Analysis
- max time kernel
76s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 21:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe
- Size 208KB
- Sample260818-1nr1css1by
- SHA256 3e2329be1586204da586187b070e041022203d24d43c9face8f7de5db2fa5a88
- MD5 0234321f2cdd7f89116e196dc5aac022
- SHA1 225471ebae2c9fb68aeb6a626fc5b36501f3b7c1
- SHA512 6976d10d1edda56e0cacb22befa3a361c4a57a791dd725412e3c5df686bec1905b05bca12eb62ae5ebedad8433704ecbb4e6bc9642968a583ac6e14622ba23b1
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFliKL+LOfq4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFliS+LOykEj1
- TLSH T1A3247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5368 KMLAIIK.exe 1820 CEUSFIT.exe 4196 DDB.exe 5512 BTP.exe 4812 HOALD.exe 3052 YOPQP.exe 5644 FHE.exe 4776 NMRFKKN.exe 4192 TIUYYZD.exe 2068 UGC.exe 4948 LGQMNA.exe 1084 SZGVEAD.exe 248 UWTPMI.exe 2528 HUTBO.exe 1336 GFW.exe 4492 HIMF.exe 1916 WYN.exe 1344 PQD.exe 4972 XEPWMEE.exe 3764 FJUCWCI.exe 5584 ECFSFI.exe 3472 YQQ.exe 3208 UVIYBZN.exe 3080 ZOK.exe 2616 OEY.exe 1228 LEHC.exe 4508 QKS.exe 2816 XATJWX.exe 2612 JQHR.exe 5928 LGN.exe 5448 MJRHD.exe 1012 EMVCIDM.exe 1960 WUJI.exe 260 GSPCCDY.exe 2760 VIQTJ.exe 4200 GAFEA.exe 2208 OGSLD.exe 4796 YEXFSGZ.exe 5428 VEH.exe 4188 JZL.exe 2852 PVW.exe 700 XAJQAMC.exe 1092 WLMYJA.exe 6084 IBF.exe 4956 PRGYDZ.exe 1540 JJVJNS.exe 1072 CXUHS.exe 2464 DAK.exe 3156 WTAOYE.exe 5992 AWYB.exe 708 ZTJELCA.exe 6132 DWPZS.exe 4136 OPXKC.exe 3516 YNCE.exe 2884 KYNJSJ.exe 4240 XAEI.exe 2768 FOIO.exe 5636 NUV.exe 2976 UPUE.exe 5568 QUMTX.exe 5552 LIJDZPI.exe 5272 AYSUG.exe 5764 KVYONTF.exe 1204 BEM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ZTJELCA.exe.bat AWYB.exe File opened for modification C:\windows\SysWOW64\YNCE.exe OPXKC.exe File opened for modification C:\windows\SysWOW64\KYNJSJ.exe YNCE.exe File created C:\windows\SysWOW64\ZCKM.exe ERBOOR.exe File opened for modification C:\windows\SysWOW64\ZCKM.exe ERBOOR.exe File opened for modification C:\windows\SysWOW64\KMLAIIK.exe 2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\NMRFKKN.exe FHE.exe File created C:\windows\SysWOW64\SZGVEAD.exe.bat LGQMNA.exe File created C:\windows\SysWOW64\GFW.exe.bat HUTBO.exe File opened for modification C:\windows\SysWOW64\HIMF.exe GFW.exe File opened for modification C:\windows\SysWOW64\VIQTJ.exe GSPCCDY.exe File created C:\windows\SysWOW64\YEXFSGZ.exe.bat OGSLD.exe File created C:\windows\SysWOW64\PVW.exe.bat JZL.exe File created C:\windows\SysWOW64\LGN.exe JQHR.exe File created C:\windows\SysWOW64\SZGVEAD.exe LGQMNA.exe File created C:\windows\SysWOW64\PQD.exe WYN.exe File created C:\windows\SysWOW64\PRGYDZ.exe IBF.exe File created C:\windows\SysWOW64\FXVN.exe ZCKM.exe File opened for modification C:\windows\SysWOW64\STV.exe UDILXA.exe File opened for modification C:\windows\SysWOW64\JJVJNS.exe PRGYDZ.exe File created C:\windows\SysWOW64\EZPDDW.exe GJWAQRX.exe File created C:\windows\SysWOW64\EZPDDW.exe.bat GJWAQRX.exe File created C:\windows\SysWOW64\HTZ.exe.bat EHACVM.exe File opened for modification C:\windows\SysWOW64\GFW.exe HUTBO.exe File created C:\windows\SysWOW64\WYN.exe HIMF.exe File created C:\windows\SysWOW64\GAFEA.exe VIQTJ.exe File created C:\windows\SysWOW64\PRGYDZ.exe.bat IBF.exe File created C:\windows\SysWOW64\ZCKM.exe.bat ERBOOR.exe File opened for modification C:\windows\SysWOW64\LGN.exe JQHR.exe File created C:\windows\SysWOW64\JJVJNS.exe PRGYDZ.exe