Analysis
- max time kernel
87s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe
- Size 208KB
- Sample260819-b2pdyswvg1
- SHA256 43015084f579bbefd84200b98f0ff7f1639f9617df27b05f0b35ade158317364
- MD5 7e6d42491b4fb63ec4b7fb972dd6fd96
- SHA1 e5407ccf91fd76c927dc8abcddd65db03b55d02c
- SHA512 b5dc40de9df564605fb760c4bd306434b946257fb0742e9c3ce069dc4bcb3b19c6e76b31fa8f045696c0d6f4cb72d57ceed8bf6dcfa5d51346010741020212a0
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfp4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOxkEj1
- TLSH T1C2247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4404 PQAQQ.exe 4908 IBECMU.exe 3428 DOI.exe 5808 SJSYHO.exe 3940 QFRYMRM.exe 5564 ACXTUA.exe 1536 BFI.exe 5776 YGQCQ.exe 748 IVWWY.exe 5828 SEYCBY.exe 460 CCDW.exe 4540 UFH.exe 248 VALVB.exe 1492 BATJKOD.exe 4444 FQZR.exe 1148 FTL.exe 5768 YOPQP.exe 4636 NEQ.exe 4860 RUWQAS.exe 6028 BSCCQ.exe 4268 ZSKQZD.exe 4556 HYKEAI.exe 4468 UJSDPT.exe 4092 VEW.exe 5164 TEEUL.exe 4280 ZZDVIO.exe 568 FZLJ.exe 3300 LASXIK.exe 4248 UAUCLIS.exe 4184 VDYGRY.exe 932 ZTF.exe 5560 OJGFKLF.exe 5180 DEX.exe 4660 DKPYE.exe 1420 NID.exe 3380 LIKGV.exe 1276 YTGE.exe 4704 KLJXI.exe 4844 VEEQQCS.exe 4348 KZWU.exe 3432 FMBELO.exe 5796 WUV.exe 2560 UNCEY.exe 1676 CADLHB.exe 4484 IBK.exe 4508 GBSUA.exe 3360 AOXEKXN.exe 2412 GKW.exe 5968 VFFJZN.exe 6032 QSKSKNR.exe 4812 SQD.exe 4788 JDOM.exe 1904 RJA.exe 4868 MWFCT.exe 1336 EZJG.exe 3212 QRERG.exe 5376 CZT.exe 3628 NSOS.exe 2816 YLR.exe 1264 JDUV.exe 2292 XOCU.exe 4284 RBHDAB.exe 2016 MXM.exe 5812 DXOA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\AOXEKXN.exe.bat GBSUA.exe File created C:\windows\SysWOW64\YITRNXE.exe.bat YDTDMK.exe File created C:\windows\SysWOW64\SAWUXSR.exe GITBPK.exe File created C:\windows\SysWOW64\NMQUXIH.exe YPKXQ.exe File opened for modification C:\windows\SysWOW64\CYDRXYU.exe KVZNS.exe File opened for modification C:\windows\SysWOW64\YDTDMK.exe SCTP.exe File opened for modification C:\windows\SysWOW64\MBVHPPA.exe VAB.exe File opened for modification C:\windows\SysWOW64\YPKXQ.exe BJEAJ.exe File created C:\windows\SysWOW64\DMQOQA.exe.bat XLIA.exe File created C:\windows\SysWOW64\HCA.exe.bat SMRHD.exe File opened for modification C:\windows\SysWOW64\ILTZTGV.exe GNN.exe File created C:\windows\SysWOW64\IVWWY.exe YGQCQ.exe File created C:\windows\SysWOW64\RUWQAS.exe.bat NEQ.exe File created C:\windows\SysWOW64\MXM.exe RBHDAB.exe File opened for modification C:\windows\SysWOW64\MXM.exe RBHDAB.exe File created C:\windows\SysWOW64\YITRNXE.exe YDTDMK.exe File opened for modification C:\windows\SysWOW64\YITRNXE.exe YDTDMK.exe File created C:\windows\SysWOW64\RTFLJ.exe.bat UOZ.exe File created C:\windows\SysWOW64\PATOCP.exe.bat PVTAT.exe File opened for modification C:\windows\SysWOW64\VFFJZN.exe GKW.exe File created C:\windows\SysWOW64\YDTDMK.exe SCTP.exe File created C:\windows\SysWOW64\GITBPK.exe CAM.exe File created C:\windows\SysWOW64\GITBPK.exe.bat CAM.exe File created C:\windows\SysWOW64\YPKXQ.exe BJEAJ.exe File created C:\windows\SysWOW64\DMQOQA.exe XLIA.exe File created C:\windows\SysWOW64\HCA.exe SMRHD.exe File created C:\windows\SysWOW64\IYFDD.exe LSHGWF.exe File created C:\windows\SysWOW64\PATOCP.exe PVTAT.exe File created C:\windows\SysWOW64\MBVHPPA.exe VAB.exe File created C:\windows\SysWOW64\CYDRXYU.exe KVZNS.exe File created C:\windows\SysWOW64\TQIWLXI.exe.bat IYFDD.exe File created C:\windows\SysWOW64\RUWQAS.exe NEQ.exe