Analysis
- max time kernel
70s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 16:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe
- Size 208KB
- Sample260808-twr7rsed54
- SHA256 21ef779cdd7b775d15e9efcd0965231aef1eb32b8bbefb71c5a4e9b070ded205
- MD5 22c61bcc73f38ece32b07d9bbd3fe440
- SHA1 422579c8ada633921292bd77ea9998813d5d1317
- SHA512 0e521405619acd8b32eabe70905a541ab2f21d00b359f6a53add3d165b65576d0ef1aaf6f9d49f70d809b05547c539d7b513543501e8d4686acdb74c13ab81d8
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFliKL+LOfe4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFliS+LOWkEj1
- TLSH T188247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3728 MNH.exe 5688 VGFXQRT.exe 6048 DLREBPP.exe 932 IMTONL.exe 1008 HBMJA.exe 4372 OSN.exe 1188 AIUJS.exe 1208 ZSXZ.exe 1116 QBLEO.exe 4756 PLOM.exe 1484 GUDR.exe 4444 IRI.exe 6116 JMUHW.exe 5956 SVOMZC.exe 5112 RGZCI.exe 1488 KYGNRJ.exe 2076 BGVTEA.exe 4356 ARXJN.exe 1792 RZMGZ.exe 2796 TXZA.exe 4836 YQB.exe 2816 ANP.exe 2580 XORZMVS.exe 1212 FUDGOUO.exe 2252 YULRGVW.exe 5308 XFWHPB.exe 4680 WQY.exe 6032 JAH.exe 2456 CTWGVS.exe 5020 SJXY.exe 4636 FUGW.exe 912 JXESQ.exe 5976 WIUIE.exe 4132 QACTN.exe 3468 YGOAY.exe 4160 CJMVYF.exe 3248 AGGYTK.exe 3872 OEGKV.exe 5068 JPO.exe 4020 WNWMLS.exe 1012 PQAQQ.exe 3612 GYGND.exe 5420 CJX.exe 2828 UEBHWSV.exe 5972 KUC.exe 5868 XFK.exe 5288 XIWBX.exe 1832 FYXA.exe 1564 NDB.exe 2724 IOSGCL.exe 4776 QUWMNJ.exe 680 SRKHU.exe 2628 TUOCAQI.exe 2232 VSUXPQJ.exe 1568 HAAX.exe 900 QICCF.exe 5796 FZDB.exe 5440 IMUD.exe 4316 ZUJIK.exe 3576 LNMBST.exe 3804 HNODW.exe 4152 LVUDIHS.exe 2124 IWEGML.exe 904 XRNS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ANP.exe.bat YQB.exe File opened for modification C:\windows\SysWOW64\WQY.exe XFWHPB.exe File created C:\windows\SysWOW64\SJXY.exe.bat CTWGVS.exe File opened for modification C:\windows\SysWOW64\YGOAY.exe QACTN.exe File opened for modification C:\windows\SysWOW64\FYXA.exe XIWBX.exe File opened for modification C:\windows\SysWOW64\YTGE.exe CSFCW.exe File created C:\windows\SysWOW64\MNH.exe 2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe File created C:\windows\SysWOW64\TXZA.exe RZMGZ.exe File opened for modification C:\windows\SysWOW64\FUGW.exe SJXY.exe File created C:\windows\SysWOW64\XKP.exe.bat HUOSCU.exe File created C:\windows\SysWOW64\DLREBPP.exe VGFXQRT.exe File created C:\windows\SysWOW64\IMTONL.exe.bat DLREBPP.exe File opened for modification C:\windows\SysWOW64\ANP.exe YQB.exe File created C:\windows\SysWOW64\XFK.exe KUC.exe File created C:\windows\SysWOW64\ZUJIK.exe IMUD.exe File created C:\windows\SysWOW64\LNMBST.exe ZUJIK.exe File opened for modification C:\windows\SysWOW64\VIOVHU.exe IXXWBJ.exe File created C:\windows\SysWOW64\HFA.exe OEK.exe File created C:\windows\SysWOW64\QBLEO.exe.bat ZSXZ.exe File opened for modification C:\windows\SysWOW64\SVOMZC.exe JMUHW.exe File created C:\windows\SysWOW64\TXZA.exe.bat RZMGZ.exe File created C:\windows\SysWOW64\WQY.exe.bat XFWHPB.exe File opened for modification C:\windows\SysWOW64\ZUJIK.exe IMUD.exe File created C:\windows\SysWOW64\LNMBST.exe.bat ZUJIK.exe File opened for modification C:\windows\SysWOW64\HUTBO.exe FWOGG.exe File created C:\windows\SysWOW64\VIOVHU.exe.bat IXXWBJ.exe File created C:\windows\SysWOW64\JMUHW.exe IRI.exe File created C:\windows\SysWOW64\SVOMZC.exe JMUHW.exe File created C:\windows\SysWOW64\FYXA.exe.bat XIWBX.exe File created