File opened for modification C:\windows\SysWOW64\XAEI.exe KYNJSJ.exe File created C:\windows\SysWOW64\NMRFKKN.exe FHE.exe File opened for modification C:\windows\SysWOW64\QKS.exe LEHC.exe File opened for modification C:\windows\SysWOW64\GAFEA.exe VIQTJ.exe File created C:\windows\SysWOW64\KYNJSJ.exe.bat YNCE.exe File opened for modification C:\windows\SysWOW64\EZPDDW.exe GJWAQRX.exe File opened for modification C:\windows\SysWOW64\KKACQ.exe UUMT.exe File created C:\windows\SysWOW64\KMLAIIK.exe.bat 2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe File created C:\windows\SysWOW64\GSPCCDY.exe WUJI.exe File created C:\windows\SysWOW64\VIQTJ.exe.bat GSPCCDY.exe File created C:\windows\SysWOW64\YEXFSGZ.exe OGSLD.exe File opened for modification C:\windows\SysWOW64\PRGYDZ.exe IBF.exe File created C:\windows\SysWOW64\STV.exe.bat UDILXA.exe File opened for modification C:\windows\SysWOW64\FXVN.exe ZCKM.exe File created C:\windows\SysWOW64\HTZ.exe EHACVM.exe File created C:\windows\SysWOW64\ZTJELCA.exe AWYB.exe File created C:\windows\SysWOW64\NMRFKKN.exe.bat FHE.exe File created C:\windows\SysWOW64\QKS.exe LEHC.exe File created C:\windows\SysWOW64\GSPCCDY.exe.bat WUJI.exe File opened for modification C:\windows\SysWOW64\YEXFSGZ.exe OGSLD.exe File created C:\windows\SysWOW64\PVW.exe JZL.exe File created C:\windows\SysWOW64\XAEI.exe KYNJSJ.exe File created C:\windows\SysWOW64\FXVN.exe.bat ZCKM.exe File created C:\windows\SysWOW64\GFW.exe HUTBO.exe File opened for modification C:\windows\SysWOW64\GSPCCDY.exe WUJI.exe File created C:\windows\SysWOW64\KKACQ.exe.bat UUMT.exe File opened for modification C:\windows\SysWOW64\SZGVEAD.exe LGQMNA.exe File created C:\windows\SysWOW64\HUTBO.exe.bat UWTPMI.exe File created C:\windows\SysWOW64\HIMF.exe GFW.exe File opened for modification C:\windows\SysWOW64\ZTJELCA.exe AWYB.exe File created C:\windows\SysWOW64\SQISQOS.exe.bat OIBS.exe File opened for modification C:\windows\SysWOW64\HTZ.exe EHACVM.exe File created C:\windows\SysWOW64\STV.exe UDILXA.exe File created C:\windows\SysWOW64\PQD.exe.bat WYN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\YQQ.exe.bat ECFSFI.exe File opened for modification C:\windows\system\UVIYBZN.exe YQQ.exe File created C:\windows\system\UVIYBZN.exe.bat YQQ.exe File opened for modification C:\windows\IBF.exe WLMYJA.exe File created C:\windows\FOIO.exe.bat XAEI.exe File created C:\windows\TSTFWG.exe.bat UZQPNAK.exe File created C:\windows\system\FJUCWCI.exe.bat XEPWMEE.exe File opened for modification C:\windows\system\JZL.exe VEH.exe File created C:\windows\CXUHS.exe.bat JJVJNS.exe File opened for modification C:\windows\DAK.exe CXUHS.exe File created C:\windows\OIBS.exe NFXPYGV.exe File created C:\windows\UUMT.exe.bat KWZYS.exe File created C:\windows\XATJWX.exe.bat QKS.exe File created C:\windows\system\OGSLD.exe.bat GAFEA.exe File created C:\windows\DAK.exe CXUHS.exe File created C:\windows\system\OPXKC.exe DWPZS.exe File opened for modification C:\windows\OIBS.exe NFXPYGV.exe File created C:\windows\system\HHQSK.exe EZPDDW.exe File created C:\windows\system\YOPQP.exe.bat HOALD.exe File created C:\windows\system\WLMYJA.exe.bat XAJQAMC.exe File created C:\windows\system\AWYB.exe WTAOYE.exe File created C:\windows\GJWAQRX.exe DTNLIW.exe File created C:\windows\GJWAQRX.exe.bat DTNLIW.exe File opened for modification C:\windows\system\YOPQP.exe HOALD.exe File opened for modification