Analysis
- max time kernel
87s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe
- Size 208KB
- Sample260719-txecasg131
- SHA256 2bf3a0b9ba64397b231ce702f050f2b00e745cb19a74de8436e40475a9f476d9
- MD5 ed439e323b709f4de60edb9ccacd1d94
- SHA1 d2d3bb2f1edb4b71aa66c422bdebcfac3196e522
- SHA512 f931cad65f103be7ead000abd61f5b8a2ae871374febdb2e6b6f055e83ef5238376125866c5866116296ad76ceafe77b470b1a7a2d19875a87551e5364d8d12a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf34pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO/kEj1
- TLSH T1C1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1676 XEJVMU.exe 2392 XZV.exe 248 QUZWSEY.exe 1776 FKANZ.exe 1332 YNERFPP.exe 1868 NIVWQ.exe 2312 IOVH.exe 2476 KMB.exe 3644 SRO.exe 1324 CPTDZ.exe 1320 ENZPO.exe 4708 JOJZ.exe 2072 WQRQGAZ.exe 1428 PTDUMQ.exe 364 OEGKV.exe 4808 WSKQ.exe 5096 NSZN.exe 2568 ZIFVEEJ.exe 4500 BGTILM.exe 1288 FJRD.exe 4140 SUACAQP.exe 4944 XMJEDM.exe 5788 INRPVN.exe 4756 UVFX.exe 3948 SQXYEI.exe 1748 EYLY.exe 2500 XBPBVQ.exe 6044 KMYSKT.exe 5756 LHB.exe 2660 PXIWB.exe 2776 ENJ.exe 4264 PGMOQ.exe 5784 FBV.exe 5964 GYJNR.exe 6100 YHL.exe 2904 GMQ.exe 6124 PMSD.exe 2716 TCYLVTK.exe 5776 IYIQ.exe 2860 JBLULE.exe 628 CEXPY.exe 2188 WRCZBUK.exe 4788 EWU.exe 6092 INBVO.exe 3136 VPR.exe 4540 HIMF.exe 716 MIUSULN.exe 3328 TDTTZGC.exe 5528 WMABLZR.exe 5796 KWQAZ.exe 1096 BFSFDH.exe 1516 HFA.exe 5396 QFUYX.exe 3656 WFBLGJB.exe 1372 WLC.exe 6080 RGGJ.exe 4640 NEMGZX.exe 5916 RUT.exe 820 FSTSNBK.exe 5276 HNYB.exe 1244 WIHOIOH.exe 4952 AQOO.exe 4308 YLNPZJL.exe 3572 BZSY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IDCTCU.exe.bat ENWTQJI.exe File created C:\windows\SysWOW64\WQRQGAZ.exe JOJZ.exe File created C:\windows\SysWOW64\PXIWB.exe.bat LHB.exe File opened for modification C:\windows\SysWOW64\VPR.exe INBVO.exe File opened for modification C:\windows\SysWOW64\WMABLZR.exe TDTTZGC.exe File created C:\windows\SysWOW64\SFHLD.exe YKC.exe File created C:\windows\SysWOW64\QFHWF.exe ZAWEPWW.exe File created C:\windows\SysWOW64\QFHWF.exe.bat ZAWEPWW.exe File opened for modification C:\windows\SysWOW64\IXMDE.exe FPFDSCL.exe File created C:\windows\SysWOW64\SUACAQP.exe.bat FJRD.exe File opened for modification C:\windows\SysWOW64\GYJNR.exe FBV.exe File created C:\windows\SysWOW64\HFA.exe BFSFDH.exe File created C:\windows\SysWOW64\WFBLGJB.exe QFUYX.exe File created C:\windows\SysWOW64\RUT.exe NEMGZX.exe File created C:\windows\SysWOW64\ENWTQJI.exe SFHLD.exe File created C:\windows\SysWOW64\MVU.exe.bat GUNFZT.exe File created C:\windows\SysWOW64\EJVFKA.exe ABPXYH.exe File opened for modification C:\windows\SysWOW64\XZV.exe XEJVMU.exe File opened for modification C:\windows\SysWOW64\EYLY.exe SQXYEI.exe File created C:\windows\SysWOW64\TDTTZGC.exe.bat MIUSULN.exe File opened for modification C:\windows\SysWOW64\KWQAZ.exe WMABLZR.exe File created C:\windows\SysWOW64\XEJVMU.exe.bat 2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe File created C:\windows\SysWOW64\PXIWB.exe LHB.exe File created C:\windows\SysWOW64\WMABLZR.exe TDTTZGC.exe File opened for modification C:\windows\SysWOW64\WFBLGJB.exe QFUYX.exe File created C:\windows\SysWOW64\SFHLD.exe.bat YKC.exe File created C:\windows\SysWOW64\XEJVMU.exe 2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\PMSD.exe GMQ.exe File created C:\windows\SysWOW64\TDTTZGC.exe MIUSULN.exe File created C:\windows\SysWOW64\KWQAZ.exe WMABLZR.exe File opened for modification C:\windows\SysWOW64\WLC.exe