Analysis
- max time kernel
78s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 14:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_fb64e28d0c6adf61114686004231353c_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-20_fb64e28d0c6adf61114686004231353c_elex_emotet_stop.exe
- Size 208KB
- Sample260820-rcwpqsdm3s
- SHA256 e246361f3292dfbca606ecf247ffaa1aa69b0906cd5ab6d0f47f8bff90bd36bc
- MD5 fb64e28d0c6adf61114686004231353c
- SHA1 f1e1f7672c51a32b4badba64dbcd21b926a13dc3
- SHA512 0101a8edb537cec139fd0b2751da4024699fa56e33902f0975ea838b92a0300d4a087c8df52aa076d4ef2a35f211813fd5a94a3abb87d05007ce3b60a1dc7337
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfZ4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOBQEj1
- TLSH T111247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 420 YONK.exe 4208 RCNPDGV.exe 2584 QVQFMM.exe 6112 ATDZTU.exe 2344 YDGPC.exe 5216 LGP.exe 3316 DOD.exe 4248 NHNLHFU.exe 2792 EPBQTWW.exe 5888 BILSFS.exe 2700 ABOIO.exe 1072 EGGX.exe 2800 SEGJGMG.exe 5820 URX.exe 1052 IXXWBJ.exe 824 LKOYMDE.exe 3632 TYBNXBA.exe 5360 IOOW.exe 3208 QTTD.exe 5204 IXZV.exe 3684 ECJ.exe 2888 HKSH.exe 3340 AOW.exe 1552 AJAGG.exe 4544 NTQ.exe 6024 XRWRCNZ.exe 2684 LPEDLZ.exe 5184 PFK.exe 2788 XKP.exe 1132 BAWSN.exe 792 LYJMU.exe 1280 JJMC.exe 5504 THSOSE.exe 4904 TMEDDD.exe 3520 SFHLD.exe 904 ENWTQJI.exe 4308 LDXLW.exe 932 OQGUIQ.exe 4672 SGUU.exe 4732 RRX.exe 4448 EXXWEA.exe 1376 XQNHWT.exe 936 CQBJ.exe 2320 SGOTRX.exe 248 WHYDC.exe 2536 YWEQK.exe 2952 GKQWU.exe 1164 YSFBH.exe 1080 RGE.exe 6016 LYT.exe 4852 TEY.exe 3440 VBLLOBW.exe 4736 OUTWFC.exe 4112 BABIHN.exe 4212 ALE.exe 5756 PBRQX.exe 2332 XOEWI.exe 1744 POKUV.exe 6072 IHANM.exe 4352 XXBE.exe 2768 ESM.exe 4412 IYWU.exe 2168 ABCEP.exe 2496 UOU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GAMBFAK.exe.bat ECGPPSJ.exe File opened for modification C:\windows\SysWOW64\GSBI.exe YMOB.exe File opened for modification C:\windows\SysWOW64\EGGX.exe ABOIO.exe File created C:\windows\SysWOW64\ECJ.exe IXZV.exe File created C:\windows\SysWOW64\UOU.exe ABCEP.exe File created C:\windows\SysWOW64\XWCD.exe.bat UOU.exe File created C:\windows\SysWOW64\GAMBFAK.exe ECGPPSJ.exe File created C:\windows\SysWOW64\GIYZXW.exe.bat TFP.exe File created C:\windows\SysWOW64\QVQFMM.exe RCNPDGV.exe File created C:\windows\SysWOW64\BAWSN.exe XKP.exe File created C:\windows\SysWOW64\BUXI.exe OWXWPT.exe File opened for modification C:\windows\SysWOW64\ABOIO.exe BILSFS.exe File created C:\windows\SysWOW64\IXZV.exe QTTD.exe File created C:\windows\SysWOW64\XRWRCNZ.exe NTQ.exe File opened for modification C:\windows\SysWOW64\LPEDLZ.exe XRWRCNZ.exe File created C:\windows\SysWOW64\BUXI.exe.bat OWXWPT.exe File opened for modification C:\windows\SysWOW64\TMEDDD.exe THSOSE.exe File opened for modification C:\windows\SysWOW64\ECJ.exe IXZV.exe File created C:\windows\SysWOW64\QVQFMM.exe.bat RCNPDGV.exe File created C:\windows\SysWOW64\XRWRCNZ.exe.bat NTQ.exe File created C:\windows\SysWOW64\XKP.exe PFK.exe File created C:\windows\SysWOW64\LDXLW.exe.bat ENWTQJI.exe File opened for modification C:\windows\SysWOW64\EXXWEA.exe RRX.exe File created C:\windows\SysWOW64\YWEQK.exe WHYDC.exe File created C:\windows\SysWOW64\TMEDDD.exe THSOSE.exe File created C:\windows\SysWOW64\TMEDDD.exe.bat THSOSE.exe File created C:\windows\SysWOW64\SFHLD.exe TMEDDD.exe File created C:\windows\SysWOW64\SFHLD.exe.bat TMEDDD.exe