Analysis
- max time kernel
89s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 21:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_544dba7758687b653804cea8c3e25519_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_544dba7758687b653804cea8c3e25519_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-09_544dba7758687b653804cea8c3e25519_elex_emotet_stop.exe
- Size 384KB
- Sample260709-1ba63saz41
- SHA256 e659cc952a9cee14584e15440e8b2631a50d9a13698e96fe08bd783918fe7bfe
- MD5 544dba7758687b653804cea8c3e25519
- SHA1 8c00299be3386bdad598569ebee19b9f139bd455
- SHA512 2faff3ed378b6ae8c0d0678a4e4092f4a1acd8d9f17e2e10fd86ae04935afe27bd4c943865a632c51ff11a9bcc89b417d6d5b425891c3ce149866559d888cdb1
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOVkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOVkmZzcukG2/
- TLSH T1DB848E167AC58333D1A302715CEB86A4773ABCA1A7B687872798720D6773BB44737390
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4884 QHN.exe 4328 BPI.exe 4456 PLYCSG.exe 1904 IOC.exe 3380 UWQ.exe 4180 UBI.exe 5940 JESZEO.exe 2524 SFU.exe 2972 WVBMU.exe 5440 MLK.exe 5036 XDFWB.exe 1168 HBSRQPH.exe 3008 UEBHWSV.exe 5860 PZFZ.exe 4764 PUJUUQ.exe 1248 RSPPB.exe 1620 DLSH.exe 4692 JLZVTAS.exe 2012 FQF.exe 6020 ORHXD.exe 4640 AHOXQZK.exe 4932 RSRNYN.exe 1072 DIX.exe 1760 YQGKR.exe 4208 SDLTUR.exe 4580 AOUVIEU.exe 4324 TRXRV.exe 3764 FHE.exe 1656 DUDZ.exe 4928 HKK.exe 5432 YKMN.exe 5572 CASNGXT.exe 6112 PLBLU.exe 6008 HMD.exe 2488 PRP.exe 2688 URX.exe 4544 EAZQVD.exe 5552 YNE.exe 620 ENM.exe 1448 FQPRBNP.exe 1300 ORR.exe 5048 SHYERL.exe 4616 KHAJ.exe 5084 ECFSFI.exe 1296 NIPKVFK.exe 5340 ESGAUZN.exe 3044 TNPMF.exe 1612 EGSFNB.exe 5088 WOUKRZF.exe 4956 QCZU.exe 2808 LPEDLZ.exe 4948 CCOV.exe 3032 EAHXASN.exe 4472 PTK.exe 3224 DDTHWK.exe 5208 OWW.exe 3172 UWDNN.exe 4908 UCWCPZ.exe 5200 JXN.exe 4872 UPIZI.exe 3716 RVOW.exe 5756 XVVKYFC.exe 5284 NGMHYZY.exe 5312 ROSI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\SDLTUR.exe YQGKR.exe File opened for modification C:\windows\SysWOW64\YKMN.exe HKK.exe File created C:\windows\SysWOW64\LPEDLZ.exe QCZU.exe File created C:\windows\SysWOW64\WAQXE.exe.bat NSOS.exe File created C:\windows\SysWOW64\WURHA.exe.bat LCWO.exe File opened for modification C:\windows\SysWOW64\HFXJC.exe WNIYTRX.exe File created C:\windows\SysWOW64\HFXJC.exe.bat WNIYTRX.exe File opened for modification C:\windows\SysWOW64\JESZEO.exe UBI.exe File created C:\windows\SysWOW64\JESZEO.exe.bat UBI.exe File opened for modification C:\windows\SysWOW64\OWW.exe DDTHWK.exe File created C:\windows\SysWOW64\UPIZI.exe.bat JXN.exe File opened for modification C:\windows\SysWOW64\HAJWQI.exe NFEMO.exe File created C:\windows\SysWOW64\WAM.exe DXIS.exe File created C:\windows\SysWOW64\HSJNM.exe.bat JXSE.exe File opened for modification C:\windows\SysWOW64\WNIYTRX.exe KUNFK.exe File created C:\windows\SysWOW64\OWW.exe DDTHWK.exe File created C:\windows\SysWOW64\UPIZI.exe JXN.exe File created C:\windows\SysWOW64\WNIYTRX.exe.bat KUNFK.exe File created C:\windows\SysWOW64\MJRG.exe ITKYN.exe File opened for modification C:\windows\SysWOW64\FBH.exe MJRG.exe File created C:\windows\SysWOW64\FBH.exe.bat MJRG.exe File created C:\windows\SysWOW64\UWQ.exe IOC.exe File created C:\windows\SysWOW64\SHYERL.exe.bat ORR.exe File opened for modification