C:\windows\SysWOW64\QICCF.exe HAAX.exe File opened for modification C:\windows\SysWOW64\OEK.exe EEIDZLF.exe File opened for modification C:\windows\SysWOW64\QCZU.exe MZBZBG.exe File created C:\windows\SysWOW64\XKP.exe HUOSCU.exe File created C:\windows\SysWOW64\MNH.exe.bat 2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe File created C:\windows\SysWOW64\QBLEO.exe ZSXZ.exe File created C:\windows\SysWOW64\JMUHW.exe.bat IRI.exe File created C:\windows\SysWOW64\BGVTEA.exe KYGNRJ.exe File created C:\windows\SysWOW64\SJXY.exe CTWGVS.exe File opened for modification C:\windows\SysWOW64\HFA.exe OEK.exe File created C:\windows\SysWOW64\QCZU.exe MZBZBG.exe File opened for modification C:\windows\SysWOW64\AIUJS.exe OSN.exe File created C:\windows\SysWOW64\SVOMZC.exe.bat JMUHW.exe File created C:\windows\SysWOW64\ZUJIK.exe.bat IMUD.exe File created C:\windows\SysWOW64\QCZU.exe.bat MZBZBG.exe File opened for modification C:\windows\SysWOW64\MNH.exe 2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe File created C:\windows\SysWOW64\IMTONL.exe DLREBPP.exe File created C:\windows\SysWOW64\BGVTEA.exe.bat KYGNRJ.exe File opened for modification C:\windows\SysWOW64\TXZA.exe RZMGZ.exe File created C:\windows\SysWOW64\FUGW.exe SJXY.exe File created C:\windows\SysWOW64\KUC.exe.bat UEBHWSV.exe File created C:\windows\SysWOW64\FYXA.exe XIWBX.exe File created C:\windows\SysWOW64\HNODW.exe LNMBST.exe File created C:\windows\SysWOW64\DLREBPP.exe.bat VGFXQRT.exe File created C:\windows\SysWOW64\JAH.exe WQY.exe File created C:\windows\SysWOW64\FUGW.exe.bat SJXY.exe File created C:\windows\SysWOW64\YGOAY.exe.bat QACTN.exe File created C:\windows\SysWOW64\SRKHU.exe.bat QUWMNJ.exe File created C:\windows\SysWOW64\QICCF.exe.bat HAAX.exe File opened for modification C:\windows\SysWOW64\HNODW.exe LNMBST.exe File created C:\windows\SysWOW64\VIOVHU.exe IXXWBJ.exe File opened for modification C:\windows\SysWOW64\JMUHW.exe IRI.exe File opened for modification C:\windows\SysWOW64\BGVTEA.exe KYGNRJ.exe File opened for modification C:\windows\SysWOW64\XFK.exe KUC.exe File opened for modification C:\windows\SysWOW64\LNMBST.exe ZUJIK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\CJX.exe GYGND.exe File opened for modification C:\windows\TUOCAQI.exe SRKHU.exe File opened for modification C:\windows\QVK.exe VIOVHU.exe File created C:\windows\system\HUOSCU.exe EMHSPKP.exe File created C:\windows\system\VGFXQRT.exe MNH.exe File created C:\windows\XFWHPB.exe YULRGVW.exe File opened for modification C:\windows\system\CTWGVS.exe JAH.exe File created C:\windows\PQAQQ.exe.bat WNWMLS.exe File created C:\windows\NDB.exe FYXA.exe File opened for modification C:\windows\XRNS.exe IWEGML.exe File created C:\windows\system\HUOSCU.exe.bat EMHSPKP.exe File created C:\windows\ZSXZ.exe AIUJS.exe File opened for modification C:\windows\RGZCI.exe SVOMZC.exe File created C:\windows\XORZMVS.exe.bat ANP.exe File opened for modification C:\windows\system\WNWMLS.exe JPO.exe File created C:\windows\TUOCAQI.exe SRKHU.exe File created C:\windows\EEIDZLF.exe.bat PJZQ.exe File created C:\windows\UEBHWSV.exe.bat CJX.exe File opened for modification C:\windows\HAAX.exe VSUXPQJ.exe File created C:\windows\system\IMUD.exe FZDB.exe File opened for modification C:\windows\YNTNOFC.exe XKP.exe File opened for modification C:\windows\XORZMVS.exe ANP.exe File opened for modification C:\windows\YULRGVW.exe FUDGOUO.exe File created