File created C:\windows\SysWOW64\RCNPDGV.exe YONK.exe File created C:\windows\SysWOW64\YDGPC.exe.bat ATDZTU.exe File opened for modification C:\windows\SysWOW64\HKSH.exe ECJ.exe File created C:\windows\SysWOW64\LPEDLZ.exe XRWRCNZ.exe File created C:\windows\SysWOW64\YDGPC.exe ATDZTU.exe File opened for modification C:\windows\SysWOW64\IXZV.exe QTTD.exe File opened for modification C:\windows\SysWOW64\XRWRCNZ.exe NTQ.exe File created C:\windows\SysWOW64\ENWTQJI.exe SFHLD.exe File opened for modification C:\windows\SysWOW64\YWEQK.exe WHYDC.exe File opened for modification C:\windows\SysWOW64\VQOZAD.exe GSBI.exe File opened for modification C:\windows\SysWOW64\TFP.exe EPOJK.exe File created C:\windows\SysWOW64\OUTWFC.exe VBLLOBW.exe File opened for modification C:\windows\SysWOW64\OUTWFC.exe VBLLOBW.exe File opened for modification C:\windows\SysWOW64\XWCD.exe UOU.exe File created C:\windows\SysWOW64\RBTIYC.exe QLLZ.exe File created C:\windows\SysWOW64\CTATQD.exe.bat RBTIYC.exe File opened for modification C:\windows\SysWOW64\GAMBFAK.exe ECGPPSJ.exe File created C:\windows\SysWOW64\GSBI.exe.bat YMOB.exe File created C:\windows\SysWOW64\VQOZAD.exe.bat GSBI.exe File created C:\windows\SysWOW64\HKSH.exe ECJ.exe File opened for modification C:\windows\SysWOW64\YDGPC.exe ATDZTU.exe File created C:\windows\SysWOW64\ABOIO.exe.bat BILSFS.exe File created C:\windows\SysWOW64\EGGX.exe.bat ABOIO.exe File created C:\windows\SysWOW64\LPEDLZ.exe.bat XRWRCNZ.exe File created C:\windows\SysWOW64\XKP.exe.bat PFK.exe File opened for modification C:\windows\SysWOW64\ENWTQJI.exe SFHLD.exe File created C:\windows\SysWOW64\SGOTRX.exe.bat CQBJ.exe File created C:\windows\SysWOW64\ECJ.exe.bat IXZV.exe File created C:\windows\SysWOW64\EPBQTWW.exe NHNLHFU.exe File created C:\windows\SysWOW64\HKSH.exe.bat ECJ.exe File created C:\windows\SysWOW64\UOU.exe.bat ABCEP.exe File opened for modification C:\windows\SysWOW64\RBTIYC.exe QLLZ.exe File created C:\windows\SysWOW64\RBTIYC.exe.bat QLLZ.exe File opened for modification C:\windows\SysWOW64\CTATQD.exe RBTIYC.exe File created C:\windows\SysWOW64\UFSUI.exe.bat FKJIXPS.exe File opened for modification C:\windows\SysWOW64\EPBQTWW.exe NHNLHFU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\OIWKRE.exe VQOZAD.exe File created C:\windows\BILSFS.exe EPBQTWW.exe File opened for modification C:\windows\TYBNXBA.exe LKOYMDE.exe File created C:\windows\IOOW.exe TYBNXBA.exe File created C:\windows\PBRQX.exe ALE.exe File opened for modification C:\windows\UDILXA.exe OIWKRE.exe File created C:\windows\LGP.exe.bat YDGPC.exe File created C:\windows\WHYDC.exe SGOTRX.exe File created C:\windows\system\LYT.exe RGE.exe File created C:\windows\OQGUIQ.exe.bat LDXLW.exe File created C:\windows\PBRQX.exe.bat ALE.exe File opened for modification C:\windows\BILSFS.exe EPBQTWW.exe File created C:\windows\LKOYMDE.exe.bat IXXWBJ.exe File created C:\windows\system\GKQWU.exe.bat YWEQK.exe File created C:\windows\VBLLOBW.exe.bat TEY.exe File created C:\windows\YCWU.exe FKHJ.exe File created C:\windows\YCWU.exe.bat FKHJ.exe File created C:\windows\LGP.exe YDGPC.exe File created C:\windows\system\AOW.exe.bat HKSH.exe File opened for modification C:\windows\NTQ.exe AJAGG.exe File created C:\windows\system\JJMC.exe.bat LYJMU.exe File opened for modification C:\windows\system\YSFBH.exe GKQWU.exe File created C:\windows\TEY.exe LYT.exe File created