C:\windows\SysWOW64\KHAJ.exe SHYERL.exe File created C:\windows\SysWOW64\DDTHWK.exe PTK.exe File created C:\windows\SysWOW64\UWDNN.exe OWW.exe File opened for modification C:\windows\SysWOW64\VEBG.exe PDTTKXM.exe File created C:\windows\SysWOW64\WURHA.exe LCWO.exe File created C:\windows\SysWOW64\MRRPUOK.exe EMRBL.exe File created C:\windows\SysWOW64\EAHXASN.exe CCOV.exe File created C:\windows\SysWOW64\MRRPUOK.exe.bat EMRBL.exe File created C:\windows\SysWOW64\HAJWQI.exe NFEMO.exe File created C:\windows\SysWOW64\HSJNM.exe JXSE.exe File opened for modification C:\windows\SysWOW64\TCCYTAY.exe ELBZNF.exe File created C:\windows\SysWOW64\TCCYTAY.exe.bat ELBZNF.exe File created C:\windows\SysWOW64\ZCKM.exe TCCYTAY.exe File created C:\windows\SysWOW64\ZCKM.exe.bat TCCYTAY.exe File created C:\windows\SysWOW64\JESZEO.exe UBI.exe File created C:\windows\SysWOW64\KHAJ.exe SHYERL.exe File created C:\windows\SysWOW64\QCZU.exe WOUKRZF.exe File opened for modification C:\windows\SysWOW64\LPEDLZ.exe QCZU.exe File opened for modification C:\windows\SysWOW64\UWDNN.exe OWW.exe File created C:\windows\SysWOW64\QRERG.exe GRKMDEU.exe File created C:\windows\SysWOW64\VEBG.exe.bat PDTTKXM.exe File opened for modification C:\windows\SysWOW64\TWEJ.exe HFXJC.exe File created C:\windows\SysWOW64\RSPPB.exe PUJUUQ.exe File opened for modification C:\windows\SysWOW64\ZCKM.exe TCCYTAY.exe File created C:\windows\SysWOW64\BBQP.exe TWEJ.exe File created C:\windows\SysWOW64\IPH.exe EHACVM.exe File opened for modification C:\windows\SysWOW64\MJRG.exe ITKYN.exe File created C:\windows\SysWOW64\FBH.exe MJRG.exe File created C:\windows\SysWOW64\YKMN.exe.bat HKK.exe File opened for modification C:\windows\SysWOW64\PRP.exe HMD.exe File created C:\windows\SysWOW64\TNPMF.exe.bat ESGAUZN.exe File opened for modification C:\windows\SysWOW64\QRERG.exe GRKMDEU.exe File created C:\windows\SysWOW64\QRERG.exe.bat GRKMDEU.exe File created C:\windows\SysWOW64\HAJWQI.exe.bat NFEMO.exe File created C:\windows\SysWOW64\BBQP.exe.bat TWEJ.exe File created C:\windows\SysWOW64\MJRG.exe.bat ITKYN.exe File created C:\windows\SysWOW64\TNPMF.exe ESGAUZN.exe File created C:\windows\SysWOW64\PRP.exe.bat HMD.exe File created C:\windows\SysWOW64\EAHXASN.exe.bat CCOV.exe File opened for modification C:\windows\SysWOW64\DDTHWK.exe PTK.exe File opened for modification C:\windows\SysWOW64\WAQXE.exe NSOS.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\HAGEKHZ.exe QRERG.exe File created C:\windows\system\NSOS.exe.bat HAGEKHZ.exe File created C:\windows\system\BPI.exe QHN.exe File created C:\windows\system\BPI.exe.bat QHN.exe File created C:\windows\system\URX.exe PRP.exe File created C:\windows\system\XDFWB.exe.bat MLK.exe File created C:\windows\CCOV.exe.bat LPEDLZ.exe File created C:\windows\system\RSRNYN.exe.bat AHOXQZK.exe File opened for modification C:\windows\DIX.exe RSRNYN.exe File opened for modification C:\windows\system\IWTKVC.exe AQTVT.exe File opened for modification C:\windows\system\PLYCSG.exe BPI.exe File opened for modification C:\windows\EAZQVD.exe URX.exe File created C:\windows\RVOW.exe.bat UPIZI.exe File created C:\windows\system\NSOS.exe HAGEKHZ.exe File created C:\windows\LCWO.exe FBPB.exe File opened for modification C:\windows\system\ARZX.exe CTGU.exe File opened for modification C:\windows\system\DXIS.exe