Analysis
- max time kernel
74s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 16:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe
- Size 208KB
- Sample260825-tkl7da11ht
- SHA256 5cb97694fc8fb2d67cec45ac6f90944639e0d5c63f79b2c938d0e10b67a205c8
- MD5 30dae4479649cf9db117fd6694c55bc4
- SHA1 21c2692170ccf81694523ab40fd98041ca942b28
- SHA512 85958a11eb69d9d37125256bdff10efb0bf89c992c7c4f63087ee6bdc788d0b909322c5b3cde73a453f03c8b7b98b7af9d46a2ba312a28a66349b68e677cc0a1
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb8l9dL+LOfL4pLthEjQT6j:vlZtbLWIgd1LZ9oECZb8l95+LOzkEj1
- TLSH T189247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5068 YBP.exe 4888 OKM.exe 3328 QIZ.exe 472 CQGLG.exe 3360 WDLUQJE.exe 4904 CDSI.exe 3180 XRXRKD.exe 5392 RMC.exe 5984 BMWO.exe 4076 SVYTB.exe 2448 MIDCLFC.exe 1692 JNV.exe 1112 EBAB.exe 3284 EEEWRY.exe 1352 EJEL.exe 1372 ZXJCDD.exe 3580 FXIQMG.exe 2420 WFKV.exe 4764 YDYPXLY.exe 5728 ZYCLKJ.exe 5300 HMGSV.exe 2100 FMOGEC.exe 1736 FPAJJ.exe 4824 ACXTUA.exe 1844 UQB.exe 2816 PDGLO.exe 1564 AVJEOH.exe 4452 MMQ.exe 2788 FHUIG.exe 3048 LHB.exe 5372 RHJJG.exe 2172 PCIKLO.exe 3464 BTP.exe 4368 TOTOCXT.exe 3236 ZOAC.exe 1936 UJFLWR.exe 2780 OWK.exe 5804 JKPMI.exe 5280 ASRRUW.exe 1724 CQWLB.exe 1956 IIEZKZ.exe 1876 ZQGE.exe 2588 UELOYE.exe 3492 DMNTBBZ.exe 4812 YZRC.exe 800 CHYKYT.exe 4304 IIGY.exe 5452 MYMYTG.exe 5492 FQPRBNP.exe 1972 YTTM.exe 5228 BBAUTV.exe 5712 IXZV.exe 5264 XSIZJTC.exe 1084 RFNR.exe 3568 BNPWX.exe 2556 XLVTEAV.exe 2348 DLDH.exe 3732 DZVVW.exe 1088 JZCJF.exe 5208 USFUNR.exe 2640 RPD.exe 5876 LKIAF.exe 2764 GYNKHAN.exe 1176 RQQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JNV.exe.bat MIDCLFC.exe File created C:\windows\SysWOW64\UQB.exe.bat ACXTUA.exe File opened for modification C:\windows\SysWOW64\CQWLB.exe ASRRUW.exe File created C:\windows\SysWOW64\RQQ.exe GYNKHAN.exe File created C:\windows\SysWOW64\RQQ.exe.bat GYNKHAN.exe File created C:\windows\SysWOW64\XOAVBM.exe CBVMR.exe File created C:\windows\SysWOW64\HKPXYLN.exe BKHK.exe File opened for modification C:\windows\SysWOW64\HXXA.exe HMWZ.exe File opened for modification C:\windows\SysWOW64\ZXJCDD.exe EJEL.exe File created C:\windows\SysWOW64\WFKV.exe FXIQMG.exe File opened for modification C:\windows\SysWOW64\FPAJJ.exe FMOGEC.exe File created C:\windows\SysWOW64\IIGY.exe CHYKYT.exe File created C:\windows\SysWOW64\XLVTEAV.exe BNPWX.exe File opened for modification C:\windows\SysWOW64\DZVVW.exe DLDH.exe File created C:\windows\SysWOW64\LKIAF.exe RPD.exe File created C:\windows\SysWOW64\TMQATEX.exe.bat TGQMSRU.exe File opened for modification C:\windows\SysWOW64\YDYPXLY.exe WFKV.exe File created C:\windows\SysWOW64\PCIKLO.exe RHJJG.exe File created C:\windows\SysWOW64\CQWLB.exe.bat ASRRUW.exe File opened for modification C:\windows\SysWOW64\LKIAF.exe RPD.exe File created C:\windows\SysWOW64\EMDKN.exe.bat NEJX.exe File created C:\windows\SysWOW64\CDSI.exe.bat WDLUQJE.exe File created C:\windows\SysWOW64\PCIKLO.exe.bat RHJJG.exe File opened for modification C:\windows\SysWOW64\IIGY.exe CHYKYT.exe File created C:\windows\SysWOW64\HKPXYLN.exe.bat BKHK.exe File created C:\windows\SysWOW64\YITRNXE.exe ZNUQJU.exe File created C:\windows\SysWOW64\HXXA.exe HMWZ.exe File created C:\windows\SysWOW64\RMC.exe XRXRKD.exe File created C:\windows\SysWOW64\IXZV.exe BBAUTV.exe File created C:\windows\SysWOW64\BNPWX.exe.bat RFNR.exe File created C:\windows\SysWOW64\DZVVW.exe.bat DLDH.exe File created