File created C:\windows\SysWOW64\SQD.exe QSKSKNR.exe File created C:\windows\SysWOW64\SQD.exe.bat QSKSKNR.exe File opened for modification C:\windows\SysWOW64\PATOCP.exe PVTAT.exe File created C:\windows\SysWOW64\KVZNS.exe SNXIGKI.exe File opened for modification C:\windows\SysWOW64\IYFDD.exe LSHGWF.exe File created C:\windows\SysWOW64\TQIWLXI.exe IYFDD.exe File created C:\windows\SysWOW64\YTGE.exe LIKGV.exe File created C:\windows\SysWOW64\QRERG.exe EZJG.exe File created C:\windows\SysWOW64\YDTDMK.exe.bat SCTP.exe File created C:\windows\SysWOW64\SAWUXSR.exe.bat GITBPK.exe File created C:\windows\SysWOW64\ILTZTGV.exe.bat GNN.exe File created C:\windows\SysWOW64\BUXI.exe QBU.exe File created C:\windows\SysWOW64\BSCCQ.exe.bat RUWQAS.exe File opened for modification C:\windows\SysWOW64\NID.exe DKPYE.exe File created C:\windows\SysWOW64\KLJXI.exe.bat YTGE.exe File created C:\windows\SysWOW64\AOXEKXN.exe GBSUA.exe File created C:\windows\SysWOW64\VFFJZN.exe GKW.exe File opened for modification C:\windows\SysWOW64\HCA.exe SMRHD.exe File opened for modification C:\windows\SysWOW64\ZSKQZD.exe BSCCQ.exe File created C:\windows\SysWOW64\KLJXI.exe YTGE.exe File created C:\windows\SysWOW64\VFFJZN.exe.bat GKW.exe File created C:\windows\SysWOW64\YPKXQ.exe.bat BJEAJ.exe File opened for modification C:\windows\SysWOW64\NMQUXIH.exe YPKXQ.exe File created C:\windows\SysWOW64\LSHGWF.exe HCA.exe File opened for modification C:\windows\SysWOW64\LSHGWF.exe HCA.exe File created C:\windows\SysWOW64\IYFDD.exe.bat LSHGWF.exe File created C:\windows\SysWOW64\FTL.exe.bat FQZR.exe File created C:\windows\SysWOW64\BSCCQ.exe RUWQAS.exe File created C:\windows\SysWOW64\NID.exe.bat DKPYE.exe File opened for modification C:\windows\SysWOW64\YTGE.exe LIKGV.exe File created C:\windows\SysWOW64\MXM.exe.bat RBHDAB.exe File created C:\windows\SysWOW64\KVZNS.exe.bat SNXIGKI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\CADLHB.exe UNCEY.exe File created C:\windows\CAM.exe.bat XZFOUY.exe File created C:\windows\system\BJEAJ.exe.bat HWZR.exe File opened for modification C:\windows\UMK.exe DMQOQA.exe File opened for modification C:\windows\FJXXLT.exe ZJPK.exe File created C:\windows\system\VAB.exe PATOCP.exe File created C:\windows\system\MWFCT.exe.bat RJA.exe File opened for modification C:\windows\system\ECQHSD.exe VPFP.exe File created C:\windows\TEW.exe ILTZTGV.exe File created C:\windows\DOI.exe IBECMU.exe File opened for modification C:\windows\BATJKOD.exe VALVB.exe File opened for modification C:\windows\UJSDPT.exe HYKEAI.exe File created C:\windows\VEW.exe UJSDPT.exe File opened for modification C:\windows\LIKGV.exe NID.exe File opened for modification C:\windows\system\UOZ.exe YITRNXE.exe File created C:\windows\system\JIIQEO.exe.bat EHACVM.exe File created C:\windows\LIKGV.exe.bat NID.exe File created C:\windows\system\ZJPK.exe TQIWLXI.exe File created C:\windows\DOI.exe.bat IBECMU.exe File opened for modification C:\windows\CADLHB.exe UNCEY.exe File created C:\windows\CADLHB.exe.bat UNCEY.exe File opened for modification C:\windows\system\IBK.exe CADLHB.exe File created C:\windows\system\UOZ.exe YITRNXE.exe File created C:\windows\LHCVMIW.exe RTFLJ.exe File created C:\windows\PQAQQ.exe 2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe File opened for modification C:\windows\system\RJA.exe JDOM.exe File created C:\windows\system\NSOS.exe CZT.exe File opened for modification C:\windows\system\SWIRRU.exe