Analysis
- max time kernel
88s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_870f2204a2d934bf394a946f2b2c80b5_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-28_870f2204a2d934bf394a946f2b2c80b5_elex_emotet_stop.exe
- Size 208KB
- Sample260728-2jyssacc46
- SHA256 de28e81ffa277e401e1da73f343d76a5ff72b4613802ef2e8386d36975c37f2b
- MD5 870f2204a2d934bf394a946f2b2c80b5
- SHA1 ec3ff8ee3c17cd34eadc391368058039acce420c
- SHA512 baa3108b0499c9c1067790b3e3f1a206f7f71d1d4c8c6c9a37644c2c2e20b8e5d443ce419b2c717e009d6111212a106a6b9edf22a4f031576e85f457d268f074
- SSDEEP 3072:cLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOff4pLthEjQT6j:olZtbLWIgd1LZ9oECZbslc5+LOnkEj1
- TLSH T1FE247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4876 GDJJJ.exe 5128 ARUZXDJ.exe 4312 AXU.exe 3760 VSZXJ.exe 5048 KNI.exe 3912 XLIVWO.exe 2308 AGN.exe 2364 EOCES.exe 5788 NWWK.exe 2412 MMPNJJY.exe 4400 MPTI.exe 2848 LAW.exe 3508 GNAIH.exe 1092 JDHQUFG.exe 4200 LBVKBNH.exe 5952 DBX.exe 1240 FZC.exe 4448 UPDB.exe 2444 PCIKLO.exe 2696 PGMOQ.exe 2500 OVF.exe 5296 IRCSO.exe 4492 SREFRP.exe 3952 CPSSGP.exe 5424 MMX.exe 2024 VNZRRD.exe 2384 WQD.exe 6132 QDIEH.exe 4996 JGMIUJP.exe 912 YBVMF.exe 3616 YPVBHI.exe 1656 GUIHS.exe 6008 MVIVBJX.exe 5796 NYTROZ.exe 5928 FTX.exe 4980 RLSN.exe 2000 IYDFK.exe 5924 TRGYSI.exe 4004 VPHSYXJ.exe 2908 QCEC.exe 5360 OAXFVKF.exe 4616 XAZK.exe 2788 SOETJ.exe 4688 TRHX.exe 6128 EJCQX.exe 3944 XMOLCDO.exe 564 CNWZT.exe 2380 XATJWX.exe 5740 SLJH.exe 1260 CLLMNF.exe 4700 NDGFWMR.exe 244 IRLO.exe 4196 TJOHO.exe 2780 NFTRQBK.exe 3016 TFAE.exe 1848 UAEINL.exe 5372 JDOM.exe 4568 CYR.exe 1524 ARCYMCT.exe 3216 KRE.exe 4232 FCNCEK.exe 2924 CUOEP.exe 2472 BNZU.exe 1500 ZDLXLAW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\QFGDNH.exe PCCZIJP.exe File opened for modification C:\windows\SysWOW64\CMOMYC.exe HJGNKR.exe File opened for modification C:\windows\SysWOW64\ARUZXDJ.exe GDJJJ.exe File created C:\windows\SysWOW64\VSZXJ.exe AXU.exe File created C:\windows\SysWOW64\GUIHS.exe YPVBHI.exe File opened for modification C:\windows\SysWOW64\GGS.exe MTNHEF.exe File opened for modification C:\windows\SysWOW64\XAZK.exe OAXFVKF.exe File opened for modification C:\windows\SysWOW64\KNI.exe VSZXJ.exe File created C:\windows\SysWOW64\LAW.exe MPTI.exe File created C:\windows\SysWOW64\SZVJ.exe GGS.exe File opened for modification C:\windows\SysWOW64\JDHQUFG.exe GNAIH.exe File created C:\windows\SysWOW64\JDHQUFG.exe.bat GNAIH.exe File created C:\windows\SysWOW64\XAZK.exe OAXFVKF.exe File created C:\windows\SysWOW64\XMOLCDO.exe.bat EJCQX.exe File created C:\windows\SysWOW64\YDTDMK.exe FAPH.exe File opened for modification C:\windows\SysWOW64\YDTDMK.exe FAPH.exe File created C:\windows\SysWOW64\EIOX.exe CKIDILB.exe File created C:\windows\SysWOW64\VSZXJ.exe.bat AXU.exe File opened for modification C:\windows\SysWOW64\MMX.exe CPSSGP.exe File created C:\windows\SysWOW64\NYTROZ.exe MVIVBJX.exe File created C:\windows\SysWOW64\CMOMYC.exe.bat HJGNKR.exe File created C:\windows\SysWOW64\GGS.exe.bat MTNHEF.exe File created C:\windows\SysWOW64\SZVJ.exe.bat GGS.exe File created C:\windows\SysWOW64\JGMIUJP.exe QDIEH.exe File created C:\windows\SysWOW64\VPHSYXJ.exe.bat TRGYSI.exe File opened for modification C:\windows\SysWOW64\NMQUXIH.exe DMO.exe File created C:\windows\SysWOW64\GGS.exe MTNHEF.exe File created C:\windows\SysWOW64\LAW.exe.bat MPTI.exe File opened for modification C:\windows\SysWOW64\IRCSO.exe OVF.exe File opened for modification C:\windows\SysWOW64\VPHSYXJ.exe TRGYSI.exe File created