WFBLGJB.exe File opened for modification C:\windows\SysWOW64\RUT.exe NEMGZX.exe File opened for modification C:\windows\SysWOW64\SFHLD.exe YKC.exe File created C:\windows\SysWOW64\IXMDE.exe.bat FPFDSCL.exe File created C:\windows\SysWOW64\BGTILM.exe.bat ZIFVEEJ.exe File created C:\windows\SysWOW64\HIMF.exe VPR.exe File created C:\windows\SysWOW64\HFA.exe.bat BFSFDH.exe File created C:\windows\SysWOW64\RUT.exe.bat NEMGZX.exe File opened for modification C:\windows\SysWOW64\QFHWF.exe ZAWEPWW.exe File opened for modification C:\windows\SysWOW64\LSF.exe VXWZT.exe File opened for modification C:\windows\SysWOW64\XEJVMU.exe 2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe File created C:\windows\SysWOW64\XZV.exe XEJVMU.exe File opened for modification C:\windows\SysWOW64\WQRQGAZ.exe JOJZ.exe File created C:\windows\SysWOW64\WQRQGAZ.exe.bat JOJZ.exe File created C:\windows\SysWOW64\GYJNR.exe FBV.exe File created C:\windows\SysWOW64\WLC.exe WFBLGJB.exe File created C:\windows\SysWOW64\WLC.exe.bat WFBLGJB.exe File created C:\windows\SysWOW64\FSTSNBK.exe RUT.exe File opened for modification C:\windows\SysWOW64\TDTTZGC.exe MIUSULN.exe File created C:\windows\SysWOW64\WMABLZR.exe.bat TDTTZGC.exe File created C:\windows\SysWOW64\IOVH.exe NIVWQ.exe File created C:\windows\SysWOW64\ZIFVEEJ.exe NSZN.exe File opened for modification C:\windows\SysWOW64\BGTILM.exe ZIFVEEJ.exe File opened for modification C:\windows\SysWOW64\SUACAQP.exe FJRD.exe File created C:\windows\SysWOW64\EYLY.exe SQXYEI.exe File created C:\windows\SysWOW64\GYJNR.exe.bat FBV.exe File opened for modification C:\windows\SysWOW64\ZIFVEEJ.exe NSZN.exe File created C:\windows\SysWOW64\EYLY.exe.bat SQXYEI.exe File opened for modification C:\windows\SysWOW64\PXIWB.exe LHB.exe File created C:\windows\SysWOW64\PMSD.exe.bat GMQ.exe File created C:\windows\SysWOW64\KWQAZ.exe.bat WMABLZR.exe File created C:\windows\SysWOW64\NEMGZX.exe RGGJ.exe File created C:\windows\SysWOW64\NEMGZX.exe.bat RGGJ.exe File created C:\windows\SysWOW64\FSTSNBK.exe.bat RUT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SQXYEI.exe UVFX.exe File opened for modification C:\windows\GMQ.exe YHL.exe File opened for modification C:\windows\system\JBLULE.exe IYIQ.exe File created C:\windows\WIHOIOH.exe.bat HNYB.exe File created C:\windows\system\YMI.exe.bat HEGZAZ.exe File created C:\windows\system\PHYUL.exe AMPHACA.exe File created C:\windows\system\MKNQ.exe VBLLOBW.exe File created C:\windows\system\RGGJ.exe WLC.exe File opened for modification C:\windows\FKANZ.exe QUZWSEY.exe File created C:\windows\ENZPO.exe.bat CPTDZ.exe File created C:\windows\SQXYEI.exe.bat UVFX.exe File created C:\windows\KMYSKT.exe.bat XBPBVQ.exe File created C:\windows\LHB.exe.bat KMYSKT.exe File created C:\windows\ENJ.exe.bat PXIWB.exe File opened for modification C:\windows\system\FBV.exe PGMOQ.exe File opened for modification C:\windows\SQXYEI.exe UVFX.exe File created C:\windows\GMQ.exe.bat YHL.exe File created C:\windows\system\TCYLVTK.exe PMSD.exe File created C:\windows\system\JBLULE.exe.bat IYIQ.exe File created C:\windows\BZSY.exe YLNPZJL.exe File created C:\windows\BZSY.exe.bat YLNPZJL.exe File opened for modification C:\windows\system\PHYUL.exe AMPHACA.exe File opened for modification C:\windows\system\AOHCLB.exe QQTIWT.exe File created C:\windows\system\XBPBVQ.exe EYLY.exe File opened for modification C:\windows\system\NSZN.exe WSKQ.exe File created C:\windows\system\XMJEDM.exe