Analysis
- max time kernel
91s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe
- Size 208KB
- Sample260809-wp49vsbl9t
- SHA256 7b4914390c16b0e0abcc2279e74badf3e7cf0d5761c8f1fb1381dbd028c2c8db
- MD5 e778cba568f8e78337c0e35a0d41b176
- SHA1 81a442ba795a5ffb9ec3e63217a16b20ab1f87bb
- SHA512 8331ec34711cc64b8be49223b8c95bb8bdd876ddcc69f18d53dfeea397d1c37dc65d13a0b93a587eb99663ce83a7bbd1b5294a01bd1d8f7fe252900a904ce7a4
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfh4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOJkEj1
- TLSH T1CA247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1068 UXAQMI.exe 4964 IVMU.exe 2740 SOETJ.exe 6032 CLJOR.exe 3388 LULTCN.exe 760 RUT.exe 2776 ZALV.exe 248 DQADZNZ.exe 4652 YDF.exe 4656 SQBWL.exe 4144 YQJJCPE.exe 4832 CYYJH.exe 3140 RPZ.exe 5612 MKDSY.exe 1312 VKXXBA.exe 3240 BKFL.exe 5392 FAUTWM.exe 5936 GWXPK.exe 848 QTDJRLN.exe 1956 UJKJD.exe 5160 SXJ.exe 4548 SANO.exe 5508 IVWSZJB.exe 3060 XLFRFE.exe 6120 MOPW.exe 4128 MTHK.exe 428 BOYWLRC.exe 4996 BUQ.exe 828 FKXLY.exe 5116 XKZQCTV.exe 5384 DLHE.exe 4164 XGLNVV.exe 5060 STQXFVZ.exe 992 MHVO.exe 3264 WEBA.exe 1136 EUCAE.exe 5456 YIGJGRI.exe 2872 FFAMB.exe 5924 DTZ.exe 3372 XOEWI.exe 3244 SBBGSZJ.exe 4528 HWSKD.exe 5504 TPNDMB.exe 1580 CNB.exe 1628 DSTM.exe 2268 MQG.exe 2388 HDLPU.exe 2032 CZQZEEP.exe 4468 IZQM.exe 244 TSTFWG.exe 6124 EKWYWVV.exe 1260 ZXAH.exe 3596 FYIV.exe 1876 QQDOY.exe 1972 FLV.exe 2360 OUPX.exe 4852 UUWLDR.exe 5496 AHVU.exe 5136 NSMLOXQ.exe 4712 TSTYF.exe 5752 OGYIPZ.exe 5636 DWZ.exe 1692 POUA.exe 2636 JCZJGB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\IVMU.exe UXAQMI.exe File opened for modification C:\windows\SysWOW64\BDC.exe VDVVYU.exe File opened for modification C:\windows\SysWOW64\NSIJZ.exe TFD.exe File created C:\windows\SysWOW64\JBXGGO.exe LBQT.exe File opened for modification C:\windows\SysWOW64\HDLPU.exe MQG.exe File created C:\windows\SysWOW64\AOLA.exe FBH.exe File created C:\windows\SysWOW64\XJPDKU.exe.bat TBJ.exe File created C:\windows\SysWOW64\IUBP.exe ZHRXIJ.exe File opened for modification C:\windows\SysWOW64\YFIO.exe JCZJGB.exe File created C:\windows\SysWOW64\NSIJZ.exe.bat TFD.exe File created C:\windows\SysWOW64\HDLPU.exe MQG.exe File created C:\windows\SysWOW64\YFIO.exe JCZJGB.exe File opened for modification C:\windows\SysWOW64\ZALV.exe RUT.exe File created C:\windows\SysWOW64\EUCAE.exe.bat WEBA.exe File created C:\windows\SysWOW64\OQSQD.exe.bat IUBP.exe File created C:\windows\SysWOW64\VJAIHTM.exe MIYCEO.exe File opened for modification C:\windows\SysWOW64\APXISV.exe LMN.exe File opened for modification C:\windows\SysWOW64\IUBP.exe ZHRXIJ.exe File created C:\windows\SysWOW64\MIYCEO.exe RYPEPL.exe File created C:\windows\SysWOW64\MOPW.exe.bat XLFRFE.exe File opened for modification C:\windows\SysWOW64\EUCAE.exe WEBA.exe File opened for modification C:\windows\SysWOW64\JBXGGO.exe LBQT.exe File created C:\windows\SysWOW64\STQXFVZ.exe XGLNVV.exe File created C:\windows\SysWOW64\GWXPK.exe FAUTWM.exe File opened for modification C:\windows\SysWOW64\FYIV.exe ZXAH.exe File created C:\windows\SysWOW64\YOEMNCZ.exe MYXM.exe File created C:\windows\SysWOW64\IVMU.exe.bat UXAQMI.exe File created C:\windows\SysWOW64\FYIV.exe ZXAH.exe File created C:\windows\SysWOW64\KKACQ.exe.bat EKSP.exe File opened for modification C:\windows\SysWOW64\VJAIHTM.exe MIYCEO.exe File opened for modification C:\windows\SysWOW64\GWXPK.exe FAUTWM.exe File