C:\windows\SysWOW64\CUOEP.exe FCNCEK.exe File created C:\windows\SysWOW64\YDTDMK.exe.bat FAPH.exe File opened for modification C:\windows\SysWOW64\EIOX.exe CKIDILB.exe File created C:\windows\SysWOW64\EIOX.exe.bat CKIDILB.exe File created C:\windows\SysWOW64\MMX.exe CPSSGP.exe File opened for modification C:\windows\SysWOW64\CUOEP.exe FCNCEK.exe File created C:\windows\SysWOW64\PROX.exe CMOMYC.exe File created C:\windows\SysWOW64\LJKLOND.exe.bat BLWZZEV.exe File opened for modification C:\windows\SysWOW64\QFGDNH.exe PCCZIJP.exe File created C:\windows\SysWOW64\ARUZXDJ.exe GDJJJ.exe File created C:\windows\SysWOW64\KNI.exe VSZXJ.exe File created C:\windows\SysWOW64\PCIKLO.exe UPDB.exe File opened for modification C:\windows\SysWOW64\PCIKLO.exe UPDB.exe File created C:\windows\SysWOW64\VPHSYXJ.exe TRGYSI.exe File opened for modification C:\windows\SysWOW64\VSZXJ.exe AXU.exe File opened for modification C:\windows\SysWOW64\LAW.exe MPTI.exe File created C:\windows\SysWOW64\IRCSO.exe.bat OVF.exe File opened for modification C:\windows\SysWOW64\GUIHS.exe YPVBHI.exe File opened for modification C:\windows\SysWOW64\NYTROZ.exe MVIVBJX.exe File opened for modification C:\windows\SysWOW64\XMOLCDO.exe EJCQX.exe File created C:\windows\SysWOW64\OVF.exe PGMOQ.exe File created C:\windows\SysWOW64\JGMIUJP.exe.bat QDIEH.exe File created C:\windows\SysWOW64\LJKLOND.exe BLWZZEV.exe File created C:\windows\SysWOW64\NMQUXIH.exe DMO.exe File created C:\windows\SysWOW64\JDHQUFG.exe GNAIH.exe File created C:\windows\SysWOW64\MMX.exe.bat CPSSGP.exe File created C:\windows\SysWOW64\CMOMYC.exe HJGNKR.exe File opened for modification C:\windows\SysWOW64\PROX.exe CMOMYC.exe File created C:\windows\SysWOW64\XMOLCDO.exe EJCQX.exe File created C:\windows\SysWOW64\PROX.exe.bat CMOMYC.exe File opened for modification C:\windows\SysWOW64\OVF.exe PGMOQ.exe File created C:\windows\SysWOW64\OVF.exe.bat PGMOQ.exe File created C:\windows\SysWOW64\XAZK.exe.bat OAXFVKF.exe File created C:\windows\SysWOW64\CUOEP.exe.bat FCNCEK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SLJH.exe XATJWX.exe File created C:\windows\system\IRLO.exe NDGFWMR.exe File created C:\windows\system\LRUUBY.exe.bat FRNH.exe File created C:\windows\TRGYSI.exe.bat IYDFK.exe File created C:\windows\system\TFAE.exe NFTRQBK.exe File created C:\windows\system\PCFYTHD.exe.bat CAWAFWI.exe File opened for modification C:\windows\MTNHEF.exe LQKL.exe File created C:\windows\system\QCH.exe HUFVAHV.exe File created C:\windows\system\HUFVAHV.exe.bat SZVJ.exe File created C:\windows\EOCES.exe AGN.exe File opened for modification C:\windows\MMPNJJY.exe NWWK.exe File created C:\windows\system\QRZJZ.exe.bat FYKYQ.exe File created C:\windows\system\PGMOQ.exe PCIKLO.exe File created C:\windows\TRGYSI.exe IYDFK.exe File created C:\windows\system\MPTI.exe MMPNJJY.exe File created C:\windows\WQD.exe VNZRRD.exe File opened for modification C:\windows\QCEC.exe VPHSYXJ.exe File created C:\windows\system\XPJF.exe KFTHKN.exe File created C:\windows\BDGSEZ.exe KVMF.exe File opened for modification C:\windows\system\DBX.exe LBVKBNH.exe File opened for modification C:\windows\CPSSGP.exe SREFRP.exe File created C:\windows\system\CLLMNF.exe SLJH.exe File created C:\windows\system\TFAE.exe.bat NFTRQBK.exe File opened for modification C:\windows\JDOM.exe UAEINL.exe File created C:\windows\HJGNKR.exe.bat ZTFW.exe File created C:\windows\system\XPJF.exe.bat KFTHKN.exe File created C:\windows\system\WRLCHZC.exe.bat BDGSEZ.exe File created C:\windows\SOETJ.exe XAZK.exe File opened