DTZ.exe File opened for modification C:\windows\UNCEY.exe WUV.exe File created C:\windows\system\PVTAT.exe ECQHSD.exe File created C:\windows\system\FQZR.exe.bat BATJKOD.exe File opened for modification C:\windows\ZTF.exe VDYGRY.exe File created C:\windows\system\DEX.exe.bat OJGFKLF.exe File created C:\windows\system\VEEQQCS.exe.bat KLJXI.exe File created C:\windows\WUV.exe FMBELO.exe File created C:\windows\system\MWFCT.exe RJA.exe File created C:\windows\system\GNN.exe JIIQEO.exe File created C:\windows\system\SEYCBY.exe IVWWY.exe File created C:\windows\system\VPFP.exe JWKWURJ.exe File opened for modification C:\windows\system\JIIQEO.exe EHACVM.exe File opened for modification C:\windows\system\FKEIDXI.exe BUXI.exe File created C:\windows\system\YZQPYQ.exe URJPMYF.exe File created C:\windows\system\QFRYMRM.exe SJSYHO.exe File opened for modification C:\windows\VDYGRY.exe UAUCLIS.exe File created C:\windows\UNCEY.exe.bat WUV.exe File created C:\windows\EZJG.exe.bat MWFCT.exe File opened for modification C:\windows\XZFOUY.exe LHCVMIW.exe File opened for modification C:\windows\system\QFRYMRM.exe SJSYHO.exe File created C:\windows\system\FZLJ.exe.bat ZZDVIO.exe File created C:\windows\system\GKW.exe.bat AOXEKXN.exe File created C:\windows\system\JDUV.exe YLR.exe File created C:\windows\FJXXLT.exe ZJPK.exe File created C:\windows\system\HYKEAI.exe.bat ZSKQZD.exe File created C:\windows\LIKGV.exe NID.exe File created C:\windows\system\VEEQQCS.exe KLJXI.exe File created C:\windows\system\EHACVM.exe.bat LEWYIWI.exe File opened for modification C:\windows\system\FQZR.exe BATJKOD.exe File created C:\windows\QSKSKNR.exe.bat VFFJZN.exe File created C:\windows\YLR.exe NSOS.exe File created C:\windows\system\QBU.exe.bat TEW.exe File created C:\windows\system\JDUV.exe.bat YLR.exe File created C:\windows\system\JWKWURJ.exe SWIRRU.exe File opened for modification C:\windows\system\PVTAT.exe ECQHSD.exe File created C:\windows\system\SMRHD.exe.bat UMK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 620 cmd.exe 888 cmd.exe 4864 cmd.exe 4396 cmd.exe 1144 cmd.exe 5304 cmd.exe 2948 cmd.exe 2576 cmd.exe 2760 cmd.exe 6044 cmd.exe 2800 cmd.exe 3680 cmd.exe 4928 cmd.exe 5604 cmd.exe 5656 cmd.exe 3332 cmd.exe 1260 cmd.exe 4672 cmd.exe 2200 cmd.exe 4116 cmd.exe 2908 cmd.exe 3220 cmd.exe 1820 cmd.exe 1284 cmd.exe 4512 cmd.exe 5480 cmd.exe 3076 cmd.exe 3016 cmd.exe 1196 cmd.exe 3168 cmd.exe 2068 cmd.exe 2512 cmd.exe 4940 cmd.exe 1228 cmd.exe 4324 cmd.exe 5596 cmd.exe 5324 cmd.exe 5948 cmd.exe 4124 cmd.exe 4204 cmd.exe 5556 cmd.exe 5248 cmd.exe 4240 cmd.exe 2832 cmd.exe 3800 cmd.exe 5668 cmd.exe 3652 cmd.exe 1584 cmd.exe 4724 cmd.exe 4728 cmd.exe 5696 cmd.exe 2584 cmd.exe 5660 cmd.exe 1924 cmd.exe 1272 cmd.exe 5708 cmd.exe 4832 cmd.exe 2400 cmd.exe 5628 cmd.exe 1432 cmd.exe 1352 cmd.exe 4708 cmd.exe 3448 cmd.exe 6020 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4072 4912 WerFault.exe 87 2388 4404 WerFault.exe 93 5936 4908 WerFault.exe 99 5604 3428 WerFault.exe 104 2000 5808 WerFault.exe 109 3912 3940 WerFault.exe 114 3704 5564 WerFault.exe 119 4528 1536 WerFault.exe 124 4048 5776 WerFault.exe 129 4932 748 WerFault.exe 134 5576 5828 WerFault.exe 139 2300 460 WerFault.exe 144 5484 4540 WerFault.exe 149 5088 248 WerFault.exe 154 2892 1492 WerFault.exe 159 2236 4444 WerFault.exe 164 1560 1148 WerFault.exe 169 2692 5768 WerFault.exe 174 4588 4636 WerFault.exe 179 5712 4860 