Analysis
- max time kernel
94s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 16:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_acdf2fc01bb159030c785864e0312661_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_acdf2fc01bb159030c785864e0312661_elex_emotet_stop.exe
- Size 208KB
- Sample260717-t7bddsfx7k
- SHA256 82650dd9ded3d5656b2e3083bc75c30c1fa0664a59cbb29112330bbffe336972
- MD5 acdf2fc01bb159030c785864e0312661
- SHA1 ecb26ecbe5f312ee46427c2970c6363ba0433cd3
- SHA512 6b0a9a0486bc6f9e77cc023e51de5ca975d4e67ceff98bb24645f8dab6ad3275f5be49490a3fab26e941fdf62e63db53fa3a15c2bf0e68bfc64820891c6cf3d6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfl4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LONQEj6
- TLSH T15C247D2235D2C073E4B7023188F6C7787BB6BD919B36928B7BC03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5600 UGI.exe 3000 MBTTNFQ.exe 2056 BECXY.exe 4960 QUDXEN.exe 3248 FPUB.exe 2068 PQW.exe 5404 RLTX.exe 1096 TBHKSOO.exe 3740 OWMB.exe 4616 FWOGG.exe 4356 JMUG.exe 2764 NUBOFOP.exe 2640 IIGY.exe 1128 XYHPO.exe 5280 DYODXLB.exe 1240 YTTM.exe 5944 JMWFP.exe 1456 DZTOZSU.exe 5780 ECFSFI.exe 5872 TXOXQVE.exe 4184 DYQCT.exe 5824 MGSPFY.exe 2404 HJBF.exe 4124 SBEYTQ.exe 3844 WRK.exe 1192 PUOCLYJ.exe 596 GVQ.exe 1972 KLXPBO.exe 2912 FYCYLOW.exe 2356 PWHTAWF.exe 3224 AOK.exe 4088 PJUQUY.exe 972 IMX.exe 956 TFAE.exe 1384 OSFOKV.exe 5748 ZLAHSDP.exe 5076 WQGEZNJ.exe 3060 CROR.exe 1396 CWOGS.exe 2320 RRX.exe 2108 LFCU.exe 6008 XVJCZHZ.exe 2244 XAJQAMC.exe 2656 JTEB.exe 5384 DGJKL.exe 3612 UTT.exe 3608 ECVP.exe 5792 JCDDVXX.exe 1916 VVG.exe 1300 EVIB.exe 4236 ZINKJC.exe 5968 LYT.exe 4212 UYVQZ.exe 5164 PMAHJR.exe 5592 TRKWZUL.exe 1380 RNJ.exe 1436 GITBPK.exe 4756 KYA.exe 5736 OBYWBW.exe 708 EWPJ.exe 4648 MBHXW.exe 3004 PROX.exe 6088 KFTHKN.exe 3884 QFAUBI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GVQ.exe.bat PUOCLYJ.exe File created C:\windows\SysWOW64\EVIB.exe.bat VVG.exe File created C:\windows\SysWOW64\RNJ.exe TRKWZUL.exe File created C:\windows\SysWOW64\TFP.exe HPJB.exe File opened for modification C:\windows\SysWOW64\LRETD.exe DMEM.exe File created C:\windows\SysWOW64\HHBAM.exe JHU.exe File opened for modification C:\windows\SysWOW64\OSFOKV.exe TFAE.exe File created C:\windows\SysWOW64\CWOGS.exe.bat CROR.exe File created C:\windows\SysWOW64\GITBPK.exe.bat RNJ.exe File created C:\windows\SysWOW64\IIGY.exe.bat NUBOFOP.exe File opened for modification C:\windows\SysWOW64\GVQ.exe PUOCLYJ.exe File opened for modification C:\windows\SysWOW64\UYVQZ.exe LYT.exe File created C:\windows\SysWOW64\KVUNY.exe.bat TIKV.exe File created C:\windows\SysWOW64\XGOIK.exe JVYKWJA.exe File created C:\windows\SysWOW64\MJCFCKI.exe HJURT.exe File opened for modification C:\windows\SysWOW64\TXOXQVE.exe ECFSFI.exe File opened for modification C:\windows\SysWOW64\MJCFCKI.exe HJURT.exe File opened for modification C:\windows\SysWOW64\XGOIK.exe JVYKWJA.exe File created C:\windows\SysWOW64\LSF.exe.bat QFAUBI.exe File created C:\windows\SysWOW64\EYS.exe.bat TFP.exe File created C:\windows\SysWOW64\GTCSYA.exe.bat CLWS.exe File opened for modification C:\windows\SysWOW64\HHBAM.exe JHU.exe File created C:\windows\SysWOW64\XGOIK.exe.bat JVYKWJA.exe File created C:\windows\SysWOW64\WRK.exe.bat SBEYTQ.exe File opened for modification C:\windows\SysWOW64\RNJ.exe TRKWZUL.exe File opened for modification C:\windows\SysWOW64\MBTTNFQ.exe UGI.exe File created C:\windows\SysWOW64\FPUB.exe