Analysis
- max time kernel
65s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 04:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_0f8c0d273a772ad907b202d0ff70dc0c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-15_0f8c0d273a772ad907b202d0ff70dc0c_elex_emotet_stop.exe
- Size 208KB
- Sample260815-ezxt4ayfja
- SHA256 90b23f00842266fa36a07fd039a20d0873ae005ef91eab48f1e7c2d2b8c5a53d
- MD5 0f8c0d273a772ad907b202d0ff70dc0c
- SHA1 00994c3cd5ddac2f58e0210fff1e9817dd8aff19
- SHA512 07fa88f134a7d1e072e95b20d9966ff91ebf2a85e088ac5c0df571d04e47bc21115eb2db4feea314b4b305379d1ba1f29a7f4142069074be4a472965686a83ba
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfV4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO9kEj1
- TLSH T10E247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5976 WICQBB.exe 5176 HLOC.exe 2692 LBVKBNH.exe 4772 THNQKSK.exe 4672 JCEDV.exe 2684 HXWEAQ.exe 8 TFKE.exe 3888 VDQ.exe 3804 MLSD.exe 3176 KLZZGII.exe 2384 WTGZ.exe 980 FCIEWGY.exe 4344 QUDXEN.exe 1932 FPUB.exe 1244 FVNPZ.exe 2900 AIRZBNG.exe 3376 PLBLU.exe 924 HMD.exe 3736 QMFV.exe 1836 FPOAUPT.exe 3328 JXDIY.exe 4704 MKARJH.exe 1228 MYAGKUH.exe 4572 RYIT.exe 3152 GWNQ.exe 2784 JRSASY.exe 1856 DEX.exe 3772 OXSC.exe 6124 JKXLNF.exe 3700 UDAEVVZ.exe 1008 PQFO.exe 3996 KLJXI.exe 2524 EZOGSUR.exe 3268 BEME.exe 2132 VRRNJW.exe 5636 BSZ.exe 2992 WFDKD.exe 3088 CADLHB.exe 3876 QYIIPLP.exe 4896 TTNR.exe 2696 RUVF.exe 2800 XUCTRHH.exe 1408 RHZ.exe 476 QSY.exe 1332 ZFISQY.exe 4224 AAM.exe 1528 EQSWIG.exe 3444 YEXFSGZ.exe 2680 RHBJYW.exe 3844 XCAKDZQ.exe 4144 SPFT.exe 3524 MDKDPY.exe 1388 BYT.exe 5692 YDZEP.exe 5972 ABSG.exe 3104 NEWFA.exe 1120 PHYUL.exe 5152 URCS.exe 5584 HUYZV.exe 260 LKSH.exe 5792 LVBA.exe 1420 NTCC.exe 4444 AWYB.exe 3036 PBEYF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\MLSD.exe.bat VDQ.exe File created C:\windows\SysWOW64\CYDRXYU.exe.bat GTX.exe File opened for modification C:\windows\SysWOW64\AIRZBNG.exe FVNPZ.exe File created C:\windows\SysWOW64\THNQKSK.exe.bat LBVKBNH.exe File opened for modification C:\windows\SysWOW64\JRSASY.exe GWNQ.exe File created C:\windows\SysWOW64\PBEYF.exe AWYB.exe File created C:\windows\SysWOW64\WOYSAYN.exe.bat NJOA.exe File created C:\windows\SysWOW64\MVERKZK.exe EKWYWVV.exe File opened for modification C:\windows\SysWOW64\CYDRXYU.exe GTX.exe File opened for modification C:\windows\SysWOW64\KJEK.exe CYDRXYU.exe File created C:\windows\SysWOW64\HXWEAQ.exe.bat JCEDV.exe File created C:\windows\SysWOW64\AIRZBNG.exe.bat FVNPZ.exe File created C:\windows\SysWOW64\BEME.exe EZOGSUR.exe File created C:\windows\SysWOW64\TTNR.exe.bat QYIIPLP.exe File created C:\windows\SysWOW64\ABSG.exe.bat YDZEP.exe File opened for modification C:\windows\SysWOW64\UDAEVVZ.exe JKXLNF.exe File created C:\windows\SysWOW64\TTNR.exe QYIIPLP.exe File opened for modification C:\windows\SysWOW64\TTNR.exe QYIIPLP.exe File created C:\windows\SysWOW64\EQSWIG.exe AAM.exe File created C:\windows\SysWOW64\PBEYF.exe.bat AWYB.exe File created C:\windows\SysWOW64\WOLBIXQ.exe NJBI.exe File created C:\windows\SysWOW64\WOLBIXQ.exe.bat NJBI.exe File created C:\windows\SysWOW64\THNQKSK.exe LBVKBNH.exe File created C:\windows\SysWOW64\FPUB.exe QUDXEN.exe File created C:\windows\SysWOW64\NJOA.exe LLV.exe File opened for modification C:\windows\SysWOW64\WOYSAYN.exe NJOA.exe File created C:\windows\SysWOW64\CYDRXYU.exe GTX.exe File created C:\windows\SysWOW64\KJEK.exe.bat CYDRXYU.exe File created C:\windows\SysWOW64\VDQ.exe TFKE.exe