WerFault.exe 184 620 6028 WerFault.exe 189 1080 4268 WerFault.exe 194 5432 4556 WerFault.exe 199 2752 4468 WerFault.exe 204 5252 4092 WerFault.exe 209 4856 5164 WerFault.exe 214 2468 4280 WerFault.exe 219 6088 568 WerFault.exe 224 4808 3300 WerFault.exe 229 1944 4248 WerFault.exe 234 5588 4184 WerFault.exe 239 3368 932 WerFault.exe 244 3304 5560 WerFault.exe 249 1392 5180 WerFault.exe 254 4632 4660 WerFault.exe 259 2892 1420 WerFault.exe 264 2236 3380 WerFault.exe 269 1668 1276 WerFault.exe 274 4492 4704 WerFault.exe 280 5480 4844 WerFault.exe 285 480 4348 WerFault.exe 290 2480 3432 WerFault.exe 295 2796 5796 WerFault.exe 300 3564 2560 WerFault.exe 305 5696 1676 WerFault.exe 310 3056 4484 WerFault.exe 315 6108 4508 WerFault.exe 320 2800 3360 WerFault.exe 325 4928 2412 WerFault.exe 330 5588 5968 WerFault.exe 335 4816 6032 WerFault.exe 340 5576 4812 WerFault.exe 345 2640 4788 WerFault.exe 350 1508 1904 WerFault.exe 355 5736 4868 WerFault.exe 360 1428 1336 WerFault.exe 365 5752 3212 WerFault.exe 370 2268 5376 WerFault.exe 375 4820 3628 WerFault.exe 380 5608 2816 WerFault.exe 385 1164 1264 WerFault.exe 390 6044 2292 WerFault.exe 395 5416 4284 WerFault.exe 400 3948 2016 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHCVMIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVZNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJEAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBECMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UAUCLIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIIQEO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZFOUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PATOCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGQCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJSDPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMQUXIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQIWLXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQAQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKEIDXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOPQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYDRXYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LASXIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEEQQCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMRHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBSUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBHDAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMQOQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILTZTGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDOM.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4912 2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe 4912 2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe 4404 PQAQQ.exe 4404 PQAQQ.exe 4908 IBECMU.exe 4908 IBECMU.exe 3428 DOI.exe 3428 DOI.exe 5808 SJSYHO.exe 5808 SJSYHO.exe 3940 QFRYMRM.exe 3940 QFRYMRM.exe 5564 ACXTUA.exe 5564 ACXTUA.exe 1536 BFI.exe 1536 BFI.exe 5776 YGQCQ.exe 5776 YGQCQ.exe 748 IVWWY.exe 748 IVWWY.exe 5828 SEYCBY.exe 5828 SEYCBY.exe 460 CCDW.exe 460 CCDW.exe 4540 UFH.exe 4540 UFH.exe 248 VALVB.exe 248 VALVB.exe 1492 BATJKOD.exe 1492 BATJKOD.exe 4444 FQZR.exe 4444 FQZR.exe 1148 FTL.exe 1148 FTL.exe 5768 YOPQP.exe 5768 YOPQP.exe 4636 NEQ.exe 4636 NEQ.exe 4860 RUWQAS.exe 4860 RUWQAS.exe 6028 BSCCQ.exe 6028 BSCCQ.exe 4268 ZSKQZD.exe 4268 ZSKQZD.exe 4556 HYKEAI.exe 4556 HYKEAI.exe 4468 UJSDPT.exe 4468 UJSDPT.exe 4092 VEW.exe 4092 VEW.exe 