C:\windows\system\CTWGVS.exe JAH.exe File created C:\windows\JPO.exe.bat OEGKV.exe File created C:\windows\system\WNWMLS.exe.bat JPO.exe File created C:\windows\system\IMUD.exe.bat FZDB.exe File created C:\windows\XRNS.exe IWEGML.exe File created C:\windows\YNTNOFC.exe.bat XKP.exe File created C:\windows\system\KYGNRJ.exe.bat RGZCI.exe File created C:\windows\system\QUWMNJ.exe IOSGCL.exe File opened for modification C:\windows\system\FWOGG.exe XRNS.exe File created C:\windows\PJZQ.exe KIPOC.exe File opened for modification C:\windows\system\HUOSCU.exe EMHSPKP.exe File created C:\windows\system\GBFUQE.exe YNTNOFC.exe File created C:\windows\XFWHPB.exe.bat YULRGVW.exe File created C:\windows\CJMVYF.exe YGOAY.exe File opened for modification C:\windows\system\QUWMNJ.exe IOSGCL.exe File created C:\windows\system\FUDGOUO.exe XORZMVS.exe File created C:\windows\system\FUDGOUO.exe.bat XORZMVS.exe File created C:\windows\system\QUWMNJ.exe.bat IOSGCL.exe File created C:\windows\GUDR.exe PLOM.exe File created C:\windows\RZMGZ.exe.bat ARXJN.exe File created C:\windows\QACTN.exe.bat WIUIE.exe File created C:\windows\HAAX.exe VSUXPQJ.exe File created C:\windows\GUDR.exe.bat PLOM.exe File created C:\windows\XORZMVS.exe ANP.exe File created C:\windows\CJMVYF.exe.bat YGOAY.exe File created C:\windows\JPO.exe OEGKV.exe File opened for modification C:\windows\FZDB.exe QICCF.exe File created C:\windows\system\HBMJA.exe.bat IMTONL.exe File opened for modification C:\windows\PJZQ.exe KIPOC.exe File opened for modification C:\windows\GUDR.exe PLOM.exe File created C:\windows\YULRGVW.exe FUDGOUO.exe File opened for modification C:\windows\OEGKV.exe AGGYTK.exe File opened for modification C:\windows\system\VSUXPQJ.exe TUOCAQI.exe File created C:\windows\IWEGML.exe.bat LVUDIHS.exe File opened for modification C:\windows\EEIDZLF.exe PJZQ.exe File opened for modification C:\windows\system\HBMJA.exe IMTONL.exe File created C:\windows\AGGYTK.exe CJMVYF.exe File created C:\windows\TUOCAQI.exe.bat SRKHU.exe File created C:\windows\system\VSUXPQJ.exe.bat TUOCAQI.exe File created C:\windows\PJZQ.exe.bat KIPOC.exe File created C:\windows\system\OSN.exe HBMJA.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3892 cmd.exe 5808 cmd.exe 2868 cmd.exe 2776 cmd.exe 5792 cmd.exe 2496 cmd.exe 576 cmd.exe 364 cmd.exe 5324 cmd.exe 1424 cmd.exe 3000 cmd.exe 1124 cmd.exe 1140 cmd.exe 3520 cmd.exe 4560 cmd.exe 6136 cmd.exe 2932 cmd.exe 2652 cmd.exe 5960 cmd.exe 1660 cmd.exe 5640 cmd.exe 4628 cmd.exe 3272 cmd.exe 3824 cmd.exe 3172 cmd.exe 3408 cmd.exe 1376 cmd.exe 864 cmd.exe 4940 cmd.exe 2516 cmd.exe 476 cmd.exe 5852 cmd.exe 1236 cmd.exe 2072 cmd.exe 3128 cmd.exe 1128 cmd.exe 4576 cmd.exe 5456 cmd.exe 4948 cmd.exe 5880 cmd.exe 724 cmd.exe 2272 cmd.exe 1972 cmd.exe 236 cmd.exe 4288 cmd.exe 4660 cmd.exe 5388 cmd.exe 2960 cmd.exe 4044 cmd.exe 5756 cmd.exe 4480 cmd.exe 2740 cmd.exe 1332 cmd.exe 2088 cmd.exe 4852 cmd.exe 1588 cmd.exe 2688 cmd.exe 2820 cmd.exe 5128 cmd.exe 432 cmd.exe 708 cmd.exe 2392 cmd.exe 3512 cmd.exe 3828 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6116 800 WerFault.exe 87 4560 3728 WerFault.exe 93 4412 5688 WerFault.exe 99 1460 6048 WerFault.exe 104 5440 932 WerFault.exe 109 2960 1008 WerFault.exe 114 2912 4372 WerFault.exe 119 4636 1188 WerFault.exe 124 4828 1208 WerFault.exe 129 912 1116 WerFault.exe 134 1744 4756 WerFault.exe 139 4204 1484 WerFault.exe 144 3580 4444 WerFault.exe 149 