Analysis
- max time kernel
81s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe
- Size 208KB
- Sample260810-ra6f6azfre
- SHA256 c8a4b7ab9a88140f8e58805c489bc432133b690be4200dee2bb378e842a26edc
- MD5 33af7847a982779c135a26b0ee19a287
- SHA1 9fcf45aa59fe4e5a87ad8059891f223dfdbc02c5
- SHA512 13697b2261ae758e6b84b9d4f1f8118ff3c9f3fc182019c38fbe1ad2940868dbcc5c9bdd3ce81b67d4f0ee991883e0b340fe467db48f1dcca3f266b83ead3639
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfi4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LOKkEj1
- TLSH T108247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1936 YOKS.exe 2716 SUDD.exe 3244 AZQK.exe 788 BCGGO.exe 1720 GDIIAX.exe 3204 FOT.exe 2668 QGA.exe 1264 RJMNXBH.exe 4684 PUPD.exe 3184 OKAY.exe 1552 SVYTB.exe 2480 MIDCLFC.exe 2752 OGQWTOL.exe 256 YEWJAW.exe 2920 OZGV.exe 2916 SCEITKE.exe 5144 APQXEJ.exe 1804 KNWJ.exe 2524 MLK.exe 5628 ZNSCHC.exe 3148 OETUN.exe 3488 PHXXTOD.exe 3328 KUC.exe 5788 DMRS.exe 4860 HCYSZH.exe 1136 FYXA.exe 264 ABFRSMZ.exe 3672 JJH.exe 4536 KMLAIIK.exe 2356 FZQJ.exe 2560 DPBMGNH.exe 4212 OHE.exe 2076 SYLFSM.exe 1760 RIWVB.exe 2516 ROOKC.exe 4128 KGDUU.exe 4872 EHLF.exe 4896 YUPPN.exe 5148 YAQDPM.exe 2128 NVZI.exe 3864 XDBVLEU.exe 1868 ZQGE.exe 4904 QBJUWK.exe 4748 VHBJNFZ.exe 3668 VMBYOSU.exe 2984 BNJMF.exe 3132 BABAH.exe 1776 GAJ.exe 2136 YBLT.exe 6072 WZEOOEK.exe 1632 GZYB.exe 5352 AMDKC.exe 6032 BPGG.exe 3896 FXVOTSY.exe 4988 XAZK.exe 2440 JQFKLA.exe 4304 RGGJ.exe 860 XHOXBQM.exe 5012 BPVF.exe 920 DCAOXI.exe 5780 DQADZNZ.exe 4572 UFZGDG.exe 5728 LGBL.exe 4452 JGIYX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\AZQK.exe SUDD.exe File created C:\windows\SysWOW64\ABFRSMZ.exe.bat FYXA.exe File created C:\windows\SysWOW64\YAQDPM.exe.bat YUPPN.exe File created C:\windows\SysWOW64\XAZK.exe FXVOTSY.exe File opened for modification C:\windows\SysWOW64\RHVK.exe GPS.exe File created C:\windows\SysWOW64\CWWQQEI.exe PLNRCTN.exe File created C:\windows\SysWOW64\WOYSAYN.exe AQTVT.exe File created C:\windows\SysWOW64\KHLBWEN.exe SEHYQO.exe File created C:\windows\SysWOW64\DPBMGNH.exe FZQJ.exe File created C:\windows\SysWOW64\APQXEJ.exe.bat SCEITKE.exe File created C:\windows\SysWOW64\KUC.exe.bat PHXXTOD.exe File opened for modification C:\windows\SysWOW64\DPBMGNH.exe FZQJ.exe File opened for modification C:\windows\SysWOW64\WZEOOEK.exe YBLT.exe File created C:\windows\SysWOW64\RHVK.exe GPS.exe File created C:\windows\SysWOW64\KWOQ.exe.bat QIJHJPW.exe File opened for modification C:\windows\SysWOW64\QDPLDZI.exe VHKBA.exe File created C:\windows\SysWOW64\FYXA.exe.bat HCYSZH.exe File created C:\windows\SysWOW64\ABFRSMZ.exe FYXA.exe File opened for modification C:\windows\SysWOW64\ABFRSMZ.exe FYXA.exe File created C:\windows\SysWOW64\OHE.exe DPBMGNH.exe File created C:\windows\SysWOW64\RIWVB.exe.bat SYLFSM.exe File created C:\windows\SysWOW64\YUPPN.exe EHLF.exe File created C:\windows\SysWOW64\CWOGS.exe CROR.exe File created C:\windows\SysWOW64\QDPLDZI.exe VHKBA.exe File opened for modification C:\windows\SysWOW64\APQXEJ.exe SCEITKE.exe File created C:\windows\SysWOW64\KMLAIIK.exe JJH.exe File opened for modification C:\windows\SysWOW64\OHE.exe DPBMGNH.exe File created C:\windows\SysWOW64\RIWVB.exe SYLFSM.exe File created C:\windows\SysWOW64\VHBJNFZ.exe.bat QBJUWK.exe File created C:\windows\SysWOW64\LGBL.exe.bat UFZGDG.exe File created C:\windows\SysWOW64\QDPLDZI.exe.bat VHKBA.exe File opened for modification