Analysis
- max time kernel
83s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 16:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_e98a726a068e12595c3996f2e93b3e40_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-21_e98a726a068e12595c3996f2e93b3e40_elex_emotet_stop.exe
- Size 208KB
- Sample260721-tx163acd66
- SHA256 0da7844500a75c7c91e88cf90c6dfee1c46577675ed281465e97fd3ed84b4264
- MD5 e98a726a068e12595c3996f2e93b3e40
- SHA1 167dbe84b3283d03b19961d5d805e15c8bedcdf2
- SHA512 b7d1ee7e20d95400b860ccddaa3e65ac8c17e46fb1be3d0ae59d99055aa289d9cca55b75637ab9191ed5ba9cd450e63fe542c96b9a655413188ba53394aeb1a6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfG4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LO+QEjK
- TLSH T1D7247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1536 JWXZ.exe 6048 KUSIJ.exe 1072 UNBIOMF.exe 1668 GDIIAX.exe 5840 AQN.exe 1100 QLEE.exe 4732 GWUU.exe 5448 FUGW.exe 3520 ZHKGSR.exe 2904 QSJE.exe 5568 LDRU.exe 760 TTSUM.exe 124 XQKJDF.exe 4804 UWQ.exe 1324 SRHH.exe 3024 TUTDUHS.exe 4716 SFU.exe 4048 CCIYP.exe 1872 INEXUL.exe 724 NOL.exe 4504 SRJGLH.exe 5868 WWCVB.exe 1468 PZFZ.exe 1316 THMZTK.exe 2712 EAPRBRV.exe 1528 TQQJ.exe 5832 ODVAKN.exe 3856 PGZW.exe 1208 CRHVENV.exe 2660 BCSLMT.exe 1380 ZMVTV.exe 3720 YCGW.exe 2616 QFSZVD.exe 3016 ADXMD.exe 2240 BGBPIBH.exe 412 SREFRP.exe 2512 QCPVA.exe 2336 GFY.exe 5784 EPBQTWW.exe 2564 WQD.exe 1884 DLMZQG.exe 4244 JGMIUJP.exe 4916 ETQR.exe 1036 YPVBHI.exe 5064 ZKZWM.exe 1568 MVIVBJX.exe 5192 DDKA.exe 3700 HLY.exe 704 EQW.exe 5352 WMABLZR.exe 1776 GUC.exe 5000 SCIGB.exe 2828 WSX.exe 5536 AAEOZ.exe 1144 UVIYBZN.exe 1088 PJNPMZ.exe 1804 PMR.exe 4056 TUYLD.exe 3256 ZPX.exe 5276 UCCDS.exe 4780 RIM.exe 5980 XDLTFI.exe 2172 RQQ.exe 5824 VYXKC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\KYNJSJ.exe QCQA.exe File opened for modification C:\windows\SysWOW64\KUSIJ.exe JWXZ.exe File opened for modification C:\windows\SysWOW64\TTSUM.exe LDRU.exe File created C:\windows\SysWOW64\WWCVB.exe.bat SRJGLH.exe File created C:\windows\SysWOW64\THMZTK.exe.bat PZFZ.exe File opened for modification C:\windows\SysWOW64\UWQ.exe XQKJDF.exe File created C:\windows\SysWOW64\DDKA.exe MVIVBJX.exe File created C:\windows\SysWOW64\WMABLZR.exe EQW.exe File opened for modification C:\windows\SysWOW64\XDLTFI.exe RIM.exe File created C:\windows\SysWOW64\EAPRBRV.exe.bat THMZTK.exe File created C:\windows\SysWOW64\FUGW.exe GWUU.exe File created C:\windows\SysWOW64\INEXUL.exe.bat CCIYP.exe File created C:\windows\SysWOW64\EPBQTWW.exe GFY.exe File created C:\windows\SysWOW64\UCCDS.exe ZPX.exe File created C:\windows\SysWOW64\SRHH.exe.bat UWQ.exe File opened for modification C:\windows\SysWOW64\GDIIAX.exe UNBIOMF.exe File created C:\windows\SysWOW64\SRJGLH.exe NOL.exe File opened for modification C:\windows\SysWOW64\EAPRBRV.exe THMZTK.exe File opened for modification C:\windows\SysWOW64\PMR.exe PJNPMZ.exe File opened for modification C:\windows\SysWOW64\ZHKGSR.exe FUGW.exe File created C:\windows\SysWOW64\RQQ.exe XDLTFI.exe File opened for modification C:\windows\SysWOW64\JNZ.exe YUWMSAE.exe File created C:\windows\SysWOW64\XQKJDF.exe.bat TTSUM.exe File created C:\windows\SysWOW64\SRHH.exe UWQ.exe File opened for modification C:\windows\SysWOW64\INEXUL.exe CCIYP.exe File created C:\windows\SysWOW64\YCGW.exe.bat ZMVTV.exe File opened for modification C:\windows\SysWOW64\RQQ.exe XDLTFI.exe File created