Analysis
- max time kernel
83s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 15:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe
- Size 208KB
- Sample260729-sh512ayte1
- SHA256 ab1c60a7a12482e3cb7440b5694cb59f2e6267b0fabbcc7ebb699fed0133107b
- MD5 e2b19b37de96c47cca7f65e052cef6a8
- SHA1 92a59ef0f37920f00f6d4e9dc0e7720ed4c76ac5
- SHA512 611719bdb10273cbb526e70bd370c7abdb5e53cf2730ae30f3f03bb421d9b26fdd989585f7485addfc275266429c687b565b8d42e253df8ebb6859a94bb6fae2
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf44pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOAkEj1
- TLSH T1CD247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5780 SXK.exe 3716 OXAMD.exe 4136 WDNTN.exe 3900 JNV.exe 5168 WLVDDM.exe 6056 GJJXLV.exe 5044 BEOHVVE.exe 4248 FMUHH.exe 1780 GPYLNDB.exe 4736 OVDRXJ.exe 5460 XDFWB.exe 1456 VTY.exe 4320 QGDJY.exe 5948 RJGELCX.exe 5336 LXLO.exe 4608 RSCXSF.exe 3224 QIWRN.exe 1164 ODVAKN.exe 3800 DYE.exe 5472 EBIAJXJ.exe 2420 IRPIV.exe 1928 GCAY.exe 4556 QCUDH.exe 2484 FFL.exe 120 NLDW.exe 3576 IYIGE.exe 1788 NYQ.exe 3016 NEQ.exe 1112 DZZMHV.exe 4876 SPA.exe 6132 QPIZX.exe 4360 CFOHJDM.exe 4280 EDCURLN.exe 4172 YRZD.exe 1152 EMYM.exe 4312 BRQBW.exe 5600 EFVLYJI.exe 704 NFX.exe 1436 GIBTPEM.exe 3668 GLFP.exe 1724 BYKYFU.exe 4340 BBNCK.exe 5536 DZTOZSU.exe 4596 YNYG.exe 5052 TADPMS.exe 5704 IVMU.exe 5540 QIMI.exe 1980 UQTILKX.exe 1508 CEFPVI.exe 1480 APIFE.exe 200 QKS.exe 5188 UNQEXC.exe 4240 OIV.exe 5008 SQBWL.exe 1396 WYQ.exe 4868 RUVF.exe 4332 RPZ.exe 3080 VFFJZN.exe 5800 ZNM.exe 3652 FILSQI.exe 4252 ZASD.exe 3396 IJUIDHZ.exe 2224 MRJQQ.exe 296 DZDVTW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WLVDDM.exe.bat JNV.exe File opened for modification C:\windows\SysWOW64\GCAY.exe IRPIV.exe File created C:\windows\SysWOW64\NFX.exe EFVLYJI.exe File created C:\windows\SysWOW64\BBNCK.exe BYKYFU.exe File created C:\windows\SysWOW64\BBNCK.exe.bat BYKYFU.exe File opened for modification C:\windows\SysWOW64\QKS.exe APIFE.exe File created C:\windows\SysWOW64\VFFJZN.exe RPZ.exe File created C:\windows\SysWOW64\OIO.exe GUJE.exe File opened for modification C:\windows\SysWOW64\NYQ.exe IYIGE.exe File created C:\windows\SysWOW64\GJJXLV.exe.bat WLVDDM.exe File created C:\windows\SysWOW64\ZNM.exe.bat VFFJZN.exe File created C:\windows\SysWOW64\HHS.exe DZDVTW.exe File created C:\windows\SysWOW64\SMX.exe.bat TBUZOL.exe File created C:\windows\SysWOW64\MROOX.exe TWKKSN.exe File created C:\windows\SysWOW64\MROOX.exe.bat TWKKSN.exe File created C:\windows\SysWOW64\ABXE.exe OLQWREI.exe File created C:\windows\SysWOW64\GJJXLV.exe WLVDDM.exe File created C:\windows\SysWOW64\BRQBW.exe EMYM.exe File opened for modification C:\windows\SysWOW64\IVMU.exe TADPMS.exe File opened for modification C:\windows\SysWOW64\FFPVI.exe QPOWBM.exe File opened for modification C:\windows\SysWOW64\ABXE.exe OLQWREI.exe File created C:\windows\SysWOW64\LXLO.exe.bat RJGELCX.exe File opened for modification C:\windows\SysWOW64\BRQBW.exe EMYM.exe File created C:\windows\SysWOW64\BRQBW.exe.bat EMYM.exe File created C:\windows\SysWOW64\IVMU.exe.bat TADPMS.exe File created C:\windows\SysWOW64\TBUZOL.exe.bat MLT.exe File created C:\windows\SysWOW64\QKS.exe APIFE.exe File created C:\windows\SysWOW64\WYQ.exe.bat SQBWL.exe File created C:\windows\SysWOW64\SMX.exe TBUZOL.exe File opened for modification C:\windows\SysWOW64\SMX.exe TBUZOL.exe File opened for modification