Analysis
- max time kernel
84s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_1fcccea60aeb7b6e6202b4806e301137_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_1fcccea60aeb7b6e6202b4806e301137_elex_emotet_stop.exe
- Size 282KB
- Sample260718-e9pw8sgw2m
- SHA256 fa618b9bc43a1167c13a6113a657bf29a7293dcde5c120ebdc4ffb1646b0ced0
- MD5 1fcccea60aeb7b6e6202b4806e301137
- SHA1 6b482687bce9985a6c1d09fa9e7bbe0754a7ec55
- SHA512 a32015f888a31320e21a23b2a68107f50312da6c4c1a24308fcc8ddd10dbaa55e9f7a85522488de6fab7512dcea258834fe211bfeabc2bd0fdd6da9f0b8cb15c
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOekEjiPISUOgW9X+hOGzC/:RLWI09QZb6LOekmZzcukG2/
- TLSH T1F2549F1776C28273D5A3037209DAC6E9773ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2324 QNH.exe 4240 AGFXBZC.exe 3440 PWSORGS.exe 2432 QRWSXW.exe 2072 AOKE.exe 4168 JXESQ.exe 924 WIUIE.exe 4584 GFA.exe 832 UDIONH.exe 5376 NWPZEI.exe 4220 VJCGPG.exe 5860 ZRJ.exe 3856 JPO.exe 6044 QFPAPU.exe 2716 LSU.exe 4188 XIBRE.exe 4664 ZGO.exe 5736 OWPDSQ.exe 2104 JJU.exe 3852 WUC.exe 2712 ICJLD.exe 4092 GYIMZO.exe 4788 JLN.exe 4268 LJTPZWA.exe 3476 FWXZ.exe 2012 AHOXQZK.exe 5680 IXPXW.exe 5788 DIX.exe 2536 MIZBO.exe 4656 QYGB.exe 5028 YDGPC.exe 4108 NYQ.exe 1884 NEQ.exe 548 RUWQAS.exe 5508 XUE.exe 2328 HVGJ.exe 6100 WQPNGNR.exe 5404 WTTR.exe 3380 WYTFV.exe 5956 TERUCRX.exe 2348 ZEZI.exe 1920 INBVO.exe 2084 DAGFZRQ.exe 4828 HIMF.exe 3000 WYN.exe 4472 AOCEE.exe 4600 VBHNGPL.exe 1068 RHFK.exe 5364 XHMY.exe 2436 GHODIYR.exe 3244 YQQ.exe 4876 SDVAV.exe 3860 NQAJGDW.exe 3212 CLJOR.exe 2100 GBQODIT.exe 4668 RUT.exe 3184 MHYQV.exe 1372 OVDZYPM.exe 1208 OIV.exe 4696 JVAFJ.exe 2932 EJEOUC.exe 1128 IRLO.exe 1616 CMQYQM.exe 1924 ZKWVXWX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RHFK.exe.bat VBHNGPL.exe File opened for modification C:\windows\SysWOW64\EJEOUC.exe JVAFJ.exe File created C:\windows\SysWOW64\QYL.exe.bat MIEZW.exe File created C:\windows\SysWOW64\VQDU.exe IFUDVZ.exe File opened for modification C:\windows\SysWOW64\VQDU.exe IFUDVZ.exe File created C:\windows\SysWOW64\LGE.exe.bat VQDU.exe File created C:\windows\SysWOW64\AHOXQZK.exe FWXZ.exe File created C:\windows\SysWOW64\INBVO.exe ZEZI.exe File opened for modification C:\windows\SysWOW64\MIEZW.exe BPJG.exe File created C:\windows\SysWOW64\AOKE.exe.bat QRWSXW.exe File created C:\windows\SysWOW64\WYTFV.exe.bat WTTR.exe File created C:\windows\SysWOW64\WYN.exe HIMF.exe File opened for modification C:\windows\SysWOW64\WYN.exe HIMF.exe File created C:\windows\SysWOW64\WYN.exe.bat HIMF.exe File created C:\windows\SysWOW64\RUT.exe GBQODIT.exe File opened for modification C:\windows\SysWOW64\MHYQV.exe RUT.exe File opened for modification C:\windows\SysWOW64\ZKWVXWX.exe CMQYQM.exe File created C:\windows\SysWOW64\AOKE.exe QRWSXW.exe File created C:\windows\SysWOW64\RUT.exe.bat GBQODIT.exe File created C:\windows\SysWOW64\KCZ.exe.bat ZKWVXWX.exe File opened for modification C:\windows\SysWOW64\QYL.exe MIEZW.exe File opened for modification C:\windows\SysWOW64\RTFLJ.exe QQTIWT.exe File opened for modification C:\windows\SysWOW64\UVHCG.exe ZAKL.exe File created C:\windows\SysWOW64\KTADHZ.exe LYBCC.exe File opened for modification C:\windows\SysWOW64\NPWXZN.exe HUWO.exe File opened for modification C:\windows\SysWOW64\INBVO.exe ZEZI.exe File created C:\windows\SysWOW64\SDVAV.exe.bat YQQ.exe File created C:\windows\SysWOW64\CMQYQM.exe.bat