XXBE.exe File opened for modification C:\windows\DUDZ.exe FHE.exe File created C:\windows\system\XVVKYFC.exe RVOW.exe File created C:\windows\system\PLBLU.exe CASNGXT.exe File created C:\windows\PTK.exe.bat EAHXASN.exe File created C:\windows\system\TRXRV.exe AOUVIEU.exe File opened for modification C:\windows\LCWO.exe FBPB.exe File opened for modification C:\windows\system\TTYO.exe NTRBVDT.exe File created C:\windows\system\UBI.exe.bat UWQ.exe File opened for modification C:\windows\JLZVTAS.exe DLSH.exe File created C:\windows\system\YQGKR.exe DIX.exe File created C:\windows\system\FBPB.exe VEBG.exe File opened for modification C:\windows\UEBHWSV.exe HBSRQPH.exe File created C:\windows\UEBHWSV.exe.bat HBSRQPH.exe File created C:\windows\system\AOUVIEU.exe.bat SDLTUR.exe File opened for modification C:\windows\system\ESGAUZN.exe NIPKVFK.exe File created C:\windows\PLHIYB.exe.bat JLAUPH.exe File created C:\windows\XRCO.exe.bat IWTKVC.exe File created C:\windows\DUDZ.exe.bat FHE.exe File created C:\windows\system\FQPRBNP.exe ENM.exe File opened for modification C:\windows\LEWYIWI.exe DZWKGR.exe File created C:\windows\system\IOC.exe PLYCSG.exe File opened for modification C:\windows\system\YQGKR.exe DIX.exe File created C:\windows\system\ORR.exe FQPRBNP.exe File opened for modification C:\windows\CCOV.exe LPEDLZ.exe File created C:\windows\PTK.exe EAHXASN.exe File opened for modification C:\windows\system\JLAUPH.exe FVTMDOG.exe File created C:\windows\system\ARZX.exe CTGU.exe File created C:\windows\system\OKNVXYN.exe XWCD.exe File opened for modification C:\windows\system\XDFWB.exe MLK.exe File opened for modification C:\windows\system\PLBLU.exe CASNGXT.exe File created C:\windows\EGSFNB.exe TNPMF.exe File created C:\windows\system\EMRBL.exe GLJNC.exe File created C:\windows\system\IWTKVC.exe.bat AQTVT.exe File created C:\windows\ITKYN.exe IPH.exe File created C:\windows\SFU.exe.bat JESZEO.exe File created C:\windows\DUDZ.exe FHE.exe File created C:\windows\system\PLBLU.exe.bat CASNGXT.exe File opened for modification C:\windows\system\NSOS.exe HAGEKHZ.exe File opened for modification C:\windows\ECFSFI.exe KHAJ.exe File created C:\windows\GRKMDEU.exe ROSI.exe File created C:\windows\system\DXIS.exe.bat XXBE.exe File created C:\windows\system\HBSRQPH.exe XDFWB.exe File opened for modification C:\windows\FQF.exe JLZVTAS.exe File created C:\windows\system\XXBE.exe.bat DKWUIMY.exe File opened for modification C:\windows\system\NTRBVDT.exe HSJNM.exe File created C:\windows\system\TTYO.exe.bat NTRBVDT.exe File created C:\windows\LEWYIWI.exe DZWKGR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 5076 4688 WerFault.exe 85 5080 4884 WerFault.exe 90 4316 4328 WerFault.exe 96 1524 4456 WerFault.exe 101 4856 1904 WerFault.exe 106 4868 3380 WerFault.exe 111 5724 4180 WerFault.exe 116 2280 5940 WerFault.exe 121 3184 2524 WerFault.exe 126 3848 2972 WerFault.exe 131 2984 5440 WerFault.exe 135 1160 5036 WerFault.exe 141 1908 1168 WerFault.exe 146 4236 3008 WerFault.exe 151 1956 5860 WerFault.exe 156 3764 4764 WerFault.exe 161 4340 1248 WerFault.exe 166 1528 1620 WerFault.exe 171 1676 4692 WerFault.exe 176 2404 2012 WerFault.exe 181 2124 6020 WerFault.exe 186 6008 4640 WerFault.exe 191 2844 4932 WerFault.exe 196 5208 1072 WerFault.exe 201 2648 1760 WerFault.exe 206 