Analysis
- max time kernel
93s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 22:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe
- Size 208KB
- Sample260814-2sh4pacd89
- SHA256 2c5afd5f732358a9784858ef6bc936e91b98ed7b9144eaa61ab43de7afa5b49e
- MD5 e658a3c4227d57165dd3b479cf0b80f1
- SHA1 4739395b098e4cc5c0b307284a2b71bf676e66e6
- SHA512 39f2f842b9f804c727ba3d4fc7019214ce0ab9b3c1b8b3cf4154e1a6619edc27a050bda897ee3c4e9c373f5843e2bf2a49465de7e51c6167e173dd253876aa74
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcdL+LOff4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlc5+LO3kEj1
- TLSH T1DD247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4260 JBSNO.exe 3320 KZMWAK.exe 5728 GFY.exe 4204 GACVY.exe 4512 BNHFIXY.exe 1544 QDIEH.exe 2728 LYNORTC.exe 2580 GMRX.exe 5888 VHBJNFZ.exe 4812 BCAKRIP.exe 4100 IXKPC.exe 1360 ZFMU.exe 5300 BDROVJ.exe 4676 EQW.exe 1308 NRYKJG.exe 1136 CMHPUBA.exe 1424 SCIGB.exe 3844 WSX.exe 2576 QFUYX.exe 2972 GVD.exe 3944 VQMBPP.exe 4592 XOSWW.exe 5380 RJXFGXM.exe 4444 OHDCNHO.exe 1976 JUHM.exe 5684 HNYB.exe 1080 ELQR.exe 4648 YGVAYW.exe 2784 KYQTY.exe 3172 QZX.exe 5268 KMCQ.exe 4572 VFFJZN.exe 4700 HXICIUS.exe 5212 YXC.exe 4908 FAUTWM.exe 6124 QTPEFUK.exe 1332 ITR.exe 992 OUYFZT.exe 3776 SKF.exe 4068 OHLCS.exe 6020 DNRZZ.exe 2376 OFMKIN.exe 1628 RTQBKMK.exe 4112 ABSG.exe 2744 UOXQYK.exe 4904 YWEQK.exe 1612 ZZITPSY.exe 5308 UNMD.exe 4480 DVOID.exe 2192 YGFGR.exe 5204 GWGYYV.exe 5116 SEMGKO.exe 2408 VUT.exe 3756 XKZAEG.exe 5788 FXZPFT.exe 3752 LYHC.exe 3348 XQKVX.exe 1052 AYQVJVA.exe 3432 EOXDV.exe 4524 EUXSX.exe 5676 AFFIL.exe 1204 JFHNOBO.exe 4392 NVOV.exe 364 EVQBE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\QZX.exe KYQTY.exe File created C:\windows\SysWOW64\VFFJZN.exe KMCQ.exe File opened for modification C:\windows\SysWOW64\ZZITPSY.exe YWEQK.exe File created C:\windows\SysWOW64\IUBP.exe.bat VKLR.exe File created C:\windows\SysWOW64\EOXDV.exe AYQVJVA.exe File opened for modification C:\windows\SysWOW64\YGVAYW.exe ELQR.exe File created C:\windows\SysWOW64\EOXDV.exe.bat AYQVJVA.exe File opened for modification C:\windows\SysWOW64\HXICIUS.exe VFFJZN.exe File created C:\windows\SysWOW64\SZLLN.exe ORE.exe File created C:\windows\SysWOW64\APJ.exe.bat CZYYB.exe File created C:\windows\SysWOW64\ZEO.exe.bat PGASE.exe File created C:\windows\SysWOW64\IUBP.exe VKLR.exe File created C:\windows\SysWOW64\ITR.exe QTPEFUK.exe File opened for modification C:\windows\SysWOW64\ITR.exe QTPEFUK.exe File opened for modification C:\windows\SysWOW64\APJ.exe CZYYB.exe File created C:\windows\SysWOW64\VQMBPP.exe.bat GVD.exe File created C:\windows\SysWOW64\ABSG.exe.bat RTQBKMK.exe File created C:\windows\SysWOW64\ESRD.exe.bat SAO.exe File created C:\windows\SysWOW64\YXC.exe.bat HXICIUS.exe File opened for modification C:\windows\SysWOW64\LYNORTC.exe QDIEH.exe File created C:\windows\SysWOW64\VQMBPP.exe GVD.exe File opened for modification C:\windows\SysWOW64\DVOID.exe UNMD.exe File opened for modification C:\windows\SysWOW64\BHLE.exe HUGUWWA.exe File opened for modification C:\windows\SysWOW64\ZEO.exe PGASE.exe File opened for modification C:\windows\SysWOW64\VQMBPP.exe GVD.exe File created C:\windows\SysWOW64\JUHM.exe.bat OHDCNHO.exe File created C:\windows\SysWOW64\FBH.exe.bat LOCHYO.exe File opened for modification C:\windows\SysWOW64\AXRRKM.exe OFWGK.exe File created C:\windows\SysWOW64\ZEO.exe PGASE.exe File created C:\windows\SysWOW64\NVOV.exe JFHNOBO.exe File opened