5164 TEEUL.exe 5164 TEEUL.exe 4280 ZZDVIO.exe 4280 ZZDVIO.exe 568 FZLJ.exe 568 FZLJ.exe 3300 LASXIK.exe 3300 LASXIK.exe 4248 UAUCLIS.exe 4248 UAUCLIS.exe 4184 VDYGRY.exe 4184 VDYGRY.exe 932 ZTF.exe 932 ZTF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4912 2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe 4912 2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe 4404 PQAQQ.exe 4404 PQAQQ.exe 4908 IBECMU.exe 4908 IBECMU.exe 3428 DOI.exe 3428 DOI.exe 5808 SJSYHO.exe 5808 SJSYHO.exe 3940 QFRYMRM.exe 3940 QFRYMRM.exe 5564 ACXTUA.exe 5564 ACXTUA.exe 1536 BFI.exe 1536 BFI.exe 5776 YGQCQ.exe 5776 YGQCQ.exe 748 IVWWY.exe 748 IVWWY.exe 5828 SEYCBY.exe 5828 SEYCBY.exe 460 CCDW.exe 460 CCDW.exe 4540 UFH.exe 4540 UFH.exe 248 VALVB.exe 248 VALVB.exe 1492 BATJKOD.exe 1492 BATJKOD.exe 4444 FQZR.exe 4444 FQZR.exe 1148 FTL.exe 1148 FTL.exe 5768 YOPQP.exe 5768 YOPQP.exe 4636 NEQ.exe 4636 NEQ.exe 4860 RUWQAS.exe 4860 RUWQAS.exe 6028 BSCCQ.exe 6028 BSCCQ.exe 4268 ZSKQZD.exe 4268 ZSKQZD.exe 4556 HYKEAI.exe 4556 HYKEAI.exe 4468 UJSDPT.exe 4468 UJSDPT.exe 4092 VEW.exe 4092 VEW.exe 5164 TEEUL.exe 5164 TEEUL.exe 4280 ZZDVIO.exe 4280 ZZDVIO.exe 568 FZLJ.exe 568 FZLJ.exe 3300 LASXIK.exe 3300 LASXIK.exe 4248 UAUCLIS.exe 4248 UAUCLIS.exe 4184 VDYGRY.exe 4184 VDYGRY.exe 932 ZTF.exe 932 ZTF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4912 wrote to memory of 1772 4912 2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe 89 PID 1772 wrote to memory of 4404 1772 cmd.exe 93 PID 4404 wrote to memory of 1272 4404 PQAQQ.exe 95 PID 1272 wrote to memory of 4908 1272 cmd.exe 99 PID 4908 wrote to memory of 2068 4908 IBECMU.exe 100 PID 2068 wrote to memory of 3428 2068 cmd.exe 104 PID 3428 wrote to memory of 3256 3428 DOI.exe 105 PID 3256 wrote to memory of 5808 3256 cmd.exe 109 PID 5808 wrote to memory of 3652 5808 SJSYHO.exe 110 PID 3652 wrote to memory of 3940 3652 cmd.exe 114 PID 3940 wrote to memory of 888 3940 QFRYMRM.exe 115 PID 888 wrote to memory of 5564 888 cmd.exe 119 PID 5564 wrote to memory of 5708 5564 ACXTUA.exe 120 PID 5708 wrote to memory of 1536 5708 cmd.exe 124 PID 1536 wrote to memory of 5324 1536 BFI.exe 125 PID 5324 wrote to memory of 5776 5324 cmd.exe 129 PID 5776 wrote to memory of 5436 5776 YGQCQ.exe 130 PID 5436 wrote to memory of 748 5436 cmd.exe 134 PID 748 wrote to memory of 5680 748 IVWWY.exe 135 PID 5680 wrote to memory of 5828 5680 cmd.exe 139 PID 5828 wrote to memory of 1180 5828 SEYCBY.exe 140 PID 1180 wrote to memory of 460 1180 cmd.exe 144 PID 460 wrote to memory of 4192 460 CCDW.exe 145 PID 4192 wrote to memory of 4540 4192 cmd.exe 149 PID 4540 wrote to memory of 1480 4540 UFH.exe 150 PID 1480 wrote to memory of 248 1480 cmd.exe 154 PID 248 wrote to memory of 2012 248 VALVB.exe 155 PID 2012 wrote to memory of 1492 2012 cmd.exe 159 PID 1492 wrote to memory of 5948 1492 BATJKOD.exe 160 PID 5948 wrote to memory of 4444 5948 cmd.exe 164 PID 4444 wrote to memory of 2760 4444 FQZR.exe 165 PID 2760 wrote to memory of 1148 2760 cmd.exe 169 PID 1148 wrote to memory of 5928 1148 FTL.exe 170 PID 5928 wrote to memory of 5768 5928 cmd.exe 174 PID 5768 wrote to memory of 4924 5768 YOPQP.exe 175 PID 4924 wrote to memory of 4636 4924 cmd.exe 179 PID 4636 wrote to memory of 2512 4636 NEQ.exe 180 PID 2512 wrote to memory of 4860 2512 cmd.exe 184 PID 4860 wrote to memory of 5532 4860 RUWQAS.exe 185 PID 5532 wrote to memory of 6028 5532 cmd.exe 189 PID 6028 wrote to