C:\windows\SysWOW64\QKQK.exe SMX.exe File created C:\windows\SysWOW64\NZXAWBA.exe.bat UZQPNAK.exe File opened for modification C:\windows\SysWOW64\HHS.exe DZDVTW.exe File created C:\windows\SysWOW64\WLVDDM.exe JNV.exe File opened for modification C:\windows\SysWOW64\WLVDDM.exe JNV.exe File created C:\windows\SysWOW64\GCAY.exe.bat IRPIV.exe File created C:\windows\SysWOW64\NLDW.exe.bat FFL.exe File opened for modification C:\windows\SysWOW64\OLQWREI.exe XAO.exe File created C:\windows\SysWOW64\OLQWREI.exe.bat XAO.exe File opened for modification C:\windows\SysWOW64\LXLO.exe RJGELCX.exe File created C:\windows\SysWOW64\GCAY.exe IRPIV.exe File created C:\windows\SysWOW64\HHS.exe.bat DZDVTW.exe File created C:\windows\SysWOW64\AVMZD.exe.bat YXZFOX.exe File opened for modification C:\windows\SysWOW64\QGDJY.exe VTY.exe File created C:\windows\SysWOW64\NLDW.exe FFL.exe File opened for modification C:\windows\SysWOW64\BBNCK.exe BYKYFU.exe File opened for modification C:\windows\SysWOW64\LGXJRBE.exe FFPVI.exe File created C:\windows\SysWOW64\LGXJRBE.exe.bat FFPVI.exe File opened for modification C:\windows\SysWOW64\AVMZD.exe YXZFOX.exe File opened for modification C:\windows\SysWOW64\OIO.exe GUJE.exe File opened for modification C:\windows\SysWOW64\MROOX.exe TWKKSN.exe File opened for modification C:\windows\SysWOW64\GJJXLV.exe WLVDDM.exe File opened for modification C:\windows\SysWOW64\NFX.exe EFVLYJI.exe File created C:\windows\SysWOW64\FFPVI.exe QPOWBM.exe File created C:\windows\SysWOW64\OLQWREI.exe XAO.exe File created C:\windows\SysWOW64\NFX.exe.bat EFVLYJI.exe File created C:\windows\SysWOW64\APIFE.exe.bat CEFPVI.exe File created C:\windows\SysWOW64\WYQ.exe SQBWL.exe File created C:\windows\SysWOW64\THON.exe PZHNJK.exe File created C:\windows\SysWOW64\APIFE.exe CEFPVI.exe File opened for modification C:\windows\SysWOW64\WYQ.exe SQBWL.exe File opened for modification C:\windows\SysWOW64\VFFJZN.exe RPZ.exe File created C:\windows\SysWOW64\THON.exe.bat PZHNJK.exe File opened for modification C:\windows\SysWOW64\JNV.exe WDNTN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\FFL.exe.bat QCUDH.exe File opened for modification C:\windows\QPIZX.exe SPA.exe File opened for modification C:\windows\IYIGE.exe NLDW.exe File created C:\windows\system\CFOHJDM.exe QPIZX.exe File created C:\windows\YRZD.exe EDCURLN.exe File opened for modification C:\windows\WQERPDE.exe GVVF.exe File created C:\windows\ZASD.exe FILSQI.exe File created C:\windows\system\ORJC.exe WRHXIG.exe File opened for modification C:\windows\BEOHVVE.exe GJJXLV.exe File opened for modification C:\windows\system\GIBTPEM.exe NFX.exe File created C:\windows\system\GIBTPEM.exe.bat NFX.exe File opened for modification C:\windows\system\GUJE.exe NZXAWBA.exe File created C:\windows\system\MFGCZQ.exe MROOX.exe File opened for modification C:\windows\system\QIWRN.exe RSCXSF.exe File created C:\windows\UQTILKX.exe QIMI.exe File opened for modification C:\windows\QPOWBM.exe ORJC.exe File created C:\windows\IRPIV.exe.bat EBIAJXJ.exe File created C:\windows\CEFPVI.exe.bat UQTILKX.exe File opened for modification C:\windows\ZASD.exe FILSQI.exe File created C:\windows\NCVWT.exe.bat HHS.exe File created C:\windows\DGJKL.exe.bat XTKKO.exe File opened for modification C:\windows\XAO.exe SIEE.exe File created C:\windows\system\NEQ.exe.bat NYQ.exe File opened for modification C:\windows\KUZX.exe MFGCZQ.exe File opened for modification