File opened for modification C:\windows\SysWOW64\FVNPZ.exe FPUB.exe File opened for modification C:\windows\SysWOW64\PQFO.exe UDAEVVZ.exe File opened for modification C:\windows\SysWOW64\BRY.exe ZTFW.exe File created C:\windows\SysWOW64\VDQ.exe.bat TFKE.exe File opened for modification C:\windows\SysWOW64\WTGZ.exe KLZZGII.exe File created C:\windows\SysWOW64\FPUB.exe.bat QUDXEN.exe File created C:\windows\SysWOW64\BRY.exe ZTFW.exe File created C:\windows\SysWOW64\BRY.exe.bat ZTFW.exe File created C:\windows\SysWOW64\WCDPJKL.exe.bat WOLBIXQ.exe File created C:\windows\SysWOW64\KJEK.exe CYDRXYU.exe File opened for modification C:\windows\SysWOW64\HXWEAQ.exe JCEDV.exe File created C:\windows\SysWOW64\AIRZBNG.exe FVNPZ.exe File created C:\windows\SysWOW64\PQFO.exe UDAEVVZ.exe File created C:\windows\SysWOW64\KLJXI.exe PQFO.exe File created C:\windows\SysWOW64\KLJXI.exe.bat PQFO.exe File created C:\windows\SysWOW64\EQSWIG.exe.bat AAM.exe File created C:\windows\SysWOW64\YEXFSGZ.exe.bat EQSWIG.exe File created C:\windows\SysWOW64\NEWFA.exe ABSG.exe File opened for modification C:\windows\SysWOW64\FPUB.exe QUDXEN.exe File created C:\windows\SysWOW64\NEWFA.exe.bat ABSG.exe File created C:\windows\SysWOW64\WCDPJKL.exe WOLBIXQ.exe File created C:\windows\SysWOW64\NJOA.exe.bat LLV.exe File opened for modification C:\windows\SysWOW64\MVERKZK.exe EKWYWVV.exe File opened for modification C:\windows\SysWOW64\KLZZGII.exe MLSD.exe File created C:\windows\SysWOW64\UDAEVVZ.exe JKXLNF.exe File created C:\windows\SysWOW64\UDAEVVZ.exe.bat JKXLNF.exe File created C:\windows\SysWOW64\WOYSAYN.exe NJOA.exe File created C:\windows\SysWOW64\MVERKZK.exe.bat EKWYWVV.exe File opened for modification C:\windows\SysWOW64\ABSG.exe YDZEP.exe File created C:\windows\SysWOW64\KLZZGII.exe MLSD.exe File created C:\windows\SysWOW64\KLZZGII.exe.bat MLSD.exe File created C:\windows\SysWOW64\JRSASY.exe GWNQ.exe File created C:\windows\SysWOW64\QYIIPLP.exe CADLHB.exe File created C:\windows\SysWOW64\ABSG.exe YDZEP.exe File opened for modification C:\windows\SysWOW64\WCDPJKL.exe WOLBIXQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\RHBJYW.exe YEXFSGZ.exe File opened for modification C:\windows\JKXLNF.exe OXSC.exe File created C:\windows\HLOC.exe.bat WICQBB.exe File opened for modification C:\windows\AAM.exe ZFISQY.exe File opened for modification C:\windows\SAJMQTN.exe WCDPJKL.exe File created C:\windows\system\PBYXL.exe.bat KZURGQ.exe File created C:\windows\system\FCIEWGY.exe.bat WTGZ.exe File created C:\windows\system\PLBLU.exe AIRZBNG.exe File created C:\windows\MYAGKUH.exe.bat MKARJH.exe File created C:\windows\WFDKD.exe BSZ.exe File opened for modification C:\windows\CADLHB.exe WFDKD.exe File opened for modification C:\windows\system\RUVF.exe TTNR.exe File created C:\windows\NTCC.exe.bat LVBA.exe File opened for modification C:\windows\system\TFKE.exe HXWEAQ.exe File created C:\windows\VRRNJW.exe BEME.exe File created C:\windows\QSY.exe RHZ.exe File created C:\windows\system\TFKE.exe HXWEAQ.exe File opened for modification C:\windows\system\EZOGSUR.exe KLJXI.exe File created C:\windows\CADLHB.exe WFDKD.exe File created C:\windows\system\PHYUL.exe.bat NEWFA.exe File opened for modification C:\windows\NTCC.exe LVBA.exe File opened for modification C:\windows\system\IAUPUU.exe CAM.exe File created C:\windows\system\PLBLU.exe.bat AIRZBNG.exe File opened for modification C:\windows\FPOAUPT.exe QMFV.exe File created C:\windows\system\MKARJH.exe JXDIY.exe