3464 6116 WerFault.exe 154 3740 5956 WerFault.exe 159 1280 5112 WerFault.exe 164 2480 1488 WerFault.exe 169 3440 2076 WerFault.exe 174 5368 4356 WerFault.exe 179 2932 1792 WerFault.exe 184 5268 2796 WerFault.exe 189 4032 4836 WerFault.exe 194 3868 2816 WerFault.exe 199 3340 2580 WerFault.exe 204 816 1212 WerFault.exe 209 4224 2252 WerFault.exe 214 3244 5308 WerFault.exe 219 4944 4680 WerFault.exe 224 4956 6032 WerFault.exe 229 5648 2456 WerFault.exe 234 1348 5020 WerFault.exe 239 3164 4636 WerFault.exe 244 3076 912 WerFault.exe 249 5364 5976 WerFault.exe 254 2088 4132 WerFault.exe 259 6000 3468 WerFault.exe 265 2864 4160 WerFault.exe 270 3508 3248 WerFault.exe 275 4328 3872 WerFault.exe 280 2848 5068 WerFault.exe 285 3704 4020 WerFault.exe 290 5624 1012 WerFault.exe 295 5744 3612 WerFault.exe 300 3632 5420 WerFault.exe 305 2356 2828 WerFault.exe 310 5900 5972 WerFault.exe 315 1192 5868 WerFault.exe 320 3288 5288 WerFault.exe 325 4520 1832 WerFault.exe 330 3240 1564 WerFault.exe 335 3804 2724 WerFault.exe 340 5036 4776 WerFault.exe 345 2704 680 WerFault.exe 350 3532 2628 WerFault.exe 355 3076 2232 WerFault.exe 360 4564 1568 WerFault.exe 365 1960 900 WerFault.exe 370 4008 5796 WerFault.exe 375 1280 5440 WerFault.exe 380 2160 4316 WerFault.exe 385 4120 3576 WerFault.exe 390 5660 3804 WerFault.exe 395 1852 4152 WerFault.exe 400 3592 2124 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZUJIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEBHWSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUOSCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VGFXQRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QICCF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWEGML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBMJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMHSPKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYGNRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXESQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVOMZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIUIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYGND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLREBPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRKHU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIPOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSFCW.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 800 2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe 800 2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe 3728 MNH.exe 3728 MNH.exe 5688 VGFXQRT.exe 5688 VGFXQRT.exe 6048 DLREBPP.exe 6048 DLREBPP.exe 932 IMTONL.exe 932 IMTONL.exe 1008 HBMJA.exe 1008 HBMJA.exe 4372 OSN.exe 4372 OSN.exe 1188 AIUJS.exe 1188 AIUJS.exe 1208 ZSXZ.exe 1208 ZSXZ.exe 1116 QBLEO.exe 1116 QBLEO.exe 4756 PLOM.exe 4756 PLOM.exe 1484 GUDR.exe 1484 GUDR.exe 4444 IRI.exe 4444 IRI.exe 6116 JMUHW.exe 6116 JMUHW.exe 5956 SVOMZC.exe 5956 SVOMZC.exe 5112 RGZCI.exe 5112 RGZCI.exe 1488 KYGNRJ.exe 1488 KYGNRJ.exe 2076 BGVTEA.exe 2076 BGVTEA.exe 4356 ARXJN.exe 4356 ARXJN.exe 1792 RZMGZ.exe 1792 RZMGZ.exe 2796 TXZA.exe 2796 TXZA.exe 4836 YQB.exe 4836 YQB.exe 2816 ANP.exe 2816 ANP.exe 2580 XORZMVS.exe 2580 XORZMVS.exe 1212 FUDGOUO.exe 1212 FUDGOUO.exe 2252 YULRGVW.exe 2252 YULRGVW.exe 5308 XFWHPB.exe 5308 XFWHPB.exe 4680 WQY.exe 4680 WQY.exe 6032 JAH.exe 6032 JAH.exe 2456 CTWGVS.exe 2456 CTWGVS.exe 5020 SJXY.exe 5020 SJXY.exe 4636 FUGW.exe 4636 