created C:\windows\SysWOW64\CZQZEEP.exe.bat HDLPU.exe File created C:\windows\SysWOW64\IZQM.exe.bat CZQZEEP.exe File created C:\windows\SysWOW64\NSIJZ.exe TFD.exe File opened for modification C:\windows\SysWOW64\YOEMNCZ.exe MYXM.exe File created C:\windows\SysWOW64\BTJPR.exe.bat OQSQD.exe File created C:\windows\SysWOW64\MTHK.exe.bat MOPW.exe File opened for modification C:\windows\SysWOW64\AOLA.exe FBH.exe File created C:\windows\SysWOW64\EKMVD.exe NRJFVU.exe File created C:\windows\SysWOW64\MQRV.exe XVIRMF.exe File created C:\windows\SysWOW64\MQRV.exe.bat XVIRMF.exe File created C:\windows\SysWOW64\TBJ.exe YOEMNCZ.exe File opened for modification C:\windows\SysWOW64\TBJ.exe YOEMNCZ.exe File created C:\windows\SysWOW64\MOPW.exe XLFRFE.exe File created C:\windows\SysWOW64\RUT.exe.bat LULTCN.exe File created C:\windows\SysWOW64\HDLPU.exe.bat MQG.exe File created C:\windows\SysWOW64\DSTM.exe CNB.exe File created C:\windows\SysWOW64\IZQM.exe CZQZEEP.exe File created C:\windows\SysWOW64\STQXFVZ.exe.bat XGLNVV.exe File created C:\windows\SysWOW64\EUCAE.exe WEBA.exe File created C:\windows\SysWOW64\BTJPR.exe OQSQD.exe File opened for modification C:\windows\SysWOW64\MIYCEO.exe RYPEPL.exe File opened for modification C:\windows\SysWOW64\MTHK.exe MOPW.exe File created C:\windows\SysWOW64\GWXPK.exe.bat FAUTWM.exe File created C:\windows\SysWOW64\EKMVD.exe.bat NRJFVU.exe File created C:\windows\SysWOW64\UJKJD.exe QTDJRLN.exe File opened for modification C:\windows\SysWOW64\CZQZEEP.exe HDLPU.exe File opened for modification C:\windows\SysWOW64\MQRV.exe XVIRMF.exe File opened for modification C:\windows\SysWOW64\LBQT.exe MQRV.exe File created C:\windows\SysWOW64\MTHK.exe MOPW.exe File opened for modification C:\windows\SysWOW64\STQXFVZ.exe XGLNVV.exe File created C:\windows\SysWOW64\MYXM.exe UDTIWTC.exe File opened for modification C:\windows\SysWOW64\MOPW.exe XLFRFE.exe File opened for modification C:\windows\SysWOW64\HWSKD.exe SBBGSZJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SXJ.exe UJKJD.exe File created C:\windows\BOYWLRC.exe.bat MTHK.exe File opened for modification C:\windows\GKHZA.exe VREG.exe File opened for modification C:\windows\system\RPZ.exe CYYJH.exe File opened for modification C:\windows\SANO.exe SXJ.exe File created C:\windows\system\POUA.exe DWZ.exe File opened for modification C:\windows\CNB.exe TPNDMB.exe File created C:\windows\MWFC.exe.bat BDC.exe File created C:\windows\system\RPZ.exe CYYJH.exe File created C:\windows\XGLNVV.exe.bat DLHE.exe File opened for modification C:\windows\UUWLDR.exe OUPX.exe File created C:\windows\AHVU.exe.bat UUWLDR.exe File opened for modification C:\windows\VREG.exe JBXGGO.exe File created C:\windows\GKHZA.exe VREG.exe File created C:\windows\UUWLDR.exe.bat OUPX.exe File opened for modification C:\windows\system\WEBA.exe MHVO.exe File created C:\windows\TSTFWG.exe.bat IZQM.exe File opened for modification C:\windows\system\EKWYWVV.exe TSTFWG.exe File created C:\windows\ZXAH.exe.bat EKWYWVV.exe File created C:\windows\NSMLOXQ.exe AHVU.exe File created C:\windows\FAUTWM.exe.bat BKFL.exe File created C:\windows\BUQ.exe.bat BOYWLRC.exe File opened for modification C:\windows\XGLNVV.exe DLHE.exe File created C:\windows\system\PGVJK.exe.bat CWMTWJS.exe File created C:\windows\system\YIGJGRI.exe.bat EUCAE.exe File created C:\windows\system\XOEWI.exe DTZ.exe File created C:\windows\QFFSJUZ.exe.bat NSIJZ.exe File created