C:\windows\SysWOW64\HAJWQI.exe.bat HXXA.exe File created C:\windows\SysWOW64\YBP.exe 2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe File created C:\windows\SysWOW64\FXIQMG.exe ZXJCDD.exe File created C:\windows\SysWOW64\YDYPXLY.exe.bat WFKV.exe File created C:\windows\SysWOW64\FMOGEC.exe HMGSV.exe File opened for modification C:\windows\SysWOW64\FMOGEC.exe HMGSV.exe File created C:\windows\SysWOW64\BNPWX.exe RFNR.exe File opened for modification C:\windows\SysWOW64\GYNKHAN.exe LKIAF.exe File opened for modification C:\windows\SysWOW64\CDSI.exe WDLUQJE.exe File opened for modification C:\windows\SysWOW64\SVYTB.exe BMWO.exe File created C:\windows\SysWOW64\FPAJJ.exe.bat FMOGEC.exe File opened for modification C:\windows\SysWOW64\PCIKLO.exe RHJJG.exe File created C:\windows\SysWOW64\UELOYE.exe.bat ZQGE.exe File opened for modification C:\windows\SysWOW64\BNPWX.exe RFNR.exe File created C:\windows\SysWOW64\GYNKHAN.exe LKIAF.exe File created C:\windows\SysWOW64\CBVMR.exe RJA.exe File created C:\windows\SysWOW64\YBP.exe.bat 2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe File created C:\windows\SysWOW64\CDSI.exe WDLUQJE.exe File opened for modification C:\windows\SysWOW64\RMC.exe XRXRKD.exe File created C:\windows\SysWOW64\JNV.exe MIDCLFC.exe File created C:\windows\SysWOW64\FXIQMG.exe.bat ZXJCDD.exe File created C:\windows\SysWOW64\LKIAF.exe.bat RPD.exe File opened for modification C:\windows\SysWOW64\RQQ.exe GYNKHAN.exe File created C:\windows\SysWOW64\NEJX.exe YJRSRI.exe File opened for modification C:\windows\SysWOW64\WFKV.exe FXIQMG.exe File opened for modification C:\windows\SysWOW64\UQB.exe ACXTUA.exe File opened for modification C:\windows\SysWOW64\UELOYE.exe ZQGE.exe File opened for modification C:\windows\SysWOW64\IXZV.exe BBAUTV.exe File opened for modification C:\windows\SysWOW64\CBVMR.exe RJA.exe File opened for modification C:\windows\SysWOW64\YITRNXE.exe ZNUQJU.exe File created C:\windows\SysWOW64\SVYTB.exe BMWO.exe File created C:\windows\SysWOW64\CQWLB.exe ASRRUW.exe File created C:\windows\SysWOW64\UELOYE.exe ZQGE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\ZOAC.exe.bat TOTOCXT.exe File opened for modification C:\windows\UNMD.exe ZZITPSY.exe File created C:\windows\system\EBAB.exe.bat JNV.exe File created C:\windows\EJEL.exe.bat EEEWRY.exe File opened for modification C:\windows\ZOAC.exe TOTOCXT.exe File created C:\windows\DMNTBBZ.exe.bat UELOYE.exe File created C:\windows\BBAUTV.exe.bat YTTM.exe File created C:\windows\system\FQPRBNP.exe MYMYTG.exe File opened for modification C:\windows\system\DLDH.exe XLVTEAV.exe File created C:\windows\system\DLDH.exe.bat XLVTEAV.exe File created C:\windows\system\MMQ.exe.bat AVJEOH.exe File opened for modification C:\windows\EEEWRY.exe EBAB.exe File opened for modification C:\windows\system\QIZ.exe OKM.exe File opened for modification C:\windows\system\ZYCLKJ.exe YDYPXLY.exe File created C:\windows\PDGLO.exe UQB.exe File created C:\windows\system\XRY.exe RQQ.exe File opened for modification C:\windows\IHD.exe XOAVBM.exe File opened for modification C:\windows\BKHK.exe IHD.exe File created C:\windows\HMGSV.exe.bat ZYCLKJ.exe File opened for modification C:\windows\RHJJG.exe LHB.exe File created C:\windows\EJEL.exe EEEWRY.exe File created C:\windows\system\ZYCLKJ.exe.bat YDYPXLY.exe File created C:\windows\system\JKPMI.exe OWK.exe File created C:\windows\BKHK.exe.bat IHD.exe File created C:\windows\system\DWPZS.exe.bat