File opened for modification C:\windows\system\MKARJH.exe JXDIY.exe File created C:\windows\system\PHYUL.exe NEWFA.exe File opened for modification C:\windows\system\PHYUL.exe NEWFA.exe File created C:\windows\system\IMHSBSY.exe LHCVMIW.exe File created C:\windows\HLOC.exe WICQBB.exe File created C:\windows\LBVKBNH.exe.bat HLOC.exe File opened for modification C:\windows\MYAGKUH.exe MKARJH.exe File created C:\windows\system\ZTFW.exe.bat IFUDVZ.exe File created C:\windows\SAJMQTN.exe.bat WCDPJKL.exe File opened for modification C:\windows\URCS.exe PHYUL.exe File opened for modification C:\windows\system\LLV.exe ASSF.exe File created C:\windows\system\JCEDV.exe THNQKSK.exe File created C:\windows\system\RUVF.exe TTNR.exe File created C:\windows\ZFISQY.exe QSY.exe File created C:\windows\NTCC.exe LVBA.exe File created C:\windows\CAM.exe.bat IMHSBSY.exe File opened for modification C:\windows\system\PBYXL.exe KZURGQ.exe File created C:\windows\WICQBB.exe.bat 2026-08-15_0f8c0d273a772ad907b202d0ff70dc0c_elex_emotet_stop.exe File opened for modification C:\windows\HLOC.exe WICQBB.exe File created C:\windows\system\QUDXEN.exe.bat FCIEWGY.exe File created C:\windows\system\OXSC.exe DEX.exe File created C:\windows\system\EZOGSUR.exe.bat KLJXI.exe File created C:\windows\WFDKD.exe.bat BSZ.exe File created C:\windows\XUCTRHH.exe.bat RUVF.exe File created C:\windows\RHZ.exe XUCTRHH.exe File created C:\windows\system\QUDXEN.exe FCIEWGY.exe File created C:\windows\BYT.exe.bat MDKDPY.exe File created C:\windows\LHCVMIW.exe PBEYF.exe File created C:\windows\NJBI.exe BRY.exe File opened for modification C:\windows\NJBI.exe BRY.exe File created C:\windows\SAJMQTN.exe WCDPJKL.exe File created C:\windows\ASSF.exe SAJMQTN.exe File created C:\windows\system\LLV.exe.bat ASSF.exe File opened for modification C:\windows\system\RYIT.exe MYAGKUH.exe File created C:\windows\YDZEP.exe BYT.exe File created C:\windows\ASSF.exe.bat SAJMQTN.exe File created C:\windows\system\PBYXL.exe KZURGQ.exe File created C:\windows\GTX.exe.bat MVERKZK.exe File opened for modification C:\windows\VRRNJW.exe BEME.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5156 cmd.exe 4260 cmd.exe 1068 cmd.exe 3440 cmd.exe 1084 cmd.exe 4856 cmd.exe 5488 cmd.exe 3424 cmd.exe 3688 cmd.exe 4292 cmd.exe 1860 cmd.exe 3360 cmd.exe 4784 cmd.exe 5428 cmd.exe 3016 cmd.exe 5952 cmd.exe 1712 cmd.exe 1944 cmd.exe 3576 cmd.exe 4568 cmd.exe 1832 cmd.exe 2948 cmd.exe 3076 cmd.exe 2856 cmd.exe 3492 cmd.exe 3624 cmd.exe 4632 cmd.exe 6048 cmd.exe 5160 cmd.exe 5716 cmd.exe 1352 cmd.exe 2708 cmd.exe 3920 cmd.exe 4860 cmd.exe 4536 cmd.exe 4984 cmd.exe 5184 cmd.exe 1380 cmd.exe 976 cmd.exe 2904 cmd.exe 1756 cmd.exe 5260 cmd.exe 2688 cmd.exe 1124 cmd.exe 4424 cmd.exe 1588 cmd.exe 5544 cmd.exe 1900 cmd.exe 5432 cmd.exe 3476 cmd.exe 1428 cmd.exe 5076 cmd.exe 3252 cmd.exe 4156 cmd.exe 6092 cmd.exe 5048 cmd.exe 6052 cmd.exe 248 cmd.exe 3580 cmd.exe 4388 cmd.exe 4116 cmd.exe 2868 cmd.exe 2468 cmd.exe 1464 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4780 3860 WerFault.exe 88 476 5976 WerFault.exe 94 5876 5176 WerFault.exe 100 4120 2692 WerFault.exe 105 4440 4772 WerFault.exe 110 5484 4672 WerFault.exe 115 3332 2684 WerFault.exe 120 3940 8 WerFault.exe 125 2680 3888 WerFault.exe 130 3512 3804 WerFault.exe 135 248 3176 WerFault.exe 140 2524 2384 WerFault.exe 145 5444 980 WerFault.exe 150 3096 4344 WerFault.exe 155 5136 1932 WerFault.exe 160 1472 1244 WerFault.exe 165 4136 2900 WerFault.exe 170 3088 