2388 4208 WerFault.exe 210 4572 4580 WerFault.exe 216 5748 4324 WerFault.exe 221 4200 3764 WerFault.exe 226 1212 1656 WerFault.exe 231 5804 4928 WerFault.exe 236 6100 5432 WerFault.exe 241 1912 5572 WerFault.exe 246 2928 6112 WerFault.exe 251 1572 6008 WerFault.exe 256 2364 2488 WerFault.exe 261 3432 2688 WerFault.exe 266 5304 4544 WerFault.exe 271 3344 5552 WerFault.exe 276 372 620 WerFault.exe 281 3944 1448 WerFault.exe 286 816 1300 WerFault.exe 291 5664 5048 WerFault.exe 296 4344 4616 WerFault.exe 301 1704 5084 WerFault.exe 306 5880 1296 WerFault.exe 311 1892 5340 WerFault.exe 316 2588 3044 WerFault.exe 321 1460 1612 WerFault.exe 326 5808 5088 WerFault.exe 331 1936 4956 WerFault.exe 336 3572 2808 WerFault.exe 341 2248 4948 WerFault.exe 346 4280 3032 WerFault.exe 351 2376 4472 WerFault.exe 356 6120 3224 WerFault.exe 361 4252 5208 WerFault.exe 366 5528 3172 WerFault.exe 371 1112 4908 WerFault.exe 376 5808 5200 WerFault.exe 381 5936 4872 WerFault.exe 386 2216 3716 WerFault.exe 391 4248 5756 WerFault.exe 396 2280 5284 WerFault.exe 401 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDLTUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOUKRZF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEWYIWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDTHWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SHYERL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTYO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNIYTRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTGU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZCKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVBMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLAUPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XWCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLHIYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGMHYZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NIPKVFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFXJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESGAUZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAGEKHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAJWQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBSRQPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUJUUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDTTKXM.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4688 2026-07-09_544dba7758687b653804cea8c3e25519_elex_emotet_stop.exe 4688 2026-07-09_544dba7758687b653804cea8c3e25519_elex_emotet_stop.exe 4884 QHN.exe 4884 QHN.exe 4328 BPI.exe 4328 BPI.exe 4456 PLYCSG.exe 4456 PLYCSG.exe 1904 IOC.exe 1904 IOC.exe 3380 UWQ.exe 3380 UWQ.exe 4180 UBI.exe 4180 UBI.exe 5940 JESZEO.exe 5940 JESZEO.exe 2524 SFU.exe 2524 SFU.exe 2972 WVBMU.exe 2972 WVBMU.exe 5440 MLK.exe 5440 MLK.exe 5036 XDFWB.exe 5036 XDFWB.exe 1168 HBSRQPH.exe 1168 HBSRQPH.exe 3008 UEBHWSV.exe 3008 UEBHWSV.exe 5860 PZFZ.exe 5860 PZFZ.exe 4764 PUJUUQ.exe 4764 PUJUUQ.exe 1248 RSPPB.exe 1248 RSPPB.exe 1620 DLSH.exe 1620 DLSH.exe 4692 JLZVTAS.exe 4692 JLZVTAS.exe 2012 FQF.exe 2012 FQF.exe 6020 ORHXD.exe 6020 ORHXD.exe 4640 AHOXQZK.exe 4640 AHOXQZK.exe 4932 RSRNYN.exe 4932 RSRNYN.exe 1072 DIX.exe 1072 DIX.exe 1760 YQGKR.exe 1760 YQGKR.exe 4208 SDLTUR.exe 4208 SDLTUR.exe 4580 AOUVIEU.exe 4580 AOUVIEU.exe 4324 TRXRV.exe 4324 TRXRV.exe 3764 FHE.exe 3764 FHE.exe 1656 DUDZ.exe 1656 DUDZ.exe 4928 HKK.exe 4928 HKK.exe 5432 YKMN.exe 5432 YKMN.