for modification C:\windows\SysWOW64\ELQR.exe HNYB.exe File created C:\windows\SysWOW64\YGVAYW.exe.bat ELQR.exe File opened for modification C:\windows\SysWOW64\KMCQ.exe QZX.exe File created C:\windows\SysWOW64\ABSG.exe RTQBKMK.exe File created C:\windows\SysWOW64\SEMGKO.exe GWGYYV.exe File created C:\windows\SysWOW64\RHTHWO.exe.bat CRSPY.exe File created C:\windows\SysWOW64\ESRD.exe SAO.exe File created C:\windows\SysWOW64\AXRRKM.exe OFWGK.exe File created C:\windows\SysWOW64\BDROVJ.exe ZFMU.exe File created C:\windows\SysWOW64\BDROVJ.exe.bat ZFMU.exe File created C:\windows\SysWOW64\WSX.exe.bat SCIGB.exe File created C:\windows\SysWOW64\KMCQ.exe.bat QZX.exe File opened for modification C:\windows\SysWOW64\FBH.exe LOCHYO.exe File created C:\windows\SysWOW64\YGVAYW.exe ELQR.exe File opened for modification C:\windows\SysWOW64\ABSG.exe RTQBKMK.exe File opened for modification C:\windows\SysWOW64\EIDT.exe YIVFPH.exe File opened for modification C:\windows\SysWOW64\XLCPEB.exe IUBP.exe File created C:\windows\SysWOW64\KZMWAK.exe JBSNO.exe File created C:\windows\SysWOW64\ZFMU.exe.bat IXKPC.exe File opened for modification C:\windows\SysWOW64\WSX.exe SCIGB.exe File opened for modification C:\windows\SysWOW64\RHTHWO.exe CRSPY.exe File created C:\windows\SysWOW64\KZMWAK.exe.bat JBSNO.exe File created C:\windows\SysWOW64\ELQR.exe.bat HNYB.exe File created C:\windows\SysWOW64\QZX.exe.bat KYQTY.exe File opened for modification C:\windows\SysWOW64\YXC.exe HXICIUS.exe File created C:\windows\SysWOW64\JUHM.exe OHDCNHO.exe File created C:\windows\SysWOW64\ITR.exe.bat QTPEFUK.exe File created C:\windows\SysWOW64\AXRRKM.exe.bat OFWGK.exe File created C:\windows\SysWOW64\ELQR.exe HNYB.exe File opened for modification C:\windows\SysWOW64\VFFJZN.exe KMCQ.exe File created C:\windows\SysWOW64\YXC.exe HXICIUS.exe File created C:\windows\SysWOW64\KMCQ.exe QZX.exe File created C:\windows\SysWOW64\BHLE.exe HUGUWWA.exe File created C:\windows\SysWOW64\VHBJNFZ.exe GMRX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\XQKVX.exe LYHC.exe File created C:\windows\FNUTP.exe KSPKFLY.exe File opened for modification C:\windows\URLV.exe ZEO.exe File created C:\windows\QDIEH.exe.bat BNHFIXY.exe File opened for modification C:\windows\system\SAO.exe MZGWP.exe File opened for modification C:\windows\system\KYQTY.exe YGVAYW.exe File created C:\windows\TQZ.exe EVQBE.exe File created C:\windows\MWJLFGV.exe EIJXDB.exe File opened for modification C:\windows\HET.exe QDRKO.exe File opened for modification C:\windows\NRYKJG.exe EQW.exe File created C:\windows\system\KYQTY.exe YGVAYW.exe File created C:\windows\system\TZHCLZ.exe.bat FBH.exe File created C:\windows\ZHAYL.exe NOFF.exe File created C:\windows\GWGYYV.exe YGFGR.exe File opened for modification C:\windows\QDRKO.exe TYMNG.exe File created C:\windows\system\SAO.exe MZGWP.exe File created C:\windows\system\SAO.exe.bat MZGWP.exe File opened for modification C:\windows\UNMD.exe ZZITPSY.exe File created C:\windows\MWJLFGV.exe.bat EIJXDB.exe File opened for modification C:\windows\system\QFUYX.exe WSX.exe File created C:\windows\system\KYQTY.exe.bat YGVAYW.exe File created C:\windows\system\LYHC.exe.bat FXZPFT.exe File created C:\windows\system\ORE.exe.bat FJCY.exe File created C:\windows\HUU.exe SZLLN.exe File created C:\windows\system\HXFQQU.exe DRN.exe File created C:\windows\system\YIVFPH.exe HXFQQU.exe File opened for modification C:\windows\system\TZHCLZ.exe FBH.exe File created