3376 WerFault.exe 175 3940 924 WerFault.exe 180 2688 3736 WerFault.exe 185 964 1836 WerFault.exe 190 5472 3328 WerFault.exe 195 5604 4704 WerFault.exe 200 5876 1228 WerFault.exe 205 2080 4572 WerFault.exe 210 1980 3152 WerFault.exe 215 424 2784 WerFault.exe 220 3088 1856 WerFault.exe 225 1180 3772 WerFault.exe 230 4112 6124 WerFault.exe 235 5640 3700 WerFault.exe 240 5472 1008 WerFault.exe 245 2928 3996 WerFault.exe 250 1388 2524 WerFault.exe 255 5692 3268 WerFault.exe 260 1560 2132 WerFault.exe 265 3392 5636 WerFault.exe 270 5448 2992 WerFault.exe 275 1392 3088 WerFault.exe 280 6044 3876 WerFault.exe 285 4988 4896 WerFault.exe 290 920 2696 WerFault.exe 295 4164 2800 WerFault.exe 300 2948 1408 WerFault.exe 305 2332 476 WerFault.exe 310 4584 1332 WerFault.exe 315 2140 4224 WerFault.exe 320 3724 1528 WerFault.exe 325 4840 3444 WerFault.exe 330 3624 2680 WerFault.exe 335 5376 3844 WerFault.exe 340 3896 4144 WerFault.exe 345 1748 3524 WerFault.exe 350 6072 1388 WerFault.exe 355 2080 5692 WerFault.exe 360 1960 5972 WerFault.exe 365 5448 3104 WerFault.exe 370 5864 1120 WerFault.exe 375 4532 5152 WerFault.exe 380 768 5584 WerFault.exe 384 4216 260 WerFault.exe 390 5164 5792 WerFault.exe 395 1344 1420 WerFault.exe 400 2080 4444 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CADLHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZURGQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCIEWGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPOAUPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKARJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRSASY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZOGSUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEWFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRRNJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WTGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUDXEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDZEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCDPJKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXWEAQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKXLNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLBLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEXFSGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHBJYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHYUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMFV.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3860 2026-08-15_0f8c0d273a772ad907b202d0ff70dc0c_elex_emotet_stop.exe 3860 2026-08-15_0f8c0d273a772ad907b202d0ff70dc0c_elex_emotet_stop.exe 5976 WICQBB.exe 5976 WICQBB.exe 5176 HLOC.exe 5176 HLOC.exe 2692 LBVKBNH.exe 2692 LBVKBNH.exe 4772 THNQKSK.exe 4772 THNQKSK.exe 4672 JCEDV.exe 4672 JCEDV.exe 2684 HXWEAQ.exe 2684 HXWEAQ.exe 8 TFKE.exe 8 TFKE.exe 3888 VDQ.exe 3888 VDQ.exe 3804 MLSD.exe 3804 MLSD.exe 3176 KLZZGII.exe 3176 KLZZGII.exe 2384 WTGZ.exe 2384 WTGZ.exe 980 FCIEWGY.exe 980 FCIEWGY.exe 4344 QUDXEN.exe 4344 QUDXEN.exe 1932 FPUB.exe 1932 FPUB.exe 1244 FVNPZ.exe 1244 FVNPZ.exe 2900 AIRZBNG.exe 2900 AIRZBNG.exe 3376 PLBLU.exe 3376 PLBLU.exe 924 HMD.exe 924 HMD.exe 3736 QMFV.exe 3736 QMFV.exe 1836 FPOAUPT.exe 1836 FPOAUPT.exe 3328 JXDIY.exe 3328 JXDIY.exe 4704 MKARJH.exe 4704 MKARJH.exe 1228 MYAGKUH.exe 1228 MYAGKUH.exe 4572 RYIT.exe 4572 RYIT.exe 3152 GWNQ.exe 3152 GWNQ.exe 2784 JRSASY.exe 2784 JRSASY.exe 1856 DEX.exe 1856 DEX.exe 3772 OXSC.exe 3772 OXSC.exe 6124 JKXLNF.exe 6124 JKXLNF.exe 3700 UDAEVVZ.exe 3700 UDAEVVZ.exe 