for modification C:\windows\system\FRNH.exe WRLCHZC.exe File created C:\windows\system\PGMOQ.exe.bat PCIKLO.exe File created C:\windows\system\IAHXTS.exe YDTDMK.exe File created C:\windows\system\LRUUBY.exe FRNH.exe File opened for modification C:\windows\system\AXU.exe ARUZXDJ.exe File created C:\windows\GNAIH.exe LAW.exe File created C:\windows\system\BLWZZEV.exe.bat AQTVT.exe File opened for modification C:\windows\WQD.exe VNZRRD.exe File created C:\windows\CNWZT.exe XMOLCDO.exe File opened for modification C:\windows\KDKWF.exe PQF.exe File created C:\windows\system\LQKL.exe.bat FQCXING.exe File created C:\windows\QDIEH.exe WQD.exe File created C:\windows\UPDB.exe.bat FZC.exe File created C:\windows\JDOM.exe.bat UAEINL.exe File opened for modification C:\windows\system\ZDLXLAW.exe BNZU.exe File created C:\windows\KFTHKN.exe.bat PROX.exe File created C:\windows\VNZRRD.exe MMX.exe File created C:\windows\system\YZYZQ.exe.bat OBKMJU.exe File created C:\windows\system\YBVMF.exe JGMIUJP.exe File opened for modification C:\windows\system\OBKMJU.exe XRIW.exe File opened for modification C:\windows\system\TJOHO.exe IRLO.exe File created C:\windows\system\OBKMJU.exe XRIW.exe File opened for modification C:\windows\system\DMWPRA.exe TPQUJRT.exe File created C:\windows\system\HUFVAHV.exe SZVJ.exe File opened for modification C:\windows\LBVKBNH.exe JDHQUFG.exe File created C:\windows\SREFRP.exe IRCSO.exe File opened for modification C:\windows\system\IRLO.exe NDGFWMR.exe File created C:\windows\system\TJOHO.exe IRLO.exe File opened for modification C:\windows\system\NNY.exe DMWPRA.exe File opened for modification C:\windows\TRGYSI.exe IYDFK.exe File created C:\windows\system\TJOHO.exe.bat IRLO.exe File opened for modification C:\windows\system\XPJF.exe KFTHKN.exe File created C:\windows\KVMF.exe NPUQ.exe File opened for modification C:\windows\BDGSEZ.exe KVMF.exe File opened for modification C:\windows\NWWK.exe EOCES.exe File created C:\windows\SREFRP.exe.bat IRCSO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5044 cmd.exe 5596 cmd.exe 5020 cmd.exe 4888 cmd.exe 2560 cmd.exe 812 cmd.exe 1280 cmd.exe 4736 cmd.exe 3880 cmd.exe 4768 cmd.exe 2432 cmd.exe 3000 cmd.exe 4484 cmd.exe 2660 cmd.exe 2012 cmd.exe 628 cmd.exe 1716 cmd.exe 3028 cmd.exe 1436 cmd.exe 4692 cmd.exe 4620 cmd.exe 2044 cmd.exe 4800 cmd.exe 3844 cmd.exe 5580 cmd.exe 3864 cmd.exe 2664 cmd.exe 2956 cmd.exe 2100 cmd.exe 2636 cmd.exe 5716 cmd.exe 1144 cmd.exe 1008 cmd.exe 5852 cmd.exe 1480 cmd.exe 4236 cmd.exe 2768 cmd.exe 5780 cmd.exe 1544 cmd.exe 3932 cmd.exe 1636 cmd.exe 4984 cmd.exe 3352 cmd.exe 2784 cmd.exe 6056 cmd.exe 4584 cmd.exe 4528 cmd.exe 2300 cmd.exe 4408 cmd.exe 3388 cmd.exe 5664 cmd.exe 4908 cmd.exe 5312 cmd.exe 4992 cmd.exe 4960 cmd.exe 4884 cmd.exe 4188 cmd.exe 2064 cmd.exe 1216 cmd.exe 3032 cmd.exe 2264 cmd.exe 2980 cmd.exe 4276 cmd.exe 4524 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1220 2260 WerFault.exe 87 5556 4876 WerFault.exe 93 2176 5128 WerFault.exe 99 3284 4312 WerFault.exe 104 3016 3760 WerFault.exe 109 1240 5048 WerFault.exe 114 1980 3912 WerFault.exe 119 5560 2308 WerFault.exe 124 2840 2364 WerFault.exe 129 2536 5788 WerFault.exe 134 824 2412 WerFault.exe 139 3372 4400 WerFault.exe 144 1124 2848 WerFault.exe 149 5984 3508 WerFault.exe 154 2732 1092 WerFault.exe 159 6128 4200 WerFault.exe 164 5328 5952 WerFault.exe 169 2380 1240 WerFault.exe 174 1780 4448 WerFault.exe 179 4512 2444 WerFault.exe 184 3932 2696 WerFault.exe 189 5980 2500 WerFault.exe 194 1276 5296 WerFault.exe 199 4224 