QUDXEN.exe File opened for modification C:\windows\SysWOW64\CROR.exe WQGEZNJ.exe File created C:\windows\SysWOW64\UYVQZ.exe LYT.exe File opened for modification C:\windows\SysWOW64\TRKWZUL.exe PMAHJR.exe File opened for modification C:\windows\SysWOW64\PROX.exe MBHXW.exe File created C:\windows\SysWOW64\LOYSJCD.exe LIXDHPA.exe File created C:\windows\SysWOW64\DMUMYMU.exe.bat GGPPR.exe File created C:\windows\SysWOW64\TXOXQVE.exe.bat ECFSFI.exe File created C:\windows\SysWOW64\CWOGS.exe CROR.exe File created C:\windows\SysWOW64\OIO.exe ZNEYC.exe File created C:\windows\SysWOW64\FRVGPLT.exe.bat OGFQPY.exe File opened for modification C:\windows\SysWOW64\TDOEOTC.exe YPJVET.exe File created C:\windows\SysWOW64\MBTTNFQ.exe UGI.exe File opened for modification C:\windows\SysWOW64\CWOGS.exe CROR.exe File opened for modification C:\windows\SysWOW64\LOYSJCD.exe LIXDHPA.exe File opened for modification C:\windows\SysWOW64\VBFA.exe GGWWIJ.exe File created C:\windows\SysWOW64\BGFCDLU.exe.bat RGDX.exe File opened for modification C:\windows\SysWOW64\AOK.exe PWHTAWF.exe File created C:\windows\SysWOW64\LOYSJCD.exe.bat LIXDHPA.exe File created C:\windows\SysWOW64\MBTTNFQ.exe.bat UGI.exe File created C:\windows\SysWOW64\FYCYLOW.exe KLXPBO.exe File created C:\windows\SysWOW64\GITBPK.exe RNJ.exe File created C:\windows\SysWOW64\PROX.exe.bat MBHXW.exe File created C:\windows\SysWOW64\KVUNY.exe TIKV.exe File created C:\windows\SysWOW64\UGI.exe.bat 2026-07-17_acdf2fc01bb159030c785864e0312661_elex_emotet_stop.exe File created C:\windows\SysWOW64\BECXY.exe.bat MBTTNFQ.exe File created C:\windows\SysWOW64\FPUB.exe.bat QUDXEN.exe File created C:\windows\SysWOW64\AOK.exe PWHTAWF.exe File created C:\windows\SysWOW64\LRETD.exe.bat DMEM.exe File created C:\windows\SysWOW64\IIGY.exe NUBOFOP.exe File opened for modification C:\windows\SysWOW64\HPJB.exe FRVGPLT.exe File created C:\windows\SysWOW64\CROR.exe.bat WQGEZNJ.exe File opened for modification C:\windows\SysWOW64\ZZGQXEY.exe LOYSJCD.exe File created C:\windows\SysWOW64\ZZGQXEY.exe.bat LOYSJCD.exe File opened for modification C:\windows\SysWOW64\KVUNY.exe TIKV.exe File created C:\windows\SysWOW64\DMUMYMU.exe GGPPR.exe File created C:\windows\SysWOW64\YCXYKR.exe.bat MJCFCKI.exe File created C:\windows\SysWOW64\TXOXQVE.exe ECFSFI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\XAJQAMC.exe XVJCZHZ.exe File created C:\windows\EWPJ.exe.bat OBYWBW.exe File created C:\windows\system\OUBN.exe EMZ.exe File opened for modification C:\windows\system\IDJ.exe NIEHWV.exe File opened for modification C:\windows\YTTM.exe DYODXLB.exe File opened for modification C:\windows\system\PWHTAWF.exe FYCYLOW.exe File opened for modification C:\windows\system\JCDDVXX.exe ECVP.exe File opened for modification C:\windows\FIQQ.exe OIO.exe File opened for modification C:\windows\system\SFOQIS.exe TMLA.exe File created C:\windows\GGWWIJ.exe LSRM.exe File created C:\windows\YPJVET.exe QFJTQ.exe File opened for modification C:\windows\system\PQW.exe FPUB.exe File created C:\windows\SBEYTQ.exe HJBF.exe File created C:\windows\system\JWRV.exe.bat LGFSNV.exe File created C:\windows\system\OQVAID.exe TDQR.exe File opened for modification C:\windows\GGPPR.exe AGH.exe File opened for modification C:\windows\YPJVET.exe QFJTQ.exe File created C:\windows\system\LFRY.exe RRMPMEJ.exe File created C:\windows\system\RGDX.exe.bat VBFA.exe File created C:\windows\HPRABIA.exe.bat QPPVYL.exe File