C:\windows\system\CLJOR.exe.bat SOETJ.exe File created C:\windows\system\POUA.exe.bat DWZ.exe File created C:\windows\system\YQJJCPE.exe.bat SQBWL.exe File created C:\windows\system\IVWSZJB.exe.bat SANO.exe File created C:\windows\system\FFAMB.exe YIGJGRI.exe File opened for modification C:\windows\system\TXNLDB.exe TSNXC.exe File created C:\windows\system\VDVVYU.exe.bat KKACQ.exe File created C:\windows\system\VCQJVN.exe AOLA.exe File opened for modification C:\windows\LULTCN.exe CLJOR.exe File created C:\windows\system\WEBA.exe MHVO.exe File opened for modification C:\windows\system\XOEWI.exe DTZ.exe File created C:\windows\FLV.exe QQDOY.exe File opened for modification C:\windows\system\LMN.exe CMLZWD.exe File opened for modification C:\windows\XKZQCTV.exe FKXLY.exe File created C:\windows\system\UXAQMI.exe.bat 2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe File created C:\windows\system\SQBWL.exe.bat YDF.exe File created C:\windows\system\CYYJH.exe YQJJCPE.exe File created C:\windows\system\XLFRFE.exe.bat IVWSZJB.exe File created C:\windows\OAETG.exe.bat QFFSJUZ.exe File created C:\windows\RCCSBV.exe.bat GKHZA.exe File opened for modification C:\windows\DWZ.exe OGYIPZ.exe File created C:\windows\system\TXNLDB.exe TSNXC.exe File created C:\windows\system\YDF.exe DQADZNZ.exe File created C:\windows\SANO.exe SXJ.exe File created C:\windows\UUWLDR.exe OUPX.exe File opened for modification C:\windows\AHVU.exe UUWLDR.exe File created C:\windows\system\SQBWL.exe YDF.exe File created C:\windows\system\RPZ.exe.bat CYYJH.exe File created C:\windows\system\VDVVYU.exe KKACQ.exe File opened for modification C:\windows\JOJLQX.exe OAETG.exe File created C:\windows\XVIRMF.exe CHDH.exe File created C:\windows\system\OUPX.exe.bat FLV.exe File created C:\windows\system\EKSP.exe VCQJVN.exe File created C:\windows\system\PGVJK.exe CWMTWJS.exe File opened for modification C:\windows\SXJ.exe UJKJD.exe File created C:\windows\system\DQADZNZ.exe.bat ZALV.exe File opened for modification C:\windows\system\SQBWL.exe YDF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3208 cmd.exe 5252 cmd.exe 6052 cmd.exe 4860 cmd.exe 5100 cmd.exe 4804 cmd.exe 5180 cmd.exe 2768 cmd.exe 2288 cmd.exe 5148 cmd.exe 5372 cmd.exe 1772 cmd.exe 3924 cmd.exe 3224 cmd.exe 2584 cmd.exe 2996 cmd.exe 1964 cmd.exe 5952 cmd.exe 3468 cmd.exe 4640 cmd.exe 2900 cmd.exe 4404 cmd.exe 5336 cmd.exe 5808 cmd.exe 2244 cmd.exe 4340 cmd.exe 4428 cmd.exe 3444 cmd.exe 1632 cmd.exe 5712 cmd.exe 6108 cmd.exe 5256 cmd.exe 4516 cmd.exe 3568 cmd.exe 2520 cmd.exe 4980 cmd.exe 4540 cmd.exe 2856 cmd.exe 3788 cmd.exe 2596 cmd.exe 1304 cmd.exe 6136 cmd.exe 3588 cmd.exe 3436 cmd.exe 4748 cmd.exe 4440 cmd.exe 4332 cmd.exe 4112 cmd.exe 5356 cmd.exe 2216 cmd.exe 2984 cmd.exe 3820 cmd.exe 2488 cmd.exe 5260 cmd.exe 4452 cmd.exe 616 cmd.exe 3276 cmd.exe 5176 cmd.exe 4344 cmd.exe 1912 cmd.exe 3036 cmd.exe 688 cmd.exe 1856 cmd.exe 5564 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1396 1372 WerFault.exe 87 4632 1068 WerFault.exe 93 5428 4964 WerFault.exe 99 5004 2740 WerFault.exe 104 2756 6032 WerFault.exe 109 3020 3388 WerFault.exe 114 1304 760 WerFault.exe 119 5176 2776 WerFault.exe 124 2208 248 WerFault.exe 129 5796 4652 WerFault.exe 134 2572 4656 WerFault.exe 139 2432 4144 WerFault.exe 144 4800 4832 WerFault.exe 149 2044 3140 WerFault.exe 154 1028 5612 WerFault.exe 159 1996 1312 WerFault.exe 164 4464 3240 WerFault.exe 169 2404 5392 