memory of 4356 6028 BSCCQ.exe 190 PID 4356 wrote to memory of 4268 4356 cmd.exe 194 PID 4268 wrote to memory of 996 4268 ZSKQZD.exe 195 PID 996 wrote to memory of 4556 996 cmd.exe 199 PID 4556 wrote to memory of 4124 4556 HYKEAI.exe 200 PID 4124 wrote to memory of 4468 4124 cmd.exe 204 PID 4468 wrote to memory of 5268 4468 UJSDPT.exe 205 PID 5268 wrote to memory of 4092 5268 cmd.exe 209 PID 4092 wrote to memory of 1380 4092 VEW.exe 210 PID 1380 wrote to memory of 5164 1380 cmd.exe 214 PID 5164 wrote to memory of 5676 5164 TEEUL.exe 215 PID 5676 wrote to memory of 4280 5676 cmd.exe 219 PID 4280 wrote to memory of 4512 4280 ZZDVIO.exe 220 PID 4512 wrote to memory of 568 4512 cmd.exe 224 PID 568 wrote to memory of 4832 568 FZLJ.exe 225 PID 4832 wrote to memory of 3300 4832 cmd.exe 229 PID 3300 wrote to memory of 1072 3300 LASXIK.exe 230 PID 1072 wrote to memory of 4248 1072 cmd.exe 234 PID 4248 wrote to memory of 1684 4248 UAUCLIS.exe 235 PID 1684 wrote to memory of 4184 1684 cmd.exe 239 PID 4184 wrote to memory of 4204 4184 VDYGRY.exe 240 PID 4204 wrote to memory of 932 4204 cmd.exe 244 PID 932 wrote to memory of 2400 932 ZTF.exe 245 PID 2400 wrote to memory of 5560 2400 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_7e6d42491b4fb63ec4b7fb972dd6fd96_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQAQQ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\windows\PQAQQ.exeC:\windows\PQAQQ.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBECMU.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\windows\system\IBECMU.exeC:\windows\system\IBECMU.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOI.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\windows\DOI.exeC:\windows\DOI.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SJSYHO.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\SJSYHO.exeC:\windows\SJSYHO.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFRYMRM.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\windows\system\QFRYMRM.exeC:\windows\system\QFRYMRM.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACXTUA.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:888 -
C:\windows\system\ACXTUA.exeC:\windows\system\ACXTUA.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BFI.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\windows\BFI.exeC:\windows\BFI.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGQCQ.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\windows\YGQCQ.exeC:\windows\YGQCQ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVWWY.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\IVWWY.exeC:\windows\system32\IVWWY.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEYCBY.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\windows\system\SEYCBY.exeC:\windows\system\SEYCBY.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCDW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\windows\CCDW.exeC:\windows\CCDW.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFH.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\UFH.exeC:\windows\UFH.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VALVB.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\windows\VALVB.exeC:\windows\VALVB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BATJKOD.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\windows\BATJKOD.exeC:\windows\BATJKOD.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQZR.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\system\FQZR.exeC:\windows\system\FQZR.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTL.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\windows\SysWOW64\FTL.exeC:\windows\system32\FTL.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOPQP.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\system\YOPQP.exeC:\windows\system\YOPQP.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEQ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\system\NEQ.exeC:\windows\system\NEQ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUWQAS.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\windows\SysWOW64\RUWQAS.exeC:\windows\system32\RUWQAS.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BSCCQ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\SysWOW64\BSCCQ.exeC:\windows\system32\BSCCQ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HYKEAI.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996 -
C:\windows\system\HYKEAI.exeC:\windows\system\HYKEAI.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJSDPT.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\windows\UJSDPT.exeC:\windows\UJSDPT.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VEW.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\windows\VEW.exeC:\windows\VEW.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEEUL.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\windows\TEEUL.exeC:\windows\TEEUL.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZDVIO.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\system\ZZDVIO.exeC:\windows\system\ZZDVIO.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZLJ.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\system\FZLJ.exeC:\windows\system\FZLJ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LASXIK.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\windows\system\LASXIK.exeC:\windows\system\LASXIK.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UAUCLIS.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\windows\system\UAUCLIS.exeC:\windows\system\UAUCLIS.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VDYGRY.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\windows\VDYGRY.exeC:\windows\VDYGRY.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTF.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\ZTF.exeC:\windows\ZTF.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJGFKLF.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\OJGFKLF.exeC:\windows\OJGFKLF.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DEX.exe.bat" "66⤵PID:1080
-
C:\windows\system\DEX.exeC:\windows\system\DEX.exe67⤵
- Executes dropped EXE
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKPYE.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5556 -
C:\windows\system\DKPYE.exeC:\windows\system\DKPYE.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NID.exe.bat" "70⤵PID:752
-
C:\windows\SysWOW64\NID.exeC:\windows\system32\NID.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LIKGV.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\windows\LIKGV.exeC:\windows\LIKGV.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTGE.exe.bat" "74⤵
- Executes a command shell one-liner
PID:4864 -
C:\windows\SysWOW64\YTGE.exeC:\windows\system32\YTGE.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLJXI.exe.bat" "76⤵PID:3740
-