1008 PQFO.exe 1008 PQFO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3860 2026-08-15_0f8c0d273a772ad907b202d0ff70dc0c_elex_emotet_stop.exe 3860 2026-08-15_0f8c0d273a772ad907b202d0ff70dc0c_elex_emotet_stop.exe 5976 WICQBB.exe 5976 WICQBB.exe 5176 HLOC.exe 5176 HLOC.exe 2692 LBVKBNH.exe 2692 LBVKBNH.exe 4772 THNQKSK.exe 4772 THNQKSK.exe 4672 JCEDV.exe 4672 JCEDV.exe 2684 HXWEAQ.exe 2684 HXWEAQ.exe 8 TFKE.exe 8 TFKE.exe 3888 VDQ.exe 3888 VDQ.exe 3804 MLSD.exe 3804 MLSD.exe 3176 KLZZGII.exe 3176 KLZZGII.exe 2384 WTGZ.exe 2384 WTGZ.exe 980 FCIEWGY.exe 980 FCIEWGY.exe 4344 QUDXEN.exe 4344 QUDXEN.exe 1932 FPUB.exe 1932 FPUB.exe 1244 FVNPZ.exe 1244 FVNPZ.exe 2900 AIRZBNG.exe 2900 AIRZBNG.exe 3376 PLBLU.exe 3376 PLBLU.exe 924 HMD.exe 924 HMD.exe 3736 QMFV.exe 3736 QMFV.exe 1836 FPOAUPT.exe 1836 FPOAUPT.exe 3328 JXDIY.exe 3328 JXDIY.exe 4704 MKARJH.exe 4704 MKARJH.exe 1228 MYAGKUH.exe 1228 MYAGKUH.exe 4572 RYIT.exe 4572 RYIT.exe 3152 GWNQ.exe 3152 GWNQ.exe 2784 JRSASY.exe 2784 JRSASY.exe 1856 DEX.exe 1856 DEX.exe 3772 OXSC.exe 3772 OXSC.exe 6124 JKXLNF.exe 6124 JKXLNF.exe 3700 UDAEVVZ.exe 3700 UDAEVVZ.exe 1008 PQFO.exe 1008 PQFO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3860 wrote to memory of 4396 3860 2026-08-15_0f8c0d273a772ad907b202d0ff70dc0c_elex_emotet_stop.exe 90 PID 4396 wrote to memory of 5976 4396 cmd.exe 94 PID 5976 wrote to memory of 4724 5976 WICQBB.exe 96 PID 4724 wrote to memory of 5176 4724 cmd.exe 100 PID 5176 wrote to memory of 2728 5176 HLOC.exe 101 PID 2728 wrote to memory of 2692 2728 cmd.exe 105 PID 2692 wrote to memory of 3472 2692 LBVKBNH.exe 106 PID 3472 wrote to memory of 4772 3472 cmd.exe 110 PID 4772 wrote to memory of 976 4772 THNQKSK.exe 111 PID 976 wrote to memory of 4672 976 cmd.exe 115 PID 4672 wrote to memory of 3252 4672 JCEDV.exe 116 PID 3252 wrote to memory of 2684 3252 cmd.exe 120 PID 2684 wrote to memory of 3832 2684 HXWEAQ.exe 121 PID 3832 wrote to memory of 8 3832 cmd.exe 125 PID 8 wrote to memory of 2904 8 TFKE.exe 126 PID 2904 wrote to memory of 3888 2904 cmd.exe 130 PID 3888 wrote to memory of 1944 3888 VDQ.exe 131 PID 1944 wrote to memory of 3804 1944 cmd.exe 135 PID 3804 wrote to memory of 2648 3804 MLSD.exe 136 PID 2648 wrote to memory of 3176 2648 cmd.exe 140 PID 3176 wrote to memory of 5156 3176 KLZZGII.exe 141 PID 5156 wrote to memory of 2384 5156 cmd.exe 145 PID 2384 wrote to memory of 5160 2384 WTGZ.exe 146 PID 5160 wrote to memory of 980 5160 cmd.exe 150 PID 980 wrote to memory of 4424 980 FCIEWGY.exe 151 PID 4424 wrote to memory of 4344 4424 cmd.exe 155 PID 4344 wrote to memory of 3788 4344 QUDXEN.exe 156 PID 3788 wrote to memory of 1932 3788 cmd.exe 160 PID 1932 wrote to memory of 1588 1932 FPUB.exe 161 PID 1588 wrote to memory of 1244 1588 cmd.exe 165 PID 1244 wrote to memory of 3492 1244 FVNPZ.exe 166 PID 3492 wrote to memory of 2900 3492 cmd.exe 170 PID 2900 wrote to memory of 6012 2900 AIRZBNG.exe 171 PID 6012 wrote to memory of 3376 6012 cmd.exe 175 PID 3376 wrote to memory of 6052 3376 PLBLU.exe 176 PID 6052 wrote to memory of 924 6052 cmd.exe 180 PID 924 wrote to memory of 2024 924 HMD.exe 181 PID 2024 wrote to memory of 3736 2024 cmd.exe 185 PID 3736 wrote to memory of 5716 3736 QMFV.exe 186 PID 5716 wrote to memory of 1836 5716 cmd.exe 190 PID 1836 wrote to memory of 5944 1836 FPOAUPT.exe 191 PID 5944 wrote to memory of 3328 5944 cmd.exe 195 PID 3328 wrote to memory of 248 3328 JXDIY.exe 196 PID 4704 wrote to memory of 4336 4704 MKARJH.exe 201 PID 4336 