WerFault.exe 174 2316 5936 WerFault.exe 179 3076 848 WerFault.exe 184 1332 1956 WerFault.exe 189 4336 5160 WerFault.exe 194 3412 4548 WerFault.exe 199 6016 5508 WerFault.exe 204 2564 3060 WerFault.exe 209 6080 6120 WerFault.exe 214 1096 4128 WerFault.exe 219 5748 428 WerFault.exe 224 2748 4996 WerFault.exe 229 5136 828 WerFault.exe 234 5276 5116 WerFault.exe 239 260 5384 WerFault.exe 244 4796 4164 WerFault.exe 249 3168 5060 WerFault.exe 254 4676 992 WerFault.exe 259 5108 3264 WerFault.exe 264 3968 1136 WerFault.exe 269 2052 5456 WerFault.exe 274 4252 2872 WerFault.exe 279 2156 5924 WerFault.exe 284 1240 3372 WerFault.exe 289 6100 3244 WerFault.exe 294 5844 4528 WerFault.exe 299 1000 5504 WerFault.exe 304 4136 1580 WerFault.exe 309 1044 1628 WerFault.exe 314 5532 2268 WerFault.exe 319 5748 2388 WerFault.exe 324 4400 2032 WerFault.exe 329 5356 4468 WerFault.exe 334 4476 244 WerFault.exe 339 4588 6124 WerFault.exe 344 2104 1260 WerFault.exe 349 1132 3596 WerFault.exe 354 3064 1876 WerFault.exe 359 2016 1972 WerFault.exe 364 5816 2360 WerFault.exe 369 5956 4852 WerFault.exe 374 2748 5496 WerFault.exe 379 704 5136 WerFault.exe 384 5848 4712 WerFault.exe 389 4556 5752 WerFault.exe 394 2108 5636 WerFault.exe 399 3932 1692 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHOMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKWYWVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLFRFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VREG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SBBGSZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKACQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKDSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCCSBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUCAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEKJDA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJAIHTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UUWLDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGLNVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKHZA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APXISV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XJPDKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDTIWTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKZQCTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWXPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JOJLQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPNDMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RYPEPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDLPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMDL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1372 2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe 1372 2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe 1068 UXAQMI.exe 1068 UXAQMI.exe 4964 IVMU.exe 4964 IVMU.exe 2740 SOETJ.exe 2740 SOETJ.exe 6032 CLJOR.exe 6032 CLJOR.exe 3388 LULTCN.exe 3388 LULTCN.exe 760 RUT.exe 760 RUT.exe 2776 ZALV.exe 2776 ZALV.exe 248 DQADZNZ.exe 248 DQADZNZ.exe 4652 YDF.exe 4652 YDF.exe 4656 SQBWL.exe 4656 SQBWL.exe 4144 YQJJCPE.exe 4144 YQJJCPE.exe 4832 CYYJH.exe 4832 CYYJH.exe 3140 RPZ.exe 3140 RPZ.exe 5612 MKDSY.exe 5612 MKDSY.exe 1312 VKXXBA.exe 1312 VKXXBA.exe 3240 BKFL.exe 3240 BKFL.exe 5392 FAUTWM.exe 5392 FAUTWM.exe 5936 GWXPK.exe 5936 GWXPK.exe 848 QTDJRLN.exe 848 QTDJRLN.exe 1956 UJKJD.exe 1956 UJKJD.exe 5160 SXJ.exe 5160 SXJ.exe 4548 SANO.exe 4548 SANO.exe 