FUGW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 800 2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe 800 2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe 3728 MNH.exe 3728 MNH.exe 5688 VGFXQRT.exe 5688 VGFXQRT.exe 6048 DLREBPP.exe 6048 DLREBPP.exe 932 IMTONL.exe 932 IMTONL.exe 1008 HBMJA.exe 1008 HBMJA.exe 4372 OSN.exe 4372 OSN.exe 1188 AIUJS.exe 1188 AIUJS.exe 1208 ZSXZ.exe 1208 ZSXZ.exe 1116 QBLEO.exe 1116 QBLEO.exe 4756 PLOM.exe 4756 PLOM.exe 1484 GUDR.exe 1484 GUDR.exe 4444 IRI.exe 4444 IRI.exe 6116 JMUHW.exe 6116 JMUHW.exe 5956 SVOMZC.exe 5956 SVOMZC.exe 5112 RGZCI.exe 5112 RGZCI.exe 1488 KYGNRJ.exe 1488 KYGNRJ.exe 2076 BGVTEA.exe 2076 BGVTEA.exe 4356 ARXJN.exe 4356 ARXJN.exe 1792 RZMGZ.exe 1792 RZMGZ.exe 2796 TXZA.exe 2796 TXZA.exe 4836 YQB.exe 4836 YQB.exe 2816 ANP.exe 2816 ANP.exe 2580 XORZMVS.exe 2580 XORZMVS.exe 1212 FUDGOUO.exe 1212 FUDGOUO.exe 2252 YULRGVW.exe 2252 YULRGVW.exe 5308 XFWHPB.exe 5308 XFWHPB.exe 4680 WQY.exe 4680 WQY.exe 6032 JAH.exe 6032 JAH.exe 2456 CTWGVS.exe 2456 CTWGVS.exe 5020 SJXY.exe 5020 SJXY.exe 4636 FUGW.exe 4636 FUGW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 800 wrote to memory of 5544 800 2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe 89 PID 5544 wrote to memory of 3728 5544 cmd.exe 93 PID 3728 wrote to memory of 2800 3728 MNH.exe 95 PID 2800 wrote to memory of 5688 2800 cmd.exe 99 PID 5688 wrote to memory of 3020 5688 VGFXQRT.exe 100 PID 3020 wrote to memory of 6048 3020 cmd.exe 104 PID 6048 wrote to memory of 1344 6048 DLREBPP.exe 105 PID 1344 wrote to memory of 932 1344 cmd.exe 109 PID 932 wrote to memory of 5080 932 IMTONL.exe 110 PID 5080 wrote to memory of 1008 5080 cmd.exe 114 PID 1008 wrote to memory of 3512 1008 HBMJA.exe 115 PID 3512 wrote to memory of 4372 3512 cmd.exe 119 PID 4372 wrote to memory of 4484 4372 OSN.exe 120 PID 4484 wrote to memory of 1188 4484 cmd.exe 124 PID 1188 wrote to memory of 4268 1188 AIUJS.exe 125 PID 4268 wrote to memory of 1208 4268 cmd.exe 129 PID 1208 wrote to memory of 2360 1208 ZSXZ.exe 130 PID 2360 wrote to memory of 1116 2360 cmd.exe 134 PID 1116 wrote to memory of 5064 1116 QBLEO.exe 135 PID 5064 wrote to memory of 4756 5064 cmd.exe 139 PID 4756 wrote to memory of 3136 4756 PLOM.exe 140 PID 3136 wrote to memory of 1484 3136 cmd.exe 144 PID 1484 wrote to memory of 2572 1484 GUDR.exe 145 PID 2572 wrote to memory of 4444 2572 cmd.exe 149 PID 4444 wrote to memory of 4660 4444 IRI.exe 150 PID 4660 wrote to memory of 6116 4660 cmd.exe 154 PID 6116 wrote to memory of 4112 6116 JMUHW.exe 155 PID 4112 wrote to memory of 5956 4112 cmd.exe 159 PID 5956 wrote to memory of 1100 5956 SVOMZC.exe 160 PID 1100 wrote to memory of 5112 1100 cmd.exe 164 PID 5112 wrote to memory of 924 5112 RGZCI.exe 165 PID 924 wrote to memory of 1488 924 cmd.exe 169 PID 1488 wrote to memory of 3828 1488 KYGNRJ.exe 170 PID 3828 wrote to memory of 2076 3828 cmd.exe 174 PID 2076 wrote to memory of 2868 2076 BGVTEA.exe 175 PID 2868 wrote to memory of 4356 2868 cmd.exe 179 PID 4356 wrote to memory of 5388 4356 ARXJN.exe 180 PID 5388 wrote to memory of 1792 5388 cmd.exe 184 PID 1792 wrote to memory of 4940 1792 RZMGZ.exe 185 PID 4940 wrote to memory of 2796 4940 cmd.exe 189 PID 2796 wrote to memory of 2064 2796 TXZA.exe 190 PID 2064 wrote to memory of 4836 2064 cmd.exe 194 PID 4836 wrote to memory of 4476 4836 YQB.exe 195 PID 4476 wrote to memory of 2816 4476 cmd.exe 199 PID 2816 wrote to