C:\windows\CEUSFIT.exe KMLAIIK.exe File created C:\windows\JQHR.exe.bat XATJWX.exe File opened for modification C:\windows\system\WLMYJA.exe XAJQAMC.exe File created C:\windows\system\UPUE.exe NUV.exe File opened for modification C:\windows\system\UZQPNAK.exe BEM.exe File opened for modification C:\windows\VEH.exe YEXFSGZ.exe File created C:\windows\system\OPXKC.exe.bat DWPZS.exe File opened for modification C:\windows\FOIO.exe XAEI.exe File created C:\windows\BEM.exe.bat KVYONTF.exe File opened for modification C:\windows\XFKKDI.exe FXVN.exe File created C:\windows\system\HHQSK.exe.bat EZPDDW.exe File created C:\windows\XEPWMEE.exe PQD.exe File created C:\windows\YQQ.exe ECFSFI.exe File opened for modification C:\windows\LEHC.exe OEY.exe File created C:\windows\CEUSFIT.exe KMLAIIK.exe File created C:\windows\JQHR.exe XATJWX.exe File opened for modification C:\windows\system\AWYB.exe WTAOYE.exe File opened for modification C:\windows\system\OPXKC.exe DWPZS.exe File opened for modification C:\windows\system\UPUE.exe NUV.exe File created C:\windows\VEH.exe YEXFSGZ.exe File opened for modification C:\windows\BEM.exe KVYONTF.exe File created C:\windows\system\UZQPNAK.exe BEM.exe File created C:\windows\system\UZQPNAK.exe.bat BEM.exe File opened for modification C:\windows\TSTFWG.exe UZQPNAK.exe File created C:\windows\system\NFXPYGV.exe.bat TSTFWG.exe File opened for modification C:\windows\system\DDB.exe CEUSFIT.exe File created C:\windows\FHE.exe YOPQP.exe File created C:\windows\LGQMNA.exe.bat UGC.exe File created C:\windows\EMVCIDM.exe MJRHD.exe File created C:\windows\system\WLMYJA.exe XAJQAMC.exe File created C:\windows\FHE.exe.bat YOPQP.exe File opened for modification C:\windows\ECFSFI.exe FJUCWCI.exe File created C:\windows\system\UVIYBZN.exe YQQ.exe File created C:\windows\ZOK.exe.bat UVIYBZN.exe File created C:\windows\system\NUV.exe.bat FOIO.exe File opened for modification C:\windows\DTNLIW.exe XFKKDI.exe File created C:\windows\system\UGC.exe TIUYYZD.exe File opened for modification C:\windows\system\TIUYYZD.exe NMRFKKN.exe File created C:\windows\system\OEY.exe.bat ZOK.exe File opened for modification C:\windows\system\MJRHD.exe LGN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4132 cmd.exe 420 cmd.exe 2868 cmd.exe 896 cmd.exe 1924 cmd.exe 3048 cmd.exe 4360 cmd.exe 3568 cmd.exe 5048 cmd.exe 1656 cmd.exe 2484 cmd.exe 3056 cmd.exe 4340 cmd.exe 3868 cmd.exe 4108 cmd.exe 3760 cmd.exe 4496 cmd.exe 3484 cmd.exe 1792 cmd.exe 2328 cmd.exe 4312 cmd.exe 5432 cmd.exe 5036 cmd.exe 4376 cmd.exe 3380 cmd.exe 1816 cmd.exe 2008 cmd.exe 4356 cmd.exe 5588 cmd.exe 3896 cmd.exe 4648 cmd.exe 2840 cmd.exe 940 cmd.exe 5572 cmd.exe 5624 cmd.exe 5860 cmd.exe 2624 cmd.exe 1156 cmd.exe 2984 cmd.exe 5396 cmd.exe 5712 cmd.exe 3372 cmd.exe 4992 cmd.exe 1428 cmd.exe 1572 cmd.exe 1884 cmd.exe 972 cmd.exe 3696 cmd.exe 3796 cmd.exe 5140 cmd.exe 1872 cmd.exe 3708 cmd.exe 4696 cmd.exe 3248 cmd.exe 6116 cmd.exe 5532 cmd.exe 5440 cmd.exe 1388 cmd.exe 5832 cmd.exe 888 cmd.exe 692 cmd.exe 2912 cmd.exe 5088 cmd.exe 4456 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1016 4404 WerFault.exe 87 2752 5368 WerFault.exe 93 3720 1820 WerFault.exe 99 2588 4196 WerFault.exe 104 3864 5512 WerFault.exe 109 3392 4812 WerFault.exe 114 3568 3052 WerFault.exe 119 3680 5644 WerFault.exe 124 6092 4776 WerFault.exe 129 4672 4192 WerFault.exe 134 2500 2068 WerFault.exe 139 4104 4948 WerFault.exe 144 2820 1084 