5508 IVWSZJB.exe 5508 IVWSZJB.exe 3060 XLFRFE.exe 3060 XLFRFE.exe 6120 MOPW.exe 6120 MOPW.exe 4128 MTHK.exe 4128 MTHK.exe 428 BOYWLRC.exe 428 BOYWLRC.exe 4996 BUQ.exe 4996 BUQ.exe 828 FKXLY.exe 828 FKXLY.exe 5116 XKZQCTV.exe 5116 XKZQCTV.exe 5384 DLHE.exe 5384 DLHE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1372 2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe 1372 2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe 1068 UXAQMI.exe 1068 UXAQMI.exe 4964 IVMU.exe 4964 IVMU.exe 2740 SOETJ.exe 2740 SOETJ.exe 6032 CLJOR.exe 6032 CLJOR.exe 3388 LULTCN.exe 3388 LULTCN.exe 760 RUT.exe 760 RUT.exe 2776 ZALV.exe 2776 ZALV.exe 248 DQADZNZ.exe 248 DQADZNZ.exe 4652 YDF.exe 4652 YDF.exe 4656 SQBWL.exe 4656 SQBWL.exe 4144 YQJJCPE.exe 4144 YQJJCPE.exe 4832 CYYJH.exe 4832 CYYJH.exe 3140 RPZ.exe 3140 RPZ.exe 5612 MKDSY.exe 5612 MKDSY.exe 1312 VKXXBA.exe 1312 VKXXBA.exe 3240 BKFL.exe 3240 BKFL.exe 5392 FAUTWM.exe 5392 FAUTWM.exe 5936 GWXPK.exe 5936 GWXPK.exe 848 QTDJRLN.exe 848 QTDJRLN.exe 1956 UJKJD.exe 1956 UJKJD.exe 5160 SXJ.exe 5160 SXJ.exe 4548 SANO.exe 4548 SANO.exe 5508 IVWSZJB.exe 5508 IVWSZJB.exe 3060 XLFRFE.exe 3060 XLFRFE.exe 6120 MOPW.exe 6120 MOPW.exe 4128 MTHK.exe 4128 MTHK.exe 428 BOYWLRC.exe 428 BOYWLRC.exe 4996 BUQ.exe 4996 BUQ.exe 828 FKXLY.exe 828 FKXLY.exe 5116 XKZQCTV.exe 5116 XKZQCTV.exe 5384 DLHE.exe 5384 DLHE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1372 wrote to memory of 1684 1372 2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe 89 PID 1684 wrote to memory of 1068 1684 cmd.exe 93 PID 1068 wrote to memory of 4404 1068 UXAQMI.exe 95 PID 4404 wrote to memory of 4964 4404 cmd.exe 99 PID 4964 wrote to memory of 616 4964 IVMU.exe 100 PID 616 wrote to memory of 2740 616 cmd.exe 104 PID 2740 wrote to memory of 3900 2740 SOETJ.exe 105 PID 3900 wrote to memory of 6032 3900 cmd.exe 109 PID 6032 wrote to memory of 4768 6032 CLJOR.exe 110 PID 4768 wrote to memory of 3388 4768 cmd.exe 114 PID 3388 wrote to memory of 5952 3388 LULTCN.exe 115 PID 5952 wrote to memory of 760 5952 cmd.exe 119 PID 760 wrote to memory of 6092 760 RUT.exe 120 PID 6092 wrote to memory of 2776 6092 cmd.exe 124 PID 2776 wrote to memory of 3924 2776 ZALV.exe 125 PID 3924 wrote to memory of 248 3924 cmd.exe 129 PID 248 wrote to memory of 5124 248 DQADZNZ.exe 130 PID 5124 wrote to memory of 4652 5124 cmd.exe 134 PID 4652 wrote to memory of 2680 4652 YDF.exe 135 PID 2680 wrote to memory of 4656 2680 cmd.exe 139 PID 4656 wrote to memory of 4948 4656 SQBWL.exe 140 PID 4948 wrote to memory of 4144 4948 cmd.exe 144 PID 4144 wrote to memory of 1060 4144 YQJJCPE.exe 145 PID 1060 wrote to memory of 4832 1060 cmd.exe 149 PID 4832 wrote to memory of 5336 4832 CYYJH.exe 150 PID 5336 wrote to memory of 3140 5336 cmd.exe 154 PID 3140 wrote to memory of 1856 3140 RPZ.exe 155 PID 1856 wrote to memory of 5612 1856 cmd.exe 159 PID 5612 wrote to memory of 3276 5612 MKDSY.exe 160 PID 3276 wrote to memory of 1312 3276 cmd.exe 164 PID 1312 wrote to memory of 3784 1312 VKXXBA.exe 165 PID 3784 wrote to memory of 3240 3784 cmd.exe 169 PID 3240 wrote to memory of 3724 3240 BKFL.exe 170 PID 3724 wrote to memory of 5392 3724 cmd.exe 174 PID 5392 wrote to memory of 6068 5392 FAUTWM.exe 175 PID 6068 wrote to memory of 5936 6068 cmd.exe 179 PID 5936 wrote to memory of 3436 5936 GWXPK.exe 180 PID 3436 wrote to memory of 848 3436 cmd.exe 184 PID 848 wrote to memory of 4980 848 QTDJRLN.exe 185 PID 