C:\windows\SysWOW64\HHS.exe NUNLVP.exe File created C:\windows\SysWOW64\KUSIJ.exe JWXZ.exe File created C:\windows\SysWOW64\TUTDUHS.exe SRHH.exe File created C:\windows\SysWOW64\SRJGLH.exe.bat NOL.exe File opened for modification C:\windows\SysWOW64\ETQR.exe JGMIUJP.exe File created C:\windows\SysWOW64\PMR.exe.bat PJNPMZ.exe File created C:\windows\SysWOW64\JNZ.exe YUWMSAE.exe File created C:\windows\SysWOW64\KYNJSJ.exe.bat QCQA.exe File created C:\windows\SysWOW64\GDIIAX.exe.bat UNBIOMF.exe File created C:\windows\SysWOW64\QSJE.exe.bat ZHKGSR.exe File opened for modification C:\windows\SysWOW64\NOL.exe INEXUL.exe File created C:\windows\SysWOW64\WSX.exe.bat SCIGB.exe File opened for modification C:\windows\SysWOW64\UCCDS.exe ZPX.exe File created C:\windows\SysWOW64\HHS.exe.bat NUNLVP.exe File created C:\windows\SysWOW64\GAFEA.exe IAX.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe HHS.exe File opened for modification C:\windows\SysWOW64\MOPW.exe MLLAL.exe File opened for modification C:\windows\SysWOW64\FUGW.exe GWUU.exe File created C:\windows\SysWOW64\TTSUM.exe LDRU.exe File created C:\windows\SysWOW64\EAPRBRV.exe THMZTK.exe File created C:\windows\SysWOW64\WMABLZR.exe.bat EQW.exe File created C:\windows\SysWOW64\YNROJ.exe.bat WQDUTS.exe File created C:\windows\SysWOW64\UCCDS.exe.bat ZPX.exe File opened for modification C:\windows\SysWOW64\SRHH.exe UWQ.exe File created C:\windows\SysWOW64\CQDIFGU.exe JNZ.exe File created C:\windows\SysWOW64\IXQLHEF.exe.bat EPJL.exe File created C:\windows\SysWOW64\GDIIAX.exe UNBIOMF.exe File created C:\windows\SysWOW64\NOL.exe INEXUL.exe File created C:\windows\SysWOW64\MOPW.exe MLLAL.exe File opened for modification C:\windows\SysWOW64\ZWL.exe XJGHVVH.exe File created C:\windows\SysWOW64\KYNJSJ.exe QCQA.exe File created C:\windows\SysWOW64\THMZTK.exe PZFZ.exe File created C:\windows\SysWOW64\SCIGB.exe GUC.exe File created C:\windows\SysWOW64\XDLTFI.exe.bat RIM.exe File opened for modification C:\windows\SysWOW64\IXQLHEF.exe EPJL.exe File opened for modification C:\windows\SysWOW64\WWCVB.exe SRJGLH.exe File created C:\windows\SysWOW64\ETQR.exe JGMIUJP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\PGZW.exe.bat ODVAKN.exe File opened for modification C:\windows\system\GFY.exe QCPVA.exe File created C:\windows\EQW.exe.bat HLY.exe File created C:\windows\RIM.exe.bat UCCDS.exe File created C:\windows\VMLWQW.exe.bat HOD.exe File created C:\windows\system\XJGHVVH.exe MOPW.exe File created C:\windows\system\YUWMSAE.exe ZWL.exe File created C:\windows\ADXMD.exe QFSZVD.exe File opened for modification C:\windows\QLEE.exe AQN.exe File created C:\windows\LDRU.exe.bat QSJE.exe File opened for modification C:\windows\SFU.exe TUTDUHS.exe File created C:\windows\system\QFSZVD.exe.bat YCGW.exe File opened for modification C:\windows\system\ZKZWM.exe YPVBHI.exe File opened for modification C:\windows\HLY.exe DDKA.exe File opened for modification C:\windows\system\YUWMSAE.exe ZWL.exe File created C:\windows\system\LMGIPWP.exe FLYUG.exe File created C:\windows\QLEE.exe AQN.exe File created C:\windows\system\ZMVTV.exe.bat BCSLMT.exe File created C:\windows\system\QCPVA.exe.bat SREFRP.exe File created C:\windows\XGLNVV.exe DLHE.exe File opened for modification C:\windows\HJGNKR.exe QYVXJLY.exe File created C:\windows\FRL.exe DUF.exe File created C:\windows\system\TUYLD.exe.bat PMR.exe File created C:\windows\system\UJBZH.exe JOKODZJ.exe File opened