SUACAQP.exe File created C:\windows\LBLFHSZ.exe QFHWF.exe File opened for modification C:\windows\system\GXMHGV.exe GJUSXI.exe File created C:\windows\system\VSWL.exe GXMHGV.exe File created C:\windows\FPFDSCL.exe NGDYOX.exe File created C:\windows\NIVWQ.exe.bat YNERFPP.exe File created C:\windows\OEGKV.exe.bat PTDUMQ.exe File created C:\windows\system\TCYLVTK.exe.bat PMSD.exe File created C:\windows\system\MIUSULN.exe HIMF.exe File created C:\windows\WIHOIOH.exe HNYB.exe File opened for modification C:\windows\system\ILNCPF.exe EVGCCN.exe File opened for modification C:\windows\VBLLOBW.exe AOHCLB.exe File opened for modification C:\windows\system\MKNQ.exe VBLLOBW.exe File created C:\windows\system\PTDUMQ.exe WQRQGAZ.exe File created C:\windows\system\WSKQ.exe OEGKV.exe File created C:\windows\system\WSKQ.exe.bat OEGKV.exe File opened for modification C:\windows\ENJ.exe PXIWB.exe File created C:\windows\system\FBV.exe PGMOQ.exe File opened for modification C:\windows\system\WRCZBUK.exe CEXPY.exe File created C:\windows\system\JYWQ.exe.bat WNOZ.exe File opened for modification C:\windows\system\UVFX.exe INRPVN.exe File created C:\windows\system\RGGJ.exe.bat WLC.exe File opened for modification C:\windows\WIHOIOH.exe HNYB.exe File opened for modification C:\windows\BZSY.exe YLNPZJL.exe File created C:\windows\system\MKNQ.exe.bat VBLLOBW.exe File created C:\windows\HXKIBG.exe MKNQ.exe File created C:\windows\HXKIBG.exe.bat MKNQ.exe File opened for modification C:\windows\system\LGFSNV.exe LSF.exe File created C:\windows\SRO.exe KMB.exe File created C:\windows\EWU.exe.bat WRCZBUK.exe File created C:\windows\system\AQOO.exe WIHOIOH.exe File created C:\windows\YLNPZJL.exe AQOO.exe File created C:\windows\system\ILNCPF.exe.bat EVGCCN.exe File created C:\windows\LBLFHSZ.exe.bat QFHWF.exe File opened for modification C:\windows\EWPJ.exe LBLFHSZ.exe File created C:\windows\system\ABPXYH.exe LGFSNV.exe File opened for modification C:\windows\MWWTMMY.exe EJVFKA.exe File created C:\windows\NGDYOX.exe.bat JYWQ.exe File created C:\windows\system\SFOQIS.exe.bat IXMDE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 992 cmd.exe 2104 cmd.exe 5636 cmd.exe 1124 cmd.exe 4468 cmd.exe 3432 cmd.exe 3480 cmd.exe 4400 cmd.exe 2220 cmd.exe 5152 cmd.exe 1200 cmd.exe 4336 cmd.exe 5432 cmd.exe 5076 cmd.exe 5952 cmd.exe 2024 cmd.exe 3776 cmd.exe 4704 cmd.exe 5036 cmd.exe 5496 cmd.exe 5124 cmd.exe 4240 cmd.exe 4460 cmd.exe 4720 cmd.exe 5240 cmd.exe 6024 cmd.exe 1540 cmd.exe 6132 cmd.exe 376 cmd.exe 4360 cmd.exe 1128 cmd.exe 1876 cmd.exe 3888 cmd.exe 1856 cmd.exe 3088 cmd.exe 4116 cmd.exe 3024 cmd.exe 5644 cmd.exe 5412 cmd.exe 4856 cmd.exe 4100 cmd.exe 2004 cmd.exe 5956 cmd.exe 3488 cmd.exe 1116 cmd.exe 4344 cmd.exe 1692 cmd.exe 5996 cmd.exe 4364 cmd.exe 1448 cmd.exe 1048 cmd.exe 2644 cmd.exe 5028 cmd.exe 1004 cmd.exe 5640 cmd.exe 920 cmd.exe 3384 cmd.exe 2688 cmd.exe 4588 cmd.exe 2468 cmd.exe 4724 cmd.exe 2704 cmd.exe 4956 cmd.exe 5296 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5872 2956 WerFault.exe 87 2692 1676 WerFault.exe 93 5688 2392 WerFault.exe 99 4172 248 WerFault.exe 104 716 1776 WerFault.exe 109 6044 1332 WerFault.exe 114 5756 1868 WerFault.exe 119 4892 2312 WerFault.exe 124 5504 2476 WerFault.exe 129 4952 3644 WerFault.exe 134 3084 1324 WerFault.exe 139 1612 1320 WerFault.exe 144 708 4708 WerFault.exe 149 3380 2072 WerFault.exe 154 5124 1428 WerFault.exe 159 3328 364 WerFault.exe 164 5916 4808 