C:\windows\system\SXK.exe 2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe File created C:\windows\system\OVDRXJ.exe GPYLNDB.exe File opened for modification C:\windows\ODVAKN.exe QIWRN.exe File opened for modification C:\windows\system\AWYB.exe LGXJRBE.exe File opened for modification C:\windows\system\RFUOX.exe QKQK.exe File opened for modification C:\windows\GVVF.exe RFUOX.exe File created C:\windows\system\UZQPNAK.exe.bat ZLLGD.exe File created C:\windows\system\QIMI.exe.bat IVMU.exe File created C:\windows\system\OIV.exe.bat UNQEXC.exe File opened for modification C:\windows\system\WDNTN.exe OXAMD.exe File created C:\windows\DZZMHV.exe NEQ.exe File opened for modification C:\windows\GLFP.exe GIBTPEM.exe File created C:\windows\system\OVDRXJ.exe.bat GPYLNDB.exe File created C:\windows\system\CFOHJDM.exe.bat QPIZX.exe File opened for modification C:\windows\DZTOZSU.exe BBNCK.exe File created C:\windows\system\MRJQQ.exe.bat IJUIDHZ.exe File opened for modification C:\windows\XTKKO.exe EQGOBA.exe File opened for modification C:\windows\system\TWKKSN.exe JYWQ.exe File created C:\windows\system\EFVLYJI.exe.bat BRQBW.exe File created C:\windows\CEFPVI.exe UQTILKX.exe File created C:\windows\system\DYE.exe ODVAKN.exe File opened for modification C:\windows\system\FFL.exe QCUDH.exe File created C:\windows\system\EMYM.exe YRZD.exe File created C:\windows\system\SQBWL.exe.bat OIV.exe File created C:\windows\DZDVTW.exe MRJQQ.exe File created C:\windows\XTKKO.exe EQGOBA.exe File created C:\windows\XAO.exe SIEE.exe File created C:\windows\GLFP.exe GIBTPEM.exe File created C:\windows\EQGOBA.exe.bat NCVWT.exe File created C:\windows\system\GPYLNDB.exe FMUHH.exe File created C:\windows\ODVAKN.exe.bat QIWRN.exe File created C:\windows\system\MFGCZQ.exe.bat MROOX.exe File created C:\windows\system\WDNTN.exe OXAMD.exe File created C:\windows\system\SPA.exe DZZMHV.exe File opened for modification C:\windows\IJUIDHZ.exe ZASD.exe File created C:\windows\system\ORJC.exe.bat WRHXIG.exe File created C:\windows\QPOWBM.exe.bat ORJC.exe File opened for modification C:\windows\system\RJGELCX.exe QGDJY.exe File opened for modification C:\windows\system\YNYG.exe DZTOZSU.exe File opened for modification C:\windows\EQGOBA.exe NCVWT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5256 cmd.exe 2336 cmd.exe 5204 cmd.exe 5732 cmd.exe 2412 cmd.exe 3868 cmd.exe 6004 cmd.exe 2740 cmd.exe 1160 cmd.exe 3240 cmd.exe 6028 cmd.exe 5664 cmd.exe 3744 cmd.exe 2760 cmd.exe 5776 cmd.exe 2288 cmd.exe 4936 cmd.exe 2652 cmd.exe 936 cmd.exe 1996 cmd.exe 2132 cmd.exe 5924 cmd.exe 5904 cmd.exe 4380 cmd.exe 2136 cmd.exe 4488 cmd.exe 5764 cmd.exe 5360 cmd.exe 3872 cmd.exe 3492 cmd.exe 4524 cmd.exe 5464 cmd.exe 3032 cmd.exe 4800 cmd.exe 4160 cmd.exe 3428 cmd.exe 1524 cmd.exe 2400 cmd.exe 4900 cmd.exe 2820 cmd.exe 4844 cmd.exe 1876 cmd.exe 2848 cmd.exe 4144 cmd.exe 4520 cmd.exe 5812 cmd.exe 2088 cmd.exe 1156 cmd.exe 5740 cmd.exe 2072 cmd.exe 3856 cmd.exe 1900 cmd.exe 1252 cmd.exe 5680 cmd.exe 4324 cmd.exe 4072 cmd.exe 5872 cmd.exe 5452 cmd.exe 5596 cmd.exe 3588 cmd.exe 5580 cmd.exe 1072 cmd.exe 5652 cmd.exe 2300 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1688 1168 WerFault.exe 87 3492 5780 WerFault.exe 93 236 3716 WerFault.exe 99 5484 4136 WerFault.exe 104 2132 3900 WerFault.exe 109 1316 5168 WerFault.exe 114 3884 6056 WerFault.exe 119 3048 5044 WerFault.exe 124 5416 4248 WerFault.exe 129 