C:\windows\SysWOW64\PBEYF.exe UOZ.exe File opened for modification C:\windows\SysWOW64\SVYTB.exe OKAY.exe File opened for modification C:\windows\SysWOW64\KUC.exe PHXXTOD.exe File created C:\windows\SysWOW64\FYXA.exe HCYSZH.exe File opened for modification C:\windows\SysWOW64\XAZK.exe FXVOTSY.exe File created C:\windows\SysWOW64\XAZK.exe.bat FXVOTSY.exe File created C:\windows\SysWOW64\GPS.exe PGQMGIL.exe File opened for modification C:\windows\SysWOW64\CWOGS.exe CROR.exe File created C:\windows\SysWOW64\TKYYHYB.exe CWOGS.exe File created C:\windows\SysWOW64\AZQK.exe SUDD.exe File created C:\windows\SysWOW64\SVYTB.exe OKAY.exe File created C:\windows\SysWOW64\APQXEJ.exe SCEITKE.exe File created C:\windows\SysWOW64\YUPPN.exe.bat EHLF.exe File created C:\windows\SysWOW64\LGBL.exe UFZGDG.exe File created C:\windows\SysWOW64\LGXJRBE.exe.bat QDPLDZI.exe File opened for modification C:\windows\SysWOW64\CWWQQEI.exe PLNRCTN.exe File opened for modification C:\windows\SysWOW64\KHLBWEN.exe SEHYQO.exe File opened for modification C:\windows\SysWOW64\YAQDPM.exe YUPPN.exe File created C:\windows\SysWOW64\CROR.exe WQGEZNJ.exe File created C:\windows\SysWOW64\WAM.exe ZVGYAV.exe File opened for modification C:\windows\SysWOW64\WAM.exe ZVGYAV.exe File opened for modification C:\windows\SysWOW64\WBZ.exe WOYSAYN.exe File created C:\windows\SysWOW64\DCAOXI.exe.bat BPVF.exe File opened for modification C:\windows\SysWOW64\LGBL.exe UFZGDG.exe File created C:\windows\SysWOW64\PGQMGIL.exe.bat JGIYX.exe File created C:\windows\SysWOW64\PBEYF.exe.bat UOZ.exe File created C:\windows\SysWOW64\WOYSAYN.exe.bat AQTVT.exe File created C:\windows\SysWOW64\WBZ.exe.bat WOYSAYN.exe File created C:\windows\SysWOW64\SUDD.exe.bat YOKS.exe File created C:\windows\SysWOW64\PGQMGIL.exe JGIYX.exe File created C:\windows\SysWOW64\RHVK.exe.bat GPS.exe File created C:\windows\SysWOW64\CROR.exe.bat WQGEZNJ.exe File created C:\windows\SysWOW64\TKYYHYB.exe.bat CWOGS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\OKAY.exe PUPD.exe File created C:\windows\system\YEWJAW.exe.bat OGQWTOL.exe File created C:\windows\OZGV.exe YEWJAW.exe File opened for modification C:\windows\system\OETUN.exe ZNSCHC.exe File created C:\windows\system\HCYSZH.exe.bat DMRS.exe File opened for modification C:\windows\UFZGDG.exe DQADZNZ.exe File created C:\windows\GZYB.exe.bat WZEOOEK.exe File created C:\windows\BCGGO.exe AZQK.exe File created C:\windows\system\OKAY.exe.bat PUPD.exe File created C:\windows\system\VMBYOSU.exe.bat VHBJNFZ.exe File opened for modification C:\windows\system\AMPHACA.exe KWOQ.exe File created C:\windows\system\UOZ.exe LGXJRBE.exe File created C:\windows\system\ZZJSM.exe PBEYF.exe File created C:\windows\system\DPQSYZR.exe.bat ZZJSM.exe File created C:\windows\QGA.exe FOT.exe File opened for modification C:\windows\RJMNXBH.exe QGA.exe File created C:\windows\system\YEWJAW.exe OGQWTOL.exe File opened for modification C:\windows\OZGV.exe YEWJAW.exe File opened for modification C:\windows\KNWJ.exe APQXEJ.exe File created C:\windows\ZNSCHC.exe MLK.exe File created C:\windows\system\JJH.exe.bat ABFRSMZ.exe File created C:\windows\FZQJ.exe.bat KMLAIIK.exe File created C:\windows\KNWJ.exe.bat APQXEJ.exe File created C:\windows\KGDUU.exe.bat ROOKC.exe File opened for modification C:\windows\system\GAJ.exe BABAH.exe File created C:\windows\YBLT.exe GAJ.exe File created C:\windows\system\RGGJ.exe.bat JQFKLA.exe File opened for modification