WerFault.exe 169 1228 5096 WerFault.exe 174 5752 2568 WerFault.exe 179 2816 4500 WerFault.exe 184 4996 1288 WerFault.exe 189 5664 4140 WerFault.exe 194 2804 4944 WerFault.exe 199 5136 5788 WerFault.exe 204 3756 4756 WerFault.exe 209 5376 3948 WerFault.exe 214 5108 1748 WerFault.exe 219 5224 2500 WerFault.exe 224 728 6044 WerFault.exe 229 3096 5756 WerFault.exe 234 2460 2660 WerFault.exe 239 4952 2776 WerFault.exe 244 4696 4264 WerFault.exe 249 5396 5784 WerFault.exe 254 3656 5964 WerFault.exe 259 872 6100 WerFault.exe 264 4296 2904 WerFault.exe 270 4248 6124 WerFault.exe 275 4332 2716 WerFault.exe 280 6032 5776 WerFault.exe 285 5592 2860 WerFault.exe 290 2816 628 WerFault.exe 295 2736 2188 WerFault.exe 300 5380 4788 WerFault.exe 305 1276 6092 WerFault.exe 310 2800 3136 WerFault.exe 315 2408 4540 WerFault.exe 320 4160 716 WerFault.exe 325 4852 3328 WerFault.exe 330 3096 5528 WerFault.exe 335 3384 5796 WerFault.exe 340 6104 1096 WerFault.exe 345 572 1516 WerFault.exe 350 4900 5396 WerFault.exe 355 5372 3656 WerFault.exe 360 3268 1372 WerFault.exe 365 3012 6080 WerFault.exe 370 3836 4640 WerFault.exe 375 6032 5916 WerFault.exe 380 2492 820 WerFault.exe 385 5684 5276 WerFault.exe 390 5992 1244 WerFault.exe 395 5256 4952 WerFault.exe 400 5280 4308 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBLLOBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYIQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFHLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFBLGJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSTSNBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGMOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJIXQMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEJVMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKANZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNERFPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTDUMQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBPBVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIUSULN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFSFDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFUYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INBVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZSY.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2956 2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe 2956 2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe 1676 XEJVMU.exe 1676 XEJVMU.exe 2392 XZV.exe 2392 XZV.exe 248 QUZWSEY.exe 248 QUZWSEY.exe 1776 FKANZ.exe 1776 FKANZ.exe 1332 YNERFPP.exe 1332 YNERFPP.exe 1868 NIVWQ.exe 1868 NIVWQ.exe 2312 IOVH.exe 2312 IOVH.exe 2476 KMB.exe 2476 KMB.exe 3644 SRO.exe 3644 SRO.exe 1324 CPTDZ.exe 1324 CPTDZ.exe 1320 ENZPO.exe 1320 ENZPO.exe 4708 JOJZ.exe 4708 JOJZ.exe 2072 WQRQGAZ.exe 2072 WQRQGAZ.exe 1428 PTDUMQ.exe 1428 PTDUMQ.exe 364 OEGKV.exe 364 OEGKV.exe 4808 WSKQ.exe 4808 WSKQ.exe 5096 NSZN.exe 5096 NSZN.exe 2568 ZIFVEEJ.exe 2568 ZIFVEEJ.exe 4500 BGTILM.exe 4500 BGTILM.exe 1288 FJRD.exe 1288 FJRD.exe 4140 SUACAQP.exe 4140 SUACAQP.exe 4944 XMJEDM.exe 4944 XMJEDM.exe 5788 INRPVN.exe 5788 INRPVN.exe 4756 UVFX.exe 4756 UVFX.exe 3948 SQXYEI.exe 3948 SQXYEI.exe 1748 EYLY.exe 1748 EYLY.exe 2500 XBPBVQ.exe 2500 XBPBVQ.exe 6044 KMYSKT.exe 6044 KMYSKT.exe 5756 LHB.exe 5756 LHB.exe 2660 PXIWB.exe 2660 PXIWB.exe 2776 ENJ.exe 2776 ENJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2956 2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe 2956 