for modification C:\windows\FLYUG.exe XGLNVV.exe File created C:\windows\system\WNAQ.exe.bat GXZZH.exe File opened for modification C:\windows\system\MTDJCBO.exe KVYONTF.exe File created C:\windows\GUXEB.exe.bat FRL.exe File created C:\windows\OIBS.exe.bat GUXEB.exe File opened for modification C:\windows\system\AQN.exe GDIIAX.exe File created C:\windows\system\AQN.exe.bat GDIIAX.exe File created C:\windows\PZFZ.exe WWCVB.exe File opened for modification C:\windows\system\PGZW.exe ODVAKN.exe File created C:\windows\LWM.exe UJBZH.exe File opened for modification C:\windows\system\QYVXJLY.exe KYNJSJ.exe File opened for modification C:\windows\GWUU.exe QLEE.exe File opened for modification C:\windows\LDRU.exe QSJE.exe File created C:\windows\SFU.exe.bat TUTDUHS.exe File created C:\windows\ODVAKN.exe.bat TQQJ.exe File created C:\windows\system\MVIVBJX.exe.bat ZKZWM.exe File created C:\windows\RIM.exe UCCDS.exe File created C:\windows\VMLWQW.exe HOD.exe File opened for modification C:\windows\JOKODZJ.exe GAFEA.exe File created C:\windows\CCIYP.exe.bat SFU.exe File created C:\windows\system\TQQJ.exe EAPRBRV.exe File opened for modification C:\windows\VMLWQW.exe HOD.exe File created C:\windows\system\MLLAL.exe.bat RXG.exe File created C:\windows\system\GXZZH.exe.bat PMW.exe File created C:\windows\system\WNAQ.exe GXZZH.exe File opened for modification C:\windows\FRL.exe DUF.exe File opened for modification C:\windows\GUXEB.exe FRL.exe File created C:\windows\system\JWXZ.exe.bat 2026-07-21_e98a726a068e12595c3996f2e93b3e40_elex_emotet_stop.exe File created C:\windows\CCIYP.exe SFU.exe File created C:\windows\system\YPVBHI.exe.bat ETQR.exe File opened for modification C:\windows\RIM.exe UCCDS.exe File created C:\windows\system\MLLAL.exe RXG.exe File created C:\windows\system\WQDUTS.exe WNAQ.exe File created C:\windows\QLEE.exe.bat AQN.exe File created C:\windows\SFU.exe TUTDUHS.exe File created C:\windows\BCSLMT.exe CRHVENV.exe File opened for modification C:\windows\system\QFSZVD.exe YCGW.exe File created C:\windows\system\GFY.exe QCPVA.exe File created C:\windows\ZPX.exe.bat TUYLD.exe File opened for modification C:\windows\LWM.exe UJBZH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5508 cmd.exe 4644 cmd.exe 5984 cmd.exe 1172 cmd.exe 3716 cmd.exe 4956 cmd.exe 5920 cmd.exe 816 cmd.exe 1744 cmd.exe 3268 cmd.exe 1984 cmd.exe 6020 cmd.exe 4680 cmd.exe 3284 cmd.exe 2552 cmd.exe 2052 cmd.exe 3748 cmd.exe 3732 cmd.exe 1512 cmd.exe 3248 cmd.exe 1328 cmd.exe 2320 cmd.exe 1524 cmd.exe 4668 cmd.exe 2836 cmd.exe 1612 cmd.exe 5776 cmd.exe 624 cmd.exe 388 cmd.exe 1240 cmd.exe 3052 cmd.exe 264 cmd.exe 4744 cmd.exe 4188 cmd.exe 1488 cmd.exe 3148 cmd.exe 5816 cmd.exe 3156 cmd.exe 2028 cmd.exe 5304 cmd.exe 4412 cmd.exe 4852 cmd.exe 5292 cmd.exe 3912 cmd.exe 5296 cmd.exe 5956 cmd.exe 5492 cmd.exe 1676 cmd.exe 2992 cmd.exe 2572 cmd.exe 5464 cmd.exe 5672 cmd.exe 4172 cmd.exe 2260 cmd.exe 5336 cmd.exe 3152 cmd.exe 1628 cmd.exe 2528 cmd.exe 4696 cmd.exe 1420 cmd.exe 2804 cmd.exe 4556 cmd.exe 5612 cmd.exe 3292 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2044 4628 WerFault.exe 87 4600 1536 WerFault.exe 93 5264 6048 WerFault.exe 99 2712 1072 WerFault.exe 104 756 1668 WerFault.exe 109 4980 5840 WerFault.exe 114 2364 1100 WerFault.exe 119 3572 4732 WerFault.exe 124 3316 5448 WerFault.exe 129 3396 3520 WerFault.exe 134 5420 2904 WerFault.exe 139 1744 5568 WerFault.exe 144 1252 760 