memory of 2536 2816 ANP.exe 200 PID 2536 wrote to memory of 2580 2536 cmd.exe 204 PID 2580 wrote to memory of 4648 2580 XORZMVS.exe 205 PID 4648 wrote to memory of 1212 4648 cmd.exe 209 PID 1212 wrote to memory of 1244 1212 FUDGOUO.exe 210 PID 1244 wrote to memory of 2252 1244 cmd.exe 214 PID 2252 wrote to memory of 4560 2252 YULRGVW.exe 215 PID 4560 wrote to memory of 5308 4560 cmd.exe 219 PID 5308 wrote to memory of 1680 5308 XFWHPB.exe 220 PID 1680 wrote to memory of 4680 1680 cmd.exe 224 PID 4680 wrote to memory of 2260 4680 WQY.exe 225 PID 2260 wrote to memory of 6032 2260 cmd.exe 229 PID 6032 wrote to memory of 4772 6032 JAH.exe 230 PID 4772 wrote to memory of 2456 4772 cmd.exe 234 PID 2456 wrote to memory of 2776 2456 CTWGVS.exe 235 PID 2776 wrote to memory of 5020 2776 cmd.exe 239 PID 5020 wrote to memory of 4936 5020 SJXY.exe 240 PID 4936 wrote to memory of 4636 4936 cmd.exe 244 PID 4636 wrote to memory of 5780 4636 FUGW.exe 245 PID 5780 wrote to memory of 912 5780 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_22c61bcc73f38ece32b07d9bbd3fe440_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MNH.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\SysWOW64\MNH.exeC:\windows\system32\MNH.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VGFXQRT.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\system\VGFXQRT.exeC:\windows\system\VGFXQRT.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLREBPP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\windows\SysWOW64\DLREBPP.exeC:\windows\system32\DLREBPP.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMTONL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\windows\SysWOW64\IMTONL.exeC:\windows\system32\IMTONL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBMJA.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\windows\system\HBMJA.exeC:\windows\system\HBMJA.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OSN.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\system\OSN.exeC:\windows\system\OSN.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIUJS.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\SysWOW64\AIUJS.exeC:\windows\system32\AIUJS.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSXZ.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\ZSXZ.exeC:\windows\ZSXZ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QBLEO.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\SysWOW64\QBLEO.exeC:\windows\system32\QBLEO.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PLOM.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\windows\PLOM.exeC:\windows\PLOM.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GUDR.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\GUDR.exeC:\windows\GUDR.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRI.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\system\IRI.exeC:\windows\system\IRI.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMUHW.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\SysWOW64\JMUHW.exeC:\windows\system32\JMUHW.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVOMZC.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\windows\SysWOW64\SVOMZC.exeC:\windows\system32\SVOMZC.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGZCI.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\RGZCI.exeC:\windows\RGZCI.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYGNRJ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924 -
