PID 6076 wrote to memory of 6072 6076 STDQC.exe 230 PID 6072 wrote to memory of 5008 6072 cmd.exe 234 PID 5008 wrote to memory of 5728 5008 LWHTPOV.exe 235 PID 5728 wrote to memory of 4796 5728 cmd.exe 239 PID 4796 wrote to memory of 3552 4796 FJMD.exe 240 PID 3552 wrote to memory of 2956 3552 cmd.exe 244 PID 2956 wrote to memory of 1176 2956 EUP.exe 245 PID 1176 wrote to memory of 4504 1176 cmd.exe 249 PID 4504 wrote to memory of 5688 4504 FXSON.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b539237eed89c07d8366ce61eb95e047_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQZSL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\windows\system\AQZSL.exeC:\windows\system\AQZSL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UOCRVK.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\UOCRVK.exeC:\windows\UOCRVK.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPKCMLJ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\windows\FPKCMLJ.exeC:\windows\FPKCMLJ.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHZNWER.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\system\YHZNWER.exeC:\windows\system\YHZNWER.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSCDFS.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\windows\SysWOW64\XSCDFS.exeC:\windows\system32\XSCDFS.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSEQIPP.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\GSEQIPP.exeC:\windows\GSEQIPP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYW.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\system\LYW.exeC:\windows\system\LYW.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEWJAW.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\system\YEWJAW.exeC:\windows\system\YEWJAW.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMD.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\system\CMD.exeC:\windows\system\CMD.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMNTYTQ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\SysWOW64\ZMNTYTQ.exeC:\windows\system32\ZMNTYTQ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UXVSE.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\windows\SysWOW64\UXVSE.exeC:\windows\system32\UXVSE.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSZN.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\windows\system\NSZN.exeC:\windows\system\NSZN.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLK.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\windows\MLK.exeC:\windows\MLK.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNSCHC.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\windows\ZNSCHC.exeC:\windows\ZNSCHC.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OETUN.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\system\OETUN.exeC:\windows\system\OETUN.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EHC.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\windows\SysWOW64\EHC.exeC:\windows\system32\EHC.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECGCM.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\windows\system\ECGCM.exeC:\windows\system\ECGCM.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFK.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\windows\SysWOW64\XFK.exeC:\windows\system32\XFK.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WPVVA.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\SysWOW64\WPVVA.exeC:\windows\system32\WPVVA.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAYD.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\windows\system\UAYD.exeC:\windows\system\UAYD.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OBNW.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\OBNW.exeC:\windows\system32\OBNW.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOSGCL.exe.bat" "44⤵PID:2928
-
C:\windows\IOSGCL.exeC:\windows\IOSGCL.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMYSKT.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\windows\KMYSKT.exeC:\windows\KMYSKT.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRYGLG.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\windows\SRYGLG.exeC:\windows\SRYGLG.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPDB.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\UPDB.exeC:\windows\UPDB.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKNFMBP.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\windows\system\JKNFMBP.exeC:\windows\system\JKNFMBP.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQVRV.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\windows\SysWOW64\XQVRV.exeC:\windows\system32\XQVRV.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STDQC.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:120 -
C:\windows\system\STDQC.exeC:\windows\system\STDQC.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWHTPOV.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\windows\system\LWHTPOV.exeC:\windows\system\LWHTPOV.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJMD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\FJMD.exeC:\windows\FJMD.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EUP.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\windows\system\EUP.exeC:\windows\system\EUP.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXSON.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\windows\FXSON.exeC:\windows\FXSON.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPIZX.exe.bat" "66⤵PID:5688
-
C:\windows\QPIZX.exeC:\windows\QPIZX.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CFOHJDM.exe.bat" "68⤵PID:1204
-
C:\windows\system\CFOHJDM.exeC:\windows\system\CFOHJDM.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDWLLO.exe.bat" "70⤵PID:1408
-
C:\windows\SysWOW64\PDWLLO.exeC:\windows\system32\PDWLLO.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZT.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:2156 -
C:\windows\system\KZT.exeC:\windows\system\KZT.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZULHGB.exe.bat" "74⤵PID:4304
-
C:\windows\system\ZULHGB.exeC:\windows\system\ZULHGB.exe75⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKMY.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3764 -
C:\windows\system\OKMY.exeC:\windows\system\OKMY.exe77⤵
- Executes dropped EXE
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFVLYJI.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2168 -
C:\windows\system\EFVLYJI.exeC:\windows\system\EFVLYJI.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YSAU.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5740 -
C:\windows\SysWOW64\YSAU.exeC:\windows\system32\YSAU.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVEQO.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:2256 -
C:\windows\SysWOW64\RVEQO.exeC:\windows\system32\RVEQO.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVGD.exe.bat" "84⤵PID:2148
-
C:\windows\system\IVGD.exeC:\windows\system\IVGD.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SEIID.exe.bat" "86⤵PID:5704
-
C:\windows\SEIID.exeC:\windows\SEIID.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHYERL.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2388 -
C:\windows\SysWOW64\SHYERL.exeC:\windows\system32\SHYERL.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YHG.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3048 -
C:\windows\SysWOW64\YHG.exeC:\windows\system32\YHG.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUKBK.exe.bat" "92⤵PID:4776
-
C:\windows\TUKBK.exeC:\windows\TUKBK.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQC.exe.bat" "94⤵PID:2000
-
C:\windows\ZQC.exeC:\windows\ZQC.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNPWX.exe.bat" "96⤵PID:5112
-
C:\windows\SysWOW64\BNPWX.exeC:\windows\system32\BNPWX.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOXKGTV.exe.bat" "98⤵PID:2424
-
C:\windows\HOXKGTV.exeC:\windows\HOXKGTV.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJBF.exe.bat" "100⤵PID:4828
-
C:\windows\system\HJBF.exeC:\windows\system\HJBF.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZC.exe.bat" "102⤵PID:4268
-
C:\windows\PZC.exeC:\windows\PZC.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZR.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5724 -
C:\windows\IZR.exeC:\windows\IZR.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZALV.exe.bat" "106⤵
- Executes a command shell one-liner
PID:3144 -
C:\windows\SysWOW64\ZALV.exeC:\windows\system32\ZALV.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVDZYPM.exe.bat" "108⤵
- Executes a command shell one-liner
PID:4296 -
C:\windows\system\OVDZYPM.exeC:\windows\system\OVDZYPM.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLEZE.exe.bat" "110⤵
- Executes a command shell one-liner
PID:3588 -
C:\windows\system\WLEZE.exeC:\windows\system\WLEZE.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGN.exe.bat" "112⤵
- Executes a command shell one-liner
PID:6080 -
C:\windows\SysWOW64\LGN.exeC:\windows\system32\LGN.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COPQB.exe.bat" "114⤵PID:2560
-
C:\windows\SysWOW64\COPQB.exeC:\windows\system32\COPQB.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHSBBK.exe.bat" "116⤵PID:2620
-
C:\windows\SysWOW64\OHSBBK.exeC:\windows\system32\OHSBBK.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUCTRHH.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:6096 -
C:\windows\XUCTRHH.exeC:\windows\XUCTRHH.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMX.exe.bat" "120⤵PID:2292
-
C:\windows\IMX.exeC:\windows\IMX.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-