2944 1780 WerFault.exe 134 4952 4736 WerFault.exe 139 2780 5460 WerFault.exe 144 2484 1456 WerFault.exe 149 4856 4320 WerFault.exe 154 5768 5948 WerFault.exe 159 1892 5336 WerFault.exe 164 1444 4608 WerFault.exe 169 476 3224 WerFault.exe 174 3912 1164 WerFault.exe 179 2524 3800 WerFault.exe 184 5304 5472 WerFault.exe 189 5684 2420 WerFault.exe 194 4912 1928 WerFault.exe 199 592 4556 WerFault.exe 204 3640 2484 WerFault.exe 209 5908 120 WerFault.exe 214 616 3576 WerFault.exe 219 4452 1788 WerFault.exe 224 5800 3016 WerFault.exe 229 4900 1112 WerFault.exe 234 5560 4876 WerFault.exe 239 5748 6132 WerFault.exe 244 4180 4360 WerFault.exe 249 2224 4280 WerFault.exe 254 1072 4172 WerFault.exe 259 3388 1152 WerFault.exe 264 2976 4312 WerFault.exe 269 4820 5600 WerFault.exe 274 1572 704 WerFault.exe 280 4884 1436 WerFault.exe 285 2440 3668 WerFault.exe 290 3288 1724 WerFault.exe 295 1180 4340 WerFault.exe 300 2152 5536 WerFault.exe 305 5000 4596 WerFault.exe 310 4376 5052 WerFault.exe 315 1500 5704 WerFault.exe 320 5892 5540 WerFault.exe 325 3792 1980 WerFault.exe 330 3912 1508 WerFault.exe 335 3944 1480 WerFault.exe 340 2120 200 WerFault.exe 345 3396 5188 WerFault.exe 350 3184 4240 WerFault.exe 355 2688 5008 WerFault.exe 360 4944 1396 WerFault.exe 365 1444 4868 WerFault.exe 370 5896 4332 WerFault.exe 375 3304 3080 WerFault.exe 380 3944 5800 WerFault.exe 385 3708 3652 WerFault.exe 390 2980 4252 WerFault.exe 395 1832 3396 WerFault.exe 400 5664 2224 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFUOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMUHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FIQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLQWREI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GPYLNDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZTOZSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEOHVVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBNCK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJUIDHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRHXIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQERPDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NZXAWBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYIGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GCAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFPVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFOHJDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWYB.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1168 2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe 1168 2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe 5780 SXK.exe 5780 SXK.exe 3716 OXAMD.exe 3716 OXAMD.exe 4136 WDNTN.exe 4136 WDNTN.exe 3900 JNV.exe 3900 JNV.exe 5168 WLVDDM.exe 5168 WLVDDM.exe 6056 GJJXLV.exe 6056 GJJXLV.exe 5044 BEOHVVE.exe 5044 BEOHVVE.exe 4248 FMUHH.exe 4248 FMUHH.exe 1780 GPYLNDB.exe 1780 GPYLNDB.exe 4736 OVDRXJ.exe 4736 OVDRXJ.exe 5460 XDFWB.exe 5460 XDFWB.exe 1456 VTY.exe 1456 VTY.exe 4320 QGDJY.exe 4320 QGDJY.exe 5948 RJGELCX.exe 5948 RJGELCX.exe 5336 LXLO.exe 5336 LXLO.exe 4608 RSCXSF.exe 4608 RSCXSF.exe 3224 QIWRN.exe 3224 QIWRN.exe 1164 ODVAKN.exe 1164 ODVAKN.exe 3800 DYE.exe 3800 DYE.exe 5472 EBIAJXJ.exe 5472 EBIAJXJ.exe 2420 IRPIV.exe 2420 IRPIV.exe 1928 GCAY.exe 1928 GCAY.exe 4556 QCUDH.exe 4556 QCUDH.exe 2484 FFL.exe 2484 FFL.exe 120 NLDW.exe 120 NLDW.exe 3576 IYIGE.exe 3576 IYIGE.exe 1788 NYQ.exe 1788 NYQ.exe 3016 