C:\windows\EUXSX.exe.bat EOXDV.exe File opened for modification C:\windows\OHDCNHO.exe RJXFGXM.exe File created C:\windows\system\KSPKFLY.exe ESIWWR.exe File opened for modification C:\windows\EODAZH.exe JTZR.exe File created C:\windows\system\OFWGK.exe.bat LXP.exe File opened for modification C:\windows\system\YGFGR.exe DVOID.exe File created C:\windows\EDEISV.exe.bat IXYTL.exe File opened for modification C:\windows\MWJLFGV.exe EIJXDB.exe File created C:\windows\system\TZHCLZ.exe FBH.exe File created C:\windows\XWTAP.exe CJO.exe File created C:\windows\system\LQU.exe.bat AXRRKM.exe File opened for modification C:\windows\system\AYQVJVA.exe XQKVX.exe File created C:\windows\FNUTP.exe.bat KSPKFLY.exe File created C:\windows\CJO.exe HVJHCO.exe File opened for modification C:\windows\JFHNOBO.exe AFFIL.exe File created C:\windows\system\OFWGK.exe LXP.exe File opened for modification C:\windows\VKLR.exe LMFECUC.exe File created C:\windows\VKLR.exe.bat LMFECUC.exe File opened for modification C:\windows\XWTAP.exe CJO.exe File created C:\windows\XWTAP.exe.bat CJO.exe File created C:\windows\VKLR.exe LMFECUC.exe File opened for modification C:\windows\system\JBSNO.exe 2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe File created C:\windows\GMRX.exe LYNORTC.exe File created C:\windows\system\YGFGR.exe.bat DVOID.exe File opened for modification C:\windows\system\SKF.exe OUYFZT.exe File opened for modification C:\windows\system\PHB.exe RHTHWO.exe File created C:\windows\system\MZGWP.exe.bat BHLE.exe File created C:\windows\system\XOSWW.exe VQMBPP.exe File created C:\windows\XPNCX.exe.bat TZHCLZ.exe File opened for modification C:\windows\system\ZYYYXS.exe RTTSMUK.exe File created C:\windows\UOXQYK.exe.bat ABSG.exe File created C:\windows\JFHNOBO.exe.bat AFFIL.exe File created C:\windows\system\CRSPY.exe.bat MWJLFGV.exe File created C:\windows\system\KYKI.exe JVGMQ.exe File opened for modification C:\windows\LMFECUC.exe ZYYYXS.exe File created C:\windows\system\JBSNO.exe 2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe File opened for modification C:\windows\GMRX.exe LYNORTC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4884 cmd.exe 4840 cmd.exe 1968 cmd.exe 5772 cmd.exe 4328 cmd.exe 3608 cmd.exe 4216 cmd.exe 4324 cmd.exe 3632 cmd.exe 2636 cmd.exe 2432 cmd.exe 3896 cmd.exe 3332 cmd.exe 4300 cmd.exe 5504 cmd.exe 3076 cmd.exe 5492 cmd.exe 2512 cmd.exe 4320 cmd.exe 5488 cmd.exe 2656 cmd.exe 1252 cmd.exe 1292 cmd.exe 1624 cmd.exe 3884 cmd.exe 6076 cmd.exe 2668 cmd.exe 2520 cmd.exe 4632 cmd.exe 5960 cmd.exe 5056 cmd.exe 3916 cmd.exe 3184 cmd.exe 4428 cmd.exe 5656 cmd.exe 5760 cmd.exe 1240 cmd.exe 4788 cmd.exe 2504 cmd.exe 1248 cmd.exe 6036 cmd.exe 244 cmd.exe 2996 cmd.exe 5028 cmd.exe 1200 cmd.exe 5136 cmd.exe 5976 cmd.exe 1816 cmd.exe 4456 cmd.exe 4596 cmd.exe 1100 cmd.exe 2180 cmd.exe 6024 cmd.exe 4752 cmd.exe 1284 cmd.exe 5876 cmd.exe 1560 cmd.exe 4316 cmd.exe 6032 cmd.exe 3788 cmd.exe 820 cmd.exe 2640 cmd.exe 4736 cmd.exe 3344 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4832 2496 WerFault.exe 87 2560 4260 WerFault.exe 93 264 3320 WerFault.exe 99 4688 5728 WerFault.exe 104 1136 4204 WerFault.exe 109 3864 4512 WerFault.exe 114 3260 1544 WerFault.exe 119 4728 2728 WerFault.exe 124 3796 2580 WerFault.exe 129 960 5888 WerFault.exe 134 3876 4812 WerFault.exe 139 1916 4100 WerFault.exe 144 3948 1360 WerFault.exe 149 4908 5300 WerFault.exe 154 5748 4676 WerFault.exe 159 2732 1308 WerFault.exe 164 