4492 WerFault.exe 204 5792 3952 WerFault.exe 209 5200 5424 WerFault.exe 214 1864 2024 WerFault.exe 219 4388 2384 WerFault.exe 224 2560 6132 WerFault.exe 229 1600 4996 WerFault.exe 234 1524 912 WerFault.exe 239 5980 3616 WerFault.exe 244 4972 1656 WerFault.exe 249 3376 6008 WerFault.exe 254 5368 5796 WerFault.exe 259 3436 5928 WerFault.exe 264 5328 4980 WerFault.exe 269 964 2000 WerFault.exe 274 4788 5924 WerFault.exe 280 5032 4004 WerFault.exe 285 5208 2908 WerFault.exe 290 1276 5360 WerFault.exe 295 1192 4616 WerFault.exe 300 1808 2788 WerFault.exe 305 4612 4688 WerFault.exe 310 5764 6128 WerFault.exe 315 5828 3944 WerFault.exe 320 1244 564 WerFault.exe 325 5460 2380 WerFault.exe 330 5104 5740 WerFault.exe 335 3216 1260 WerFault.exe 340 4860 4700 WerFault.exe 345 4856 244 WerFault.exe 350 2264 4196 WerFault.exe 355 712 2780 WerFault.exe 360 3108 3016 WerFault.exe 365 2480 1848 WerFault.exe 370 4684 5372 WerFault.exe 375 4892 4568 WerFault.exe 380 3512 1524 WerFault.exe 385 2540 3216 WerFault.exe 390 4856 4232 WerFault.exe 395 2264 2924 WerFault.exe 400 4940 2472 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMOLCDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFTRQBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCCZIJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPJF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRLCHZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KDKWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XAZK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SOETJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUOEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDLXLAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAHXTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRHX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRUUBY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LQKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRCSO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAXFVKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZYZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EIOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMQUXIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBPQMCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVIVBJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMOMYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AGN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XATJWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLLMNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCCCDSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLWZZEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_870f2204a2d934bf394a946f2b2c80b5_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LAW.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2260 2026-07-28_870f2204a2d934bf394a946f2b2c80b5_elex_emotet_stop.exe 2260 2026-07-28_870f2204a2d934bf394a946f2b2c80b5_elex_emotet_stop.exe 4876 GDJJJ.exe 4876 GDJJJ.exe 5128 ARUZXDJ.exe 5128 ARUZXDJ.exe 4312 AXU.exe 4312 AXU.exe 3760 VSZXJ.exe 3760 VSZXJ.exe 5048 KNI.exe 5048 KNI.exe 3912 XLIVWO.exe 3912 XLIVWO.exe 2308 AGN.exe 2308 AGN.exe 2364 EOCES.exe 2364 EOCES.exe 5788 NWWK.exe 5788 NWWK.exe 2412 MMPNJJY.exe 2412 MMPNJJY.exe 4400 MPTI.exe 4400 MPTI.exe 2848 LAW.exe 2848 LAW.exe 3508 GNAIH.exe 3508 GNAIH.exe 1092 JDHQUFG.exe 1092 JDHQUFG.exe 4200 LBVKBNH.exe 4200 LBVKBNH.exe 5952 DBX.exe 5952 DBX.exe 1240 FZC.exe 1240 FZC.exe 4448 UPDB.exe 4448 UPDB.exe 2444 PCIKLO.exe 2444 PCIKLO.exe 2696 PGMOQ.exe 2696 