created C:\windows\JHU.exe.bat DMUMYMU.exe File created C:\windows\system\DYODXLB.exe.bat XYHPO.exe File created C:\windows\DYQCT.exe TXOXQVE.exe File opened for modification C:\windows\KLXPBO.exe GVQ.exe File created C:\windows\system\WQGEZNJ.exe ZLAHSDP.exe File opened for modification C:\windows\XVJCZHZ.exe LFCU.exe File created C:\windows\XVJCZHZ.exe.bat LFCU.exe File created C:\windows\system\JHV.exe YOALBAK.exe File opened for modification C:\windows\system\VCKM.exe BGFCDLU.exe File created C:\windows\MGSPFY.exe.bat DYQCT.exe File opened for modification C:\windows\QFAUBI.exe KFTHKN.exe File created C:\windows\PRQWF.exe.bat JWRV.exe File created C:\windows\system\HJBF.exe MGSPFY.exe File created C:\windows\system\PWHTAWF.exe.bat FYCYLOW.exe File opened for modification C:\windows\KFTHKN.exe PROX.exe File created C:\windows\system\JHV.exe.bat YOALBAK.exe File opened for modification C:\windows\system\FWOGG.exe OWMB.exe File opened for modification C:\windows\JMWFP.exe YTTM.exe File created C:\windows\system\PUOCLYJ.exe.bat WRK.exe File created C:\windows\system\KYA.exe GITBPK.exe File opened for modification C:\windows\system\OBYWBW.exe KYA.exe File opened for modification C:\windows\system\RRMPMEJ.exe LRETD.exe File opened for modification C:\windows\ECFSFI.exe DZTOZSU.exe File created C:\windows\TMLA.exe.bat ZZGQXEY.exe File opened for modification C:\windows\system\OQVAID.exe TDQR.exe File created C:\windows\system\QUDXEN.exe.bat BECXY.exe File opened for modification C:\windows\NUBOFOP.exe JMUG.exe File created C:\windows\system\ECANM.exe.bat JHV.exe File created C:\windows\system\RGDX.exe VBFA.exe File created C:\windows\system\HJURT.exe BJN.exe File opened for modification C:\windows\system\TBHKSOO.exe RLTX.exe File created C:\windows\system\XAJQAMC.exe XVJCZHZ.exe File created C:\windows\PRQWF.exe JWRV.exe File created C:\windows\system\SFOQIS.exe TMLA.exe File created C:\windows\system\IDJ.exe NIEHWV.exe File opened for modification C:\windows\system\YOALBAK.exe IDJ.exe File created C:\windows\JMUG.exe FWOGG.exe File opened for modification C:\windows\system\WQGEZNJ.exe ZLAHSDP.exe File created C:\windows\LFCU.exe.bat RRX.exe File opened for modification C:\windows\system\JTEB.exe XAJQAMC.exe File created C:\windows\system\JCDDVXX.exe.bat ECVP.exe File opened for modification C:\windows\system\VVG.exe JCDDVXX.exe File opened for modification C:\windows\system\TIKV.exe VVKUDRX.exe File created C:\windows\system\TFAE.exe IMX.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 796 cmd.exe 1080 cmd.exe 252 cmd.exe 2660 cmd.exe 1256 cmd.exe 2580 cmd.exe 5412 cmd.exe 2268 cmd.exe 2140 cmd.exe 3712 cmd.exe 5332 cmd.exe 3264 cmd.exe 4468 cmd.exe 4840 cmd.exe 4836 cmd.exe 1100 cmd.exe 5880 cmd.exe 2540 cmd.exe 5116 cmd.exe 5484 cmd.exe 4284 cmd.exe 5408 cmd.exe 4188 cmd.exe 5504 cmd.exe 3192 cmd.exe 752 cmd.exe 5176 cmd.exe 1268 cmd.exe 2612 cmd.exe 4868 cmd.exe 5684 cmd.exe 1252 cmd.exe 5276 cmd.exe 4540 cmd.exe 5692 cmd.exe 4760 cmd.exe 2976 cmd.exe 1428 cmd.exe 4152 cmd.exe 1936 cmd.exe 1444 cmd.exe 1564 cmd.exe 964 cmd.exe 4708 cmd.exe 4816 cmd.exe 3312 cmd.exe 5184 cmd.exe 460 cmd.exe 2384 cmd.exe 1064 cmd.exe 4080 cmd.exe 1704 cmd.exe 1168 cmd.exe 3504 cmd.exe 1028 cmd.exe 4260 cmd.exe 3100 cmd.exe 2808 cmd.exe 2920 cmd.exe 3928 cmd.exe 3356 cmd.exe 1308 cmd.exe 1860 cmd.exe 4352 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2892 4328 WerFault.exe 86 4748 5600 