992 1136 WerFault.exe 169 3260 1424 WerFault.exe 174 1840 3844 WerFault.exe 179 6020 2576 WerFault.exe 184 4884 2972 WerFault.exe 189 2964 3944 WerFault.exe 194 5588 4592 WerFault.exe 199 2516 5380 WerFault.exe 204 5796 4444 WerFault.exe 209 1208 1976 WerFault.exe 214 1716 5684 WerFault.exe 219 2644 1080 WerFault.exe 224 1512 4648 WerFault.exe 229 5564 2784 WerFault.exe 234 708 3172 WerFault.exe 239 3140 5268 WerFault.exe 244 4392 4572 WerFault.exe 249 4200 4700 WerFault.exe 254 4280 5212 WerFault.exe 259 3592 4908 WerFault.exe 264 1392 6124 WerFault.exe 269 5952 1332 WerFault.exe 274 4848 992 WerFault.exe 279 2996 3776 WerFault.exe 284 5624 4068 WerFault.exe 289 4880 6020 WerFault.exe 294 3184 2376 WerFault.exe 299 3948 1628 WerFault.exe 304 4832 4112 WerFault.exe 309 1492 2744 WerFault.exe 314 3020 4904 WerFault.exe 319 2492 1612 WerFault.exe 324 3300 5308 WerFault.exe 329 4324 4480 WerFault.exe 334 728 2192 WerFault.exe 339 944 5204 WerFault.exe 344 3304 5116 WerFault.exe 349 2072 2408 WerFault.exe 354 1108 3756 WerFault.exe 359 6056 5788 WerFault.exe 364 1736 3752 WerFault.exe 369 6096 3348 WerFault.exe 374 2064 1052 WerFault.exe 379 5564 3432 WerFault.exe 384 3612 4524 WerFault.exe 389 4532 5676 WerFault.exe 394 5412 1204 WerFault.exe 399 4236 4392 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZHCLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRYKJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HNYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTQBKMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFUYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOSWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWGYYV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQKVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSPKFLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOXDV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZLLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDRKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MZGWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYQTY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFMKIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYQVJVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRSPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFFIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EIJXDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GACVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXICIUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEMGKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HET.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2496 2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe 2496 2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe 4260 JBSNO.exe 4260 JBSNO.exe 3320 KZMWAK.exe 3320 KZMWAK.exe 5728 GFY.exe 5728 GFY.exe 4204 GACVY.exe 4204 GACVY.exe 4512 BNHFIXY.exe 4512 BNHFIXY.exe 1544 QDIEH.exe 1544 QDIEH.exe 2728 LYNORTC.exe 2728 LYNORTC.exe 2580 GMRX.exe 2580 GMRX.exe 5888 VHBJNFZ.exe 5888 VHBJNFZ.exe 4812 BCAKRIP.exe 4812 BCAKRIP.exe 4100 IXKPC.exe 4100 IXKPC.exe 1360 ZFMU.exe 1360 ZFMU.exe 5300 BDROVJ.exe 5300 BDROVJ.exe 4676 EQW.exe 4676 EQW.exe 1308 NRYKJG.exe 1308 NRYKJG.exe 1136 CMHPUBA.exe 1136 CMHPUBA.exe 1424 SCIGB.exe 1424 SCIGB.exe 3844 WSX.exe 3844 WSX.exe 2576 QFUYX.exe 2576 QFUYX.exe 2972 GVD.exe 2972 GVD.exe 3944 VQMBPP.exe 3944 VQMBPP.exe 4592 XOSWW.exe 4592 XOSWW.exe 5380 RJXFGXM.exe 5380 RJXFGXM.exe 4444 