IRLO.exe File created C:\windows\SysWOW64\OWPDSQ.exe.bat ZGO.exe File opened for modification C:\windows\SysWOW64\AHOXQZK.exe FWXZ.exe File created C:\windows\SysWOW64\HIMF.exe.bat DAGFZRQ.exe File created C:\windows\SysWOW64\MHYQV.exe.bat RUT.exe File opened for modification C:\windows\SysWOW64\NYQ.exe YDGPC.exe File created C:\windows\SysWOW64\HVGJ.exe XUE.exe File created C:\windows\SysWOW64\SDVAV.exe YQQ.exe File created C:\windows\SysWOW64\EJEOUC.exe.bat JVAFJ.exe File created C:\windows\SysWOW64\CMQYQM.exe IRLO.exe File created C:\windows\SysWOW64\XADPX.exe.bat ORJC.exe File created C:\windows\SysWOW64\PROX.exe.bat POKUV.exe File created C:\windows\SysWOW64\UVHCG.exe ZAKL.exe File opened for modification C:\windows\SysWOW64\CMQYQM.exe IRLO.exe File created C:\windows\SysWOW64\WQPNGNR.exe HVGJ.exe File created C:\windows\SysWOW64\INBVO.exe.bat ZEZI.exe File created C:\windows\SysWOW64\MHYQV.exe RUT.exe File created C:\windows\SysWOW64\MIEZW.exe BPJG.exe File created C:\windows\SysWOW64\PROX.exe POKUV.exe File created C:\windows\SysWOW64\NPWXZN.exe.bat HUWO.exe File created C:\windows\SysWOW64\YDGPC.exe.bat QYGB.exe File opened for modification C:\windows\SysWOW64\RUWQAS.exe NEQ.exe File created C:\windows\SysWOW64\RHFK.exe VBHNGPL.exe File created C:\windows\SysWOW64\ZKWVXWX.exe.bat CMQYQM.exe File created C:\windows\SysWOW64\RTFLJ.exe QQTIWT.exe File created C:\windows\SysWOW64\NPWXZN.exe HUWO.exe File opened for modification C:\windows\SysWOW64\AOKE.exe QRWSXW.exe File created C:\windows\SysWOW64\NYQ.exe.bat YDGPC.exe File opened for modification C:\windows\SysWOW64\WQPNGNR.exe HVGJ.exe File opened for modification C:\windows\SysWOW64\KCZ.exe ZKWVXWX.exe File created C:\windows\SysWOW64\UVHCG.exe.bat ZAKL.exe File opened for modification C:\windows\SysWOW64\KTADHZ.exe LYBCC.exe File created C:\windows\SysWOW64\AHOXQZK.exe.bat FWXZ.exe File created C:\windows\SysWOW64\RUWQAS.exe.bat NEQ.exe File opened for modification C:\windows\SysWOW64\RHFK.exe VBHNGPL.exe File created C:\windows\SysWOW64\EJEOUC.exe JVAFJ.exe File opened for modification C:\windows\SysWOW64\PROX.exe POKUV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\WTTR.exe.bat WQPNGNR.exe File opened for modification C:\windows\GBQODIT.exe CLJOR.exe File opened for modification C:\windows\CKAD.exe WKTPCU.exe File opened for modification C:\windows\LHCVMIW.exe RTFLJ.exe File opened for modification C:\windows\system\UBHJPN.exe UVHCG.exe File created C:\windows\QNH.exe.bat 2026-07-17_1fcccea60aeb7b6e6202b4806e301137_elex_emotet_stop.exe File created C:\windows\QYGB.exe MIZBO.exe File created C:\windows\system\SNOZ.exe TDDJCFU.exe File created C:\windows\system\HQXEWGZ.exe SNOZ.exe File created C:\windows\QFPAPU.exe JPO.exe File created C:\windows\JLN.exe GYIMZO.exe File created C:\windows\JVAFJ.exe.bat OIV.exe File opened for modification C:\windows\system\IRLO.exe EJEOUC.exe File opened for modification C:\windows\PWSORGS.exe AGFXBZC.exe File created C:\windows\MIZBO.exe.bat DIX.exe File opened for modification C:\windows\NQAJGDW.exe SDVAV.exe File created C:\windows\NQAJGDW.exe.bat SDVAV.exe File created C:\windows\system\IKIRUY.exe.bat CKAD.exe File created C:\windows\DAK.exe XADPX.exe File opened for modification C:\windows\system\QQTIWT.exe SQLU.exe File opened for modification C:\windows\NAQZHRE.exe WAOU.exe File created C:\windows\JPO.exe ZRJ.exe File opened for