Analysis
- max time kernel
84s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe
- Size 208KB
- Sample260809-xdvfysbh87
- SHA256 7a64fca33b3f44ffab06d5e263262c7673e8b4a0def7b7be692094e6bc96e7c5
- MD5 294cd3e081c37a90c75a502d276a8900
- SHA1 e48832600891a4cd58e60fd05ad58ff3bbac6da5
- SHA512 bc56002059a21058adb97e6d0b6ea45664d92438b23ca5e2a34c6ce3a193f5f685f56d9a60fd9b367c1e0e1e0934da5fdb220bea955a95ea1eab5f2a35845726
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbZlUKL+LOfC4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbZlUS+LOKkEj1
- TLSH T152247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1712 NFRTXFV.exe 2616 UYGB.exe 4824 OLZZDAZ.exe 5000 MWCHEG.exe 1160 WFEUPLX.exe 1960 UUP.exe 1212 VXTTI.exe 3316 CNU.exe 1044 RILXZP.exe 3852 UWQ.exe 3416 UBI.exe 4448 TUTDUHS.exe 2608 RKFGPN.exe 2312 VNDB.exe 4712 KQMFA.exe 4852 OYTF.exe 4980 HBFJRB.exe 5740 PHJPCH.exe 1236 AZMIKOL.exe 4296 BCQE.exe 4264 KCSRTCP.exe 4860 WSZR.exe 1924 PWCVTK.exe 3920 GBNN.exe 4804 RTQYJ.exe 4624 DMLQ.exe 4832 MUN.exe 2536 DIX.exe 756 MIZBO.exe 1748 YACLWK.exe 5136 POND.exe 2732 JBSNO.exe 4532 AMILOB.exe 5624 EUP.exe 2584 ZPTCK.exe 2860 OKD.exe 2452 FLFL.exe 2052 AGKVJL.exe 1804 UTO.exe 3832 ETQR.exe 5872 YPVBHI.exe 2412 EPD.exe 2252 VPFU.exe 3384 LKOYMDE.exe 4092 LYP.exe 1332 NWUHDQQ.exe 244 CRELO.exe 5976 EEIDZLF.exe 3272 QXL.exe 2080 QCEC.exe 4668 OAXFVKF.exe 3404 ZTAX.exe 5684 LLVQE.exe 3184 RLCEVBD.exe 4392 RRD.exe 2508 WRK.exe 3228 RFPQQ.exe 2352 ANR.exe 2600 DAOEE.exe 5512 MNYWTC.exe 5848 DYXUTX.exe 896 UEHM.exe 5936 FWK.exe 4840 JMRFVTW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\DYXUTX.exe MNYWTC.exe File created C:\windows\SysWOW64\VEBG.exe.bat JLG.exe File created C:\windows\SysWOW64\BCQE.exe.bat AZMIKOL.exe File created C:\windows\SysWOW64\RFPQQ.exe.bat WRK.exe File opened for modification C:\windows\SysWOW64\PRGYDZ.exe VEBG.exe File created C:\windows\SysWOW64\GVTQRX.exe.bat MAOGO.exe File opened for modification C:\windows\SysWOW64\WSZR.exe KCSRTCP.exe File created C:\windows\SysWOW64\DYXUTX.exe MNYWTC.exe File opened for modification C:\windows\SysWOW64\CNU.exe VXTTI.exe File opened for modification C:\windows\SysWOW64\HBFJRB.exe OYTF.exe File created C:\windows\SysWOW64\ETQR.exe UTO.exe File created C:\windows\SysWOW64\MNYWTC.exe DAOEE.exe File created C:\windows\SysWOW64\PRGYDZ.exe VEBG.exe File opened for modification C:\windows\SysWOW64\MAOGO.exe MUOS.exe File created C:\windows\SysWOW64\CNU.exe.bat VXTTI.exe File opened for modification C:\windows\SysWOW64\UWQ.exe RILXZP.exe File opened for modification C:\windows\SysWOW64\KQMFA.exe VNDB.exe File opened for modification C:\windows\SysWOW64\OYTF.exe KQMFA.exe File created C:\windows\SysWOW64\AZMIKOL.exe.bat PHJPCH.exe File created C:\windows\SysWOW64\FLFL.exe OKD.exe File created C:\windows\SysWOW64\WRK.exe.bat RRD.exe File created C:\windows\SysWOW64\HBFJRB.exe.bat OYTF.exe File created C:\windows\SysWOW64\BCQE.exe AZMIKOL.exe File created C:\windows\SysWOW64\NWUHDQQ.exe LYP.exe File created C:\windows\SysWOW64\MNYWTC.exe.bat DAOEE.exe File opened for modification C:\windows\SysWOW64\UEHM.exe DYXUTX.exe File opened for modification C:\windows\SysWOW64\LBJG.exe WYA.exe File created C:\windows\SysWOW64\NFRTXFV.exe.bat 2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe File created C:\windows\SysWOW64\CNU.exe VXTTI.exe File created C:\windows\SysWOW64\HBFJRB.exe OYTF.exe File opened for modification C:\windows\SysWOW64\BCQE.exe AZMIKOL.exe File created C:\windows\SysWOW64\DYXUTX.exe.bat MNYWTC.exe File created C:\windows\SysWOW64\UEHM.exe.bat DYXUTX.exe File created C:\windows\SysWOW64\VYYJYP.exe GATMRF.exe File created C:\windows\SysWOW64\OIRMK.exe.bat IIK.exe File created C:\windows\SysWOW64\OYTF.exe KQMFA.exe File created C:\windows\SysWOW64\UTO.exe AGKVJL.exe File created C:\windows\SysWOW64\LBJG.exe WYA.exe File created C:\windows\SysWOW64\LBJG.exe.bat WYA.exe File created C:\windows\SysWOW64\UWQ.exe RILXZP.exe File created C:\windows\SysWOW64\OYTF.exe.bat KQMFA.exe File created C:\windows\SysWOW64\WSZR.exe.bat KCSRTCP.exe File created