wrote to memory of 1228 4336 cmd.exe 205 PID 1228 wrote to memory of 5052 1228 MYAGKUH.exe 206 PID 5052 wrote to memory of 4572 5052 cmd.exe 210 PID 4572 wrote to memory of 4408 4572 RYIT.exe 211 PID 4408 wrote to memory of 3152 4408 cmd.exe 215 PID 3152 wrote to memory of 480 3152 GWNQ.exe 216 PID 480 wrote to memory of 2784 480 cmd.exe 220 PID 2784 wrote to memory of 5148 2784 JRSASY.exe 221 PID 5148 wrote to memory of 1856 5148 cmd.exe 225 PID 1856 wrote to memory of 1712 1856 DEX.exe 226 PID 1712 wrote to memory of 3772 1712 cmd.exe 230 PID 3772 wrote to memory of 6104 3772 OXSC.exe 231 PID 6104 wrote to memory of 6124 6104 cmd.exe 235 PID 6124 wrote to memory of 5544 6124 JKXLNF.exe 236 PID 5544 wrote to memory of 3700 5544 cmd.exe 240 PID 3700 wrote to memory of 3512 3700 UDAEVVZ.exe 241 PID 3512 wrote to memory of 1008 3512 cmd.exe 245 PID 1008 wrote to memory of 612 1008 PQFO.exe 246 PID 612 wrote to memory of 3996 612 cmd.exe 250 PID 3996 wrote to memory of 4140 3996 KLJXI.exe 251
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_0f8c0d273a772ad907b202d0ff70dc0c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0f8c0d273a772ad907b202d0ff70dc0c_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WICQBB.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\WICQBB.exeC:\windows\WICQBB.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLOC.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\HLOC.exeC:\windows\HLOC.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBVKBNH.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\LBVKBNH.exeC:\windows\LBVKBNH.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THNQKSK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\SysWOW64\THNQKSK.exeC:\windows\system32\THNQKSK.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JCEDV.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:976 -
C:\windows\system\JCEDV.exeC:\windows\system\JCEDV.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXWEAQ.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\windows\SysWOW64\HXWEAQ.exeC:\windows\system32\HXWEAQ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFKE.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\windows\system\TFKE.exeC:\windows\system\TFKE.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDQ.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\SysWOW64\VDQ.exeC:\windows\system32\VDQ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLSD.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\windows\SysWOW64\MLSD.exeC:\windows\system32\MLSD.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLZZGII.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\windows\SysWOW64\KLZZGII.exeC:\windows\system32\KLZZGII.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTGZ.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\windows\SysWOW64\WTGZ.exeC:\windows\system32\WTGZ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCIEWGY.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\windows\system\FCIEWGY.exeC:\windows\system\FCIEWGY.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUDXEN.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\windows\system\QUDXEN.exeC:\windows\system\QUDXEN.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPUB.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\windows\SysWOW64\FPUB.exeC:\windows\system32\FPUB.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FVNPZ.