C:\windows\system\YMOB.exe.bat NTFBDVD.exe File opened for modification C:\windows\QTTD.exe IOOW.exe File opened for modification C:\windows\system\AOW.exe HKSH.exe File created C:\windows\WHYDC.exe.bat SGOTRX.exe File opened for modification C:\windows\TEY.exe LYT.exe File created C:\windows\system\XXBE.exe.bat IHANM.exe File created C:\windows\ESM.exe XXBE.exe File created C:\windows\OIWKRE.exe.bat VQOZAD.exe File created C:\windows\UDILXA.exe.bat OIWKRE.exe File created C:\windows\OWXWPT.exe.bat UDILXA.exe File created C:\windows\system\SGUU.exe OQGUIQ.exe File created C:\windows\system\POKUV.exe.bat XOEWI.exe File created C:\windows\ABCEP.exe IYWU.exe File created C:\windows\system\ECGPPSJ.exe.bat UFSUI.exe File created C:\windows\HVPF.exe GAMBFAK.exe File opened for modification C:\windows\VBLLOBW.exe TEY.exe File opened for modification C:\windows\BABIHN.exe OUTWFC.exe File created C:\windows\system\ECGPPSJ.exe UFSUI.exe File opened for modification C:\windows\system\OBKUJIK.exe KTWU.exe File created C:\windows\system\YONK.exe.bat 2026-08-20_fb64e28d0c6adf61114686004231353c_elex_emotet_stop.exe File created C:\windows\QTTD.exe.bat IOOW.exe File created C:\windows\ALE.exe.bat BABIHN.exe File opened for modification C:\windows\system\XOEWI.exe PBRQX.exe File created C:\windows\system\XXBE.exe IHANM.exe File created C:\windows\FKJIXPS.exe.bat CTATQD.exe File created C:\windows\OWXWPT.exe UDILXA.exe File opened for modification C:\windows\system\EPOJK.exe BUXI.exe File opened for modification C:\windows\system\JJMC.exe LYJMU.exe File opened for modification C:\windows\system\POKUV.exe XOEWI.exe File opened for modification C:\windows\FKJIXPS.exe CTATQD.exe File created C:\windows\HVPF.exe.bat GAMBFAK.exe File created C:\windows\system\KTWU.exe.bat GIYZXW.exe File created C:\windows\system\OBKUJIK.exe.bat KTWU.exe File opened for modification C:\windows\system\ATDZTU.exe QVQFMM.exe File opened for modification C:\windows\AJAGG.exe AOW.exe File created C:\windows\AJAGG.exe.bat AOW.exe File opened for modification C:\windows\system\FKHJ.exe XWCD.exe File created C:\windows\WTDWSX.exe HVPF.exe File created C:\windows\BABIHN.exe OUTWFC.exe File opened for modification C:\windows\system\IHANM.exe POKUV.exe File opened for modification C:\windows\ESM.exe XXBE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1852 cmd.exe 3760 cmd.exe 2520 cmd.exe 5324 cmd.exe 4172 cmd.exe 5592 cmd.exe 3488 cmd.exe 5420 cmd.exe 2980 cmd.exe 6088 cmd.exe 3220 cmd.exe 1360 cmd.exe 2456 cmd.exe 5948 cmd.exe 4364 cmd.exe 1956 cmd.exe 3260 cmd.exe 3620 cmd.exe 912 cmd.exe 6064 cmd.exe 1796 cmd.exe 4216 cmd.exe 4964 cmd.exe 296 cmd.exe 4572 cmd.exe 6084 cmd.exe 4648 cmd.exe 1860 cmd.exe 4692 cmd.exe 6136 cmd.exe 2336 cmd.exe 5728 cmd.exe 3600 cmd.exe 2808 cmd.exe 1572 cmd.exe 2384 cmd.exe 1720 cmd.exe 5588 cmd.exe 712 cmd.exe 5624 cmd.exe 3756 cmd.exe 3652 cmd.exe 2592 cmd.exe 5376 cmd.exe 4988 cmd.exe 2392 cmd.exe 6048 cmd.exe 3408 cmd.exe 952 cmd.exe 4476 cmd.exe 292 cmd.exe 2920 cmd.exe 5864 cmd.exe 4228 cmd.exe 3404 cmd.exe 6000 cmd.exe 1152 cmd.exe 3436 cmd.exe 2804 cmd.exe 5456 cmd.exe 4152 cmd.exe 960 cmd.exe 4344 cmd.exe 1836 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2440 1088 WerFault.exe 87 4980 420 WerFault.exe 93 3836 4208 WerFault.exe 99 5368 2584 WerFault.exe 104 4676 6112 WerFault.exe 109 2632 2344 WerFault.exe 114 2988 5216 WerFault.exe 119 