4980 wrote to memory of 1956 4980 cmd.exe 189 PID 1956 wrote to memory of 1448 1956 UJKJD.exe 190 PID 1448 wrote to memory of 5160 1448 cmd.exe 194 PID 5160 wrote to memory of 3700 5160 SXJ.exe 195 PID 3700 wrote to memory of 4548 3700 cmd.exe 199 PID 4548 wrote to memory of 5712 4548 SANO.exe 200 PID 5712 wrote to memory of 5508 5712 cmd.exe 204 PID 5508 wrote to memory of 1660 5508 IVWSZJB.exe 205 PID 1660 wrote to memory of 3060 1660 cmd.exe 209 PID 3060 wrote to memory of 3472 3060 XLFRFE.exe 210 PID 3472 wrote to memory of 6120 3472 cmd.exe 214 PID 6120 wrote to memory of 2708 6120 MOPW.exe 215 PID 2708 wrote to memory of 4128 2708 cmd.exe 219 PID 4128 wrote to memory of 2216 4128 MTHK.exe 220 PID 2216 wrote to memory of 428 2216 cmd.exe 224 PID 428 wrote to memory of 3476 428 BOYWLRC.exe 225 PID 3476 wrote to memory of 4996 3476 cmd.exe 229 PID 4996 wrote to memory of 4764 4996 BUQ.exe 230 PID 4764 wrote to memory of 828 4764 cmd.exe 234 PID 828 wrote to memory of 5176 828 FKXLY.exe 235 PID 5176 wrote to memory of 5116 5176 cmd.exe 239 PID 5116 wrote to memory of 2828 5116 XKZQCTV.exe 240 PID 2828 wrote to memory of 5384 2828 cmd.exe 244 PID 5384 wrote to memory of 2764 5384 DLHE.exe 245 PID 2764 wrote to memory of 4164 2764 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e778cba568f8e78337c0e35a0d41b176_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXAQMI.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\windows\system\UXAQMI.exeC:\windows\system\UXAQMI.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVMU.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\SysWOW64\IVMU.exeC:\windows\system32\IVMU.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOETJ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:616 -
C:\windows\SOETJ.exeC:\windows\SOETJ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLJOR.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\windows\system\CLJOR.exeC:\windows\system\CLJOR.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LULTCN.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\LULTCN.exeC:\windows\LULTCN.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUT.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\SysWOW64\RUT.exeC:\windows\system32\RUT.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZALV.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\windows\SysWOW64\ZALV.exeC:\windows\system32\ZALV.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQADZNZ.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\windows\system\DQADZNZ.exeC:\windows\system\DQADZNZ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDF.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\windows\system\YDF.exeC:\windows\system\YDF.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQBWL.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\windows\system\SQBWL.exeC:\windows\system\SQBWL.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQJJCPE.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\windows\system\YQJJCPE.exeC:\windows\system\YQJJCPE.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYYJH.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\system\CYYJH.exeC:\windows\system\CYYJH.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPZ.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\windows\system\RPZ.exeC:\windows\system\RPZ.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKDSY.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\windows\MKDSY.exeC:\windows\MKDSY.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VKXXBA.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\windows\SysWOW64\VKXXBA.exeC:\windows\system32\VKXXBA.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKFL.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\windows\BKFL.exeC:\windows\BKFL.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWXPK.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\SysWOW64\GWXPK.exeC:\windows\system32\GWXPK.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTDJRLN.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\system\QTDJRLN.exeC:\windows\system\QTDJRLN.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UJKJD.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\SysWOW64\UJKJD.exeC:\windows\system32\UJKJD.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXJ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\windows\SXJ.exeC:\windows\SXJ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SANO.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\SANO.exeC:\windows\SANO.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVWSZJB.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\windows\system\IVWSZJB.exeC:\windows\system\IVWSZJB.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XLFRFE.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\windows\system\XLFRFE.exeC:\windows\system\XLFRFE.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOPW.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\SysWOW64\MOPW.exeC:\windows\system32\MOPW.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTHK.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\windows\SysWOW64\MTHK.exeC:\windows\system32\MTHK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOYWLRC.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\windows\BOYWLRC.exeC:\windows\BOYWLRC.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BUQ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\BUQ.exeC:\windows\BUQ.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKXLY.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\windows\system\FKXLY.exeC:\windows\system\FKXLY.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XKZQCTV.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\XKZQCTV.exeC:\windows\XKZQCTV.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLHE.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\system\DLHE.exeC:\windows\system\DLHE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGLNVV.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\windows\XGLNVV.exeC:\windows\XGLNVV.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STQXFVZ.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3224 -
C:\windows\SysWOW64\STQXFVZ.exeC:\windows\system32\STQXFVZ.exe67⤵
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHVO.exe.bat" "68⤵PID:1396
-
C:\windows\MHVO.exeC:\windows\MHVO.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEBA.exe.bat" "70⤵PID:1864
-
C:\windows\system\WEBA.exeC:\windows\system\WEBA.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EUCAE.exe.bat" "72⤵PID:1992
-
C:\windows\SysWOW64\EUCAE.exeC:\windows\system32\EUCAE.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YIGJGRI.exe.bat" "74⤵PID:2484
-
C:\windows\system\YIGJGRI.exeC:\windows\system\YIGJGRI.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFAMB.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4748 -