C:\windows\CMY.exe NWXGG.exe File opened for modification C:\windows\OCLFS.exe DJINKY.exe File opened for modification C:\windows\system\OGQWTOL.exe MIDCLFC.exe File created C:\windows\MLK.exe KNWJ.exe File opened for modification C:\windows\KGDUU.exe ROOKC.exe File created C:\windows\system\JQFKLA.exe XAZK.exe File created C:\windows\XHOXBQM.exe RGGJ.exe File created C:\windows\system\ZPYAS.exe NXDH.exe File opened for modification C:\windows\PLNRCTN.exe LIPECA.exe File created C:\windows\UEY.exe.bat CWWQQEI.exe File opened for modification C:\windows\system\OKAY.exe PUPD.exe File created C:\windows\system\PHXXTOD.exe OETUN.exe File opened for modification C:\windows\system\JJH.exe ABFRSMZ.exe File opened for modification C:\windows\FZQJ.exe KMLAIIK.exe File created C:\windows\SYLFSM.exe OHE.exe File created C:\windows\EHLF.exe KGDUU.exe File created C:\windows\BPGG.exe.bat AMDKC.exe File created C:\windows\system\WQGEZNJ.exe.bat ZLAHSDP.exe File opened for modification C:\windows\ROOKC.exe RIWVB.exe File created C:\windows\system\QBJUWK.exe.bat ZQGE.exe File created C:\windows\VHKBA.exe.bat CMY.exe File created C:\windows\UEY.exe CWWQQEI.exe File opened for modification C:\windows\system\DJINKY.exe UEY.exe File created C:\windows\ZVGYAV.exe OCLFS.exe File created C:\windows\YOKS.exe 2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe File opened for modification C:\windows\MLK.exe KNWJ.exe File opened for modification C:\windows\SYLFSM.exe OHE.exe File created C:\windows\system\AMDKC.exe.bat GZYB.exe File created C:\windows\system\QVKUSAO.exe.bat NFEMO.exe File opened for modification C:\windows\SEHYQO.exe WBZ.exe File created C:\windows\YOKS.exe.bat 2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe File created C:\windows\FOT.exe GDIIAX.exe File created C:\windows\OZGV.exe.bat YEWJAW.exe File created C:\windows\system\DMRS.exe KUC.exe File created C:\windows\ZQGE.exe XDBVLEU.exe File created C:\windows\system\GAJ.exe BABAH.exe File opened for modification C:\windows\system\JQFKLA.exe XAZK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5556 cmd.exe 4628 cmd.exe 1388 cmd.exe 1088 cmd.exe 2344 cmd.exe 5416 cmd.exe 5640 cmd.exe 4880 cmd.exe 1952 cmd.exe 4576 cmd.exe 3108 cmd.exe 2564 cmd.exe 4516 cmd.exe 4836 cmd.exe 4824 cmd.exe 4596 cmd.exe 5240 cmd.exe 4168 cmd.exe 4728 cmd.exe 2804 cmd.exe 3436 cmd.exe 3168 cmd.exe 1612 cmd.exe 3900 cmd.exe 4588 cmd.exe 5460 cmd.exe 6112 cmd.exe 4116 cmd.exe 6068 cmd.exe 3080 cmd.exe 5636 cmd.exe 572 cmd.exe 2788 cmd.exe 1996 cmd.exe 3084 cmd.exe 5136 cmd.exe 5100 cmd.exe 5840 cmd.exe 3444 cmd.exe 5140 cmd.exe 2004 cmd.exe 5340 cmd.exe 6004 cmd.exe 4732 cmd.exe 4072 cmd.exe 2856 cmd.exe 4756 cmd.exe 1164 cmd.exe 5720 cmd.exe 2268 cmd.exe 5724 cmd.exe 3504 cmd.exe 1608 cmd.exe 3728 cmd.exe 2368 cmd.exe 1484 cmd.exe 1880 cmd.exe 2696 cmd.exe 1140 cmd.exe 4300 cmd.exe 3940 cmd.exe 2576 cmd.exe 4364 cmd.exe 2600 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1368 2296 WerFault.exe 87 4588 1936 WerFault.exe 93 2744 2716 WerFault.exe 99 5632 3244 WerFault.exe 104 2800 788 WerFault.exe 109 4328 1720 WerFault.exe 114 4120 3204 WerFault.exe 119 1372 2668 WerFault.exe 124 3884 1264 WerFault.exe 129 1248 4684 WerFault.exe 134 5540 3184 WerFault.exe 139 6136 1552 WerFault.exe 144 5044 2480 WerFault.exe 149 5960 2752 WerFault.exe 154 4296 256 WerFault.exe 159 2204 2920 WerFault.exe 164 720 2916 WerFault.exe 169 1152 5144 WerFault.exe 174 5780 1804 