4228 3316 WerFault.exe 124 4344 4248 WerFault.exe 129 2036 2792 WerFault.exe 134 4444 5888 WerFault.exe 139 4912 2700 WerFault.exe 144 4588 1072 WerFault.exe 149 4392 2800 WerFault.exe 154 1212 5820 WerFault.exe 159 2204 1052 WerFault.exe 164 4748 824 WerFault.exe 169 1880 3632 WerFault.exe 174 4196 5360 WerFault.exe 179 5560 3208 WerFault.exe 184 3212 5204 WerFault.exe 189 1280 3684 WerFault.exe 194 4348 2888 WerFault.exe 199 2168 3340 WerFault.exe 204 4856 1552 WerFault.exe 209 3620 4544 WerFault.exe 214 4116 6024 WerFault.exe 219 5388 2684 WerFault.exe 224 3220 5184 WerFault.exe 229 2132 2788 WerFault.exe 234 1120 1132 WerFault.exe 239 2836 792 WerFault.exe 244 2656 1280 WerFault.exe 249 5172 5504 WerFault.exe 254 2600 4904 WerFault.exe 260 5564 3520 WerFault.exe 265 712 904 WerFault.exe 270 5884 4308 WerFault.exe 275 1744 932 WerFault.exe 280 3760 4672 WerFault.exe 285 2808 4732 WerFault.exe 290 5572 4448 WerFault.exe 295 4252 1376 WerFault.exe 300 4364 936 WerFault.exe 305 4760 2320 WerFault.exe 310 3008 248 WerFault.exe 315 4948 2536 WerFault.exe 320 2632 2952 WerFault.exe 325 3808 1164 WerFault.exe 330 1392 1080 WerFault.exe 335 4680 6016 WerFault.exe 340 2044 4852 WerFault.exe 345 4588 3440 WerFault.exe 350 3336 4736 WerFault.exe 355 4836 4112 WerFault.exe 360 4564 4212 WerFault.exe 365 1880 5756 WerFault.exe 370 3652 2332 WerFault.exe 375 5780 1744 WerFault.exe 380 2840 6072 WerFault.exe 385 2488 4352 WerFault.exe 390 4912 2768 WerFault.exe 395 2440 4412 WerFault.exe 400 4440 2168 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSFBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBRQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABOIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YONK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIWKRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEGJGMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWEQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQNHWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBLLOBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABCEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDILXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMEDDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPOJK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHNLHFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POKUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLLZ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1088 2026-08-20_fb64e28d0c6adf61114686004231353c_elex_emotet_stop.exe 1088 2026-08-20_fb64e28d0c6adf61114686004231353c_elex_emotet_stop.exe 420 YONK.exe 420 YONK.exe 4208 RCNPDGV.exe 4208 RCNPDGV.exe 2584 QVQFMM.exe 2584 QVQFMM.exe 6112 ATDZTU.exe 6112 ATDZTU.exe 2344 YDGPC.exe 2344 YDGPC.exe 5216 LGP.exe 5216 LGP.exe 3316 DOD.exe 3316 DOD.exe 4248 NHNLHFU.exe 4248 NHNLHFU.exe 2792 EPBQTWW.exe 2792 EPBQTWW.exe 5888 BILSFS.exe 5888 BILSFS.exe 2700 ABOIO.exe 2700 ABOIO.exe 1072 EGGX.exe 1072 EGGX.exe 2800 SEGJGMG.exe 2800 SEGJGMG.exe 5820 URX.exe 5820 URX.exe 1052 IXXWBJ.exe 1052 IXXWBJ.exe 824 LKOYMDE.exe 824 LKOYMDE.exe 3632 TYBNXBA.exe 3632 TYBNXBA.exe 5360 IOOW.exe 5360 IOOW.exe 3208 QTTD.exe 3208 QTTD.exe 5204 IXZV.exe 5204 IXZV.exe 3684 ECJ.exe 3684 ECJ.exe 2888 HKSH.exe 2888 HKSH.exe 3340 AOW.exe 3340 AOW.exe 1552 AJAGG.exe 1552 AJAGG.exe 4544 NTQ.exe 4544 NTQ.exe 6024 XRWRCNZ.exe 6024 XRWRCNZ.exe 2684 