C:\windows\system\KYGNRJ.exeC:\windows\system\KYGNRJ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BGVTEA.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\windows\SysWOW64\BGVTEA.exeC:\windows\system32\BGVTEA.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARXJN.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\system\ARXJN.exeC:\windows\system\ARXJN.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RZMGZ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\windows\RZMGZ.exeC:\windows\RZMGZ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXZA.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\SysWOW64\TXZA.exeC:\windows\system32\TXZA.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQB.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\windows\YQB.exeC:\windows\YQB.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANP.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\windows\SysWOW64\ANP.exeC:\windows\system32\ANP.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XORZMVS.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\windows\XORZMVS.exeC:\windows\XORZMVS.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUDGOUO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\system\FUDGOUO.exeC:\windows\system\FUDGOUO.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YULRGVW.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\windows\YULRGVW.exeC:\windows\YULRGVW.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFWHPB.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\XFWHPB.exeC:\windows\XFWHPB.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQY.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\windows\SysWOW64\WQY.exeC:\windows\system32\WQY.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAH.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\SysWOW64\JAH.exeC:\windows\system32\JAH.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CTWGVS.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\system\CTWGVS.exeC:\windows\system\CTWGVS.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJXY.exe.bat" "60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\SysWOW64\SJXY.exeC:\windows\system32\SJXY.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUGW.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\windows\SysWOW64\FUGW.exeC:\windows\system32\FUGW.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXESQ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\system\JXESQ.exeC:\windows\system\JXESQ.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIUIE.exe.bat" "66⤵PID:4828
-
C:\windows\WIUIE.exeC:\windows\WIUIE.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QACTN.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3748 -
C:\windows\QACTN.exeC:\windows\QACTN.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGOAY.exe.bat" "70⤵PID:2500
-
C:\windows\SysWOW64\YGOAY.exeC:\windows\system32\YGOAY.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJMVYF.exe.bat" "72⤵
- Executes a command shell one-liner
PID:4576 -
C:\windows\CJMVYF.exeC:\windows\CJMVYF.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGGYTK.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2740 -
C:\windows\AGGYTK.exeC:\windows\AGGYTK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEGKV.exe.bat" "76⤵PID:4196
-