OHDCNHO.exe 4444 OHDCNHO.exe 1976 JUHM.exe 1976 JUHM.exe 5684 HNYB.exe 5684 HNYB.exe 1080 ELQR.exe 1080 ELQR.exe 4648 YGVAYW.exe 4648 YGVAYW.exe 2784 KYQTY.exe 2784 KYQTY.exe 3172 QZX.exe 3172 QZX.exe 5268 KMCQ.exe 5268 KMCQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2496 2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe 2496 2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe 4260 JBSNO.exe 4260 JBSNO.exe 3320 KZMWAK.exe 3320 KZMWAK.exe 5728 GFY.exe 5728 GFY.exe 4204 GACVY.exe 4204 GACVY.exe 4512 BNHFIXY.exe 4512 BNHFIXY.exe 1544 QDIEH.exe 1544 QDIEH.exe 2728 LYNORTC.exe 2728 LYNORTC.exe 2580 GMRX.exe 2580 GMRX.exe 5888 VHBJNFZ.exe 5888 VHBJNFZ.exe 4812 BCAKRIP.exe 4812 BCAKRIP.exe 4100 IXKPC.exe 4100 IXKPC.exe 1360 ZFMU.exe 1360 ZFMU.exe 5300 BDROVJ.exe 5300 BDROVJ.exe 4676 EQW.exe 4676 EQW.exe 1308 NRYKJG.exe 1308 NRYKJG.exe 1136 CMHPUBA.exe 1136 CMHPUBA.exe 1424 SCIGB.exe 1424 SCIGB.exe 3844 WSX.exe 3844 WSX.exe 2576 QFUYX.exe 2576 QFUYX.exe 2972 GVD.exe 2972 GVD.exe 3944 VQMBPP.exe 3944 VQMBPP.exe 4592 XOSWW.exe 4592 XOSWW.exe 5380 RJXFGXM.exe 5380 RJXFGXM.exe 4444 OHDCNHO.exe 4444 OHDCNHO.exe 1976 JUHM.exe 1976 JUHM.exe 5684 HNYB.exe 5684 HNYB.exe 1080 ELQR.exe 1080 ELQR.exe 4648 YGVAYW.exe 4648 YGVAYW.exe 2784 KYQTY.exe 2784 KYQTY.exe 3172 QZX.exe 3172 QZX.exe 5268 KMCQ.exe 5268 KMCQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 636 2496 2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe 89 PID 636 wrote to memory of 4260 636 cmd.exe 93 PID 4260 wrote to memory of 4488 4260 JBSNO.exe 95 PID 4488 wrote to memory of 3320 4488 cmd.exe 99 PID 3320 wrote to memory of 4780 3320 KZMWAK.exe 100 PID 4780 wrote to memory of 5728 4780 cmd.exe 104 PID 5728 wrote to memory of 5772 5728 GFY.exe 105 PID 5772 wrote to memory of 4204 5772 cmd.exe 109 PID 4204 wrote to memory of 4528 4204 GACVY.exe 110 PID 4528 wrote to memory of 4512 4528 cmd.exe 114 PID 4512 wrote to memory of 1684 4512 BNHFIXY.exe 115 PID 1684 wrote to memory of 1544 1684 cmd.exe 119 PID 1544 wrote to memory of 4448 1544 QDIEH.exe 120 PID 4448 wrote to memory of 2728 4448 cmd.exe 124 PID 2728 wrote to memory of 3888 2728 LYNORTC.exe 125 PID 3888 wrote to memory of 2580 3888 cmd.exe 129 PID 2580 wrote to memory of 3748 2580 GMRX.exe 130 PID 3748 wrote to memory of 5888 3748 cmd.exe 134 PID 5888 wrote to memory of 1560 5888 VHBJNFZ.exe 135 PID 1560 wrote to memory of 4812 1560 cmd.exe 139 PID 4812 wrote to memory of 2804 4812 BCAKRIP.exe 140 PID 2804 wrote to memory of 4100 2804 cmd.exe 144 PID 4100 wrote to memory of 3920 4100 IXKPC.exe 145 PID 3920 wrote to memory of 1360 3920 cmd.exe 149 PID 1360 wrote to memory of 4316 1360 ZFMU.exe 150 PID 4316 wrote to memory of 5300 4316 cmd.exe 154 PID 5300 wrote to memory of 236 5300 BDROVJ.exe 155 PID 236 wrote to memory of 4676 236 cmd.exe 159 PID 4676 wrote to memory of 3848 4676 EQW.exe 160 PID 3848 wrote to memory of 1308 3848 cmd.exe 164 PID 1308 wrote to memory of 1832 1308 NRYKJG.exe 165 PID 1832 wrote to memory of 1136 1832 cmd.exe 169 PID 1136 wrote to memory of 2212 1136 CMHPUBA.exe 170 PID 2212 wrote to memory of 1424 2212 cmd.exe 174 PID 1424 wrote to memory of 680 1424 SCIGB.exe 175 PID 680 wrote to memory of 3844 680 cmd.exe 179 PID 3844 wrote to memory of 3408 3844 WSX.exe 180 PID 3408 wrote to memory of 2576 3408 cmd.exe 184 PID 2576 wrote to memory of 3796 2576 QFUYX.exe 185 PID 3796 wrote to memory of 2972 3796 cmd.exe 189 PID 2972 wrote to memory of 4300 