LPEDLZ.exe 2684 LPEDLZ.exe 5184 PFK.exe 5184 PFK.exe 2788 XKP.exe 2788 XKP.exe 1132 BAWSN.exe 1132 BAWSN.exe 792 LYJMU.exe 792 LYJMU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1088 2026-08-20_fb64e28d0c6adf61114686004231353c_elex_emotet_stop.exe 1088 2026-08-20_fb64e28d0c6adf61114686004231353c_elex_emotet_stop.exe 420 YONK.exe 420 YONK.exe 4208 RCNPDGV.exe 4208 RCNPDGV.exe 2584 QVQFMM.exe 2584 QVQFMM.exe 6112 ATDZTU.exe 6112 ATDZTU.exe 2344 YDGPC.exe 2344 YDGPC.exe 5216 LGP.exe 5216 LGP.exe 3316 DOD.exe 3316 DOD.exe 4248 NHNLHFU.exe 4248 NHNLHFU.exe 2792 EPBQTWW.exe 2792 EPBQTWW.exe 5888 BILSFS.exe 5888 BILSFS.exe 2700 ABOIO.exe 2700 ABOIO.exe 1072 EGGX.exe 1072 EGGX.exe 2800 SEGJGMG.exe 2800 SEGJGMG.exe 5820 URX.exe 5820 URX.exe 1052 IXXWBJ.exe 1052 IXXWBJ.exe 824 LKOYMDE.exe 824 LKOYMDE.exe 3632 TYBNXBA.exe 3632 TYBNXBA.exe 5360 IOOW.exe 5360 IOOW.exe 3208 QTTD.exe 3208 QTTD.exe 5204 IXZV.exe 5204 IXZV.exe 3684 ECJ.exe 3684 ECJ.exe 2888 HKSH.exe 2888 HKSH.exe 3340 AOW.exe 3340 AOW.exe 1552 AJAGG.exe 1552 AJAGG.exe 4544 NTQ.exe 4544 NTQ.exe 6024 XRWRCNZ.exe 6024 XRWRCNZ.exe 2684 LPEDLZ.exe 2684 LPEDLZ.exe 5184 PFK.exe 5184 PFK.exe 2788 XKP.exe 2788 XKP.exe 1132 BAWSN.exe 1132 BAWSN.exe 792 LYJMU.exe 792 LYJMU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1088 wrote to memory of 4332 1088 2026-08-20_fb64e28d0c6adf61114686004231353c_elex_emotet_stop.exe 89 PID 4332 wrote to memory of 420 4332 cmd.exe 93 PID 420 wrote to memory of 4876 420 YONK.exe 95 PID 4876 wrote to memory of 4208 4876 cmd.exe 99 PID 4208 wrote to memory of 4988 4208 RCNPDGV.exe 100 PID 4988 wrote to memory of 2584 4988 cmd.exe 104 PID 2584 wrote to memory of 3648 2584 QVQFMM.exe 105 PID 3648 wrote to memory of 6112 3648 cmd.exe 109 PID 6112 wrote to memory of 3824 6112 ATDZTU.exe 110 PID 3824 wrote to memory of 2344 3824 cmd.exe 114 PID 2344 wrote to memory of 2144 2344 YDGPC.exe 115 PID 2144 wrote to memory of 5216 2144 cmd.exe 119 PID 5216 wrote to memory of 1996 5216 LGP.exe 120 PID 1996 wrote to memory of 3316 1996 cmd.exe 124 PID 3316 wrote to memory of 1572 3316 DOD.exe 125 PID 1572 wrote to memory of 4248 1572 cmd.exe 129 PID 4248 wrote to memory of 464 4248 NHNLHFU.exe 130 PID 464 wrote to memory of 2792 464 cmd.exe 134 PID 2792 wrote to memory of 2912 2792 EPBQTWW.exe 135 PID 2912 wrote to memory of 5888 2912 cmd.exe 139 PID 5888 wrote to memory of 5788 5888 BILSFS.exe 140 PID 5788 wrote to memory of 2700 5788 cmd.exe 144 PID 2700 wrote to memory of 5304 2700 ABOIO.exe 145 PID 5304 wrote to memory of 1072 5304 cmd.exe 149 PID 1072 wrote to memory of 3540 1072 EGGX.exe 150 PID 3540 wrote to memory of 2800 3540 cmd.exe 154 PID 2800 wrote to memory of 4980 2800 SEGJGMG.exe 155 PID 4980 wrote to memory of 5820 4980 cmd.exe 159 PID 5820 wrote to memory of 296 5820 URX.exe 160 PID 296 wrote to memory of 1052 296 cmd.exe 164 PID 1052 wrote to memory of 1948 1052 IXXWBJ.exe 165 PID 1948 wrote to memory of 824 1948 cmd.exe 169 PID 824 wrote to memory of 5008 824 LKOYMDE.exe 170 PID 5008 wrote to memory of 3632 5008 cmd.exe 174 PID 3632 wrote to memory of 4572 3632 TYBNXBA.exe 175 PID 4572 wrote to memory of 5360 4572 cmd.exe 179 PID 5360 wrote to memory of 2392 5360 IOOW.exe 180 PID 2392 wrote to memory of 3208 2392 cmd.exe 184 PID 3208 wrote to memory of 2456 3208 QTTD.exe 185 PID 2456 wrote to memory of 5204 2456 cmd.exe 189 PID 5204 wrote to memory