C:\windows\OEGKV.exeC:\windows\OEGKV.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JPO.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2644 -
C:\windows\JPO.exeC:\windows\JPO.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WNWMLS.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2072 -
C:\windows\system\WNWMLS.exeC:\windows\system\WNWMLS.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQAQQ.exe.bat" "82⤵PID:3216
-
C:\windows\PQAQQ.exeC:\windows\PQAQQ.exe83⤵
- Executes dropped EXE
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYGND.exe.bat" "84⤵PID:5144
-
C:\windows\GYGND.exeC:\windows\GYGND.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJX.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2516 -
C:\windows\CJX.exeC:\windows\CJX.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEBHWSV.exe.bat" "88⤵PID:2180
-
C:\windows\UEBHWSV.exeC:\windows\UEBHWSV.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUC.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3272 -
C:\windows\SysWOW64\KUC.exeC:\windows\system32\KUC.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFK.exe.bat" "92⤵
- Executes a command shell one-liner
PID:6136 -
C:\windows\SysWOW64\XFK.exeC:\windows\system32\XFK.exe93⤵
- Executes dropped EXE
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIWBX.exe.bat" "94⤵PID:5700
-
C:\windows\SysWOW64\XIWBX.exeC:\windows\system32\XIWBX.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYXA.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3824 -
C:\windows\SysWOW64\FYXA.exeC:\windows\system32\FYXA.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDB.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1376 -
C:\windows\NDB.exeC:\windows\NDB.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOSGCL.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4480 -
C:\windows\IOSGCL.exeC:\windows\IOSGCL.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUWMNJ.exe.bat" "102⤵PID:2164
-
C:\windows\system\QUWMNJ.exeC:\windows\system\QUWMNJ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRKHU.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5792 -
C:\windows\SysWOW64\SRKHU.exeC:\windows\system32\SRKHU.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUOCAQI.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3172 -
C:\windows\TUOCAQI.exeC:\windows\TUOCAQI.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSUXPQJ.exe.bat" "108⤵
- Executes a command shell one-liner
PID:864 -
C:\windows\system\VSUXPQJ.exeC:\windows\system\VSUXPQJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAAX.exe.bat" "110⤵PID:4500
-
C:\windows\HAAX.exeC:\windows\HAAX.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QICCF.exe.bat" "112⤵PID:3580
-
C:\windows\SysWOW64\QICCF.exeC:\windows\system32\QICCF.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZDB.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5960 -
C:\windows\FZDB.exeC:\windows\FZDB.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMUD.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5640 -
C:\windows\system\IMUD.exeC:\windows\system\IMUD.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZUJIK.exe.bat" "118⤵PID:2520
-
C:\windows\SysWOW64\ZUJIK.exeC:\windows\system32\ZUJIK.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LNMBST.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:1272 -
C:\windows\SysWOW64\LNMBST.exeC:\windows\system32\LNMBST.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-