NEQ.exe 3016 NEQ.exe 1112 DZZMHV.exe 1112 DZZMHV.exe 4876 SPA.exe 4876 SPA.exe 6132 QPIZX.exe 6132 QPIZX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1168 2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe 1168 2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe 5780 SXK.exe 5780 SXK.exe 3716 OXAMD.exe 3716 OXAMD.exe 4136 WDNTN.exe 4136 WDNTN.exe 3900 JNV.exe 3900 JNV.exe 5168 WLVDDM.exe 5168 WLVDDM.exe 6056 GJJXLV.exe 6056 GJJXLV.exe 5044 BEOHVVE.exe 5044 BEOHVVE.exe 4248 FMUHH.exe 4248 FMUHH.exe 1780 GPYLNDB.exe 1780 GPYLNDB.exe 4736 OVDRXJ.exe 4736 OVDRXJ.exe 5460 XDFWB.exe 5460 XDFWB.exe 1456 VTY.exe 1456 VTY.exe 4320 QGDJY.exe 4320 QGDJY.exe 5948 RJGELCX.exe 5948 RJGELCX.exe 5336 LXLO.exe 5336 LXLO.exe 4608 RSCXSF.exe 4608 RSCXSF.exe 3224 QIWRN.exe 3224 QIWRN.exe 1164 ODVAKN.exe 1164 ODVAKN.exe 3800 DYE.exe 3800 DYE.exe 5472 EBIAJXJ.exe 5472 EBIAJXJ.exe 2420 IRPIV.exe 2420 IRPIV.exe 1928 GCAY.exe 1928 GCAY.exe 4556 QCUDH.exe 4556 QCUDH.exe 2484 FFL.exe 2484 FFL.exe 120 NLDW.exe 120 NLDW.exe 3576 IYIGE.exe 3576 IYIGE.exe 1788 NYQ.exe 1788 NYQ.exe 3016 NEQ.exe 3016 NEQ.exe 1112 DZZMHV.exe 1112 DZZMHV.exe 4876 SPA.exe 4876 SPA.exe 6132 QPIZX.exe 6132 QPIZX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1168 wrote to memory of 1900 1168 2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe 89 PID 1900 wrote to memory of 5780 1900 cmd.exe 93 PID 5780 wrote to memory of 2412 5780 SXK.exe 95 PID 2412 wrote to memory of 3716 2412 cmd.exe 99 PID 3716 wrote to memory of 5324 3716 OXAMD.exe 100 PID 5324 wrote to memory of 4136 5324 cmd.exe 104 PID 4136 wrote to memory of 6076 4136 WDNTN.exe 105 PID 6076 wrote to memory of 3900 6076 cmd.exe 109 PID 3900 wrote to memory of 1256 3900 JNV.exe 110 PID 1256 wrote to memory of 5168 1256 cmd.exe 114 PID 5168 wrote to memory of 5452 5168 WLVDDM.exe 115 PID 5452 wrote to memory of 6056 5452 cmd.exe 119 PID 6056 wrote to memory of 4276 6056 GJJXLV.exe 120 PID 4276 wrote to memory of 5044 4276 cmd.exe 124 PID 5044 wrote to memory of 3324 5044 BEOHVVE.exe 125 PID 3324 wrote to memory of 4248 3324 cmd.exe 129 PID 4248 wrote to memory of 3180 4248 FMUHH.exe 130 PID 3180 wrote to memory of 1780 3180 cmd.exe 134 PID 1780 wrote to memory of 1524 1780 GPYLNDB.exe 135 PID 1524 wrote to memory of 4736 1524 cmd.exe 139 PID 4736 wrote to memory of 1464 4736 OVDRXJ.exe 140 PID 1464 wrote to memory of 5460 1464 cmd.exe 144 PID 5460 wrote to memory of 2400 5460 XDFWB.exe 145 PID 2400 wrote to memory of 1456 2400 cmd.exe 149 PID 1456 wrote to memory of 5228 1456 VTY.exe 150 PID 5228 wrote to memory of 4320 5228 cmd.exe 154 PID 4320 wrote to memory of 6040 4320 QGDJY.exe 155 PID 6040 wrote to memory of 5948 6040 cmd.exe 159 PID 5948 wrote to memory of 5256 5948 RJGELCX.exe 160 PID 5256 wrote to memory of 5336 5256 cmd.exe 164 PID 5336 wrote to memory of 1896 5336 LXLO.exe 165 PID 1896 wrote to memory of 4608 1896 cmd.exe 169 PID 4608 wrote to memory of 2528 4608 RSCXSF.exe 170 PID 2528 wrote to memory of 3224 2528 cmd.exe 174 PID 3224 wrote to memory of 3744 3224 QIWRN.exe 175 PID 3744 wrote to memory of 1164 3744 cmd.exe 179 PID 1164 wrote to memory of 3392 1164 ODVAKN.exe 180 PID 3392 wrote to memory of 3800 3392 cmd.exe 184 PID 3800 wrote to memory of 3872 3800 DYE.exe 185 PID 3872 wrote to memory of 5472 3872 cmd.exe 189 PID 5472 wrote to memory of 4520 5472 EBIAJXJ.exe 190 PID 4520 wrote to memory of 2420 4520 