WerFault.exe 149 6124 124 WerFault.exe 154 4932 4804 WerFault.exe 159 4132 1324 WerFault.exe 164 4988 3024 WerFault.exe 169 3808 4716 WerFault.exe 174 1816 4048 WerFault.exe 179 4912 1872 WerFault.exe 184 2288 724 WerFault.exe 189 4792 4504 WerFault.exe 194 1284 5868 WerFault.exe 199 240 1468 WerFault.exe 204 4908 1316 WerFault.exe 209 2820 2712 WerFault.exe 214 816 1528 WerFault.exe 219 560 5832 WerFault.exe 224 1164 3856 WerFault.exe 229 2496 1208 WerFault.exe 234 5860 2660 WerFault.exe 239 5704 1380 WerFault.exe 244 4904 3720 WerFault.exe 249 912 2616 WerFault.exe 254 3284 3016 WerFault.exe 259 2936 2240 WerFault.exe 264 5744 412 WerFault.exe 269 1200 2512 WerFault.exe 275 2104 2336 WerFault.exe 280 4116 5784 WerFault.exe 285 4376 2564 WerFault.exe 290 5680 1884 WerFault.exe 295 1268 4244 WerFault.exe 300 4340 4916 WerFault.exe 305 6056 1036 WerFault.exe 310 4536 5064 WerFault.exe 315 4108 1568 WerFault.exe 320 3900 5192 WerFault.exe 325 4184 3700 WerFault.exe 330 2984 704 WerFault.exe 335 3132 5352 WerFault.exe 340 6052 1776 WerFault.exe 345 1532 5000 WerFault.exe 350 2708 2828 WerFault.exe 355 3372 5536 WerFault.exe 360 1864 1144 WerFault.exe 365 2196 1088 WerFault.exe 370 1816 1804 WerFault.exe 375 4144 4056 WerFault.exe 380 4308 3256 WerFault.exe 385 2044 5276 WerFault.exe 390 5544 4780 WerFault.exe 395 5264 5980 WerFault.exe 400 240 2172 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GDIIAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYNJSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTSUM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LDRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJGNKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCCDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVIVBJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDLTFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TUYLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JOKODZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAPRBRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WWCVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPVBHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAFEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYVXJLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVIYBZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUSIJ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4628 2026-07-21_e98a726a068e12595c3996f2e93b3e40_elex_emotet_stop.exe 4628 2026-07-21_e98a726a068e12595c3996f2e93b3e40_elex_emotet_stop.exe 1536 JWXZ.exe 1536 JWXZ.exe 6048 KUSIJ.exe 6048 KUSIJ.exe 1072 UNBIOMF.exe 1072 UNBIOMF.exe 1668 GDIIAX.exe 1668 GDIIAX.exe 5840 AQN.exe 5840 AQN.exe 1100 QLEE.exe 1100 QLEE.exe 4732 GWUU.exe 4732 GWUU.exe 5448 FUGW.exe 5448 FUGW.exe 3520 ZHKGSR.exe 3520 ZHKGSR.exe 2904 QSJE.exe 2904 QSJE.exe 5568 LDRU.exe 5568 LDRU.exe 760 TTSUM.exe 760 TTSUM.exe 124 XQKJDF.exe 124 XQKJDF.exe 4804 UWQ.exe 4804 UWQ.exe 1324 SRHH.exe 1324 SRHH.exe 3024 TUTDUHS.exe 3024 TUTDUHS.exe 4716 SFU.exe 4716 SFU.exe 4048 CCIYP.exe 4048 CCIYP.exe 1872 INEXUL.exe 1872 INEXUL.exe 724 NOL.exe 724 NOL.exe 4504 SRJGLH.exe 4504 SRJGLH.exe 5868 WWCVB.exe 5868 WWCVB.exe 1468 PZFZ.exe 1468 PZFZ.exe 1316 THMZTK.exe 1316 THMZTK.exe 2712 EAPRBRV.exe 2712 EAPRBRV.exe 1528 TQQJ.exe 1528 TQQJ.exe 5832 ODVAKN.exe 5832 ODVAKN.exe 3856 PGZW.exe 3856 PGZW.exe 1208 CRHVENV.exe 1208 CRHVENV.exe 2660 BCSLMT.exe 2660 BCSLMT.exe 