WerFault.exe 90 1980 3000 WerFault.exe 97 5964 2056 WerFault.exe 102 5264 4960 WerFault.exe 107 6004 3248 WerFault.exe 112 1100 2068 WerFault.exe 117 1704 5404 WerFault.exe 122 4452 1096 WerFault.exe 127 124 3740 WerFault.exe 132 3044 4616 WerFault.exe 137 2404 4356 WerFault.exe 142 4864 2764 WerFault.exe 147 3844 2640 WerFault.exe 152 1976 1128 WerFault.exe 157 792 5280 WerFault.exe 162 920 1240 WerFault.exe 167 4800 5944 WerFault.exe 172 5968 1456 WerFault.exe 177 4792 5780 WerFault.exe 182 4352 5872 WerFault.exe 187 4144 4184 WerFault.exe 192 4148 5824 WerFault.exe 197 2816 2404 WerFault.exe 202 6084 4124 WerFault.exe 207 720 3844 WerFault.exe 212 5792 1192 WerFault.exe 217 1856 596 WerFault.exe 222 4648 1972 WerFault.exe 227 4084 2912 WerFault.exe 232 4188 2356 WerFault.exe 237 1520 3224 WerFault.exe 242 5752 4088 WerFault.exe 247 5488 972 WerFault.exe 252 4748 956 WerFault.exe 257 1436 1384 WerFault.exe 262 4600 5748 WerFault.exe 267 4948 5076 WerFault.exe 272 4156 3060 WerFault.exe 277 3124 1396 WerFault.exe 283 4292 2320 WerFault.exe 288 4504 2108 WerFault.exe 293 4212 6008 WerFault.exe 298 4920 2244 WerFault.exe 303 4120 2656 WerFault.exe 308 5496 5384 WerFault.exe 313 4844 3612 WerFault.exe 318 3736 3608 WerFault.exe 323 5856 5792 WerFault.exe 328 4492 1916 WerFault.exe 333 2052 1300 WerFault.exe 338 4740 4236 WerFault.exe 343 3008 5968 WerFault.exe 348 1696 4212 WerFault.exe 353 4120 5164 WerFault.exe 358 1372 5592 WerFault.exe 363 4844 1380 WerFault.exe 368 3736 1436 WerFault.exe 373 2628 4756 WerFault.exe 378 4492 5736 WerFault.exe 383 3304 708 WerFault.exe 388 2924 4648 WerFault.exe 393 3376 3004 WerFault.exe 398 5408 6088 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUBN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TIKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVUNY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZTOZSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGSPFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OBYWBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRQWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPJVET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJURT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXOXQVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGFQPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYCYLOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGPPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECFSFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTCSYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPRABIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYQCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4328 2026-07-17_acdf2fc01bb159030c785864e0312661_elex_emotet_stop.exe 4328 2026-07-17_acdf2fc01bb159030c785864e0312661_elex_emotet_stop.exe 5600 UGI.exe 5600 UGI.exe 3000 MBTTNFQ.exe 3000 MBTTNFQ.exe 2056 BECXY.exe 2056 BECXY.exe 4960 QUDXEN.exe 4960 QUDXEN.exe 3248 FPUB.exe 3248 FPUB.exe 2068 PQW.exe 2068 PQW.exe 5404 RLTX.exe 5404 RLTX.exe 1096 TBHKSOO.exe 1096 TBHKSOO.exe 3740 OWMB.exe 3740 OWMB.exe 4616 FWOGG.exe 4616 FWOGG.exe 4356 JMUG.exe 4356 JMUG.exe 2764 NUBOFOP.exe 2764 NUBOFOP.exe 2640 IIGY.exe 2640 IIGY.exe 1128 XYHPO.exe 1128 XYHPO.exe 5280 DYODXLB.exe 5280 DYODXLB.exe 1240 YTTM.exe 1240 YTTM.exe 5944 JMWFP.exe 5944 JMWFP.exe 1456 DZTOZSU.exe 1456 DZTOZSU.exe 5780 ECFSFI.exe 5780 ECFSFI.exe 5872 TXOXQVE.exe 5872 TXOXQVE.exe 4184 