modification C:\windows\system\IXPXW.exe AHOXQZK.exe File created C:\windows\system\UCAAWL.exe VRXKOXX.exe File opened for modification C:\windows\system\HUWO.exe OZTSPUW.exe File opened for modification C:\windows\system\CKFB.exe NPWXZN.exe File created C:\windows\QRWSXW.exe PWSORGS.exe File created C:\windows\TERUCRX.exe.bat WYTFV.exe File created C:\windows\system\OVDZYPM.exe MHYQV.exe File created C:\windows\system\QRZJZ.exe HQXEWGZ.exe File created C:\windows\system\UBHJPN.exe.bat UVHCG.exe File created C:\windows\LJTPZWA.exe.bat JLN.exe File created C:\windows\system\DAGFZRQ.exe INBVO.exe File created C:\windows\system\LRQWT.exe LLPIS.exe File created C:\windows\KFTHKN.exe PROX.exe File created C:\windows\system\GYIMZO.exe ICJLD.exe File created C:\windows\system\ONPG.exe XZFOUY.exe File opened for modification C:\windows\IFUDVZ.exe IAUPUU.exe File opened for modification C:\windows\system\GYIMZO.exe ICJLD.exe File created C:\windows\DIX.exe.bat IXPXW.exe File created C:\windows\QYGB.exe.bat MIZBO.exe File opened for modification C:\windows\BPJG.exe KCZ.exe File opened for modification C:\windows\system\LLPIS.exe QYL.exe File opened for modification C:\windows\system\SNOZ.exe TDDJCFU.exe File opened for modification C:\windows\FWXZ.exe LJTPZWA.exe File created C:\windows\DAK.exe.bat XADPX.exe File created C:\windows\IFUDVZ.exe.bat IAUPUU.exe File created C:\windows\system\HUWO.exe OZTSPUW.exe File created C:\windows\JLN.exe.bat GYIMZO.exe File created C:\windows\TERUCRX.exe WYTFV.exe File opened for modification C:\windows\XZFOUY.exe LHCVMIW.exe File opened for modification C:\windows\system\GFA.exe WIUIE.exe File created C:\windows\system\NEQ.exe NYQ.exe File created C:\windows\ZAKL.exe.bat KFTHKN.exe File created C:\windows\system\GFA.exe.bat WIUIE.exe File opened for modification C:\windows\system\NWPZEI.exe UDIONH.exe File opened for modification C:\windows\JLN.exe GYIMZO.exe File created C:\windows\LJTPZWA.exe JLN.exe File created C:\windows\system\JXESQ.exe.bat AOKE.exe File created C:\windows\system\WKTPCU.exe.bat LRQWT.exe File created C:\windows\WIUIE.exe.bat JXESQ.exe File created C:\windows\VJCGPG.exe.bat NWPZEI.exe File created C:\windows\MIZBO.exe DIX.exe File created C:\windows\system\XUE.exe.bat RUWQAS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4400 cmd.exe 4064 cmd.exe 3004 cmd.exe 5036 cmd.exe 2572 cmd.exe 1548 cmd.exe 3232 cmd.exe 5408 cmd.exe 5224 cmd.exe 3468 cmd.exe 2540 cmd.exe 2500 cmd.exe 2800 cmd.exe 5976 cmd.exe 4252 cmd.exe 4288 cmd.exe 4648 cmd.exe 2688 cmd.exe 4536 cmd.exe 4384 cmd.exe 1788 cmd.exe 3428 cmd.exe 4944 cmd.exe 5048 cmd.exe 3936 cmd.exe 5516 cmd.exe 3800 cmd.exe 5412 cmd.exe 5960 cmd.exe 5244 cmd.exe 4780 cmd.exe 4948 cmd.exe 1400 cmd.exe 5792 cmd.exe 1508 cmd.exe 4432 cmd.exe 3156 cmd.exe 5300 cmd.exe 5840 cmd.exe 5612 cmd.exe 4820 cmd.exe 3432 cmd.exe 2400 cmd.exe 124 cmd.exe 5604 cmd.exe 3140 cmd.exe 4848 cmd.exe 5208 cmd.exe 4916 cmd.exe 3196 cmd.exe 4304 cmd.exe 1216 cmd.exe 5340 cmd.exe 4904 cmd.exe 4500 cmd.exe 4236 cmd.exe 5944 cmd.exe 2916 cmd.exe 2460 cmd.exe 4116 cmd.exe 5092 cmd.exe 3160 cmd.exe 1908 cmd.exe 5880 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2828 1420 WerFault.exe 87 3248 2324 WerFault.exe 93 1492 4240 WerFault.exe 99 952 3440 WerFault.exe 104 1972 2432 WerFault.exe 109 4536 2072 WerFault.exe 114 764 4168 WerFault.exe 119 828 924 WerFault.exe 124 4780 