WerFault.exe 179 3080 2524 WerFault.exe 184 3884 5628 WerFault.exe 189 2380 3148 WerFault.exe 194 3348 3488 WerFault.exe 199 4456 3328 WerFault.exe 204 5560 5788 WerFault.exe 209 2372 4860 WerFault.exe 214 6116 1136 WerFault.exe 219 5048 264 WerFault.exe 224 1480 3672 WerFault.exe 229 2224 4536 WerFault.exe 234 5528 2356 WerFault.exe 239 2368 2560 WerFault.exe 244 2460 4212 WerFault.exe 249 4344 2076 WerFault.exe 254 4324 1760 WerFault.exe 259 6108 2516 WerFault.exe 264 5416 4128 WerFault.exe 269 5976 4872 WerFault.exe 274 848 4896 WerFault.exe 279 5012 5148 WerFault.exe 284 6092 2128 WerFault.exe 289 5776 3864 WerFault.exe 294 5876 1868 WerFault.exe 299 1304 4904 WerFault.exe 304 3752 4748 WerFault.exe 309 4928 3668 WerFault.exe 314 5416 2984 WerFault.exe 319 2940 3132 WerFault.exe 324 2544 1776 WerFault.exe 329 2792 2136 WerFault.exe 334 4852 6072 WerFault.exe 339 5860 1632 WerFault.exe 344 4880 5352 WerFault.exe 349 4708 6032 WerFault.exe 354 1640 3896 WerFault.exe 359 6096 4988 WerFault.exe 364 1420 2440 WerFault.exe 369 1124 4304 WerFault.exe 374 108 860 WerFault.exe 379 2792 5012 WerFault.exe 384 5172 920 WerFault.exe 389 3216 5780 WerFault.exe 393 4636 4572 WerFault.exe 399 3752 5728 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEWJAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGQWTOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHBJNFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABFRSMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXVOTSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQADZNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPBSEFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XHOXBQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQGEZNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMPHACA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHXXTOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCGB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDPLDZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLAHSDP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCYSZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIWVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZEOOEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBJUWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLNRCTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGIYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CROR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZQGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe 2296 2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe 1936 YOKS.exe 1936 YOKS.exe 2716 SUDD.exe 2716 SUDD.exe 3244 AZQK.exe 3244 AZQK.exe 788 BCGGO.exe 788 BCGGO.exe 1720 GDIIAX.exe 1720 GDIIAX.exe 3204 FOT.exe 3204 FOT.exe 2668 QGA.exe 2668 QGA.exe 1264 RJMNXBH.exe 1264 RJMNXBH.exe 4684 PUPD.exe 4684 PUPD.exe 3184 OKAY.exe 3184 OKAY.exe 1552 SVYTB.exe 1552 SVYTB.exe 2480 MIDCLFC.exe 2480 MIDCLFC.exe 2752 OGQWTOL.exe 2752 OGQWTOL.exe 256 YEWJAW.exe 256 YEWJAW.exe 2920 OZGV.exe 2920 OZGV.exe 2916 SCEITKE.exe 2916 SCEITKE.exe 5144 APQXEJ.exe 5144 APQXEJ.exe 1804 KNWJ.exe 1804 KNWJ.exe 2524 MLK.exe 2524 MLK.exe 5628 ZNSCHC.exe 5628 ZNSCHC.exe 3148 OETUN.exe 3148 OETUN.exe 3488 PHXXTOD.exe 3488 PHXXTOD.exe 3328 KUC.exe 3328 KUC.exe 5788 DMRS.exe 5788 DMRS.exe 4860 HCYSZH.exe 4860 HCYSZH.exe 1136 FYXA.exe 1136 FYXA.exe 264 ABFRSMZ.exe 264 ABFRSMZ.exe 3672 JJH.exe 3672 JJH.exe 4536 KMLAIIK.exe 4536 KMLAIIK.exe 2356 FZQJ.exe 2356 FZQJ.exe 2560 DPBMGNH.exe 2560 DPBMGNH.