WerFault.exe 149 1468 248 WerFault.exe 154 5100 2528 WerFault.exe 159 1748 1336 WerFault.exe 164 2696 4492 WerFault.exe 169 1300 1916 WerFault.exe 174 6088 1344 WerFault.exe 179 5740 4972 WerFault.exe 184 4672 3764 WerFault.exe 189 2372 5584 WerFault.exe 194 2220 3472 WerFault.exe 199 1360 3208 WerFault.exe 204 1536 3080 WerFault.exe 209 5384 2616 WerFault.exe 214 2520 1228 WerFault.exe 219 2696 4508 WerFault.exe 224 1508 2816 WerFault.exe 229 4636 2612 WerFault.exe 234 796 5928 WerFault.exe 239 2192 5448 WerFault.exe 244 2496 1012 WerFault.exe 249 1816 1960 WerFault.exe 254 4964 260 WerFault.exe 259 1556 2760 WerFault.exe 264 1576 4200 WerFault.exe 269 3292 2208 WerFault.exe 274 3220 4796 WerFault.exe 279 4312 5428 WerFault.exe 284 4472 4188 WerFault.exe 289 2792 2852 WerFault.exe 294 5012 700 WerFault.exe 299 3580 1092 WerFault.exe 304 5116 6084 WerFault.exe 309 2324 4956 WerFault.exe 314 1148 1540 WerFault.exe 319 3272 1072 WerFault.exe 324 2996 2464 WerFault.exe 329 5060 3156 WerFault.exe 334 4988 5992 WerFault.exe 339 4748 708 WerFault.exe 344 1164 6132 WerFault.exe 349 5472 4136 WerFault.exe 354 4884 3516 WerFault.exe 359 792 2884 WerFault.exe 364 1368 4240 WerFault.exe 369 3376 2768 WerFault.exe 374 5964 5636 WerFault.exe 379 5444 2976 WerFault.exe 384 4688 5568 WerFault.exe 389 4472 5552 WerFault.exe 394 2552 5272 WerFault.exe 399 4548 5764 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIQTJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTJELCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQISQOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEUSFIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOPQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJRHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXUHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHQSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMRFKKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XAEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUMTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOALD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJUCWCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XAJQAMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OPXKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFKKDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAFEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRGYDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWTPMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZGVEAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYNJSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYKXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4404 2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe 4404 2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe 5368 KMLAIIK.exe 5368 KMLAIIK.exe 1820 CEUSFIT.exe 1820 CEUSFIT.exe 4196 DDB.exe 4196 DDB.exe 5512 BTP.exe 5512 BTP.exe 4812 HOALD.exe 4812 HOALD.exe 3052 YOPQP.exe 3052 YOPQP.exe 5644 FHE.exe 5644 FHE.exe 4776 NMRFKKN.exe 4776 NMRFKKN.exe 4192 TIUYYZD.exe 4192 TIUYYZD.exe 2068 UGC.exe 2068 UGC.exe 4948 LGQMNA.exe 4948 LGQMNA.exe 1084 SZGVEAD.exe 1084 SZGVEAD.exe 248 UWTPMI.exe 248 UWTPMI.exe 2528 HUTBO.exe 2528 HUTBO.exe 1336 GFW.exe 1336 GFW.exe 4492 HIMF.exe 4492 HIMF.exe 1916 WYN.exe 1916 WYN.exe 1344 PQD.exe 1344 PQD.exe 4972 XEPWMEE.exe 4972 XEPWMEE.exe 3764 FJUCWCI.exe 3764 FJUCWCI.exe 5584 ECFSFI.exe 5584 ECFSFI.exe 