cmd.exe 194 PID 2420 wrote to memory of 2172 2420 IRPIV.exe 195 PID 2172 wrote to memory of 1928 2172 cmd.exe 199 PID 1928 wrote to memory of 2336 1928 GCAY.exe 200 PID 2336 wrote to memory of 4556 2336 cmd.exe 204 PID 4556 wrote to memory of 3492 4556 QCUDH.exe 205 PID 3492 wrote to memory of 2484 3492 cmd.exe 209 PID 2484 wrote to memory of 1252 2484 FFL.exe 210 PID 1252 wrote to memory of 120 1252 cmd.exe 214 PID 120 wrote to memory of 5596 120 NLDW.exe 215 PID 5596 wrote to memory of 3576 5596 cmd.exe 219 PID 3576 wrote to memory of 4524 3576 IYIGE.exe 220 PID 4524 wrote to memory of 1788 4524 cmd.exe 224 PID 1788 wrote to memory of 3868 1788 NYQ.exe 225 PID 3868 wrote to memory of 3016 3868 cmd.exe 229 PID 3016 wrote to memory of 3128 3016 NEQ.exe 230 PID 3128 wrote to memory of 1112 3128 cmd.exe 234 PID 1112 wrote to memory of 5712 1112 DZZMHV.exe 235 PID 5712 wrote to memory of 4876 5712 cmd.exe 239 PID 4876 wrote to memory of 1744 4876 SPA.exe 240 PID 1744 wrote to memory of 6132 1744 cmd.exe 244 PID 6132 wrote to memory of 5912 6132 QPIZX.exe 245 PID 5912 wrote to memory of 4360 5912 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_e2b19b37de96c47cca7f65e052cef6a8_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXK.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\windows\system\SXK.exeC:\windows\system\SXK.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXAMD.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\OXAMD.exeC:\windows\OXAMD.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WDNTN.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\windows\system\WDNTN.exeC:\windows\system\WDNTN.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNV.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\windows\SysWOW64\JNV.exeC:\windows\system32\JNV.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLVDDM.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\windows\SysWOW64\WLVDDM.exeC:\windows\system32\WLVDDM.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJJXLV.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\windows\SysWOW64\GJJXLV.exeC:\windows\system32\GJJXLV.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEOHVVE.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\BEOHVVE.exeC:\windows\BEOHVVE.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FMUHH.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\FMUHH.exeC:\windows\FMUHH.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GPYLNDB.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\windows\system\GPYLNDB.exeC:\windows\system\GPYLNDB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVDRXJ.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\windows\system\OVDRXJ.exeC:\windows\system\OVDRXJ.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XDFWB.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\windows\system\XDFWB.exeC:\windows\system\XDFWB.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTY.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\VTY.exeC:\windows\VTY.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGDJY.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\windows\SysWOW64\QGDJY.exeC:\windows\system32\QGDJY.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJGELCX.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\system\RJGELCX.exeC:\windows\system\RJGELCX.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXLO.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\windows\SysWOW64\LXLO.exeC:\windows\system32\LXLO.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSCXSF.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\windows\system\RSCXSF.exeC:\windows\system\RSCXSF.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIWRN.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\windows\system\QIWRN.exeC:\windows\system\QIWRN.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYE.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\system\DYE.exeC:\windows\system\DYE.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBIAJXJ.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\windows\system\EBIAJXJ.exeC:\windows\system\EBIAJXJ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRPIV.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\IRPIV.exeC:\windows\IRPIV.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCAY.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\windows\SysWOW64\GCAY.exeC:\windows\system32\GCAY.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCUDH.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\windows\QCUDH.exeC:\windows\QCUDH.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFL.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\system\FFL.exeC:\windows\system\FFL.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NLDW.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\SysWOW64\NLDW.exeC:\windows\system32\NLDW.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYIGE.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\windows\IYIGE.exeC:\windows\IYIGE.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYQ.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\SysWOW64\NYQ.exeC:\windows\system32\NYQ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEQ.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\windows\system\NEQ.exeC:\windows\system\NEQ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZZMHV.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\windows\DZZMHV.exeC:\windows\DZZMHV.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPA.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\windows\system\SPA.exeC:\windows\system\SPA.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPIZX.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\windows\QPIZX.exeC:\windows\QPIZX.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CFOHJDM.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\system\CFOHJDM.exeC:\windows\system\CFOHJDM.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDCURLN.exe.bat" "66⤵
- Executes a command shell one-liner
PID:3588 -
C:\windows\EDCURLN.exeC:\windows\EDCURLN.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YRZD.exe.bat" "68⤵PID:2480
-
C:\windows\YRZD.exeC:\windows\YRZD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMYM.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:6140 -
C:\windows\system\EMYM.exeC:\windows\system\EMYM.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRQBW.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4288 -
C:\windows\SysWOW64\BRQBW.exeC:\windows\system32\BRQBW.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFVLYJI.exe.bat" "74⤵PID:2560
-
C:\windows\system\EFVLYJI.exeC:\windows\system\EFVLYJI.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFX.exe.bat" "76⤵PID:1084
-