2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe 1676 XEJVMU.exe 1676 XEJVMU.exe 2392 XZV.exe 2392 XZV.exe 248 QUZWSEY.exe 248 QUZWSEY.exe 1776 FKANZ.exe 1776 FKANZ.exe 1332 YNERFPP.exe 1332 YNERFPP.exe 1868 NIVWQ.exe 1868 NIVWQ.exe 2312 IOVH.exe 2312 IOVH.exe 2476 KMB.exe 2476 KMB.exe 3644 SRO.exe 3644 SRO.exe 1324 CPTDZ.exe 1324 CPTDZ.exe 1320 ENZPO.exe 1320 ENZPO.exe 4708 JOJZ.exe 4708 JOJZ.exe 2072 WQRQGAZ.exe 2072 WQRQGAZ.exe 1428 PTDUMQ.exe 1428 PTDUMQ.exe 364 OEGKV.exe 364 OEGKV.exe 4808 WSKQ.exe 4808 WSKQ.exe 5096 NSZN.exe 5096 NSZN.exe 2568 ZIFVEEJ.exe 2568 ZIFVEEJ.exe 4500 BGTILM.exe 4500 BGTILM.exe 1288 FJRD.exe 1288 FJRD.exe 4140 SUACAQP.exe 4140 SUACAQP.exe 4944 XMJEDM.exe 4944 XMJEDM.exe 5788 INRPVN.exe 5788 INRPVN.exe 4756 UVFX.exe 4756 UVFX.exe 3948 SQXYEI.exe 3948 SQXYEI.exe 1748 EYLY.exe 1748 EYLY.exe 2500 XBPBVQ.exe 2500 XBPBVQ.exe 6044 KMYSKT.exe 6044 KMYSKT.exe 5756 LHB.exe 5756 LHB.exe 2660 PXIWB.exe 2660 PXIWB.exe 2776 ENJ.exe 2776 ENJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2956 wrote to memory of 4940 2956 2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe 89 PID 4940 wrote to memory of 1676 4940 cmd.exe 93 PID 1676 wrote to memory of 5928 1676 XEJVMU.exe 95 PID 5928 wrote to memory of 2392 5928 cmd.exe 99 PID 2392 wrote to memory of 2132 2392 XZV.exe 100 PID 2132 wrote to memory of 248 2132 cmd.exe 104 PID 248 wrote to memory of 932 248 QUZWSEY.exe 105 PID 932 wrote to memory of 1776 932 cmd.exe 109 PID 1776 wrote to memory of 2652 1776 FKANZ.exe 110 PID 2652 wrote to memory of 1332 2652 cmd.exe 114 PID 1332 wrote to memory of 2152 1332 YNERFPP.exe 115 PID 2152 wrote to memory of 1868 2152 cmd.exe 119 PID 1868 wrote to memory of 2772 1868 NIVWQ.exe 120 PID 2772 wrote to memory of 2312 2772 cmd.exe 124 PID 2312 wrote to memory of 1688 2312 IOVH.exe 125 PID 1688 wrote to memory of 2476 1688 cmd.exe 129 PID 2476 wrote to memory of 3336 2476 KMB.exe 130 PID 3336 wrote to memory of 3644 3336 cmd.exe 134 PID 3644 wrote to memory of 3376 3644 SRO.exe 135 PID 3376 wrote to memory of 1324 3376 cmd.exe 139 PID 1324 wrote to memory of 1172 1324 CPTDZ.exe 140 PID 1172 wrote to memory of 1320 1172 cmd.exe 144 PID 1320 wrote to memory of 444 1320 ENZPO.exe 145 PID 444 wrote to memory of 4708 444 cmd.exe 149 PID 4708 wrote to memory of 1204 4708 JOJZ.exe 150 PID 1204 wrote to memory of 2072 1204 cmd.exe 154 PID 2072 wrote to memory of 784 2072 WQRQGAZ.exe 155 PID 784 wrote to memory of 1428 784 cmd.exe 159 PID 1428 wrote to memory of 2644 1428 PTDUMQ.exe 160 PID 2644 wrote to memory of 364 2644 cmd.exe 164 PID 364 wrote to memory of 1212 364 OEGKV.exe 165 PID 1212 wrote to memory of 4808 1212 cmd.exe 169 PID 4808 wrote to memory of 2332 4808 WSKQ.exe 170 PID 2332 wrote to memory of 5096 2332 cmd.exe 174 PID 5096 wrote to memory of 4468 5096 NSZN.exe 175 PID 4468 wrote to memory of 2568 4468 cmd.exe 179 PID 2568 wrote to memory of 4624 2568 ZIFVEEJ.exe 180 PID 4624 wrote to memory of 4500 4624 cmd.exe 184 PID 4500 wrote to memory of 3024 4500 BGTILM.exe 185 PID 3024 wrote to memory of 1288 3024 cmd.exe 189 PID 1288 wrote to memory of 3164 1288 FJRD.exe 190 PID 3164 wrote to memory of 4140 3164 cmd.exe 194 PID 4140 wrote to memory of 5644 4140 SUACAQP.exe 195 PID 5644 wrote to memory of 4944 5644 cmd.exe 199 PID 4944 wrote to memory of 1116 4944 XMJEDM.exe 200 PID 1116 wrote to memory of 5788 1116 cmd.exe 204 PID 5788 wrote to memory of 5060 5788 INRPVN.exe 205 