3472 YQQ.exe 3472 YQQ.exe 3208 UVIYBZN.exe 3208 UVIYBZN.exe 3080 ZOK.exe 3080 ZOK.exe 2616 OEY.exe 2616 OEY.exe 1228 LEHC.exe 1228 LEHC.exe 4508 QKS.exe 4508 QKS.exe 2816 XATJWX.exe 2816 XATJWX.exe 2612 JQHR.exe 2612 JQHR.exe 5928 LGN.exe 5928 LGN.exe 5448 MJRHD.exe 5448 MJRHD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4404 2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe 4404 2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe 5368 KMLAIIK.exe 5368 KMLAIIK.exe 1820 CEUSFIT.exe 1820 CEUSFIT.exe 4196 DDB.exe 4196 DDB.exe 5512 BTP.exe 5512 BTP.exe 4812 HOALD.exe 4812 HOALD.exe 3052 YOPQP.exe 3052 YOPQP.exe 5644 FHE.exe 5644 FHE.exe 4776 NMRFKKN.exe 4776 NMRFKKN.exe 4192 TIUYYZD.exe 4192 TIUYYZD.exe 2068 UGC.exe 2068 UGC.exe 4948 LGQMNA.exe 4948 LGQMNA.exe 1084 SZGVEAD.exe 1084 SZGVEAD.exe 248 UWTPMI.exe 248 UWTPMI.exe 2528 HUTBO.exe 2528 HUTBO.exe 1336 GFW.exe 1336 GFW.exe 4492 HIMF.exe 4492 HIMF.exe 1916 WYN.exe 1916 WYN.exe 1344 PQD.exe 1344 PQD.exe 4972 XEPWMEE.exe 4972 XEPWMEE.exe 3764 FJUCWCI.exe 3764 FJUCWCI.exe 5584 ECFSFI.exe 5584 ECFSFI.exe 3472 YQQ.exe 3472 YQQ.exe 3208 UVIYBZN.exe 3208 UVIYBZN.exe 3080 ZOK.exe 3080 ZOK.exe 2616 OEY.exe 2616 OEY.exe 1228 LEHC.exe 1228 LEHC.exe 4508 QKS.exe 4508 QKS.exe 2816 XATJWX.exe 2816 XATJWX.exe 2612 JQHR.exe 2612 JQHR.exe 5928 LGN.exe 5928 LGN.exe 5448 MJRHD.exe 5448 MJRHD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4404 wrote to memory of 5624 4404 2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe 89 PID 5624 wrote to memory of 5368 5624 cmd.exe 93 PID 5368 wrote to memory of 5796 5368 KMLAIIK.exe 95 PID 5796 wrote to memory of 1820 5796 cmd.exe 99 PID 1820 wrote to memory of 4456 1820 CEUSFIT.exe 100 PID 4456 wrote to memory of 4196 4456 cmd.exe 104 PID 4196 wrote to memory of 3372 4196 DDB.exe 105 PID 3372 wrote to memory of 5512 3372 cmd.exe 109 PID 5512 wrote to memory of 5908 5512 BTP.exe 110 PID 5908 wrote to memory of 4812 5908 cmd.exe 114 PID 4812 wrote to memory of 4356 4812 HOALD.exe 115 PID 4356 wrote to memory of 3052 4356 cmd.exe 119 PID 3052 wrote to memory of 3800 3052 YOPQP.exe 120 PID 3800 wrote to memory of 5644 3800 cmd.exe 124 PID 5644 wrote to memory of 940 5644 FHE.exe 125 PID 940 wrote to memory of 4776 940 cmd.exe 129 PID 4776 wrote to memory of 1656 4776 NMRFKKN.exe 130 PID 1656 wrote to memory of 4192 1656 cmd.exe 134 PID 4192 wrote to memory of 5304 4192 TIUYYZD.exe 135 PID 5304 wrote to memory of 2068 5304 cmd.exe 139 PID 2068 wrote to memory of 2824 2068 UGC.exe 140 PID 2824 wrote to memory of 4948 2824 cmd.exe 144 PID 4948 wrote to memory of 1824 4948 LGQMNA.exe 145 PID 1824 wrote to memory of 1084 1824 cmd.exe 149 PID 1084 wrote to memory of 2452 1084 SZGVEAD.exe 150 PID 2452 wrote to memory of 248 2452 cmd.exe 154 PID 248 wrote to memory of 3184 248 UWTPMI.exe 155 PID 3184 wrote to memory of 2528 3184 cmd.exe 159 PID 2528 wrote to memory of 4992 2528 HUTBO.exe 160 PID 4992 wrote to memory of 1336 4992 cmd.exe 164 PID 1336 wrote to memory of 3132 1336 GFW.exe 165 PID 3132 wrote to memory of 4492 3132 cmd.exe 169 PID 4492 wrote to memory of 1384 4492 HIMF.exe 170 PID 1384 wrote to memory of 1916 1384 cmd.exe 174 PID 1916 wrote to memory of 5860 1916 WYN.exe 175 PID 5860 wrote to memory of 1344 5860 cmd.exe 179 PID 1344 wrote to memory of 2328 1344 PQD.exe 180 PID 2328 wrote to memory of 4972 2328 cmd.exe 184 PID 4972 wrote to memory of 4360 4972 