DYQCT.exe 4184 DYQCT.exe 5824 MGSPFY.exe 5824 MGSPFY.exe 2404 HJBF.exe 2404 HJBF.exe 4124 SBEYTQ.exe 4124 SBEYTQ.exe 3844 WRK.exe 3844 WRK.exe 1192 PUOCLYJ.exe 1192 PUOCLYJ.exe 596 GVQ.exe 596 GVQ.exe 1972 KLXPBO.exe 1972 KLXPBO.exe 2912 FYCYLOW.exe 2912 FYCYLOW.exe 2356 PWHTAWF.exe 2356 PWHTAWF.exe 3224 AOK.exe 3224 AOK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4328 2026-07-17_acdf2fc01bb159030c785864e0312661_elex_emotet_stop.exe 4328 2026-07-17_acdf2fc01bb159030c785864e0312661_elex_emotet_stop.exe 5600 UGI.exe 5600 UGI.exe 3000 MBTTNFQ.exe 3000 MBTTNFQ.exe 2056 BECXY.exe 2056 BECXY.exe 4960 QUDXEN.exe 4960 QUDXEN.exe 3248 FPUB.exe 3248 FPUB.exe 2068 PQW.exe 2068 PQW.exe 5404 RLTX.exe 5404 RLTX.exe 1096 TBHKSOO.exe 1096 TBHKSOO.exe 3740 OWMB.exe 3740 OWMB.exe 4616 FWOGG.exe 4616 FWOGG.exe 4356 JMUG.exe 4356 JMUG.exe 2764 NUBOFOP.exe 2764 NUBOFOP.exe 2640 IIGY.exe 2640 IIGY.exe 1128 XYHPO.exe 1128 XYHPO.exe 5280 DYODXLB.exe 5280 DYODXLB.exe 1240 YTTM.exe 1240 YTTM.exe 5944 JMWFP.exe 5944 JMWFP.exe 1456 DZTOZSU.exe 1456 DZTOZSU.exe 5780 ECFSFI.exe 5780 ECFSFI.exe 5872 TXOXQVE.exe 5872 TXOXQVE.exe 4184 DYQCT.exe 4184 DYQCT.exe 5824 MGSPFY.exe 5824 MGSPFY.exe 2404 HJBF.exe 2404 HJBF.exe 4124 SBEYTQ.exe 4124 SBEYTQ.exe 3844 WRK.exe 3844 WRK.exe 1192 PUOCLYJ.exe 1192 PUOCLYJ.exe 596 GVQ.exe 596 GVQ.exe 1972 KLXPBO.exe 1972 KLXPBO.exe 2912 FYCYLOW.exe 2912 FYCYLOW.exe 2356 PWHTAWF.exe 2356 PWHTAWF.exe 3224 AOK.exe 3224 AOK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4328 wrote to memory of 3308 4328 2026-07-17_acdf2fc01bb159030c785864e0312661_elex_emotet_stop.exe 87 PID 3308 wrote to memory of 5600 3308 cmd.exe 90 PID 5600 wrote to memory of 3476 5600 UGI.exe 93 PID 3476 wrote to memory of 3000 3476 cmd.exe 97 PID 3000 wrote to memory of 3528 3000 MBTTNFQ.exe 98 PID 3528 wrote to memory of 2056 3528 cmd.exe 102 PID 2056 wrote to memory of 5116 2056 BECXY.exe 103 PID 5116 wrote to memory of 4960 5116 cmd.exe 107 PID 4960 wrote to memory of 4540 4960 QUDXEN.exe 108 PID 4540 wrote to memory of 3248 4540 cmd.exe 112 PID 3248 wrote to memory of 2896 3248 FPUB.exe 113 PID 2896 wrote to memory of 2068 2896 cmd.exe 117 PID 2068 wrote to memory of 2804 2068 PQW.exe 118 PID 2804 wrote to memory of 5404 2804 cmd.exe 122 PID 5404 wrote to memory of 5484 5404 RLTX.exe 123 PID 5484 wrote to memory of 1096 5484 cmd.exe 127 PID 1096 wrote to memory of 2920 1096 TBHKSOO.exe 128 PID 2920 wrote to memory of 3740 2920 cmd.exe 132 PID 3740 wrote to memory of 796 3740 OWMB.exe 133 PID 796 wrote to memory of 4616 796 cmd.exe 137 PID 4616 wrote to memory of 1492 4616 FWOGG.exe 138 PID 1492 wrote to memory of 4356 1492 cmd.exe 142 PID 4356 wrote to memory of 200 4356 JMUG.exe 143 PID 200 wrote to memory of 2764 200 cmd.exe 147 PID 2764 wrote to memory of 5916 2764 NUBOFOP.exe 148 PID 5916 wrote to memory of 2640 5916 cmd.exe 152 PID 2640 wrote to memory of 4840 2640 IIGY.exe 153 PID 4840 wrote to memory of 1128 4840 cmd.exe 157 PID 1128 wrote to memory of 3156 1128 XYHPO.exe 158 PID 3156 wrote to memory of 5280 3156 cmd.exe 162 PID 5280 wrote to memory of 2612 5280 DYODXLB.exe 163 PID 2612 wrote to memory of 1240 2612 cmd.exe 167 PID 1240 wrote to memory of 3676 1240 YTTM.exe 168 PID 3676 wrote to memory of 5944 3676 cmd.exe 172 PID 5944 wrote to memory of 4780 5944 JMWFP.exe 173 PID 4780 wrote to memory of 1456 4780 cmd.exe 177 PID 1456 wrote to memory of 3388 1456 DZTOZSU.exe 178 PID 3388 wrote