NGG.exe File created C:\windows\system\CTGU.exe HGBKZUS.exe File opened for modification C:\windows\OWK.exe UJFLWR.exe File created C:\windows\YLR.exe HKPXYLN.exe File opened for modification C:\windows\ZNUQJU.exe UNMD.exe File created C:\windows\system\JKPMI.exe.bat OWK.exe File created C:\windows\USFUNR.exe.bat JZCJF.exe File created C:\windows\system\RJA.exe.bat FAUTWM.exe File created C:\windows\BKHK.exe IHD.exe File opened for modification C:\windows\system\NGG.exe IGZMDF.exe File created C:\windows\BMWO.exe RMC.exe File created C:\windows\system\BTP.exe PCIKLO.exe File created C:\windows\system\CHYKYT.exe YZRC.exe File opened for modification C:\windows\RVOW.exe LVGI.exe File opened for modification C:\windows\system\IGZMDF.exe YITRNXE.exe File opened for modification C:\windows\system\TGQMSRU.exe CTGU.exe File created C:\windows\system\ZYCLKJ.exe YDYPXLY.exe File created C:\windows\system\ACXTUA.exe FPAJJ.exe File created C:\windows\system\CHYKYT.exe.bat YZRC.exe File opened for modification C:\windows\system\XSIZJTC.exe IXZV.exe File created C:\windows\RVOW.exe LVGI.exe File created C:\windows\ZMYOK.exe.bat TMQATEX.exe File created C:\windows\FAUTWM.exe.bat RVOW.exe File opened for modification C:\windows\HGBKZUS.exe HAJWQI.exe File created C:\windows\system\CTGU.exe.bat HGBKZUS.exe File created C:\windows\HMGSV.exe ZYCLKJ.exe File created C:\windows\FZHHBF.exe IUBKUW.exe File opened for modification C:\windows\YTTM.exe FQPRBNP.exe File created C:\windows\system\ACXTUA.exe.bat FPAJJ.exe File created C:\windows\CQGLG.exe QIZ.exe File created C:\windows\CQGLG.exe.bat QIZ.exe File created C:\windows\system\WDLUQJE.exe.bat CQGLG.exe File created C:\windows\system\XRXRKD.exe CDSI.exe File created C:\windows\ZOAC.exe TOTOCXT.exe File opened for modification C:\windows\system\JKPMI.exe OWK.exe File opened for modification C:\windows\PDGLO.exe UQB.exe File created C:\windows\system\AVJEOH.exe PDGLO.exe File created C:\windows\system\AVJEOH.exe.bat PDGLO.exe File created C:\windows\RHJJG.exe.bat LHB.exe File created C:\windows\IUBKUW.exe.bat ZORS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1620 cmd.exe 4140 cmd.exe 724 cmd.exe 2516 cmd.exe 4584 cmd.exe 5116 cmd.exe 1988 cmd.exe 1740 cmd.exe 5484 cmd.exe 1212 cmd.exe 1380 cmd.exe 3100 cmd.exe 5948 cmd.exe 2840 cmd.exe 2328 cmd.exe 4832 cmd.exe 4336 cmd.exe 6060 cmd.exe 4860 cmd.exe 2644 cmd.exe 1720 cmd.exe 4312 cmd.exe 4704 cmd.exe 5892 cmd.exe 4500 cmd.exe 2772 cmd.exe 1700 cmd.exe 3352 cmd.exe 3104 cmd.exe 2836 cmd.exe 568 cmd.exe 1092 cmd.exe 4144 cmd.exe 2976 cmd.exe 3696 cmd.exe 2232 cmd.exe 120 cmd.exe 1848 cmd.exe 1712 cmd.exe 1856 cmd.exe 4536 cmd.exe 2992 cmd.exe 5708 cmd.exe 580 cmd.exe 6092 cmd.exe 5884 cmd.exe 5344 cmd.exe 1148 cmd.exe 5384 cmd.exe 1452 cmd.exe 2360 cmd.exe 4612 cmd.exe 3676 cmd.exe 5632 cmd.exe 5848 cmd.exe 4576 cmd.exe 4928 cmd.exe 5476 cmd.exe 3168 cmd.exe 4288 cmd.exe 5176 cmd.exe 2444 cmd.exe 1812 cmd.exe 3444 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4308 1312 WerFault.exe 87 2044 5068 WerFault.exe 93 4532 4888 WerFault.exe 99 4584 3328 WerFault.exe 104 2784 472 WerFault.exe 108 2836 3360 WerFault.exe 114 1648 4904 WerFault.exe 119 2028 3180 WerFault.exe 124 5288 5392 WerFault.exe 129 5680 5984 WerFault.exe 134 5260 4076 WerFault.exe 139 4832 2448 WerFault.exe 144 5168 1692 WerFault.exe 149 1916 1112 WerFault.exe 154 120 3284 WerFault.exe 159 5908 1352 WerFault.exe 164 4464 1372 WerFault.exe 