4584 WerFault.exe 129 4996 832 WerFault.exe 134 2792 5376 WerFault.exe 139 2984 4220 WerFault.exe 144 2632 5860 WerFault.exe 149 5244 3856 WerFault.exe 154 2076 6044 WerFault.exe 159 1992 2716 WerFault.exe 164 3024 4188 WerFault.exe 169 3344 4664 WerFault.exe 174 2208 5736 WerFault.exe 179 5028 2104 WerFault.exe 184 4140 3852 WerFault.exe 189 1920 2712 WerFault.exe 194 4088 4092 WerFault.exe 199 4936 4788 WerFault.exe 204 4596 4268 WerFault.exe 209 1708 3476 WerFault.exe 214 5928 2012 WerFault.exe 219 2800 5680 WerFault.exe 224 5416 5788 WerFault.exe 229 3848 2536 WerFault.exe 234 4804 4656 WerFault.exe 239 4324 5028 WerFault.exe 244 3032 4108 WerFault.exe 249 4136 1884 WerFault.exe 254 744 548 WerFault.exe 259 984 5508 WerFault.exe 264 2656 2328 WerFault.exe 269 4536 6100 WerFault.exe 275 940 5404 WerFault.exe 280 4468 3380 WerFault.exe 285 3316 5956 WerFault.exe 290 3144 2348 WerFault.exe 295 1120 1920 WerFault.exe 300 2448 2084 WerFault.exe 305 5164 4828 WerFault.exe 310 5020 3000 WerFault.exe 315 4436 4472 WerFault.exe 320 1000 4600 WerFault.exe 325 4312 1068 WerFault.exe 330 2532 5364 WerFault.exe 335 2868 2436 WerFault.exe 340 5040 3244 WerFault.exe 345 2680 4876 WerFault.exe 350 2448 3860 WerFault.exe 355 1256 3212 WerFault.exe 360 952 2100 WerFault.exe 365 2812 4668 WerFault.exe 370 4760 3184 WerFault.exe 375 4060 1372 WerFault.exe 380 4492 1208 WerFault.exe 385 3032 4696 WerFault.exe 390 2280 2932 WerFault.exe 395 2360 1128 WerFault.exe 400 4520 1616 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKTPCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDDJCFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRWSXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDGPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRQWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWPDSQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFTHKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXESQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCAAWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWXZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHYQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYTFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDVAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AGFXBZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TERUCRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAUPUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1420 2026-07-17_1fcccea60aeb7b6e6202b4806e301137_elex_emotet_stop.exe 1420 2026-07-17_1fcccea60aeb7b6e6202b4806e301137_elex_emotet_stop.exe 2324 QNH.exe 2324 QNH.exe 4240 AGFXBZC.exe 4240 AGFXBZC.exe 3440 PWSORGS.exe 3440 PWSORGS.exe 2432 QRWSXW.exe 2432 QRWSXW.exe 2072 AOKE.exe 2072 AOKE.exe 4168 JXESQ.exe 4168 JXESQ.exe 924 WIUIE.exe 924 WIUIE.exe 4584 GFA.exe 4584 GFA.exe 832 UDIONH.exe 832 UDIONH.exe 5376 NWPZEI.exe 5376 NWPZEI.exe 4220 VJCGPG.exe 4220 VJCGPG.exe 5860 ZRJ.exe 5860 ZRJ.exe 3856 JPO.exe 3856 JPO.exe 6044 QFPAPU.exe 6044 QFPAPU.exe 2716 LSU.exe 2716 LSU.exe 4188 XIBRE.exe 4188 XIBRE.exe 4664 ZGO.exe 4664 ZGO.exe 5736 OWPDSQ.exe 5736 OWPDSQ.exe 2104 JJU.exe 2104 JJU.exe 3852 WUC.exe 3852 WUC.exe 2712 ICJLD.exe 2712 ICJLD.exe 4092 GYIMZO.exe 4092 GYIMZO.exe 4788 JLN.exe 4788 JLN.exe 4268 LJTPZWA.exe 4268 LJTPZWA.exe 3476 FWXZ.exe 3476 FWXZ.exe 2012 AHOXQZK.exe 2012 AHOXQZK.exe 5680 IXPXW.exe 5680 IXPXW.exe 5788 DIX.exe 