to memory of 5780 3388 cmd.exe 182 PID 5780 wrote to memory of 5708 5780 ECFSFI.exe 183 PID 5708 wrote to memory of 5872 5708 cmd.exe 187 PID 5872 wrote to memory of 752 5872 TXOXQVE.exe 188 PID 752 wrote to memory of 4184 752 cmd.exe 192 PID 4184 wrote to memory of 2112 4184 DYQCT.exe 193 PID 2112 wrote to memory of 5824 2112 cmd.exe 197 PID 5824 wrote to memory of 4624 5824 MGSPFY.exe 198 PID 4624 wrote to memory of 2404 4624 cmd.exe 202 PID 2404 wrote to memory of 4080 2404 HJBF.exe 203 PID 4080 wrote to memory of 4124 4080 cmd.exe 207 PID 4124 wrote to memory of 6064 4124 SBEYTQ.exe 208 PID 6064 wrote to memory of 3844 6064 cmd.exe 212 PID 3844 wrote to memory of 1080 3844 WRK.exe 213 PID 1080 wrote to memory of 1192 1080 cmd.exe 217 PID 1192 wrote to memory of 3040 1192 PUOCLYJ.exe 218 PID 3040 wrote to memory of 596 3040 cmd.exe 222 PID 596 wrote to memory of 832 596 GVQ.exe 223 PID 832 wrote to memory of 1972 832 cmd.exe 227 PID 1972 wrote to memory of 3928 1972 KLXPBO.exe 228 PID 3928 wrote to memory of 2912 3928 cmd.exe 232 PID 2912 wrote to memory of 1704 2912 FYCYLOW.exe 233 PID 1704 wrote to memory of 2356 1704 cmd.exe 237 PID 2356 wrote to memory of 5820 2356 PWHTAWF.exe 238 PID 5820 wrote to memory of 3224 5820 cmd.exe 242 PID 3224 wrote to memory of 1428 3224 AOK.exe 243 PID 1428 wrote to memory of 4088 1428 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_acdf2fc01bb159030c785864e0312661_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_acdf2fc01bb159030c785864e0312661_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UGI.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\windows\SysWOW64\UGI.exeC:\windows\system32\UGI.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBTTNFQ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\SysWOW64\MBTTNFQ.exeC:\windows\system32\MBTTNFQ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BECXY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\SysWOW64\BECXY.exeC:\windows\system32\BECXY.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUDXEN.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\windows\system\QUDXEN.exeC:\windows\system\QUDXEN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPUB.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\SysWOW64\FPUB.exeC:\windows\system32\FPUB.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQW.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\windows\system\PQW.exeC:\windows\system\PQW.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TBHKSOO.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\system\TBHKSOO.exeC:\windows\system\TBHKSOO.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OWMB.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\windows\OWMB.exeC:\windows\OWMB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWOGG.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:796 -
C:\windows\system\FWOGG.exeC:\windows\system\FWOGG.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMUG.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\windows\JMUG.exeC:\windows\JMUG.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NUBOFOP.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\NUBOFOP.exeC:\windows\NUBOFOP.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIGY.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\SysWOW64\IIGY.exeC:\windows\system32\IIGY.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYODXLB.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\windows\system\DYODXLB.exeC:\windows\system\DYODXLB.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTTM.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\windows\YTTM.exeC:\windows\YTTM.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMWFP.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\windows\JMWFP.exeC:\windows\JMWFP.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZTOZSU.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\DZTOZSU.exeC:\windows\DZTOZSU.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECFSFI.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\ECFSFI.exeC:\windows\ECFSFI.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXOXQVE.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\windows\SysWOW64\TXOXQVE.exeC:\windows\system32\TXOXQVE.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:752 -
C:\windows\DYQCT.exeC:\windows\DYQCT.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGSPFY.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\windows\MGSPFY.exeC:\windows\MGSPFY.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJBF.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\system\HJBF.exeC:\windows\system\HJBF.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBEYTQ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\windows\SBEYTQ.exeC:\windows\SBEYTQ.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WRK.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\windows\SysWOW64\WRK.exeC:\windows\system32\WRK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PUOCLYJ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\windows\system\PUOCLYJ.exeC:\windows\system\PUOCLYJ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GVQ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\SysWOW64\GVQ.exeC:\windows\system32\GVQ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KLXPBO.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\windows\KLXPBO.exeC:\windows\KLXPBO.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYCYLOW.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\windows\SysWOW64\FYCYLOW.exeC:\windows\system32\FYCYLOW.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWHTAWF.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\windows\system\PWHTAWF.exeC:\windows\system\PWHTAWF.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOK.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\windows\SysWOW64\AOK.exeC:\windows\system32\AOK.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJUQUY.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\PJUQUY.exeC:\windows\PJUQUY.exe65⤵
- Executes dropped EXE
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMX.exe.bat" "66⤵PID:1692
-
C:\windows\IMX.exeC:\windows\IMX.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "68⤵PID:3868
-
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSFOKV.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:252 -
C:\windows\SysWOW64\OSFOKV.exeC:\windows\system32\OSFOKV.exe71⤵
- Executes dropped EXE
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "72⤵PID:5512
-
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQGEZNJ.exe.bat" "74⤵PID:4392
-
C:\windows\system\WQGEZNJ.exeC:\windows\system\WQGEZNJ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CROR.exe.bat" "76⤵
- Executes a command shell one-liner
PID:1168 -