169 5796 3580 WerFault.exe 174 4780 2420 WerFault.exe 179 2544 4764 WerFault.exe 184 1500 5728 WerFault.exe 189 868 5300 WerFault.exe 194 4020 2100 WerFault.exe 199 5636 1736 WerFault.exe 204 2044 4824 WerFault.exe 209 3348 1844 WerFault.exe 214 4448 2816 WerFault.exe 219 4492 1564 WerFault.exe 224 564 4452 WerFault.exe 229 2880 2788 WerFault.exe 234 3200 3048 WerFault.exe 239 4944 5372 WerFault.exe 244 3540 2172 WerFault.exe 249 4220 3464 WerFault.exe 254 4188 4368 WerFault.exe 259 5856 3236 WerFault.exe 264 3760 1936 WerFault.exe 269 3368 2780 WerFault.exe 274 724 5804 WerFault.exe 280 3484 5280 WerFault.exe 285 4848 1724 WerFault.exe 290 4176 1956 WerFault.exe 295 5648 1876 WerFault.exe 300 5772 2588 WerFault.exe 305 5920 3492 WerFault.exe 310 3324 4812 WerFault.exe 315 2820 800 WerFault.exe 320 4060 4304 WerFault.exe 325 3732 5452 WerFault.exe 330 5252 5492 WerFault.exe 335 2188 1972 WerFault.exe 340 1828 5228 WerFault.exe 345 4872 5712 WerFault.exe 350 4220 5264 WerFault.exe 355 3516 1084 WerFault.exe 360 1552 3568 WerFault.exe 365 1616 2556 WerFault.exe 370 4464 2348 WerFault.exe 375 3748 3732 WerFault.exe 380 4720 1088 WerFault.exe 385 4396 5208 WerFault.exe 390 2184 2640 WerFault.exe 395 1700 5876 WerFault.exe 400 4308 2764 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKPXYLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXJCDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOAVBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSIZJTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNPWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCIKLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKPMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQWLB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZCJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHUIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRXRKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEEWRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASRRUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYNKHAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZHHBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIDCLFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMDKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YITRNXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HGBKZUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLVTEAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAJWQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMQATEX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMOGEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMYOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1312 2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe 1312 2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe 5068 YBP.exe 5068 YBP.exe 4888 OKM.exe 4888 OKM.exe 3328 QIZ.exe 3328 QIZ.exe 472 CQGLG.exe 472 CQGLG.exe 3360 WDLUQJE.exe 3360 WDLUQJE.exe 4904 CDSI.exe 4904 CDSI.exe 3180 XRXRKD.exe 3180 XRXRKD.exe 5392 RMC.exe 5392 RMC.exe 5984 BMWO.exe 5984 BMWO.exe 4076 SVYTB.exe 4076 SVYTB.exe 2448 MIDCLFC.exe 2448 MIDCLFC.exe 1692 JNV.exe 1692 JNV.exe 1112 EBAB.exe 1112 EBAB.exe 3284 EEEWRY.exe 3284 EEEWRY.exe 1352 EJEL.exe 1352 EJEL.exe 1372 ZXJCDD.exe 1372 ZXJCDD.exe 3580 FXIQMG.exe 3580 FXIQMG.exe 2420 WFKV.exe 2420 WFKV.exe 4764 YDYPXLY.exe 4764 YDYPXLY.exe 5728 ZYCLKJ.exe 5728 ZYCLKJ.exe 5300 HMGSV.exe 5300 HMGSV.exe 2100 FMOGEC.exe 2100 FMOGEC.exe 1736 