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4688 2026-07-09_544dba7758687b653804cea8c3e25519_elex_emotet_stop.exe 4688 2026-07-09_544dba7758687b653804cea8c3e25519_elex_emotet_stop.exe 4884 QHN.exe 4884 QHN.exe 4328 BPI.exe 4328 BPI.exe 4456 PLYCSG.exe 4456 PLYCSG.exe 1904 IOC.exe 1904 IOC.exe 3380 UWQ.exe 3380 UWQ.exe 4180 UBI.exe 4180 UBI.exe 5940 JESZEO.exe 5940 JESZEO.exe 2524 SFU.exe 2524 SFU.exe 2972 WVBMU.exe 2972 WVBMU.exe 5440 MLK.exe 5440 MLK.exe 5036 XDFWB.exe 5036 XDFWB.exe 1168 HBSRQPH.exe 1168 HBSRQPH.exe 3008 UEBHWSV.exe 3008 UEBHWSV.exe 5860 PZFZ.exe 5860 PZFZ.exe 4764 PUJUUQ.exe 4764 PUJUUQ.exe 1248 RSPPB.exe 1248 RSPPB.exe 1620 DLSH.exe 1620 DLSH.exe 4692 JLZVTAS.exe 4692 JLZVTAS.exe 2012 FQF.exe 2012 FQF.exe 6020 ORHXD.exe 6020 ORHXD.exe 4640 AHOXQZK.exe 4640 AHOXQZK.exe 4932 RSRNYN.exe 4932 RSRNYN.exe 1072 DIX.exe 1072 DIX.exe 1760 YQGKR.exe 1760 YQGKR.exe 4208 SDLTUR.exe 4208 SDLTUR.exe 4580 AOUVIEU.exe 4580 AOUVIEU.exe 4324 TRXRV.exe 4324 TRXRV.exe 3764 FHE.exe 3764 FHE.exe 1656 DUDZ.exe 1656 DUDZ.exe 4928 HKK.exe 4928 HKK.exe 5432 YKMN.exe 5432 YKMN.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 2916 4688 2026-07-09_544dba7758687b653804cea8c3e25519_elex_emotet_stop.exe 86 PID 2916 wrote to memory of 4884 2916 cmd.exe 90 PID 4884 wrote to memory of 2056 4884 QHN.exe 92 PID 2056 wrote to memory of 4328 2056 cmd.exe 96 PID 4328 wrote to memory of 2900 4328 BPI.exe 97 PID 2900 wrote to memory of 4456 2900 cmd.exe 101 PID 4456 wrote to memory of 5480 4456 PLYCSG.exe 102 PID 5480 wrote to memory of 1904 5480 cmd.exe 106 PID 1904 wrote to memory of 1012 1904 IOC.exe 107 PID 1012 wrote to memory of 3380 1012 cmd.exe 111 PID 3380 wrote to memory of 4684 3380 UWQ.exe 112 PID 4684 wrote to memory of 4180 4684 cmd.exe 116 PID 4180 wrote to memory of 800 4180 UBI.exe 117 PID 800 wrote to memory of 5940 800 cmd.exe 121 PID 5940 wrote to memory of 416 5940 JESZEO.exe 122 PID 416 wrote to memory of 2524 416 cmd.exe 126 PID 2524 wrote to memory of 3580 2524 SFU.exe 127 PID 3580 wrote to memory of 2972 3580 cmd.exe 131 PID 2972 wrote to memory of 464 2972 WVBMU.exe 132 PID 464 wrote to memory of 5440 464 cmd.exe 135 PID 5440 wrote to memory of 5856 5440 MLK.exe 137 PID 5856 wrote to memory of 5036 5856 cmd.exe 141 PID 5036 wrote to memory of 2668 5036 XDFWB.exe 142 PID 2668 wrote to memory of 1168 2668 cmd.exe 146 PID 1168 wrote to memory of 5468 1168 HBSRQPH.exe 147 PID 5468 wrote to memory of 3008 5468 cmd.exe 151 PID 3008 wrote to memory of 1256 3008 UEBHWSV.exe 152 PID 1256 wrote to memory of 5860 1256 cmd.exe 156 PID 5860 wrote to memory of 4152 5860 PZFZ.exe 157 PID 4152 wrote to memory of 4764 4152 cmd.exe 161 PID 4764 wrote to memory of 5848 4764 PUJUUQ.exe 162 PID 5848 wrote to memory of 1248 5848 cmd.exe 166 PID 1248 wrote to memory of 5276 1248 RSPPB.exe 167 PID 5276 wrote to memory of 1620 5276 cmd.exe 171 PID 1620 wrote to memory of 1764 1620 DLSH.exe 172 PID 1764 wrote to memory of 4692 1764 cmd.exe 176 PID 4692 wrote to memory of 1500 4692 JLZVTAS.exe 177 PID 1500 wrote to memory of 2012 1500 cmd.exe 181 PID 2012 wrote to memory of 676 2012 FQF.exe 182 PID 676 wrote to memory of 6020 676 cmd.exe 186 PID 6020 wrote to memory of 2268 