C:\windows\SysWOW64\CROR.exeC:\windows\system32\CROR.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWOGS.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3356 -
C:\windows\SysWOW64\CWOGS.exeC:\windows\system32\CWOGS.exe79⤵
- Executes dropped EXE
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRX.exe.bat" "80⤵PID:4588
-
C:\windows\RRX.exeC:\windows\RRX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFCU.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3504 -
C:\windows\LFCU.exeC:\windows\LFCU.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XVJCZHZ.exe.bat" "84⤵PID:2824
-
C:\windows\XVJCZHZ.exeC:\windows\XVJCZHZ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XAJQAMC.exe.bat" "86⤵PID:2176
-
C:\windows\system\XAJQAMC.exeC:\windows\system\XAJQAMC.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTEB.exe.bat" "88⤵PID:5752
-
C:\windows\system\JTEB.exeC:\windows\system\JTEB.exe89⤵
- Executes dropped EXE
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DGJKL.exe.bat" "90⤵PID:4744
-
C:\windows\DGJKL.exeC:\windows\DGJKL.exe91⤵
- Executes dropped EXE
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTT.exe.bat" "92⤵PID:976
-
C:\windows\UTT.exeC:\windows\UTT.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECVP.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4152 -
C:\windows\ECVP.exeC:\windows\ECVP.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JCDDVXX.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1308 -
C:\windows\system\JCDDVXX.exeC:\windows\system\JCDDVXX.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVG.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2140 -
C:\windows\system\VVG.exeC:\windows\system\VVG.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVIB.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4284 -
C:\windows\SysWOW64\EVIB.exeC:\windows\system32\EVIB.exe101⤵
- Executes dropped EXE
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZINKJC.exe.bat" "102⤵PID:4628
-
C:\windows\ZINKJC.exeC:\windows\ZINKJC.exe103⤵
- Executes dropped EXE
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYT.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2304 -
C:\windows\system\LYT.exeC:\windows\system\LYT.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UYVQZ.exe.bat" "106⤵
- Executes a command shell one-liner
PID:1028 -
C:\windows\SysWOW64\UYVQZ.exeC:\windows\system32\UYVQZ.exe107⤵
- Executes dropped EXE
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMAHJR.exe.bat" "108⤵PID:4896
-
C:\windows\SysWOW64\PMAHJR.exeC:\windows\system32\PMAHJR.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TRKWZUL.exe.bat" "110⤵PID:4288
-
C:\windows\SysWOW64\TRKWZUL.exeC:\windows\system32\TRKWZUL.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RNJ.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1860 -
C:\windows\SysWOW64\RNJ.exeC:\windows\system32\RNJ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GITBPK.exe.bat" "114⤵PID:4100
-
C:\windows\SysWOW64\GITBPK.exeC:\windows\system32\GITBPK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYA.exe.bat" "116⤵PID:1616
-
C:\windows\system\KYA.exeC:\windows\system\KYA.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OBYWBW.exe.bat" "118⤵PID:1996
-
C:\windows\system\OBYWBW.exeC:\windows\system\OBYWBW.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWPJ.exe.bat" "120⤵PID:1656
-
C:\windows\EWPJ.exeC:\windows\EWPJ.exe121⤵
- Executes dropped EXE
PID:708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-