5788 DIX.exe 2536 MIZBO.exe 2536 MIZBO.exe 4656 QYGB.exe 4656 QYGB.exe 5028 YDGPC.exe 5028 YDGPC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1420 2026-07-17_1fcccea60aeb7b6e6202b4806e301137_elex_emotet_stop.exe 1420 2026-07-17_1fcccea60aeb7b6e6202b4806e301137_elex_emotet_stop.exe 2324 QNH.exe 2324 QNH.exe 4240 AGFXBZC.exe 4240 AGFXBZC.exe 3440 PWSORGS.exe 3440 PWSORGS.exe 2432 QRWSXW.exe 2432 QRWSXW.exe 2072 AOKE.exe 2072 AOKE.exe 4168 JXESQ.exe 4168 JXESQ.exe 924 WIUIE.exe 924 WIUIE.exe 4584 GFA.exe 4584 GFA.exe 832 UDIONH.exe 832 UDIONH.exe 5376 NWPZEI.exe 5376 NWPZEI.exe 4220 VJCGPG.exe 4220 VJCGPG.exe 5860 ZRJ.exe 5860 ZRJ.exe 3856 JPO.exe 3856 JPO.exe 6044 QFPAPU.exe 6044 QFPAPU.exe 2716 LSU.exe 2716 LSU.exe 4188 XIBRE.exe 4188 XIBRE.exe 4664 ZGO.exe 4664 ZGO.exe 5736 OWPDSQ.exe 5736 OWPDSQ.exe 2104 JJU.exe 2104 JJU.exe 3852 WUC.exe 3852 WUC.exe 2712 ICJLD.exe 2712 ICJLD.exe 4092 GYIMZO.exe 4092 GYIMZO.exe 4788 JLN.exe 4788 JLN.exe 4268 LJTPZWA.exe 4268 LJTPZWA.exe 3476 FWXZ.exe 3476 FWXZ.exe 2012 AHOXQZK.exe 2012 AHOXQZK.exe 5680 IXPXW.exe 5680 IXPXW.exe 5788 DIX.exe 5788 DIX.exe 2536 MIZBO.exe 2536 MIZBO.exe 4656 QYGB.exe 4656 QYGB.exe 5028 YDGPC.exe 5028 YDGPC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1420 wrote to memory of 3604 1420 2026-07-17_1fcccea60aeb7b6e6202b4806e301137_elex_emotet_stop.exe 89 PID 3604 wrote to memory of 2324 3604 cmd.exe 93 PID 2324 wrote to memory of 2096 2324 QNH.exe 95 PID 2096 wrote to memory of 4240 2096 cmd.exe 99 PID 4240 wrote to memory of 1108 4240 AGFXBZC.exe 100 PID 1108 wrote to memory of 3440 1108 cmd.exe 104 PID 3440 wrote to memory of 3152 3440 PWSORGS.exe 105 PID 3152 wrote to memory of 2432 3152 cmd.exe 109 PID 2432 wrote to memory of 4452 2432 QRWSXW.exe 110 PID 4452 wrote to memory of 2072 4452 cmd.exe 114 PID 2072 wrote to memory of 2572 2072 AOKE.exe 115 PID 2572 wrote to memory of 4168 2572 cmd.exe 119 PID 4168 wrote to memory of 4384 4168 JXESQ.exe 120 PID 4384 wrote to memory of 924 4384 cmd.exe 124 PID 924 wrote to memory of 2916 924 WIUIE.exe 125 PID 2916 wrote to memory of 4584 2916 cmd.exe 129 PID 4584 wrote to memory of 1508 4584 GFA.exe 130 PID 1508 wrote to memory of 832 1508 cmd.exe 134 PID 832 wrote to memory of 1836 832 UDIONH.exe 135 PID 1836 wrote to memory of 5376 1836 cmd.exe 139 PID 5376 wrote to memory of 2540 5376 NWPZEI.exe 140 PID 2540 wrote to memory of 4220 2540 cmd.exe 144 PID 4220 wrote to memory of 4604 4220 VJCGPG.exe 145 PID 4604 wrote to memory of 5860 4604 cmd.exe 149 PID 5860 wrote to memory of 4716 5860 ZRJ.exe 150 PID 4716 wrote to memory of 3856 4716 cmd.exe 154 PID 3856 wrote to memory of 1548 3856 JPO.exe 155 PID 1548 wrote to memory of 6044 1548 cmd.exe 159 PID 6044 wrote to memory of 2264 6044 QFPAPU.exe 160 PID 2264 wrote to memory of 2716 2264 cmd.exe 164 PID 2716 wrote to memory of 1816 2716 LSU.exe 165 PID 1816 wrote to memory of 4188 1816 cmd.exe 169 PID 4188 wrote to memory of 1788 4188 XIBRE.exe 170 PID 1788 wrote to memory of 4664 1788 cmd.exe 174 PID 4664 wrote to memory of 4204 4664 ZGO.exe 175 PID 4204 wrote to memory of 5736 4204 cmd.exe 179 PID 5736 wrote to memory of 2500 5736 OWPDSQ.exe 180 PID 2500 wrote to memory of 2104 2500 cmd.exe 184 PID 2104 wrote to memory of 5676 2104 JJU.exe 185 PID 5676 wrote to memory of 3852 5676 cmd.exe 189 PID 3852 wrote to memory of 5836 3852 WUC.exe 190 PID 5836 wrote to memory of 