FPAJJ.exe 1736 FPAJJ.exe 4824 ACXTUA.exe 4824 ACXTUA.exe 1844 UQB.exe 1844 UQB.exe 2816 PDGLO.exe 2816 PDGLO.exe 1564 AVJEOH.exe 1564 AVJEOH.exe 4452 MMQ.exe 4452 MMQ.exe 2788 FHUIG.exe 2788 FHUIG.exe 3048 LHB.exe 3048 LHB.exe 5372 RHJJG.exe 5372 RHJJG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1312 2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe 1312 2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe 5068 YBP.exe 5068 YBP.exe 4888 OKM.exe 4888 OKM.exe 3328 QIZ.exe 3328 QIZ.exe 472 CQGLG.exe 472 CQGLG.exe 3360 WDLUQJE.exe 3360 WDLUQJE.exe 4904 CDSI.exe 4904 CDSI.exe 3180 XRXRKD.exe 3180 XRXRKD.exe 5392 RMC.exe 5392 RMC.exe 5984 BMWO.exe 5984 BMWO.exe 4076 SVYTB.exe 4076 SVYTB.exe 2448 MIDCLFC.exe 2448 MIDCLFC.exe 1692 JNV.exe 1692 JNV.exe 1112 EBAB.exe 1112 EBAB.exe 3284 EEEWRY.exe 3284 EEEWRY.exe 1352 EJEL.exe 1352 EJEL.exe 1372 ZXJCDD.exe 1372 ZXJCDD.exe 3580 FXIQMG.exe 3580 FXIQMG.exe 2420 WFKV.exe 2420 WFKV.exe 4764 YDYPXLY.exe 4764 YDYPXLY.exe 5728 ZYCLKJ.exe 5728 ZYCLKJ.exe 5300 HMGSV.exe 5300 HMGSV.exe 2100 FMOGEC.exe 2100 FMOGEC.exe 1736 FPAJJ.exe 1736 FPAJJ.exe 4824 ACXTUA.exe 4824 ACXTUA.exe 1844 UQB.exe 1844 UQB.exe 2816 PDGLO.exe 2816 PDGLO.exe 1564 AVJEOH.exe 1564 AVJEOH.exe 4452 MMQ.exe 4452 MMQ.exe 2788 FHUIG.exe 2788 FHUIG.exe 3048 LHB.exe 3048 LHB.exe 5372 RHJJG.exe 5372 RHJJG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1312 wrote to memory of 1420 1312 2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe 89 PID 1420 wrote to memory of 5068 1420 cmd.exe 93 PID 5068 wrote to memory of 3352 5068 YBP.exe 95 PID 3352 wrote to memory of 4888 3352 cmd.exe 99 PID 4888 wrote to memory of 4880 4888 OKM.exe 100 PID 4880 wrote to memory of 3328 4880 cmd.exe 104 PID 3328 wrote to memory of 2148 3328 QIZ.exe 105 PID 2148 wrote to memory of 472 2148 cmd.exe 108 PID 472 wrote to memory of 624 472 CQGLG.exe 110 PID 624 wrote to memory of 3360 624 cmd.exe 114 PID 3360 wrote to memory of 1164 3360 WDLUQJE.exe 115 PID 1164 wrote to memory of 4904 1164 cmd.exe 119 PID 4904 wrote to memory of 3320 4904 CDSI.exe 120 PID 3320 wrote to memory of 3180 3320 cmd.exe 124 PID 3180 wrote to memory of 4576 3180 XRXRKD.exe 125 PID 4576 wrote to memory of 5392 4576 cmd.exe 129 PID 5392 wrote to memory of 2516 5392 RMC.exe 130 PID 2516 wrote to memory of 5984 2516 cmd.exe 134 PID 5984 wrote to memory of 2644 5984 BMWO.exe 135 PID 2644 wrote to memory of 4076 2644 cmd.exe 139 PID 4076 wrote to memory of 3668 4076 SVYTB.exe 140 PID 3668 wrote to memory of 2448 3668 cmd.exe 144 PID 2448 wrote to memory of 4620 2448 MIDCLFC.exe 145 PID 4620 wrote to memory of 1692 4620 cmd.exe 149 PID 1692 wrote to memory of 5088 1692 JNV.exe 150 PID 5088 wrote to memory of 1112 5088 cmd.exe 154 PID 1112 wrote to memory of 256 1112 EBAB.exe 155 PID 256 wrote to memory of 3284 256 cmd.exe 159 PID 3284 wrote to memory of 4928 3284 EEEWRY.exe 160 PID 4928 wrote to memory of 1352 4928 cmd.exe 164 PID 1352 wrote to memory of 5344 1352 EJEL.exe 165 PID 5344 wrote to memory of 1372 5344 cmd.exe 169 PID 1372 wrote to memory of 1996 1372 ZXJCDD.exe 170 PID 1996 wrote to memory of 3580 1996 cmd.exe 174 PID 3580 wrote to memory of 2912 3580 FXIQMG.exe 175 PID 2912 wrote to memory of 2420 2912 cmd.exe 179 PID 2420 wrote to memory of 3696 2420 WFKV.exe 180 PID 3696 wrote to memory of 4764 3696 cmd.exe 184 PID 4764 wrote to memory of 3620 4764 YDYPXLY.exe 185 PID 3620 wrote to memory of 5728 3620 cmd.exe 189 PID 