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\windows\SysWOW64\FVNPZ.exeC:\windows\system32\FVNPZ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIRZBNG.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\SysWOW64\AIRZBNG.exeC:\windows\system32\AIRZBNG.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLBLU.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\system\PLBLU.exeC:\windows\system\PLBLU.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMD.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\HMD.exeC:\windows\HMD.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMFV.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\windows\system\QMFV.exeC:\windows\system\QMFV.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPOAUPT.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\windows\FPOAUPT.exeC:\windows\FPOAUPT.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXDIY.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\JXDIY.exeC:\windows\JXDIY.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKARJH.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:248 -
C:\windows\system\MKARJH.exeC:\windows\system\MKARJH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYAGKUH.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\MYAGKUH.exeC:\windows\MYAGKUH.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYIT.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\windows\system\RYIT.exeC:\windows\system\RYIT.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWNQ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\GWNQ.exeC:\windows\GWNQ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRSASY.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:480 -
C:\windows\SysWOW64\JRSASY.exeC:\windows\system32\JRSASY.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DEX.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\windows\system\DEX.exeC:\windows\system\DEX.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXSC.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\windows\system\OXSC.exeC:\windows\system\OXSC.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKXLNF.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\JKXLNF.exeC:\windows\JKXLNF.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UDAEVVZ.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\SysWOW64\UDAEVVZ.exeC:\windows\system32\UDAEVVZ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQFO.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\SysWOW64\PQFO.exeC:\windows\system32\PQFO.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLJXI.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:612 -
C:\windows\SysWOW64\KLJXI.exeC:\windows\system32\KLJXI.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZOGSUR.exe.bat" "66⤵PID:4140
-
C:\windows\system\EZOGSUR.exeC:\windows\system\EZOGSUR.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3464 -
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRRNJW.exe.bat" "70⤵
- Executes a command shell one-liner
PID:3576 -
C:\windows\VRRNJW.exeC:\windows\VRRNJW.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BSZ.exe.bat" "72⤵PID:4512
-
C:\windows\BSZ.exeC:\windows\BSZ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFDKD.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3580 -
C:\windows\WFDKD.exeC:\windows\WFDKD.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CADLHB.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5844 -