6020 ORHXD.exe 187 PID 2268 wrote to memory of 4640 2268 cmd.exe 191 PID 4640 wrote to memory of 3476 4640 AHOXQZK.exe 192 PID 3476 wrote to memory of 4932 3476 cmd.exe 196 PID 4932 wrote to memory of 6024 4932 RSRNYN.exe 197 PID 6024 wrote to memory of 1072 6024 cmd.exe 201 PID 1072 wrote to memory of 2968 1072 DIX.exe 202 PID 2968 wrote to memory of 1760 2968 cmd.exe 206 PID 1760 wrote to memory of 2912 1760 YQGKR.exe 207 PID 2912 wrote to memory of 4208 2912 cmd.exe 210 PID 4208 wrote to memory of 4740 4208 SDLTUR.exe 212 PID 4740 wrote to memory of 4580 4740 cmd.exe 216 PID 4580 wrote to memory of 2964 4580 AOUVIEU.exe 217 PID 2964 wrote to memory of 4324 2964 cmd.exe 221 PID 4324 wrote to memory of 2936 4324 TRXRV.exe 222 PID 2936 wrote to memory of 3764 2936 cmd.exe 226 PID 3764 wrote to memory of 908 3764 FHE.exe 227 PID 908 wrote to memory of 1656 908 cmd.exe 231 PID 1656 wrote to memory of 5836 1656 DUDZ.exe 232 PID 5836 wrote to memory of 4928 5836 cmd.exe 236 PID 4928 wrote to memory of 5968 4928 HKK.exe 237 PID 5968 wrote to memory of 5432 5968 cmd.exe 241 PID 5432 wrote to memory of 5792 5432 YKMN.exe 242 PID 5792 wrote to memory of 5572 5792 cmd.exe 246
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_544dba7758687b653804cea8c3e25519_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_544dba7758687b653804cea8c3e25519_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHN.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\system\QHN.exeC:\windows\system\QHN.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPI.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\windows\system\BPI.exeC:\windows\system\BPI.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLYCSG.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\system\PLYCSG.exeC:\windows\system\PLYCSG.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOC.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\windows\system\IOC.exeC:\windows\system\IOC.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWQ.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\windows\SysWOW64\UWQ.exeC:\windows\system32\UWQ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBI.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\system\UBI.exeC:\windows\system\UBI.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JESZEO.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800 -
C:\windows\SysWOW64\JESZEO.exeC:\windows\system32\JESZEO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFU.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:416 -
C:\windows\SFU.exeC:\windows\SFU.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WVBMU.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\windows\WVBMU.exeC:\windows\WVBMU.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLK.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\windows\MLK.exeC:\windows\MLK.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XDFWB.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\system\XDFWB.exeC:\windows\system\XDFWB.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBSRQPH.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\windows\system\HBSRQPH.exeC:\windows\system\HBSRQPH.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEBHWSV.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\UEBHWSV.exeC:\windows\UEBHWSV.