PGMOQ.exe 2500 OVF.exe 2500 OVF.exe 5296 IRCSO.exe 5296 IRCSO.exe 4492 SREFRP.exe 4492 SREFRP.exe 3952 CPSSGP.exe 3952 CPSSGP.exe 5424 MMX.exe 5424 MMX.exe 2024 VNZRRD.exe 2024 VNZRRD.exe 2384 WQD.exe 2384 WQD.exe 6132 QDIEH.exe 6132 QDIEH.exe 4996 JGMIUJP.exe 4996 JGMIUJP.exe 912 YBVMF.exe 912 YBVMF.exe 3616 YPVBHI.exe 3616 YPVBHI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2260 2026-07-28_870f2204a2d934bf394a946f2b2c80b5_elex_emotet_stop.exe 2260 2026-07-28_870f2204a2d934bf394a946f2b2c80b5_elex_emotet_stop.exe 4876 GDJJJ.exe 4876 GDJJJ.exe 5128 ARUZXDJ.exe 5128 ARUZXDJ.exe 4312 AXU.exe 4312 AXU.exe 3760 VSZXJ.exe 3760 VSZXJ.exe 5048 KNI.exe 5048 KNI.exe 3912 XLIVWO.exe 3912 XLIVWO.exe 2308 AGN.exe 2308 AGN.exe 2364 EOCES.exe 2364 EOCES.exe 5788 NWWK.exe 5788 NWWK.exe 2412 MMPNJJY.exe 2412 MMPNJJY.exe 4400 MPTI.exe 4400 MPTI.exe 2848 LAW.exe 2848 LAW.exe 3508 GNAIH.exe 3508 GNAIH.exe 1092 JDHQUFG.exe 1092 JDHQUFG.exe 4200 LBVKBNH.exe 4200 LBVKBNH.exe 5952 DBX.exe 5952 DBX.exe 1240 FZC.exe 1240 FZC.exe 4448 UPDB.exe 4448 UPDB.exe 2444 PCIKLO.exe 2444 PCIKLO.exe 2696 PGMOQ.exe 2696 PGMOQ.exe 2500 OVF.exe 2500 OVF.exe 5296 IRCSO.exe 5296 IRCSO.exe 4492 SREFRP.exe 4492 SREFRP.exe 3952 CPSSGP.exe 3952 CPSSGP.exe 5424 MMX.exe 5424 MMX.exe 2024 VNZRRD.exe 2024 VNZRRD.exe 2384 WQD.exe 2384 WQD.exe 6132 QDIEH.exe 6132 QDIEH.exe 4996 JGMIUJP.exe 4996 JGMIUJP.exe 912 YBVMF.exe 912 YBVMF.exe 3616 YPVBHI.exe 3616 YPVBHI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 236 2260 2026-07-28_870f2204a2d934bf394a946f2b2c80b5_elex_emotet_stop.exe 89 PID 236 wrote to memory of 4876 236 cmd.exe 93 PID 4876 wrote to memory of 4244 4876 GDJJJ.exe 95 PID 4244 wrote to memory of 5128 4244 cmd.exe 99 PID 5128 wrote to memory of 6020 5128 ARUZXDJ.exe 100 PID 6020 wrote to memory of 4312 6020 cmd.exe 104 PID 4312 wrote to memory of 5580 4312 AXU.exe 105 PID 5580 wrote to memory of 3760 5580 cmd.exe 109 PID 3760 wrote to memory of 4768 3760 VSZXJ.exe 110 PID 4768 wrote to memory of 5048 4768 cmd.exe 114 PID 5048 wrote to memory of 1764 5048 KNI.exe 115 PID 1764 wrote to memory of 3912 1764 cmd.exe 119 PID 3912 wrote to memory of 2432 3912 XLIVWO.exe 120 PID 2432 wrote to memory of 2308 2432 cmd.exe 124 PID 2308 wrote to memory of 2348 2308 AGN.exe 125 PID 2348 wrote to memory of 2364 2348 cmd.exe 129 PID 2364 wrote to memory of 4764 2364 EOCES.exe 130 PID 4764 wrote to memory of 5788 4764 cmd.exe 134 PID 5788 wrote to memory of 5044 5788 NWWK.exe 135 PID 5044 wrote to memory of 2412 5044 cmd.exe 139 PID 2412 wrote to memory of 4260 2412 MMPNJJY.exe 140 PID 4260 wrote to memory of 4400 4260 cmd.exe 144 PID 4400 wrote to memory of 468 4400 MPTI.exe 145 PID 468 wrote to memory of 2848 468 cmd.exe 149 PID 2848 wrote to memory of 3976 2848 LAW.exe 150 PID 3976 wrote to memory of 3508 3976 cmd.exe 154 PID 3508 wrote to memory of 4776 3508 GNAIH.exe 155 PID 4776 wrote to memory of 1092 4776 cmd.exe 159 PID 1092 wrote to memory of 1936 1092 JDHQUFG.exe 160 PID 1936 wrote to memory of 4200 1936 cmd.exe 164 PID 4200 wrote to memory of 5716 4200 LBVKBNH.exe 165 PID 5716 wrote to memory of 5952 5716 cmd.exe 169 PID 5952 wrote to memory of 5596 5952 DBX.exe 170 PID 5596 wrote to memory of 1240 5596 cmd.exe 174 PID 1240 wrote to memory of 1144 1240 FZC.exe 175 PID 1144 wrote to memory of 4448 1144 cmd.exe 179 PID 4448 wrote to memory of 2064 4448 UPDB.exe 180 PID 2064 wrote to memory of 2444 2064 cmd.exe 184 PID 2444 wrote to memory of 4896 2444 PCIKLO.exe 185 PID 4896 wrote to memory of 2696 4896 cmd.exe 189 