2712 5836 cmd.exe 194 PID 2712 wrote to memory of 5332 2712 ICJLD.exe 195 PID 5332 wrote to memory of 4092 5332 cmd.exe 199 PID 4092 wrote to memory of 5144 4092 GYIMZO.exe 200 PID 5144 wrote to memory of 4788 5144 cmd.exe 204 PID 4788 wrote to memory of 1088 4788 JLN.exe 205 PID 1088 wrote to memory of 4268 1088 cmd.exe 209 PID 4268 wrote to memory of 5976 4268 LJTPZWA.exe 210 PID 5976 wrote to memory of 3476 5976 cmd.exe 214 PID 3476 wrote to memory of 2672 3476 FWXZ.exe 215 PID 2672 wrote to memory of 2012 2672 cmd.exe 219 PID 2012 wrote to memory of 5008 2012 AHOXQZK.exe 220 PID 5008 wrote to memory of 5680 5008 cmd.exe 224 PID 5680 wrote to memory of 3420 5680 IXPXW.exe 225 PID 3420 wrote to memory of 5788 3420 cmd.exe 229 PID 5788 wrote to memory of 3428 5788 DIX.exe 230 PID 3428 wrote to memory of 2536 3428 cmd.exe 234 PID 2536 wrote to memory of 3232 2536 MIZBO.exe 235 PID 3232 wrote to memory of 4656 3232 cmd.exe 239 PID 4656 wrote to memory of 2408 4656 QYGB.exe 240 PID 2408 wrote to memory of 5028 2408 cmd.exe 244 PID 5028 wrote to memory of 3236 5028 YDGPC.exe 245 PID 3236 wrote to memory of 4108 3236 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_1fcccea60aeb7b6e6202b4806e301137_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1fcccea60aeb7b6e6202b4806e301137_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QNH.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\windows\QNH.exeC:\windows\QNH.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGFXBZC.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\windows\AGFXBZC.exeC:\windows\AGFXBZC.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWSORGS.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\windows\PWSORGS.exeC:\windows\PWSORGS.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRWSXW.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\windows\QRWSXW.exeC:\windows\QRWSXW.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOKE.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\SysWOW64\AOKE.exeC:\windows\system32\AOKE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXESQ.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\system\JXESQ.exeC:\windows\system\JXESQ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIUIE.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\windows\WIUIE.exeC:\windows\WIUIE.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFA.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\system\GFA.exeC:\windows\system\GFA.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDIONH.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\system\UDIONH.exeC:\windows\system\UDIONH.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWPZEI.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\windows\system\NWPZEI.exeC:\windows\system\NWPZEI.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJCGPG.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\VJCGPG.exeC:\windows\VJCGPG.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZRJ.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\SysWOW64\ZRJ.exeC:\windows\system32\ZRJ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JPO.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\JPO.exeC:\windows\JPO.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFPAPU.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\windows\QFPAPU.exeC:\windows\QFPAPU.