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2296 2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe 2296 2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe 1936 YOKS.exe 1936 YOKS.exe 2716 SUDD.exe 2716 SUDD.exe 3244 AZQK.exe 3244 AZQK.exe 788 BCGGO.exe 788 BCGGO.exe 1720 GDIIAX.exe 1720 GDIIAX.exe 3204 FOT.exe 3204 FOT.exe 2668 QGA.exe 2668 QGA.exe 1264 RJMNXBH.exe 1264 RJMNXBH.exe 4684 PUPD.exe 4684 PUPD.exe 3184 OKAY.exe 3184 OKAY.exe 1552 SVYTB.exe 1552 SVYTB.exe 2480 MIDCLFC.exe 2480 MIDCLFC.exe 2752 OGQWTOL.exe 2752 OGQWTOL.exe 256 YEWJAW.exe 256 YEWJAW.exe 2920 OZGV.exe 2920 OZGV.exe 2916 SCEITKE.exe 2916 SCEITKE.exe 5144 APQXEJ.exe 5144 APQXEJ.exe 1804 KNWJ.exe 1804 KNWJ.exe 2524 MLK.exe 2524 MLK.exe 5628 ZNSCHC.exe 5628 ZNSCHC.exe 3148 OETUN.exe 3148 OETUN.exe 3488 PHXXTOD.exe 3488 PHXXTOD.exe 3328 KUC.exe 3328 KUC.exe 5788 DMRS.exe 5788 DMRS.exe 4860 HCYSZH.exe 4860 HCYSZH.exe 1136 FYXA.exe 1136 FYXA.exe 264 ABFRSMZ.exe 264 ABFRSMZ.exe 3672 JJH.exe 3672 JJH.exe 4536 KMLAIIK.exe 4536 KMLAIIK.exe 2356 FZQJ.exe 2356 FZQJ.exe 2560 DPBMGNH.exe 2560 DPBMGNH.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 5556 2296 2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe 89 PID 5556 wrote to memory of 1936 5556 cmd.exe 93 PID 1936 wrote to memory of 4628 1936 YOKS.exe 95 PID 4628 wrote to memory of 2716 4628 cmd.exe 99 PID 2716 wrote to memory of 2400 2716 SUDD.exe 100 PID 2400 wrote to memory of 3244 2400 cmd.exe 104 PID 3244 wrote to memory of 2432 3244 AZQK.exe 105 PID 2432 wrote to memory of 788 2432 cmd.exe 109 PID 788 wrote to memory of 2576 788 BCGGO.exe 110 PID 2576 wrote to memory of 1720 2576 cmd.exe 114 PID 1720 wrote to memory of 4396 1720 GDIIAX.exe 115 PID 4396 wrote to memory of 3204 4396 cmd.exe 119 PID 3204 wrote to memory of 5140 3204 FOT.exe 120 PID 5140 wrote to memory of 2668 5140 cmd.exe 124 PID 2668 wrote to memory of 5720 2668 QGA.exe 125 PID 5720 wrote to memory of 1264 5720 cmd.exe 129 PID 1264 wrote to memory of 2240 1264 RJMNXBH.exe 130 PID 2240 wrote to memory of 4684 2240 cmd.exe 134 PID 4684 wrote to memory of 5400 4684 PUPD.exe 135 PID 5400 wrote to memory of 3184 5400 cmd.exe 139 PID 3184 wrote to memory of 1780 3184 OKAY.exe 140 PID 1780 wrote to memory of 1552 1780 cmd.exe 144 PID 1552 wrote to memory of 4864 1552 SVYTB.exe 145 PID 4864 wrote to memory of 2480 4864 cmd.exe 149 PID 2480 wrote to memory of 2268 2480 MIDCLFC.exe 150 PID 2268 wrote to memory of 2752 2268 cmd.exe 154 PID 2752 wrote to memory of 4356 2752 OGQWTOL.exe 155 PID 4356 wrote to memory of 256 4356 cmd.exe 159 PID 256 wrote to memory of 5748 256 YEWJAW.exe 160 PID 5748 wrote to memory of 2920 5748 cmd.exe 164 PID 2920 wrote to memory of 52 2920 OZGV.exe 165 PID 52 wrote to memory of 2916 52 cmd.exe 169 PID 2916 wrote to memory of 4824 2916 SCEITKE.exe 170 PID 4824 wrote to memory of 5144 4824 cmd.exe 174 PID 5144 wrote to memory of 1484 5144 APQXEJ.exe 175 PID 1484 wrote to memory of 1804 1484 cmd.exe 179 PID 1804 wrote to memory of 1500 1804 KNWJ.exe 180 PID 1500 wrote to memory of 2524 1500 cmd.exe 184 PID 2524 wrote to memory of 1524 2524 MLK.exe 185 PID 1524 wrote to memory of 5628 1524 cmd.exe 189 PID 5628 wrote to memory of 4812 5628 ZNSCHC.exe 190 PID 4812 wrote to memory of 3148 4812 cmd.exe 194 PID 3148 wrote to memory of 4596 3148 OETUN.exe 195 PID 4596 wrote to memory of 