5728 wrote to memory of 4952 5728 ZYCLKJ.exe 190 PID 4952 wrote to memory of 5300 4952 cmd.exe 194 PID 5300 wrote to memory of 5268 5300 HMGSV.exe 195 PID 5268 wrote to memory of 2100 5268 cmd.exe 199 PID 2100 wrote to memory of 4856 2100 FMOGEC.exe 200 PID 4856 wrote to memory of 1736 4856 cmd.exe 204 PID 1736 wrote to memory of 4748 1736 FPAJJ.exe 205 PID 4748 wrote to memory of 4824 4748 cmd.exe 209 PID 4824 wrote to memory of 3100 4824 ACXTUA.exe 210 PID 3100 wrote to memory of 1844 3100 cmd.exe 214 PID 1844 wrote to memory of 4584 1844 UQB.exe 215 PID 4584 wrote to memory of 2816 4584 cmd.exe 219 PID 2816 wrote to memory of 4276 2816 PDGLO.exe 220 PID 4276 wrote to memory of 1564 4276 cmd.exe 224 PID 1564 wrote to memory of 4180 1564 AVJEOH.exe 225 PID 4180 wrote to memory of 4452 4180 cmd.exe 229 PID 4452 wrote to memory of 1720 4452 MMQ.exe 230 PID 1720 wrote to memory of 2788 1720 cmd.exe 234 PID 2788 wrote to memory of 2472 2788 FHUIG.exe 235 PID 2472 wrote to memory of 3048 2472 cmd.exe 239 PID 3048 wrote to memory of 556 3048 LHB.exe 240 PID 556 wrote to memory of 5372 556 cmd.exe 244 PID 5372 wrote to memory of 1444 5372 RHJJG.exe 245 PID 1444 wrote to memory of 2172 1444 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_30dae4479649cf9db117fd6694c55bc4_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBP.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\windows\SysWOW64\YBP.exeC:\windows\system32\YBP.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKM.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\windows\OKM.exeC:\windows\OKM.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\system\QIZ.exeC:\windows\system\QIZ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQGLG.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\CQGLG.exeC:\windows\CQGLG.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WDLUQJE.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624 -
C:\windows\system\WDLUQJE.exeC:\windows\system\WDLUQJE.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CDSI.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\windows\SysWOW64\CDSI.exeC:\windows\system32\CDSI.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRXRKD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\windows\system\XRXRKD.exeC:\windows\system\XRXRKD.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMC.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\SysWOW64\RMC.exeC:\windows\system32\RMC.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMWO.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\windows\BMWO.exeC:\windows\BMWO.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVYTB.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\SysWOW64\SVYTB.exeC:\windows\system32\SVYTB.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MIDCLFC.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\windows\MIDCLFC.exeC:\windows\MIDCLFC.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNV.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\SysWOW64\JNV.exeC:\windows\system32\JNV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBAB.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\windows\system\EBAB.exeC:\windows\system\EBAB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEEWRY.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\EEEWRY.exeC:\windows\EEEWRY.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EJEL.