1380 ZMVTV.exe 1380 ZMVTV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4628 2026-07-21_e98a726a068e12595c3996f2e93b3e40_elex_emotet_stop.exe 4628 2026-07-21_e98a726a068e12595c3996f2e93b3e40_elex_emotet_stop.exe 1536 JWXZ.exe 1536 JWXZ.exe 6048 KUSIJ.exe 6048 KUSIJ.exe 1072 UNBIOMF.exe 1072 UNBIOMF.exe 1668 GDIIAX.exe 1668 GDIIAX.exe 5840 AQN.exe 5840 AQN.exe 1100 QLEE.exe 1100 QLEE.exe 4732 GWUU.exe 4732 GWUU.exe 5448 FUGW.exe 5448 FUGW.exe 3520 ZHKGSR.exe 3520 ZHKGSR.exe 2904 QSJE.exe 2904 QSJE.exe 5568 LDRU.exe 5568 LDRU.exe 760 TTSUM.exe 760 TTSUM.exe 124 XQKJDF.exe 124 XQKJDF.exe 4804 UWQ.exe 4804 UWQ.exe 1324 SRHH.exe 1324 SRHH.exe 3024 TUTDUHS.exe 3024 TUTDUHS.exe 4716 SFU.exe 4716 SFU.exe 4048 CCIYP.exe 4048 CCIYP.exe 1872 INEXUL.exe 1872 INEXUL.exe 724 NOL.exe 724 NOL.exe 4504 SRJGLH.exe 4504 SRJGLH.exe 5868 WWCVB.exe 5868 WWCVB.exe 1468 PZFZ.exe 1468 PZFZ.exe 1316 THMZTK.exe 1316 THMZTK.exe 2712 EAPRBRV.exe 2712 EAPRBRV.exe 1528 TQQJ.exe 1528 TQQJ.exe 5832 ODVAKN.exe 5832 ODVAKN.exe 3856 PGZW.exe 3856 PGZW.exe 1208 CRHVENV.exe 1208 CRHVENV.exe 2660 BCSLMT.exe 2660 BCSLMT.exe 1380 ZMVTV.exe 1380 ZMVTV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4628 wrote to memory of 5812 4628 2026-07-21_e98a726a068e12595c3996f2e93b3e40_elex_emotet_stop.exe 89 PID 5812 wrote to memory of 1536 5812 cmd.exe 93 PID 1536 wrote to memory of 2964 1536 JWXZ.exe 95 PID 2964 wrote to memory of 6048 2964 cmd.exe 99 PID 6048 wrote to memory of 244 6048 KUSIJ.exe 100 PID 244 wrote to memory of 1072 244 cmd.exe 104 PID 1072 wrote to memory of 2952 1072 UNBIOMF.exe 105 PID 2952 wrote to memory of 1668 2952 cmd.exe 109 PID 1668 wrote to memory of 2924 1668 GDIIAX.exe 110 PID 2924 wrote to memory of 5840 2924 cmd.exe 114 PID 5840 wrote to memory of 4660 5840 AQN.exe 115 PID 4660 wrote to memory of 1100 4660 cmd.exe 119 PID 1100 wrote to memory of 4412 1100 QLEE.exe 120 PID 4412 wrote to memory of 4732 4412 cmd.exe 124 PID 4732 wrote to memory of 3080 4732 GWUU.exe 125 PID 3080 wrote to memory of 5448 3080 cmd.exe 129 PID 5448 wrote to memory of 2804 5448 FUGW.exe 130 PID 2804 wrote to memory of 3520 2804 cmd.exe 134 PID 3520 wrote to memory of 3164 3520 ZHKGSR.exe 135 PID 3164 wrote to memory of 2904 3164 cmd.exe 139 PID 2904 wrote to memory of 4700 2904 QSJE.exe 140 PID 4700 wrote to memory of 5568 4700 cmd.exe 144 PID 5568 wrote to memory of 6020 5568 LDRU.exe 145 PID 6020 wrote to memory of 760 6020 cmd.exe 149 PID 760 wrote to memory of 2748 760 TTSUM.exe 150 PID 2748 wrote to memory of 124 2748 cmd.exe 154 PID 124 wrote to memory of 2100 124 XQKJDF.exe 155 PID 2100 wrote to memory of 4804 2100 cmd.exe 159 PID 4804 wrote to memory of 3948 4804 UWQ.exe 160 PID 3948 wrote to memory of 1324 3948 cmd.exe 164 PID 1324 wrote to memory of 4880 1324 SRHH.exe 165 PID 4880 wrote to memory of 3024 4880 cmd.exe 169 PID 3024 wrote to memory of 2084 3024 TUTDUHS.exe 170 PID 2084 wrote to memory of 4716 2084 cmd.exe 174 PID 4716 wrote to memory of 4172 4716 SFU.exe 175 PID 4172 wrote to memory of 4048 4172 cmd.exe 179 PID 4048 wrote to memory of 1328 4048 CCIYP.exe 180 PID 1328 wrote to memory of 1872 1328 cmd.exe 184 PID 1872 wrote to memory of 4680 1872 INEXUL.exe 185 PID 4680 wrote to memory of 724 4680 cmd.exe 189 PID 724 wrote to memory of 3616 724 NOL.exe 190 PID 3616 wrote to memory of 4504 3616 cmd.exe 194 PID 4504 wrote to memory of 6008 4504 SRJGLH.exe 195 PID 6008 wrote to