2972 GVD.exe 190 PID 4300 wrote to memory of 3944 4300 cmd.exe 194 PID 3944 wrote to memory of 4276 3944 VQMBPP.exe 195 PID 4276 wrote to memory of 4592 4276 cmd.exe 199 PID 4592 wrote to memory of 2956 4592 XOSWW.exe 200 PID 2956 wrote to memory of 5380 2956 cmd.exe 204 PID 5380 wrote to memory of 352 5380 RJXFGXM.exe 205 PID 352 wrote to memory of 4444 352 cmd.exe 209 PID 4444 wrote to memory of 1252 4444 OHDCNHO.exe 210 PID 1252 wrote to memory of 1976 1252 cmd.exe 214 PID 1976 wrote to memory of 4328 1976 JUHM.exe 215 PID 4328 wrote to memory of 5684 4328 cmd.exe 219 PID 5684 wrote to memory of 4928 5684 HNYB.exe 220 PID 4928 wrote to memory of 1080 4928 cmd.exe 224 PID 1080 wrote to memory of 1776 1080 ELQR.exe 225 PID 1776 wrote to memory of 4648 1776 cmd.exe 229 PID 4648 wrote to memory of 2664 4648 YGVAYW.exe 230 PID 2664 wrote to memory of 2784 2664 cmd.exe 234 PID 2784 wrote to memory of 1748 2784 KYQTY.exe 235 PID 1748 wrote to memory of 3172 1748 cmd.exe 239 PID 3172 wrote to memory of 6008 3172 QZX.exe 240 PID 6008 wrote to memory of 5268 6008 cmd.exe 244 PID 5268 wrote to memory of 5504 5268 KMCQ.exe 245 PID 5504 wrote to memory of 4572 5504 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e658a3c4227d57165dd3b479cf0b80f1_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBSNO.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\windows\system\JBSNO.exeC:\windows\system\JBSNO.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZMWAK.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\windows\SysWOW64\KZMWAK.exeC:\windows\system32\KZMWAK.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFY.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\system\GFY.exeC:\windows\system\GFY.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GACVY.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\system\GACVY.exeC:\windows\system\GACVY.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNHFIXY.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\BNHFIXY.exeC:\windows\BNHFIXY.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QDIEH.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\windows\QDIEH.exeC:\windows\QDIEH.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LYNORTC.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\windows\SysWOW64\LYNORTC.exeC:\windows\system32\LYNORTC.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMRX.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\windows\GMRX.exeC:\windows\GMRX.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VHBJNFZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\windows\SysWOW64\VHBJNFZ.exeC:\windows\system32\VHBJNFZ.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCAKRIP.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\windows\BCAKRIP.exeC:\windows\BCAKRIP.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXKPC.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\system\IXKPC.exeC:\windows\system\IXKPC.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFMU.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\windows\SysWOW64\ZFMU.exeC:\windows\system32\ZFMU.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDROVJ.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\SysWOW64\BDROVJ.exeC:\windows\system32\BDROVJ.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQW.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\EQW.exeC:\windows\EQW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NRYKJG.