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\windows\EJEL.exeC:\windows\EJEL.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXJCDD.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\SysWOW64\ZXJCDD.exeC:\windows\system32\ZXJCDD.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIQMG.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\SysWOW64\FXIQMG.exeC:\windows\system32\FXIQMG.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFKV.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\SysWOW64\WFKV.exeC:\windows\system32\WFKV.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDYPXLY.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\windows\SysWOW64\YDYPXLY.exeC:\windows\system32\YDYPXLY.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYCLKJ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\windows\system\ZYCLKJ.exeC:\windows\system\ZYCLKJ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMGSV.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\windows\HMGSV.exeC:\windows\HMGSV.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMOGEC.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\windows\SysWOW64\FMOGEC.exeC:\windows\system32\FMOGEC.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPAJJ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\windows\SysWOW64\FPAJJ.exeC:\windows\system32\FPAJJ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACXTUA.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\windows\system\ACXTUA.exeC:\windows\system\ACXTUA.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQB.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\windows\SysWOW64\UQB.exeC:\windows\system32\UQB.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PDGLO.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\PDGLO.exeC:\windows\PDGLO.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVJEOH.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\system\AVJEOH.exeC:\windows\system\AVJEOH.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MMQ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\system\MMQ.exeC:\windows\system\MMQ.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHUIG.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\windows\FHUIG.exeC:\windows\FHUIG.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHB.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\windows\LHB.exeC:\windows\LHB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHJJG.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:556 -
C:\windows\RHJJG.exeC:\windows\RHJJG.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCIKLO.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\windows\SysWOW64\PCIKLO.exeC:\windows\system32\PCIKLO.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTP.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3104 -
C:\windows\system\BTP.exeC:\windows\system\BTP.exe67⤵
- Executes dropped EXE
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOTOCXT.exe.bat" "68⤵PID:4724
-
C:\windows\system\TOTOCXT.exeC:\windows\system\TOTOCXT.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOAC.exe.bat" "70⤵PID:5380
-
C:\windows\ZOAC.exeC:\windows\ZOAC.exe71⤵
- Executes dropped EXE
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJFLWR.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3444 -
C:\windows\system\UJFLWR.exeC:\windows\system\UJFLWR.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OWK.exe.bat" "74⤵
- Executes a command shell one-liner