of 4692 5204 IXZV.exe 190 PID 4692 wrote to memory of 3684 4692 cmd.exe 194 PID 3684 wrote to memory of 5948 3684 ECJ.exe 195 PID 5948 wrote to memory of 2888 5948 cmd.exe 199 PID 2888 wrote to memory of 4164 2888 HKSH.exe 200 PID 4164 wrote to memory of 3340 4164 cmd.exe 204 PID 3340 wrote to memory of 5680 3340 AOW.exe 205 PID 5680 wrote to memory of 1552 5680 cmd.exe 209 PID 1552 wrote to memory of 3204 1552 AJAGG.exe 210 PID 3204 wrote to memory of 4544 3204 cmd.exe 214 PID 4544 wrote to memory of 6048 4544 NTQ.exe 215 PID 6048 wrote to memory of 6024 6048 cmd.exe 219 PID 6024 wrote to memory of 1796 6024 XRWRCNZ.exe 220 PID 1796 wrote to memory of 2684 1796 cmd.exe 224 PID 2684 wrote to memory of 4216 2684 LPEDLZ.exe 225 PID 4216 wrote to memory of 5184 4216 cmd.exe 229 PID 5184 wrote to memory of 1408 5184 PFK.exe 230 PID 1408 wrote to memory of 2788 1408 cmd.exe 234 PID 2788 wrote to memory of 3408 2788 XKP.exe 235 PID 3408 wrote to memory of 1132 3408 cmd.exe 239 PID 1132 wrote to memory of 4972 1132 BAWSN.exe 240 PID 4972 wrote to memory of 792 4972 cmd.exe 244 PID 792 wrote to memory of 4964 792 LYJMU.exe 245 PID 4964 wrote to memory of 1280 4964 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_fb64e28d0c6adf61114686004231353c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_fb64e28d0c6adf61114686004231353c_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YONK.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\system\YONK.exeC:\windows\system\YONK.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCNPDGV.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\SysWOW64\RCNPDGV.exeC:\windows\system32\RCNPDGV.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVQFMM.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\SysWOW64\QVQFMM.exeC:\windows\system32\QVQFMM.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATDZTU.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\windows\system\ATDZTU.exeC:\windows\system\ATDZTU.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDGPC.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\windows\SysWOW64\YDGPC.exeC:\windows\system32\YDGPC.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGP.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\windows\LGP.exeC:\windows\LGP.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\system\DOD.exeC:\windows\system\DOD.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NHNLHFU.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\windows\SysWOW64\NHNLHFU.exeC:\windows\system32\NHNLHFU.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPBQTWW.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\windows\SysWOW64\EPBQTWW.exeC:\windows\system32\EPBQTWW.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BILSFS.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\BILSFS.exeC:\windows\BILSFS.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABOIO.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\SysWOW64\ABOIO.exeC:\windows\system32\ABOIO.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EGGX.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\windows\SysWOW64\EGGX.exeC:\windows\system32\EGGX.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEGJGMG.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\windows\system\SEGJGMG.exeC:\windows\system\SEGJGMG.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URX.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\system\URX.exeC:\windows\system\URX.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXXWBJ.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:296 -