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSU.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\system\LSU.exeC:\windows\system\LSU.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XIBRE.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\system\XIBRE.exeC:\windows\system\XIBRE.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\windows\ZGO.exeC:\windows\ZGO.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWPDSQ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\SysWOW64\OWPDSQ.exeC:\windows\system32\OWPDSQ.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJU.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\system\JJU.exeC:\windows\system\JJU.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUC.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\WUC.exeC:\windows\WUC.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ICJLD.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\windows\ICJLD.exeC:\windows\ICJLD.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYIMZO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\windows\system\GYIMZO.exeC:\windows\system\GYIMZO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLN.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\windows\JLN.exeC:\windows\JLN.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJTPZWA.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\windows\LJTPZWA.exeC:\windows\LJTPZWA.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWXZ.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\FWXZ.exeC:\windows\FWXZ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AHOXQZK.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\windows\SysWOW64\AHOXQZK.exeC:\windows\system32\AHOXQZK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXPXW.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\windows\system\IXPXW.exeC:\windows\system\IXPXW.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DIX.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\windows\DIX.exeC:\windows\DIX.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MIZBO.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\windows\MIZBO.exeC:\windows\MIZBO.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYGB.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\windows\QYGB.exeC:\windows\QYGB.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDGPC.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\windows\SysWOW64\YDGPC.exeC:\windows\system32\YDGPC.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYQ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\windows\SysWOW64\NYQ.exeC:\windows\system32\NYQ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEQ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5024 -
C:\windows\system\NEQ.exeC:\windows\system\NEQ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUWQAS.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5412 -
C:\windows\SysWOW64\RUWQAS.exeC:\windows\system32\RUWQAS.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUE.exe.bat" "70⤵PID:5768
-
C:\windows\system\XUE.exeC:\windows\system\XUE.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVGJ.exe.bat" "72⤵PID:5568
-
C:\windows\SysWOW64\HVGJ.exeC:\windows\system32\HVGJ.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQPNGNR.exe.bat" "74⤵PID:1708
-
C:\windows\SysWOW64\WQPNGNR.exeC:\windows\system32\WQPNGNR.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WTTR.exe.bat" "76⤵PID:1792