C:\windows\CADLHB.exeC:\windows\CADLHB.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYIIPLP.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4876 -
C:\windows\SysWOW64\QYIIPLP.exeC:\windows\system32\QYIIPLP.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTNR.exe.bat" "80⤵PID:912
-
C:\windows\SysWOW64\TTNR.exeC:\windows\system32\TTNR.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUVF.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5672 -
C:\windows\system\RUVF.exeC:\windows\system\RUVF.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUCTRHH.exe.bat" "84⤵
- Executes a command shell one-liner
PID:1900 -
C:\windows\XUCTRHH.exeC:\windows\XUCTRHH.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHZ.exe.bat" "86⤵PID:4996
-
C:\windows\RHZ.exeC:\windows\RHZ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSY.exe.bat" "88⤵PID:836
-
C:\windows\QSY.exeC:\windows\QSY.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFISQY.exe.bat" "90⤵PID:4812
-
C:\windows\ZFISQY.exeC:\windows\ZFISQY.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AAM.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:2272 -
C:\windows\AAM.exeC:\windows\AAM.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EQSWIG.exe.bat" "94⤵PID:3660
-
C:\windows\SysWOW64\EQSWIG.exeC:\windows\system32\EQSWIG.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEXFSGZ.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5432 -
C:\windows\SysWOW64\YEXFSGZ.exeC:\windows\system32\YEXFSGZ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHBJYW.exe.bat" "98⤵PID:2308
-
C:\windows\RHBJYW.exeC:\windows\RHBJYW.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCAKDZQ.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3476 -
C:\windows\system\XCAKDZQ.exeC:\windows\system\XCAKDZQ.exe101⤵
- Executes dropped EXE
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SPFT.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4292 -
C:\windows\SPFT.exeC:\windows\SPFT.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MDKDPY.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4568 -
C:\windows\system\MDKDPY.exeC:\windows\system\MDKDPY.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYT.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\windows\BYT.exeC:\windows\BYT.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDZEP.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3404 -
C:\windows\YDZEP.exeC:\windows\YDZEP.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABSG.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:5008 -
C:\windows\SysWOW64\ABSG.exeC:\windows\system32\ABSG.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEWFA.exe.bat" "112⤵PID:1472
-
C:\windows\SysWOW64\NEWFA.exeC:\windows\system32\NEWFA.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHYUL.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4984 -
C:\windows\system\PHYUL.exeC:\windows\system\PHYUL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URCS.exe.bat" "116⤵
- Executes a command shell one-liner
PID:1756 -
C:\windows\URCS.exeC:\windows\URCS.exe117⤵
- Executes dropped EXE
PID:5152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUYZV.exe.bat" "118⤵PID:3912
-
C:\windows\system\HUYZV.exeC:\windows\system\HUYZV.exe119⤵
- Executes dropped EXE
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKSH.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4448 -
C:\windows\system\LKSH.exeC:\windows\system\LKSH.exe121⤵
- Executes dropped EXE
PID:260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-