3488 4596 cmd.exe 199 PID 3488 wrote to memory of 4364 3488 PHXXTOD.exe 200 PID 4364 wrote to memory of 3328 4364 cmd.exe 204 PID 3328 wrote to memory of 5696 3328 KUC.exe 205 PID 5696 wrote to memory of 5788 5696 cmd.exe 209 PID 5788 wrote to memory of 3088 5788 DMRS.exe 210 PID 3088 wrote to memory of 4860 3088 cmd.exe 214 PID 4860 wrote to memory of 4588 4860 HCYSZH.exe 215 PID 4588 wrote to memory of 1136 4588 cmd.exe 219 PID 1136 wrote to memory of 4204 1136 FYXA.exe 220 PID 4204 wrote to memory of 264 4204 cmd.exe 224 PID 264 wrote to memory of 5460 264 ABFRSMZ.exe 225 PID 5460 wrote to memory of 3672 5460 cmd.exe 229 PID 3672 wrote to memory of 4468 3672 JJH.exe 230 PID 4468 wrote to memory of 4536 4468 cmd.exe 234 PID 4536 wrote to memory of 5064 4536 KMLAIIK.exe 235 PID 5064 wrote to memory of 2356 5064 cmd.exe 239 PID 2356 wrote to memory of 2780 2356 FZQJ.exe 240 PID 2780 wrote to memory of 2560 2780 cmd.exe 244 PID 2560 wrote to memory of 3388 2560 DPBMGNH.exe 245 PID 3388 wrote to memory of 4212 3388 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_33af7847a982779c135a26b0ee19a287_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOKS.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\windows\YOKS.exeC:\windows\YOKS.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUDD.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\windows\SysWOW64\SUDD.exeC:\windows\system32\SUDD.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZQK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\SysWOW64\AZQK.exeC:\windows\system32\AZQK.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCGGO.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\BCGGO.exeC:\windows\BCGGO.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDIIAX.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\SysWOW64\GDIIAX.exeC:\windows\system32\GDIIAX.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOT.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\FOT.exeC:\windows\FOT.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGA.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\windows\QGA.exeC:\windows\QGA.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJMNXBH.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\windows\RJMNXBH.exeC:\windows\RJMNXBH.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PUPD.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\windows\system\PUPD.exeC:\windows\system\PUPD.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKAY.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\system\OKAY.exeC:\windows\system\OKAY.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVYTB.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\windows\SysWOW64\SVYTB.exeC:\windows\system32\SVYTB.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MIDCLFC.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\MIDCLFC.exeC:\windows\MIDCLFC.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGQWTOL.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\system\OGQWTOL.exeC:\windows\system\OGQWTOL.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YEWJAW.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\system\YEWJAW.exeC:\windows\system\YEWJAW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZGV.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\OZGV.exeC:\windows\OZGV.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCEITKE.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:52 -