C:\windows\IXXWBJ.exeC:\windows\IXXWBJ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKOYMDE.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\windows\LKOYMDE.exeC:\windows\LKOYMDE.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYBNXBA.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\windows\TYBNXBA.exeC:\windows\TYBNXBA.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOOW.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\IOOW.exeC:\windows\IOOW.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTTD.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\windows\QTTD.exeC:\windows\QTTD.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ECJ.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\SysWOW64\ECJ.exeC:\windows\system32\ECJ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKSH.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\SysWOW64\HKSH.exeC:\windows\system32\HKSH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOW.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\windows\system\AOW.exeC:\windows\system\AOW.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJAGG.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\windows\AJAGG.exeC:\windows\AJAGG.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTQ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\NTQ.exeC:\windows\NTQ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRWRCNZ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\windows\SysWOW64\XRWRCNZ.exeC:\windows\system32\XRWRCNZ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LPEDLZ.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\windows\SysWOW64\LPEDLZ.exeC:\windows\system32\LPEDLZ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFK.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\PFK.exeC:\windows\PFK.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKP.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\windows\SysWOW64\XKP.exeC:\windows\system32\XKP.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAWSN.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\SysWOW64\BAWSN.exeC:\windows\system32\BAWSN.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYJMU.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\system\LYJMU.exeC:\windows\system\LYJMU.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THSOSE.exe.bat" "66⤵PID:5064
-
C:\windows\SysWOW64\THSOSE.exeC:\windows\system32\THSOSE.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TMEDDD.exe.bat" "68⤵PID:4532
-
C:\windows\SysWOW64\TMEDDD.exeC:\windows\system32\TMEDDD.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFHLD.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1284 -
C:\windows\SysWOW64\SFHLD.exeC:\windows\system32\SFHLD.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENWTQJI.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3620 -
C:\windows\SysWOW64\ENWTQJI.exeC:\windows\system32\ENWTQJI.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LDXLW.exe.bat" "74⤵PID:3732
-
C:\windows\SysWOW64\LDXLW.exeC:\windows\system32\LDXLW.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQGUIQ.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5624 -