XEPWMEE.exe 185 PID 4360 wrote to memory of 3764 4360 cmd.exe 189 PID 3764 wrote to memory of 4108 3764 FJUCWCI.exe 190 PID 4108 wrote to memory of 5584 4108 cmd.exe 194 PID 5584 wrote to memory of 2868 5584 ECFSFI.exe 195 PID 2868 wrote to memory of 3472 2868 cmd.exe 199 PID 3472 wrote to memory of 1640 3472 YQQ.exe 200 PID 1640 wrote to memory of 3208 1640 cmd.exe 204 PID 3208 wrote to memory of 1428 3208 UVIYBZN.exe 205 PID 1428 wrote to memory of 3080 1428 cmd.exe 209 PID 3080 wrote to memory of 4560 3080 ZOK.exe 210 PID 4560 wrote to memory of 2616 4560 cmd.exe 214 PID 2616 wrote to memory of 3408 2616 OEY.exe 215 PID 3408 wrote to memory of 1228 3408 cmd.exe 219 PID 1228 wrote to memory of 5504 1228 LEHC.exe 220 PID 5504 wrote to memory of 4508 5504 cmd.exe 224 PID 4508 wrote to memory of 5572 4508 QKS.exe 225 PID 5572 wrote to memory of 2816 5572 cmd.exe 229 PID 2816 wrote to memory of 5816 2816 XATJWX.exe 230 PID 5816 wrote to memory of 2612 5816 cmd.exe 234 PID 2612 wrote to memory of 3696 2612 JQHR.exe 235 PID 3696 wrote to memory of 5928 3696 cmd.exe 239 PID 5928 wrote to memory of 2624 5928 LGN.exe 240 PID 2624 wrote to memory of 5448 2624 cmd.exe 244 PID 5448 wrote to memory of 896 5448 MJRHD.exe 245 PID 896 wrote to memory of 1012 896 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_0234321f2cdd7f89116e196dc5aac022_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMLAIIK.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\SysWOW64\KMLAIIK.exeC:\windows\system32\KMLAIIK.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEUSFIT.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\windows\CEUSFIT.exeC:\windows\CEUSFIT.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDB.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\system\DDB.exeC:\windows\system\DDB.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTP.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\system\BTP.exeC:\windows\system\BTP.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOALD.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\windows\system\HOALD.exeC:\windows\system\HOALD.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOPQP.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\system\YOPQP.exeC:\windows\system\YOPQP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\windows\FHE.exeC:\windows\FHE.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMRFKKN.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\SysWOW64\NMRFKKN.exeC:\windows\system32\NMRFKKN.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TIUYYZD.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\windows\system\TIUYYZD.exeC:\windows\system\TIUYYZD.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\windows\system\UGC.exeC:\windows\system\UGC.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGQMNA.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\windows\LGQMNA.exeC:\windows\LGQMNA.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZGVEAD.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\windows\SysWOW64\SZGVEAD.exeC:\windows\system32\SZGVEAD.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UWTPMI.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\UWTPMI.exeC:\windows\UWTPMI.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUTBO.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\windows\SysWOW64\HUTBO.exeC:\windows\system32\HUTBO.