C:\windows\SCEITKE.exeC:\windows\SCEITKE.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APQXEJ.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SysWOW64\APQXEJ.exeC:\windows\system32\APQXEJ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KNWJ.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\KNWJ.exeC:\windows\KNWJ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLK.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\MLK.exeC:\windows\MLK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNSCHC.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\windows\ZNSCHC.exeC:\windows\ZNSCHC.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OETUN.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\windows\system\OETUN.exeC:\windows\system\OETUN.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHXXTOD.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\system\PHXXTOD.exeC:\windows\system\PHXXTOD.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUC.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\windows\SysWOW64\KUC.exeC:\windows\system32\KUC.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMRS.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\windows\system\DMRS.exeC:\windows\system\DMRS.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HCYSZH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\windows\system\HCYSZH.exeC:\windows\system\HCYSZH.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYXA.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\SysWOW64\FYXA.exeC:\windows\system32\FYXA.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABFRSMZ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\SysWOW64\ABFRSMZ.exeC:\windows\system32\ABFRSMZ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJH.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\windows\system\JJH.exeC:\windows\system\JJH.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMLAIIK.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\SysWOW64\KMLAIIK.exeC:\windows\system32\KMLAIIK.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZQJ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\windows\FZQJ.exeC:\windows\FZQJ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPBMGNH.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\windows\SysWOW64\DPBMGNH.exeC:\windows\system32\DPBMGNH.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHE.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\SysWOW64\OHE.exeC:\windows\system32\OHE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SYLFSM.exe.bat" "66⤵
- Executes a command shell one-liner
PID:6112 -
C:\windows\SYLFSM.exeC:\windows\SYLFSM.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIWVB.exe.bat" "68⤵PID:4600
-
C:\windows\SysWOW64\RIWVB.exeC:\windows\system32\RIWVB.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROOKC.exe.bat" "70⤵PID:4056
-
C:\windows\ROOKC.exeC:\windows\ROOKC.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGDUU.exe.bat" "72⤵PID:3260
-
C:\windows\KGDUU.exeC:\windows\KGDUU.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHLF.exe.bat" "74⤵PID:3096
-
C:\windows\EHLF.exeC:\windows\EHLF.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YUPPN.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4116 -
C:\windows\SysWOW64\YUPPN.exeC:\windows\system32\YUPPN.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAQDPM.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5356 -