C:\windows\OQGUIQ.exeC:\windows\OQGUIQ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGUU.exe.bat" "78⤵PID:4196
-
C:\windows\system\SGUU.exeC:\windows\system\SGUU.exe79⤵
- Executes dropped EXE
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRX.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1268 -
C:\windows\RRX.exeC:\windows\RRX.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXXWEA.exe.bat" "82⤵PID:4944
-
C:\windows\SysWOW64\EXXWEA.exeC:\windows\system32\EXXWEA.exe83⤵
- Executes dropped EXE
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XQNHWT.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4172 -
C:\windows\XQNHWT.exeC:\windows\XQNHWT.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQBJ.exe.bat" "86⤵PID:1160
-
C:\windows\system\CQBJ.exeC:\windows\system\CQBJ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGOTRX.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1852 -
C:\windows\SysWOW64\SGOTRX.exeC:\windows\system32\SGOTRX.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WHYDC.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:204 -
C:\windows\WHYDC.exeC:\windows\WHYDC.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWEQK.exe.bat" "92⤵
- Executes a command shell one-liner
PID:952 -
C:\windows\SysWOW64\YWEQK.exeC:\windows\system32\YWEQK.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKQWU.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1368 -
C:\windows\system\GKQWU.exeC:\windows\system\GKQWU.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSFBH.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2964 -
C:\windows\system\YSFBH.exeC:\windows\system\YSFBH.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGE.exe.bat" "98⤵PID:3252
-
C:\windows\system\RGE.exeC:\windows\system\RGE.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYT.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5768 -
C:\windows\system\LYT.exeC:\windows\system\LYT.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEY.exe.bat" "102⤵PID:1120
-
C:\windows\TEY.exeC:\windows\TEY.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VBLLOBW.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5452 -
C:\windows\VBLLOBW.exeC:\windows\VBLLOBW.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUTWFC.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1152 -
C:\windows\SysWOW64\OUTWFC.exeC:\windows\system32\OUTWFC.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BABIHN.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5220 -
C:\windows\BABIHN.exeC:\windows\BABIHN.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ALE.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:256 -
C:\windows\ALE.exeC:\windows\ALE.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PBRQX.exe.bat" "112⤵PID:4752
-
C:\windows\PBRQX.exeC:\windows\PBRQX.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOEWI.exe.bat" "114⤵PID:4512
-
C:\windows\system\XOEWI.exeC:\windows\system\XOEWI.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\POKUV.exe.bat" "116⤵PID:5936
-
C:\windows\system\POKUV.exeC:\windows\system\POKUV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHANM.exe.bat" "118⤵PID:4688
-
C:\windows\system\IHANM.exeC:\windows\system\IHANM.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXBE.exe.bat" "120⤵PID:3904
-
C:\windows\system\XXBE.exeC:\windows\system\XXBE.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-