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\windows\NRYKJG.exeC:\windows\NRYKJG.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMHPUBA.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\windows\system\CMHPUBA.exeC:\windows\system\CMHPUBA.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SCIGB.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\windows\SysWOW64\SCIGB.exeC:\windows\system32\SCIGB.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFUYX.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\system\QFUYX.exeC:\windows\system\QFUYX.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVD.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\windows\GVD.exeC:\windows\GVD.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQMBPP.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\SysWOW64\VQMBPP.exeC:\windows\system32\VQMBPP.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOSWW.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\system\XOSWW.exeC:\windows\system\XOSWW.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJXFGXM.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\windows\RJXFGXM.exeC:\windows\RJXFGXM.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHDCNHO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:352 -
C:\windows\OHDCNHO.exeC:\windows\OHDCNHO.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUHM.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\SysWOW64\JUHM.exeC:\windows\system32\JUHM.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNYB.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\HNYB.exeC:\windows\HNYB.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELQR.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\windows\SysWOW64\ELQR.exeC:\windows\system32\ELQR.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGVAYW.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\windows\SysWOW64\YGVAYW.exeC:\windows\system32\YGVAYW.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYQTY.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\windows\system\KYQTY.exeC:\windows\system\KYQTY.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZX.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\SysWOW64\QZX.exeC:\windows\system32\QZX.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMCQ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\SysWOW64\KMCQ.exeC:\windows\system32\KMCQ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFFJZN.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\windows\SysWOW64\VFFJZN.exeC:\windows\system32\VFFJZN.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5960 -
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXC.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3264 -
C:\windows\SysWOW64\YXC.exeC:\windows\system32\YXC.exe69⤵
- Executes dropped EXE
PID:5212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "70⤵PID:3912
-
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe71⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTPEFUK.exe.bat" "72⤵PID:5784
-
C:\windows\system\QTPEFUK.exeC:\windows\system\QTPEFUK.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ITR.exe.bat" "74⤵PID:5316
-
C:\windows\SysWOW64\ITR.exeC:\windows\system32\ITR.exe75⤵
- Executes dropped EXE
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUYFZT.exe.bat" "76⤵PID:600
-
C:\windows\system\OUYFZT.exeC:\windows\system\OUYFZT.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKF.exe.bat" "78⤵PID:2968