memory of 5868 6008 cmd.exe 199 PID 5868 wrote to memory of 5440 5868 WWCVB.exe 200 PID 5440 wrote to memory of 1468 5440 cmd.exe 204 PID 1468 wrote to memory of 3052 1468 PZFZ.exe 205 PID 3052 wrote to memory of 1316 3052 cmd.exe 209 PID 1316 wrote to memory of 2260 1316 THMZTK.exe 210 PID 2260 wrote to memory of 2712 2260 cmd.exe 214 PID 2712 wrote to memory of 5304 2712 EAPRBRV.exe 215 PID 5304 wrote to memory of 1528 5304 cmd.exe 219 PID 1528 wrote to memory of 5284 1528 TQQJ.exe 220 PID 5284 wrote to memory of 5832 5284 cmd.exe 224 PID 5832 wrote to memory of 3248 5832 ODVAKN.exe 225 PID 3248 wrote to memory of 3856 3248 cmd.exe 229 PID 3856 wrote to memory of 4420 3856 PGZW.exe 230 PID 4420 wrote to memory of 1208 4420 cmd.exe 234 PID 1208 wrote to memory of 1384 1208 CRHVENV.exe 235 PID 1384 wrote to memory of 2660 1384 cmd.exe 239 PID 2660 wrote to memory of 3344 2660 BCSLMT.exe 240 PID 3344 wrote to memory of 1380 3344 cmd.exe 244 PID 1380 wrote to memory of 5508 1380 ZMVTV.exe 245 PID 5508 wrote to memory of 3720 5508 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_e98a726a068e12595c3996f2e93b3e40_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_e98a726a068e12595c3996f2e93b3e40_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWXZ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\windows\system\JWXZ.exeC:\windows\system\JWXZ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUSIJ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\windows\SysWOW64\KUSIJ.exeC:\windows\system32\KUSIJ.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNBIOMF.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\UNBIOMF.exeC:\windows\UNBIOMF.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDIIAX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\SysWOW64\GDIIAX.exeC:\windows\system32\GDIIAX.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQN.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\system\AQN.exeC:\windows\system\AQN.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLEE.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\QLEE.exeC:\windows\QLEE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWUU.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\GWUU.exeC:\windows\GWUU.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUGW.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\windows\SysWOW64\FUGW.exeC:\windows\system32\FUGW.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZHKGSR.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\windows\SysWOW64\ZHKGSR.exeC:\windows\system32\ZHKGSR.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSJE.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\windows\SysWOW64\QSJE.exeC:\windows\system32\QSJE.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LDRU.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\windows\LDRU.exeC:\windows\LDRU.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTSUM.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\SysWOW64\TTSUM.exeC:\windows\system32\TTSUM.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQKJDF.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\windows\SysWOW64\XQKJDF.exeC:\windows\system32\XQKJDF.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\windows\SysWOW64\UWQ.exeC:\windows\system32\UWQ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRHH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\windows\SysWOW64\SRHH.exeC:\windows\system32\SRHH.