C:\windows\system\FFAMB.exeC:\windows\system\FFAMB.exe77⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTZ.exe.bat" "78⤵PID:1704
-
C:\windows\DTZ.exeC:\windows\DTZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOEWI.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3468 -
C:\windows\system\XOEWI.exeC:\windows\system\XOEWI.exe81⤵
- Executes dropped EXE
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SBBGSZJ.exe.bat" "82⤵PID:3076
-
C:\windows\SBBGSZJ.exeC:\windows\SBBGSZJ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWSKD.exe.bat" "84⤵PID:3132
-
C:\windows\SysWOW64\HWSKD.exeC:\windows\system32\HWSKD.exe85⤵
- Executes dropped EXE
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TPNDMB.exe.bat" "86⤵PID:1708
-
C:\windows\TPNDMB.exeC:\windows\TPNDMB.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNB.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4344 -
C:\windows\CNB.exeC:\windows\CNB.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DSTM.exe.bat" "90⤵PID:1984
-
C:\windows\SysWOW64\DSTM.exeC:\windows\system32\DSTM.exe91⤵
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MQG.exe.bat" "92⤵PID:4900
-
C:\windows\system\MQG.exeC:\windows\system\MQG.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HDLPU.exe.bat" "94⤵PID:5020
-
C:\windows\SysWOW64\HDLPU.exeC:\windows\system32\HDLPU.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CZQZEEP.exe.bat" "96⤵PID:1868
-
C:\windows\SysWOW64\CZQZEEP.exeC:\windows\system32\CZQZEEP.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZQM.exe.bat" "98⤵PID:8
-
C:\windows\SysWOW64\IZQM.exeC:\windows\system32\IZQM.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSTFWG.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4540 -
C:\windows\TSTFWG.exeC:\windows\TSTFWG.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EKWYWVV.exe.bat" "102⤵PID:5092
-
C:\windows\system\EKWYWVV.exeC:\windows\system\EKWYWVV.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXAH.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2584 -
C:\windows\ZXAH.exeC:\windows\ZXAH.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYIV.exe.bat" "106⤵PID:4632
-
C:\windows\SysWOW64\FYIV.exeC:\windows\system32\FYIV.exe107⤵
- Executes dropped EXE
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QQDOY.exe.bat" "108⤵PID:4356
-
C:\windows\system\QQDOY.exeC:\windows\system\QQDOY.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLV.exe.bat" "110⤵PID:3412
-
C:\windows\FLV.exeC:\windows\FLV.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUPX.exe.bat" "112⤵PID:1244
-
C:\windows\system\OUPX.exeC:\windows\system\OUPX.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUWLDR.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5916 -
C:\windows\UUWLDR.exeC:\windows\UUWLDR.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AHVU.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4640 -
C:\windows\AHVU.exeC:\windows\AHVU.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NSMLOXQ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2672 -
C:\windows\NSMLOXQ.exeC:\windows\NSMLOXQ.exe119⤵
- Executes dropped EXE
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSTYF.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5252 -
C:\windows\TSTYF.exeC:\windows\TSTYF.exe121⤵
- Executes dropped EXE
PID:4712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-