-
C:\windows\system\SKF.exeC:\windows\system\SKF.exe79⤵
- Executes dropped EXE
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLCS.exe.bat" "80⤵PID:2892
-
C:\windows\OHLCS.exeC:\windows\OHLCS.exe81⤵
- Executes dropped EXE
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNRZZ.exe.bat" "82⤵
- Executes a command shell one-liner
PID:6032 -
C:\windows\DNRZZ.exeC:\windows\DNRZZ.exe83⤵
- Executes dropped EXE
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OFMKIN.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1064 -
C:\windows\system\OFMKIN.exeC:\windows\system\OFMKIN.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTQBKMK.exe.bat" "86⤵
- Executes a command shell one-liner
PID:3788 -
C:\windows\RTQBKMK.exeC:\windows\RTQBKMK.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABSG.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4596 -
C:\windows\SysWOW64\ABSG.exeC:\windows\system32\ABSG.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UOXQYK.exe.bat" "90⤵PID:444
-
C:\windows\UOXQYK.exeC:\windows\UOXQYK.exe91⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWEQK.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5056 -
C:\windows\SysWOW64\YWEQK.exeC:\windows\system32\YWEQK.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZZITPSY.exe.bat" "94⤵PID:3904
-
C:\windows\SysWOW64\ZZITPSY.exeC:\windows\system32\ZZITPSY.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNMD.exe.bat" "96⤵PID:5552
-
C:\windows\UNMD.exeC:\windows\UNMD.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DVOID.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2432 -
C:\windows\SysWOW64\DVOID.exeC:\windows\system32\DVOID.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YGFGR.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1996 -
C:\windows\system\YGFGR.exeC:\windows\system\YGFGR.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWGYYV.exe.bat" "102⤵
- Executes a command shell one-liner
PID:3608 -
C:\windows\GWGYYV.exeC:\windows\GWGYYV.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEMGKO.exe.bat" "104⤵PID:4824
-
C:\windows\SysWOW64\SEMGKO.exeC:\windows\system32\SEMGKO.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUT.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5388 -
C:\windows\VUT.exeC:\windows\VUT.exe107⤵
- Executes dropped EXE
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XKZAEG.exe.bat" "108⤵PID:4616
-
C:\windows\XKZAEG.exeC:\windows\XKZAEG.exe109⤵
- Executes dropped EXE
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXZPFT.exe.bat" "110⤵PID:4772
-
C:\windows\FXZPFT.exeC:\windows\FXZPFT.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYHC.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3076 -
C:\windows\system\LYHC.exeC:\windows\system\LYHC.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XQKVX.exe.bat" "114⤵PID:252
-
C:\windows\XQKVX.exeC:\windows\XQKVX.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYQVJVA.exe.bat" "116⤵PID:1716
-
C:\windows\system\AYQVJVA.exeC:\windows\system\AYQVJVA.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EOXDV.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3704 -
C:\windows\SysWOW64\EOXDV.exeC:\windows\system32\EOXDV.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUXSX.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1292 -
C:\windows\EUXSX.exeC:\windows\EUXSX.exe121⤵
- Executes dropped EXE
PID:4524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-