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TUTDUHS.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\SysWOW64\TUTDUHS.exeC:\windows\system32\TUTDUHS.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFU.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\windows\SFU.exeC:\windows\SFU.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCIYP.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\CCIYP.exeC:\windows\CCIYP.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INEXUL.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\SysWOW64\INEXUL.exeC:\windows\system32\INEXUL.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOL.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\SysWOW64\NOL.exeC:\windows\system32\NOL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRJGLH.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\windows\SysWOW64\SRJGLH.exeC:\windows\system32\SRJGLH.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWCVB.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\SysWOW64\WWCVB.exeC:\windows\system32\WWCVB.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZFZ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\windows\PZFZ.exeC:\windows\PZFZ.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THMZTK.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\windows\SysWOW64\THMZTK.exeC:\windows\system32\THMZTK.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAPRBRV.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\SysWOW64\EAPRBRV.exeC:\windows\system32\EAPRBRV.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQQJ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\windows\system\TQQJ.exeC:\windows\system\TQQJ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGZW.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\windows\system\PGZW.exeC:\windows\system\PGZW.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRHVENV.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\windows\CRHVENV.exeC:\windows\CRHVENV.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCSLMT.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\BCSLMT.exeC:\windows\BCSLMT.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMVTV.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\windows\system\ZMVTV.exeC:\windows\system\ZMVTV.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCGW.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\SysWOW64\YCGW.exeC:\windows\system32\YCGW.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFSZVD.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5336 -
C:\windows\system\QFSZVD.exeC:\windows\system\QFSZVD.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADXMD.exe.bat" "68⤵PID:5804
-
C:\windows\ADXMD.exeC:\windows\ADXMD.exe69⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BGBPIBH.exe.bat" "70⤵
- Executes a command shell one-liner
PID:1172 -
C:\windows\BGBPIBH.exeC:\windows\BGBPIBH.exe71⤵
- Executes dropped EXE
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SREFRP.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4256 -
C:\windows\SREFRP.exeC:\windows\SREFRP.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QCPVA.exe.bat" "74⤵PID:1684
-
C:\windows\system\QCPVA.exeC:\windows\system\QCPVA.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFY.exe.bat" "76⤵PID:4676
-