PID:1452 -
C:\windows\OWK.exeC:\windows\OWK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKPMI.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2836 -
C:\windows\system\JKPMI.exeC:\windows\system\JKPMI.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASRRUW.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4160 -
C:\windows\system\ASRRUW.exeC:\windows\system\ASRRUW.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQWLB.exe.bat" "80⤵PID:1768
-
C:\windows\SysWOW64\CQWLB.exeC:\windows\system32\CQWLB.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIEZKZ.exe.bat" "82⤵PID:5756
-
C:\windows\system\IIEZKZ.exeC:\windows\system\IIEZKZ.exe83⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQGE.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5948 -
C:\windows\ZQGE.exeC:\windows\ZQGE.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UELOYE.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2360 -
C:\windows\SysWOW64\UELOYE.exeC:\windows\system32\UELOYE.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMNTBBZ.exe.bat" "88⤵PID:3540
-
C:\windows\DMNTBBZ.exeC:\windows\DMNTBBZ.exe89⤵
- Executes dropped EXE
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZRC.exe.bat" "90⤵PID:856
-
C:\windows\system\YZRC.exeC:\windows\system\YZRC.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHYKYT.exe.bat" "92⤵PID:4248
-
C:\windows\system\CHYKYT.exeC:\windows\system\CHYKYT.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIGY.exe.bat" "94⤵PID:4172
-
C:\windows\SysWOW64\IIGY.exeC:\windows\system32\IIGY.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYMYTG.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2232 -
C:\windows\MYMYTG.exeC:\windows\MYMYTG.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQPRBNP.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:120 -
C:\windows\system\FQPRBNP.exeC:\windows\system\FQPRBNP.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTTM.exe.bat" "100⤵PID:4028
-
C:\windows\YTTM.exeC:\windows\YTTM.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBAUTV.exe.bat" "102⤵PID:4052
-
C:\windows\BBAUTV.exeC:\windows\BBAUTV.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4780 -
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSIZJTC.exe.bat" "106⤵PID:5540
-
C:\windows\system\XSIZJTC.exeC:\windows\system\XSIZJTC.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFNR.exe.bat" "108⤵PID:2996
-
C:\windows\RFNR.exeC:\windows\RFNR.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNPWX.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4312 -
C:\windows\SysWOW64\BNPWX.exeC:\windows\system32\BNPWX.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XLVTEAV.exe.bat" "112⤵PID:5820
-
C:\windows\SysWOW64\XLVTEAV.exeC:\windows\system32\XLVTEAV.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDH.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:108 -
C:\windows\system\DLDH.exeC:\windows\system\DLDH.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DZVVW.exe.bat" "116⤵PID:4124
-
C:\windows\SysWOW64\DZVVW.exeC:\windows\system32\DZVVW.exe117⤵
- Executes dropped EXE
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZCJF.exe.bat" "118⤵PID:2072
-
C:\windows\JZCJF.exeC:\windows\JZCJF.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USFUNR.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5116 -
C:\windows\USFUNR.exeC:\windows\USFUNR.exe121⤵
- Executes dropped EXE
PID:5208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-