PID 2696 wrote to memory of 3864 2696 PGMOQ.exe 190 PID 3864 wrote to memory of 2500 3864 cmd.exe 194 PID 2500 wrote to memory of 3448 2500 OVF.exe 195 PID 3448 wrote to memory of 5296 3448 cmd.exe 199 PID 5296 wrote to memory of 6060 5296 IRCSO.exe 200 PID 6060 wrote to memory of 4492 6060 cmd.exe 204 PID 4492 wrote to memory of 1816 4492 SREFRP.exe 205 PID 1816 wrote to memory of 3952 1816 cmd.exe 209 PID 3952 wrote to memory of 1104 3952 CPSSGP.exe 210 PID 1104 wrote to memory of 5424 1104 cmd.exe 214 PID 5424 wrote to memory of 772 5424 MMX.exe 215 PID 772 wrote to memory of 2024 772 cmd.exe 219 PID 2024 wrote to memory of 4804 2024 VNZRRD.exe 220 PID 4804 wrote to memory of 2384 4804 cmd.exe 224 PID 2384 wrote to memory of 1752 2384 WQD.exe 225 PID 1752 wrote to memory of 6132 1752 cmd.exe 229 PID 6132 wrote to memory of 2836 6132 QDIEH.exe 230 PID 2836 wrote to memory of 4996 2836 cmd.exe 234 PID 4996 wrote to memory of 4520 4996 JGMIUJP.exe 235 PID 4520 wrote to memory of 912 4520 cmd.exe 239 PID 912 wrote to memory of 1716 912 YBVMF.exe 240 PID 1716 wrote to memory of 3616 1716 cmd.exe 244 PID 3616 wrote to memory of 3388 3616 YPVBHI.exe 245 PID 3388 wrote to memory of 1656 3388 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_870f2204a2d934bf394a946f2b2c80b5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_870f2204a2d934bf394a946f2b2c80b5_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GDJJJ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\system\GDJJJ.exeC:\windows\system\GDJJJ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARUZXDJ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\SysWOW64\ARUZXDJ.exeC:\windows\system32\ARUZXDJ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AXU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\system\AXU.exeC:\windows\system\AXU.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VSZXJ.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\SysWOW64\VSZXJ.exeC:\windows\system32\VSZXJ.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNI.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\SysWOW64\KNI.exeC:\windows\system32\KNI.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLIVWO.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\windows\XLIVWO.exeC:\windows\XLIVWO.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGN.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\system\AGN.exeC:\windows\system\AGN.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EOCES.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\EOCES.exeC:\windows\EOCES.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NWWK.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\NWWK.exeC:\windows\NWWK.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MMPNJJY.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\MMPNJJY.exeC:\windows\MMPNJJY.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPTI.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\system\MPTI.exeC:\windows\system\MPTI.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LAW.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\windows\SysWOW64\LAW.exeC:\windows\system32\LAW.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GNAIH.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\windows\GNAIH.exeC:\windows\GNAIH.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDHQUFG.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\SysWOW64\JDHQUFG.exeC:\windows\system32\JDHQUFG.