C:\windows\system\GFY.exeC:\windows\system\GFY.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EPBQTWW.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4312 -
C:\windows\SysWOW64\EPBQTWW.exeC:\windows\system32\EPBQTWW.exe79⤵
- Executes dropped EXE
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQD.exe.bat" "80⤵PID:1112
-
C:\windows\WQD.exeC:\windows\WQD.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLMZQG.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5492 -
C:\windows\SysWOW64\DLMZQG.exeC:\windows\system32\DLMZQG.exe83⤵
- Executes dropped EXE
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGMIUJP.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2320 -
C:\windows\SysWOW64\JGMIUJP.exeC:\windows\system32\JGMIUJP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETQR.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\windows\SysWOW64\ETQR.exeC:\windows\system32\ETQR.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPVBHI.exe.bat" "88⤵PID:2584
-
C:\windows\system\YPVBHI.exeC:\windows\system\YPVBHI.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZKZWM.exe.bat" "90⤵PID:1460
-
C:\windows\system\ZKZWM.exeC:\windows\system\ZKZWM.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVIVBJX.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1488 -
C:\windows\system\MVIVBJX.exeC:\windows\system\MVIVBJX.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDKA.exe.bat" "94⤵PID:5844
-
C:\windows\SysWOW64\DDKA.exeC:\windows\system32\DDKA.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLY.exe.bat" "96⤵PID:4316
-
C:\windows\HLY.exeC:\windows\HLY.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQW.exe.bat" "98⤵PID:4692
-
C:\windows\EQW.exeC:\windows\EQW.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WMABLZR.exe.bat" "100⤵PID:1432
-
C:\windows\SysWOW64\WMABLZR.exeC:\windows\system32\WMABLZR.exe101⤵
- Executes dropped EXE
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GUC.exe.bat" "102⤵PID:4900
-
C:\windows\system\GUC.exeC:\windows\system\GUC.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SCIGB.exe.bat" "104⤵PID:5716
-
C:\windows\SysWOW64\SCIGB.exeC:\windows\system32\SCIGB.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "106⤵
- Executes a command shell one-liner
PID:264 -
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe107⤵
- Executes dropped EXE
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAEOZ.exe.bat" "108⤵PID:340
-
C:\windows\SysWOW64\AAEOZ.exeC:\windows\system32\AAEOZ.exe109⤵
- Executes dropped EXE
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVIYBZN.exe.bat" "110⤵
- Executes a command shell one-liner
PID:3716 -
C:\windows\system\UVIYBZN.exeC:\windows\system\UVIYBZN.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJNPMZ.exe.bat" "112⤵PID:1788
-
C:\windows\system\PJNPMZ.exeC:\windows\system\PJNPMZ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMR.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3592 -
C:\windows\SysWOW64\PMR.exeC:\windows\system32\PMR.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TUYLD.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4956 -
C:\windows\system\TUYLD.exeC:\windows\system\TUYLD.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPX.exe.bat" "118⤵PID:1800
-
C:\windows\ZPX.exeC:\windows\ZPX.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCCDS.exe.bat" "120⤵PID:4604
-
C:\windows\SysWOW64\UCCDS.exeC:\windows\system32\UCCDS.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-