-
C:\windows\WTTR.exeC:\windows\WTTR.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYTFV.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5960 -
C:\windows\SysWOW64\WYTFV.exeC:\windows\system32\WYTFV.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4304 -
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEZI.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5880 -
C:\windows\system\ZEZI.exeC:\windows\system\ZEZI.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INBVO.exe.bat" "84⤵PID:5964
-
C:\windows\SysWOW64\INBVO.exeC:\windows\system32\INBVO.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAGFZRQ.exe.bat" "86⤵PID:4484
-
C:\windows\system\DAGFZRQ.exeC:\windows\system\DAGFZRQ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HIMF.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2996 -
C:\windows\SysWOW64\HIMF.exeC:\windows\system32\HIMF.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYN.exe.bat" "90⤵
- Executes a command shell one-liner
PID:5244 -
C:\windows\SysWOW64\WYN.exeC:\windows\system32\WYN.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOCEE.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2400 -
C:\windows\system\AOCEE.exeC:\windows\system\AOCEE.exe93⤵
- Executes dropped EXE
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBHNGPL.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4400 -
C:\windows\system\VBHNGPL.exeC:\windows\system\VBHNGPL.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHFK.exe.bat" "96⤵
- Executes a command shell one-liner
PID:1216 -
C:\windows\SysWOW64\RHFK.exeC:\windows\system32\RHFK.exe97⤵
- Executes dropped EXE
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XHMY.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:472 -
C:\windows\system\XHMY.exeC:\windows\system\XHMY.exe99⤵
- Executes dropped EXE
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHODIYR.exe.bat" "100⤵PID:2788
-
C:\windows\GHODIYR.exeC:\windows\GHODIYR.exe101⤵
- Executes dropped EXE
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "102⤵PID:4908
-
C:\windows\YQQ.exeC:\windows\YQQ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDVAV.exe.bat" "104⤵PID:3436
-
C:\windows\SysWOW64\SDVAV.exeC:\windows\system32\SDVAV.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NQAJGDW.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4064 -
C:\windows\NQAJGDW.exeC:\windows\NQAJGDW.exe107⤵
- Executes dropped EXE
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLJOR.exe.bat" "108⤵PID:2964
-
C:\windows\system\CLJOR.exeC:\windows\system\CLJOR.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUT.exe.bat" "112⤵PID:6056
-
C:\windows\SysWOW64\RUT.exeC:\windows\system32\RUT.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHYQV.exe.bat" "114⤵PID:4068
-
C:\windows\SysWOW64\MHYQV.exeC:\windows\system32\MHYQV.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVDZYPM.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2368 -
C:\windows\system\OVDZYPM.exeC:\windows\system\OVDZYPM.exe117⤵
- Executes dropped EXE
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIV.exe.bat" "118⤵PID:3928
-
C:\windows\system\OIV.exeC:\windows\system\OIV.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVAFJ.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2488 -
C:\windows\JVAFJ.exeC:\windows\JVAFJ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-