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBVKBNH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\windows\LBVKBNH.exeC:\windows\LBVKBNH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBX.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\windows\system\DBX.exeC:\windows\system\DBX.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZC.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\windows\FZC.exeC:\windows\FZC.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPDB.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\windows\UPDB.exeC:\windows\UPDB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCIKLO.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\windows\SysWOW64\PCIKLO.exeC:\windows\system32\PCIKLO.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGMOQ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\system\PGMOQ.exeC:\windows\system\PGMOQ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVF.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\SysWOW64\OVF.exeC:\windows\system32\OVF.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IRCSO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\windows\SysWOW64\IRCSO.exeC:\windows\system32\IRCSO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SREFRP.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\SREFRP.exeC:\windows\SREFRP.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPSSGP.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\CPSSGP.exeC:\windows\CPSSGP.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMX.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\SysWOW64\MMX.exeC:\windows\system32\MMX.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VNZRRD.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\windows\VNZRRD.exeC:\windows\VNZRRD.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQD.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\WQD.exeC:\windows\WQD.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QDIEH.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\windows\QDIEH.exeC:\windows\QDIEH.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGMIUJP.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\windows\SysWOW64\JGMIUJP.exeC:\windows\system32\JGMIUJP.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBVMF.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\system\YBVMF.exeC:\windows\system\YBVMF.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPVBHI.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\windows\system\YPVBHI.exeC:\windows\system\YPVBHI.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GUIHS.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\SysWOW64\GUIHS.exeC:\windows\system32\GUIHS.exe65⤵
- Executes dropped EXE
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVIVBJX.exe.bat" "66⤵PID:2296
-
C:\windows\system\MVIVBJX.exeC:\windows\system\MVIVBJX.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3960 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe69⤵
- Executes dropped EXE
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTX.exe.bat" "70⤵PID:736
-
C:\windows\FTX.exeC:\windows\FTX.exe71⤵
- Executes dropped EXE
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLSN.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3028 -
C:\windows\system\RLSN.exeC:\windows\system\RLSN.exe73⤵
- Executes dropped EXE
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3580 -
C:\windows\IYDFK.exeC:\windows\IYDFK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRGYSI.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2964 -