PID 5060 wrote to memory of 4756 5060 cmd.exe 209 PID 4756 wrote to memory of 5020 4756 UVFX.exe 210 PID 5020 wrote to memory of 3948 5020 cmd.exe 214 PID 3948 wrote to memory of 1540 3948 SQXYEI.exe 215 PID 1540 wrote to memory of 1748 1540 cmd.exe 219 PID 1748 wrote to memory of 2364 1748 EYLY.exe 220 PID 2364 wrote to memory of 2500 2364 cmd.exe 224 PID 2500 wrote to memory of 5748 2500 XBPBVQ.exe 225 PID 5748 wrote to memory of 6044 5748 cmd.exe 229 PID 6044 wrote to memory of 4424 6044 KMYSKT.exe 230 PID 4424 wrote to memory of 5756 4424 cmd.exe 234 PID 5756 wrote to memory of 6132 5756 LHB.exe 235 PID 6132 wrote to memory of 2660 6132 cmd.exe 239 PID 2660 wrote to memory of 5412 2660 PXIWB.exe 240 PID 5412 wrote to memory of 2776 5412 cmd.exe 244 PID 2776 wrote to memory of 5348 2776 ENJ.exe 245 PID 5348 wrote to memory of 4264 5348 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_ed439e323b709f4de60edb9ccacd1d94_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEJVMU.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\SysWOW64\XEJVMU.exeC:\windows\system32\XEJVMU.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XZV.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\SysWOW64\XZV.exeC:\windows\system32\XZV.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUZWSEY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\windows\QUZWSEY.exeC:\windows\QUZWSEY.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKANZ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:932 -
C:\windows\FKANZ.exeC:\windows\FKANZ.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YNERFPP.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\windows\SysWOW64\YNERFPP.exeC:\windows\system32\YNERFPP.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIVWQ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\windows\NIVWQ.exeC:\windows\NIVWQ.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IOVH.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\SysWOW64\IOVH.exeC:\windows\system32\IOVH.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMB.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\windows\KMB.exeC:\windows\KMB.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRO.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\windows\SRO.exeC:\windows\SRO.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPTDZ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\system\CPTDZ.exeC:\windows\system\CPTDZ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENZPO.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\windows\ENZPO.exeC:\windows\ENZPO.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JOJZ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:444 -
C:\windows\system\JOJZ.exeC:\windows\system\JOJZ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQRQGAZ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\SysWOW64\WQRQGAZ.exeC:\windows\system32\WQRQGAZ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTDUMQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\windows\system\PTDUMQ.exeC:\windows\system\PTDUMQ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEGKV.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\OEGKV.exeC:\windows\OEGKV.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSKQ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\windows\system\WSKQ.exeC:\windows\system\WSKQ.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSZN.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\windows\system\NSZN.exeC:\windows\system\NSZN.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZIFVEEJ.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\SysWOW64\ZIFVEEJ.exeC:\windows\system32\ZIFVEEJ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BGTILM.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\SysWOW64\BGTILM.exeC:\windows\system32\BGTILM.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJRD.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\FJRD.exeC:\windows\FJRD.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUACAQP.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\windows\SysWOW64\SUACAQP.exeC:\windows\system32\SUACAQP.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XMJEDM.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\system\XMJEDM.exeC:\windows\system\XMJEDM.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INRPVN.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\system\INRPVN.exeC:\windows\system\INRPVN.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVFX.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\windows\system\UVFX.exeC:\windows\system\UVFX.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SQXYEI.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\SQXYEI.exeC:\windows\SQXYEI.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYLY.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\windows\SysWOW64\EYLY.exeC:\windows\system32\EYLY.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XBPBVQ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\windows\system\XBPBVQ.exeC:\windows\system\XBPBVQ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMYSKT.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\KMYSKT.exeC:\windows\KMYSKT.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHB.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\windows\LHB.exeC:\windows\LHB.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXIWB.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\windows\SysWOW64\PXIWB.exeC:\windows\system32\PXIWB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENJ.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\windows\ENJ.exeC:\windows\ENJ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGMOQ.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\system\PGMOQ.exeC:\windows\system\PGMOQ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBV.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1360 -
C:\windows\system\FBV.exeC:\windows\system\FBV.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYJNR.exe.bat" "68⤵PID:5976
-
C:\windows\SysWOW64\GYJNR.exeC:\windows\system32\GYJNR.exe69⤵
- Executes dropped EXE
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHL.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2104 -
C:\windows\YHL.exeC:\windows\YHL.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMQ.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3432 -
C:\windows\GMQ.exeC:\windows\GMQ.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMSD.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4512 -
C:\windows\SysWOW64\PMSD.exeC:\windows\system32\PMSD.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TCYLVTK.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\windows\system\TCYLVTK.exeC:\windows\system\TCYLVTK.exe77⤵
- Executes dropped EXE
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYIQ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5028 -