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZFZ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\windows\PZFZ.exeC:\windows\PZFZ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUJUUQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\PUJUUQ.exeC:\windows\PUJUUQ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSPPB.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\windows\SysWOW64\RSPPB.exeC:\windows\system32\RSPPB.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLSH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\windows\system\DLSH.exeC:\windows\system\DLSH.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLZVTAS.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\windows\JLZVTAS.exeC:\windows\JLZVTAS.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQF.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\FQF.exeC:\windows\FQF.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORHXD.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:676 -
C:\windows\system\ORHXD.exeC:\windows\system\ORHXD.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AHOXQZK.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\SysWOW64\AHOXQZK.exeC:\windows\system32\AHOXQZK.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DIX.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\DIX.exeC:\windows\DIX.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQGKR.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\windows\system\YQGKR.exeC:\windows\system\YQGKR.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDLTUR.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\SysWOW64\SDLTUR.exeC:\windows\system32\SDLTUR.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOUVIEU.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\system\AOUVIEU.exeC:\windows\system\AOUVIEU.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRXRV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\windows\system\TRXRV.exeC:\windows\system\TRXRV.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\windows\FHE.exeC:\windows\FHE.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DUDZ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\windows\DUDZ.exeC:\windows\DUDZ.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\windows\system\HKK.exeC:\windows\system\HKK.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKMN.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\SysWOW64\YKMN.exeC:\windows\system32\YKMN.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CASNGXT.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\windows\CASNGXT.exeC:\windows\CASNGXT.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLBLU.exe.bat" "66⤵PID:1832
-
C:\windows\system\PLBLU.exeC:\windows\system\PLBLU.exe67⤵
- Executes dropped EXE
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMD.exe.bat" "68⤵PID:3780
-
C:\windows\HMD.exeC:\windows\HMD.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRP.exe.bat" "70⤵PID:4088
-
C:\windows\SysWOW64\PRP.exeC:\windows\system32\PRP.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URX.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4300 -
C:\windows\system\URX.exeC:\windows\system\URX.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EAZQVD.exe.bat" "74⤵PID:3412
-