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFW.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\windows\SysWOW64\GFW.exeC:\windows\system32\GFW.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HIMF.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\SysWOW64\HIMF.exeC:\windows\system32\HIMF.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYN.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\SysWOW64\WYN.exeC:\windows\system32\WYN.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQD.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\windows\SysWOW64\PQD.exeC:\windows\system32\PQD.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XEPWMEE.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\XEPWMEE.exeC:\windows\XEPWMEE.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJUCWCI.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\system\FJUCWCI.exeC:\windows\system\FJUCWCI.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECFSFI.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\ECFSFI.exeC:\windows\ECFSFI.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\YQQ.exeC:\windows\YQQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVIYBZN.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\windows\system\UVIYBZN.exeC:\windows\system\UVIYBZN.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOK.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\ZOK.exeC:\windows\ZOK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEY.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\system\OEY.exeC:\windows\system\OEY.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LEHC.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\LEHC.exeC:\windows\LEHC.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKS.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\windows\SysWOW64\QKS.exeC:\windows\system32\QKS.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XATJWX.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\XATJWX.exeC:\windows\XATJWX.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQHR.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\JQHR.exeC:\windows\JQHR.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGN.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\windows\SysWOW64\LGN.exeC:\windows\system32\LGN.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MJRHD.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\windows\system\MJRHD.exeC:\windows\system\MJRHD.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EMVCIDM.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:896 -
C:\windows\EMVCIDM.exeC:\windows\EMVCIDM.exe65⤵
- Executes dropped EXE
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUJI.exe.bat" "66⤵PID:3268
-
C:\windows\WUJI.exeC:\windows\WUJI.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSPCCDY.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:688 -
C:\windows\SysWOW64\GSPCCDY.exeC:\windows\system32\GSPCCDY.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VIQTJ.exe.bat" "70⤵PID:1060
-
C:\windows\SysWOW64\VIQTJ.exeC:\windows\system32\VIQTJ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAFEA.exe.bat" "72⤵PID:2140
-
C:\windows\SysWOW64\GAFEA.exeC:\windows\system32\GAFEA.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGSLD.exe.bat" "74⤵PID:3000
-
C:\windows\system\OGSLD.exeC:\windows\system\OGSLD.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEXFSGZ.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5532 -