C:\windows\SysWOW64\KLJXI.exeC:\windows\system32\KLJXI.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VEEQQCS.exe.bat" "78⤵PID:2476
-
C:\windows\system\VEEQQCS.exeC:\windows\system\VEEQQCS.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWU.exe.bat" "80⤵PID:828
-
C:\windows\SysWOW64\KZWU.exeC:\windows\system32\KZWU.exe81⤵
- Executes dropped EXE
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMBELO.exe.bat" "82⤵PID:5312
-
C:\windows\system\FMBELO.exeC:\windows\system\FMBELO.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUV.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4396 -
C:\windows\WUV.exeC:\windows\WUV.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNCEY.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:1500 -
C:\windows\UNCEY.exeC:\windows\UNCEY.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CADLHB.exe.bat" "88⤵PID:5128
-
C:\windows\CADLHB.exeC:\windows\CADLHB.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBK.exe.bat" "90⤵PID:5252
-
C:\windows\system\IBK.exeC:\windows\system\IBK.exe91⤵
- Executes dropped EXE
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBSUA.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:2452 -
C:\windows\system\GBSUA.exeC:\windows\system\GBSUA.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOXEKXN.exe.bat" "94⤵PID:4936
-
C:\windows\SysWOW64\AOXEKXN.exeC:\windows\system32\AOXEKXN.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKW.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1260 -
C:\windows\system\GKW.exeC:\windows\system\GKW.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFFJZN.exe.bat" "98⤵PID:4340
-
C:\windows\SysWOW64\VFFJZN.exeC:\windows\system32\VFFJZN.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSKSKNR.exe.bat" "100⤵PID:2424
-
C:\windows\QSKSKNR.exeC:\windows\QSKSKNR.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQD.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1144 -
C:\windows\SysWOW64\SQD.exeC:\windows\system32\SQD.exe103⤵
- Executes dropped EXE
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDOM.exe.bat" "104⤵
- Executes a command shell one-liner
PID:620 -
C:\windows\JDOM.exeC:\windows\JDOM.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJA.exe.bat" "106⤵PID:2652
-
C:\windows\system\RJA.exeC:\windows\system\RJA.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWFCT.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4428 -
C:\windows\system\MWFCT.exeC:\windows\system\MWFCT.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZJG.exe.bat" "110⤵PID:5716
-
C:\windows\EZJG.exeC:\windows\EZJG.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QRERG.exe.bat" "112⤵PID:2236
-
C:\windows\SysWOW64\QRERG.exeC:\windows\system32\QRERG.exe113⤵
- Executes dropped EXE
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZT.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5628 -
C:\windows\CZT.exeC:\windows\CZT.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSOS.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4940 -
C:\windows\system\NSOS.exeC:\windows\system\NSOS.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLR.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3220 -
C:\windows\YLR.exeC:\windows\YLR.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JDUV.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5304 -
C:\windows\system\JDUV.exeC:\windows\system\JDUV.exe121⤵
- Executes dropped EXE
PID:1264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-