C:\windows\EAZQVD.exeC:\windows\EAZQVD.exe75⤵
- Executes dropped EXE
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNE.exe.bat" "76⤵PID:4628
-
C:\windows\system\YNE.exeC:\windows\system\YNE.exe77⤵
- Executes dropped EXE
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENM.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:3200 -
C:\windows\ENM.exeC:\windows\ENM.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQPRBNP.exe.bat" "80⤵PID:1436
-
C:\windows\system\FQPRBNP.exeC:\windows\system\FQPRBNP.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORR.exe.bat" "82⤵PID:1388
-
C:\windows\system\ORR.exeC:\windows\system\ORR.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHYERL.exe.bat" "84⤵PID:4188
-
C:\windows\SysWOW64\SHYERL.exeC:\windows\system32\SHYERL.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHAJ.exe.bat" "86⤵PID:1264
-
C:\windows\SysWOW64\KHAJ.exeC:\windows\system32\KHAJ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECFSFI.exe.bat" "88⤵PID:1428
-
C:\windows\ECFSFI.exeC:\windows\ECFSFI.exe89⤵
- Executes dropped EXE
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIPKVFK.exe.bat" "90⤵PID:6064
-
C:\windows\NIPKVFK.exeC:\windows\NIPKVFK.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESGAUZN.exe.bat" "92⤵PID:2236
-
C:\windows\system\ESGAUZN.exeC:\windows\system\ESGAUZN.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNPMF.exe.bat" "94⤵PID:3484
-
C:\windows\SysWOW64\TNPMF.exeC:\windows\system32\TNPMF.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGSFNB.exe.bat" "96⤵PID:5196
-
C:\windows\EGSFNB.exeC:\windows\EGSFNB.exe97⤵
- Executes dropped EXE
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUKRZF.exe.bat" "98⤵PID:832
-
C:\windows\WOUKRZF.exeC:\windows\WOUKRZF.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QCZU.exe.bat" "100⤵PID:5272
-
C:\windows\SysWOW64\QCZU.exeC:\windows\system32\QCZU.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LPEDLZ.exe.bat" "102⤵PID:5352
-
C:\windows\SysWOW64\LPEDLZ.exeC:\windows\system32\LPEDLZ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCOV.exe.bat" "104⤵PID:1988
-
C:\windows\CCOV.exeC:\windows\CCOV.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAHXASN.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3292 -
C:\windows\SysWOW64\EAHXASN.exeC:\windows\system32\EAHXASN.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTK.exe.bat" "108⤵PID:4212
-
C:\windows\PTK.exeC:\windows\PTK.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDTHWK.exe.bat" "110⤵PID:5000
-
C:\windows\SysWOW64\DDTHWK.exeC:\windows\system32\DDTHWK.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWW.exe.bat" "112⤵PID:1124
-
C:\windows\SysWOW64\OWW.exeC:\windows\system32\OWW.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWDNN.exe.bat" "114⤵PID:3648
-
C:\windows\SysWOW64\UWDNN.exeC:\windows\system32\UWDNN.exe115⤵
- Executes dropped EXE
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCWCPZ.exe.bat" "116⤵PID:2132
-
C:\windows\UCWCPZ.exeC:\windows\UCWCPZ.exe117⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXN.exe.bat" "118⤵PID:1524
-
C:\windows\SysWOW64\JXN.exeC:\windows\system32\JXN.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UPIZI.exe.bat" "120⤵PID:3344
-
C:\windows\SysWOW64\UPIZI.exeC:\windows\system32\UPIZI.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-