C:\windows\SysWOW64\YAQDPM.exeC:\windows\system32\YAQDPM.exe79⤵
- Executes dropped EXE
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NVZI.exe.bat" "80⤵PID:2944
-
C:\windows\system\NVZI.exeC:\windows\system\NVZI.exe81⤵
- Executes dropped EXE
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDBVLEU.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1388 -
C:\windows\XDBVLEU.exeC:\windows\XDBVLEU.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQGE.exe.bat" "84⤵
- Executes a command shell one-liner
PID:1088 -
C:\windows\ZQGE.exeC:\windows\ZQGE.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QBJUWK.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1952 -
C:\windows\system\QBJUWK.exeC:\windows\system\QBJUWK.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHBJNFZ.exe.bat" "88⤵PID:2460
-
C:\windows\SysWOW64\VHBJNFZ.exeC:\windows\system32\VHBJNFZ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMBYOSU.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4576 -
C:\windows\system\VMBYOSU.exeC:\windows\system\VMBYOSU.exe91⤵
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4964 -
C:\windows\BNJMF.exeC:\windows\BNJMF.exe93⤵
- Executes dropped EXE
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BABAH.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4316 -
C:\windows\BABAH.exeC:\windows\BABAH.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GAJ.exe.bat" "96⤵PID:5632
-
C:\windows\system\GAJ.exeC:\windows\system\GAJ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YBLT.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4728 -
C:\windows\YBLT.exeC:\windows\YBLT.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZEOOEK.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5964 -
C:\windows\SysWOW64\WZEOOEK.exeC:\windows\system32\WZEOOEK.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZYB.exe.bat" "102⤵PID:3288
-
C:\windows\GZYB.exeC:\windows\GZYB.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMDKC.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2344 -
C:\windows\system\AMDKC.exeC:\windows\system\AMDKC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BPGG.exe.bat" "106⤵PID:5740
-
C:\windows\BPGG.exeC:\windows\BPGG.exe107⤵
- Executes dropped EXE
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXVOTSY.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2600 -
C:\windows\system\FXVOTSY.exeC:\windows\system\FXVOTSY.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAZK.exe.bat" "110⤵
- Executes a command shell one-liner
PID:6068 -
C:\windows\SysWOW64\XAZK.exeC:\windows\system32\XAZK.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQFKLA.exe.bat" "112⤵PID:4928
-
C:\windows\system\JQFKLA.exeC:\windows\system\JQFKLA.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGGJ.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5416 -
C:\windows\system\RGGJ.exeC:\windows\system\RGGJ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHOXBQM.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:6120 -
C:\windows\XHOXBQM.exeC:\windows\XHOXBQM.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPVF.exe.bat" "118⤵PID:1128
-
C:\windows\SysWOW64\BPVF.exeC:\windows\system32\BPVF.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCAOXI.exe.bat" "120⤵PID:4480
-
C:\windows\SysWOW64\DCAOXI.exeC:\windows\system32\DCAOXI.exe121⤵
- Executes dropped EXE
PID:920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-