C:\windows\SysWOW64\NFX.exeC:\windows\system32\NFX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIBTPEM.exe.bat" "78⤵PID:1124
-
C:\windows\system\GIBTPEM.exeC:\windows\system\GIBTPEM.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLFP.exe.bat" "80⤵
- Executes a command shell one-liner
PID:6004 -
C:\windows\GLFP.exeC:\windows\GLFP.exe81⤵
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYKYFU.exe.bat" "82⤵PID:4604
-
C:\windows\system\BYKYFU.exeC:\windows\system\BYKYFU.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBNCK.exe.bat" "84⤵PID:5900
-
C:\windows\SysWOW64\BBNCK.exeC:\windows\system32\BBNCK.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZTOZSU.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5464 -
C:\windows\DZTOZSU.exeC:\windows\DZTOZSU.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNYG.exe.bat" "88⤵PID:3400
-
C:\windows\system\YNYG.exeC:\windows\system\YNYG.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TADPMS.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3032 -
C:\windows\TADPMS.exeC:\windows\TADPMS.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVMU.exe.bat" "92⤵PID:260
-
C:\windows\SysWOW64\IVMU.exeC:\windows\system32\IVMU.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIMI.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5204 -
C:\windows\system\QIMI.exeC:\windows\system\QIMI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQTILKX.exe.bat" "96⤵PID:1916
-
C:\windows\UQTILKX.exeC:\windows\UQTILKX.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEFPVI.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:432 -
C:\windows\CEFPVI.exeC:\windows\CEFPVI.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APIFE.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5812 -
C:\windows\SysWOW64\APIFE.exeC:\windows\system32\APIFE.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKS.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4900 -
C:\windows\SysWOW64\QKS.exeC:\windows\system32\QKS.exe103⤵
- Executes dropped EXE
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNQEXC.exe.bat" "104⤵PID:1196
-
C:\windows\system\UNQEXC.exeC:\windows\system\UNQEXC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIV.exe.bat" "106⤵PID:3336
-
C:\windows\system\OIV.exeC:\windows\system\OIV.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQBWL.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2760 -
C:\windows\system\SQBWL.exeC:\windows\system\SQBWL.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYQ.exe.bat" "110⤵PID:5020
-
C:\windows\SysWOW64\WYQ.exeC:\windows\system32\WYQ.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUVF.exe.bat" "112⤵PID:2012
-
C:\windows\system\RUVF.exeC:\windows\system\RUVF.exe113⤵
- Executes dropped EXE
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPZ.exe.bat" "114⤵PID:4872
-
C:\windows\system\RPZ.exeC:\windows\system\RPZ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFFJZN.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4800 -
C:\windows\SysWOW64\VFFJZN.exeC:\windows\system32\VFFJZN.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNM.exe.bat" "118⤵
- Executes a command shell one-liner
PID:5680 -
C:\windows\SysWOW64\ZNM.exeC:\windows\system32\ZNM.exe119⤵
- Executes dropped EXE
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FILSQI.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\windows\FILSQI.exeC:\windows\FILSQI.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-