C:\windows\SysWOW64\IYIQ.exeC:\windows\system32\IYIQ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBLULE.exe.bat" "80⤵PID:2680
-
C:\windows\system\JBLULE.exeC:\windows\system\JBLULE.exe81⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEXPY.exe.bat" "82⤵PID:5068
-
C:\windows\CEXPY.exeC:\windows\CEXPY.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRCZBUK.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5636 -
C:\windows\system\WRCZBUK.exeC:\windows\system\WRCZBUK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EWU.exe.bat" "86⤵PID:2548
-
C:\windows\EWU.exeC:\windows\EWU.exe87⤵
- Executes dropped EXE
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INBVO.exe.bat" "88⤵PID:3588
-
C:\windows\SysWOW64\INBVO.exeC:\windows\system32\INBVO.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPR.exe.bat" "90⤵PID:3596
-
C:\windows\SysWOW64\VPR.exeC:\windows\system32\VPR.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HIMF.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4588 -
C:\windows\SysWOW64\HIMF.exeC:\windows\system32\HIMF.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MIUSULN.exe.bat" "94⤵PID:1440
-
C:\windows\system\MIUSULN.exeC:\windows\system\MIUSULN.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDTTZGC.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1724 -
C:\windows\SysWOW64\TDTTZGC.exeC:\windows\system32\TDTTZGC.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WMABLZR.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1004 -
C:\windows\SysWOW64\WMABLZR.exeC:\windows\system32\WMABLZR.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWQAZ.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3548 -
C:\windows\SysWOW64\KWQAZ.exeC:\windows\system32\KWQAZ.exe101⤵
- Executes dropped EXE
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFSFDH.exe.bat" "102⤵
- Executes a command shell one-liner
PID:4336 -
C:\windows\system\BFSFDH.exeC:\windows\system\BFSFDH.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFA.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4344 -
C:\windows\SysWOW64\HFA.exeC:\windows\system32\HFA.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFUYX.exe.bat" "106⤵PID:4620
-
C:\windows\system\QFUYX.exeC:\windows\system\QFUYX.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFBLGJB.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2504 -
C:\windows\SysWOW64\WFBLGJB.exeC:\windows\system32\WFBLGJB.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLC.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4636 -
C:\windows\SysWOW64\WLC.exeC:\windows\system32\WLC.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGGJ.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2468 -
C:\windows\system\RGGJ.exeC:\windows\system\RGGJ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NEMGZX.exe.bat" "114⤵PID:844
-
C:\windows\SysWOW64\NEMGZX.exeC:\windows\system32\NEMGZX.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUT.exe.bat" "116⤵PID:5108
-
C:\windows\SysWOW64\RUT.exeC:\windows\system32\RUT.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FSTSNBK.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:560 -
C:\windows\SysWOW64\FSTSNBK.exeC:\windows\system32\FSTSNBK.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HNYB.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4856 -
C:\windows\HNYB.exeC:\windows\HNYB.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-