C:\windows\SysWOW64\YEXFSGZ.exeC:\windows\system32\YEXFSGZ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEH.exe.bat" "78⤵PID:3940
-
C:\windows\VEH.exeC:\windows\VEH.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JZL.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4376 -
C:\windows\system\JZL.exeC:\windows\system\JZL.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVW.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\windows\SysWOW64\PVW.exeC:\windows\system32\PVW.exe83⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XAJQAMC.exe.bat" "84⤵PID:6024
-
C:\windows\system\XAJQAMC.exeC:\windows\system\XAJQAMC.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLMYJA.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2484 -
C:\windows\system\WLMYJA.exeC:\windows\system\WLMYJA.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBF.exe.bat" "88⤵PID:5784
-
C:\windows\IBF.exeC:\windows\IBF.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRGYDZ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2932 -
C:\windows\SysWOW64\PRGYDZ.exeC:\windows\system32\PRGYDZ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJVJNS.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3796 -
C:\windows\SysWOW64\JJVJNS.exeC:\windows\system32\JJVJNS.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXUHS.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5588 -
C:\windows\CXUHS.exeC:\windows\CXUHS.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DAK.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3568 -
C:\windows\DAK.exeC:\windows\DAK.exe97⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTAOYE.exe.bat" "98⤵PID:3396
-
C:\windows\WTAOYE.exeC:\windows\WTAOYE.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AWYB.exe.bat" "100⤵PID:4744
-
C:\windows\system\AWYB.exeC:\windows\system\AWYB.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTJELCA.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\windows\SysWOW64\ZTJELCA.exeC:\windows\system32\ZTJELCA.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWPZS.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5140 -
C:\windows\system\DWPZS.exeC:\windows\system\DWPZS.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OPXKC.exe.bat" "106⤵PID:5456
-
C:\windows\system\OPXKC.exeC:\windows\system\OPXKC.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNCE.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4996 -
C:\windows\SysWOW64\YNCE.exeC:\windows\system32\YNCE.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYNJSJ.exe.bat" "110⤵PID:2860
-
C:\windows\SysWOW64\KYNJSJ.exeC:\windows\system32\KYNJSJ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAEI.exe.bat" "112⤵PID:2336
-
C:\windows\SysWOW64\XAEI.exeC:\windows\system32\XAEI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOIO.exe.bat" "114⤵
- Executes a command shell one-liner
PID:1156 -
C:\windows\FOIO.exeC:\windows\FOIO.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUV.exe.bat" "116⤵PID:4460
-
C:\windows\system\NUV.exeC:\windows\system\NUV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UPUE.exe.bat" "118⤵PID:4152
-
C:\windows\system\UPUE.exeC:\windows\system\UPUE.exe119⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUMTX.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4676 -
C:\windows\QUMTX.exeC:\windows\QUMTX.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-