C:\windows\TRGYSI.exeC:\windows\TRGYSI.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPHSYXJ.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1008 -
C:\windows\SysWOW64\VPHSYXJ.exeC:\windows\system32\VPHSYXJ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCEC.exe.bat" "80⤵PID:5800
-
C:\windows\QCEC.exeC:\windows\QCEC.exe81⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OAXFVKF.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1216 -
C:\windows\system\OAXFVKF.exeC:\windows\system\OAXFVKF.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAZK.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5936 -
C:\windows\SysWOW64\XAZK.exeC:\windows\system32\XAZK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOETJ.exe.bat" "86⤵PID:2096
-
C:\windows\SOETJ.exeC:\windows\SOETJ.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRHX.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4992 -
C:\windows\system\TRHX.exeC:\windows\system\TRHX.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EJCQX.exe.bat" "90⤵PID:5152
-
C:\windows\system\EJCQX.exeC:\windows\system\EJCQX.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XMOLCDO.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2784 -
C:\windows\SysWOW64\XMOLCDO.exeC:\windows\system32\XMOLCDO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNWZT.exe.bat" "94⤵PID:5088
-
C:\windows\CNWZT.exeC:\windows\CNWZT.exe95⤵
- Executes dropped EXE
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XATJWX.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3032 -
C:\windows\XATJWX.exeC:\windows\XATJWX.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLJH.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3000 -
C:\windows\SLJH.exeC:\windows\SLJH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLLMNF.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4484 -
C:\windows\system\CLLMNF.exeC:\windows\system\CLLMNF.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDGFWMR.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2536 -
C:\windows\NDGFWMR.exeC:\windows\NDGFWMR.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRLO.exe.bat" "104⤵PID:948
-
C:\windows\system\IRLO.exeC:\windows\system\IRLO.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "106⤵PID:4972
-
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe107⤵
- Executes dropped EXE
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFTRQBK.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3880 -
C:\windows\system\NFTRQBK.exeC:\windows\system\NFTRQBK.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "110⤵PID:3420
-
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe111⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAEINL.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3248 -
C:\windows\UAEINL.exeC:\windows\UAEINL.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JDOM.exe.bat" "114⤵
- Executes a command shell one-liner
PID:2664 -
C:\windows\JDOM.exeC:\windows\JDOM.exe115⤵
- Executes dropped EXE
PID:5372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYR.exe.bat" "116⤵PID:4320
-
C:\windows\system\CYR.exeC:\windows\system\CYR.exe117⤵
- Executes dropped EXE
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ARCYMCT.exe.bat" "118⤵PID:2204
-
C:\windows\ARCYMCT.exeC:\windows\ARCYMCT.exe119⤵
- Executes dropped EXE
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KRE.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5852 -
C:\windows\KRE.exeC:\windows\KRE.exe121⤵
- Executes dropped EXE
PID:3216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-