C:\windows\SysWOW64\FLFL.exe.bat OKD.exe File opened for modification C:\windows\SysWOW64\WRK.exe RRD.exe File opened for modification C:\windows\SysWOW64\RFPQQ.exe WRK.exe File created C:\windows\SysWOW64\PRGYDZ.exe.bat VEBG.exe File created C:\windows\SysWOW64\MXM.exe PRGYDZ.exe File created C:\windows\SysWOW64\TUTDUHS.exe.bat UBI.exe File created C:\windows\SysWOW64\ETQR.exe.bat UTO.exe File opened for modification C:\windows\SysWOW64\NWUHDQQ.exe LYP.exe File created C:\windows\SysWOW64\RFPQQ.exe WRK.exe File opened for modification C:\windows\SysWOW64\MNYWTC.exe DAOEE.exe File opened for modification C:\windows\SysWOW64\MXM.exe PRGYDZ.exe File created C:\windows\SysWOW64\MXM.exe.bat PRGYDZ.exe File created C:\windows\SysWOW64\MAOGO.exe.bat MUOS.exe File created C:\windows\SysWOW64\TUTDUHS.exe UBI.exe File created C:\windows\SysWOW64\WSZR.exe KCSRTCP.exe File opened for modification C:\windows\SysWOW64\GBNN.exe PWCVTK.exe File created C:\windows\SysWOW64\GBNN.exe.bat PWCVTK.exe File created C:\windows\SysWOW64\WRK.exe RRD.exe File opened for modification C:\windows\SysWOW64\GVTQRX.exe MAOGO.exe File created C:\windows\SysWOW64\OIRMK.exe IIK.exe File created C:\windows\SysWOW64\MAOGO.exe MUOS.exe File opened for modification C:\windows\SysWOW64\NFRTXFV.exe 2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\JBSNO.exe POND.exe File created C:\windows\system\UIZ.exe.bat OIRMK.exe File opened for modification C:\windows\VHBI.exe BLWZZEV.exe File opened for modification C:\windows\MWCHEG.exe OLZZDAZ.exe File created C:\windows\system\YACLWK.exe MIZBO.exe File created C:\windows\AMILOB.exe JBSNO.exe File created C:\windows\system\EPD.exe.bat YPVBHI.exe File created C:\windows\system\JSJ.exe.bat JMRFVTW.exe File created C:\windows\system\JBSNO.exe.bat POND.exe File created C:\windows\system\RLCEVBD.exe LLVQE.exe File created C:\windows\system\AORI.exe.bat BDGSEZ.exe File opened for modification C:\windows\system\UYGB.exe NFRTXFV.exe File created C:\windows\UUP.exe WFEUPLX.exe File created C:\windows\system\VXTTI.exe.bat UUP.exe File created C:\windows\system\YPVBHI.exe ETQR.exe File opened for modification C:\windows\FWK.exe UEHM.exe File created C:\windows\UCNSG.exe.bat VMBXLRM.exe File opened for modification C:\windows\BDGSEZ.exe AACP.exe File created C:\windows\LKOYMDE.exe.bat VPFU.exe File created C:\windows\system\SHICT.exe XLD.exe File opened for modification C:\windows\VGA.exe YAUBXYB.exe File opened for modification C:\windows\system\XXBE.exe XCXIF.exe File created C:\windows\VHBI.exe BLWZZEV.exe File opened for modification C:\windows\system\RTQYJ.exe GBNN.exe File created C:\windows\system\OBYWBW.exe GVTQRX.exe File opened for modification C:\windows\system\JSORES.exe UCNSG.exe File opened for modification C:\windows\system\LLVQE.exe ZTAX.exe File opened for modification C:\windows\system\IUVP.exe AORI.exe File created C:\windows\AGKVJL.exe FLFL.exe File created C:\windows\RRD.exe RLCEVBD.exe File created C:\windows\EWPJ.exe.bat OBYWBW.exe File opened for modification C:\windows\system\OLZZDAZ.exe UYGB.exe File created C:\windows\CRELO.exe.bat NWUHDQQ.exe File opened for modification C:\windows\system\OAXFVKF.exe QCEC.exe File opened for modification C:\windows\SANO.exe MENN.exe File created C:\windows\system\GUGE.exe XUEZS.exe File created C:\windows\MUN.exe.bat DMLQ.exe File created C:\windows\VGA.exe YAUBXYB.exe File opened for modification C:\windows\system\OBYWBW.exe GVTQRX.exe File opened for modification C:\windows\AQTVT.exe RDIDESX.exe File created C:\windows\POND.exe YACLWK.exe File created C:\windows\ZPTCK.exe.bat EUP.exe File opened for modification C:\windows\system\AORI.exe BDGSEZ.exe File created C:\windows\UUP.exe.bat WFEUPLX.exe File created C:\windows\system\UBI.exe UWQ.exe File created C:\windows\PHJPCH.exe.bat HBFJRB.exe File created C:\windows\system\OKD.exe ZPTCK.exe File created C:\windows\LYP.exe.bat LKOYMDE.exe File created C:\windows\MFODH.exe JSJ.exe File created C:\windows\ZVGYAV.exe XXBE.exe File created C:\windows\UCNSG.exe VMBXLRM.exe File opened for modification C:\windows\system\RLCEVBD.exe LLVQE.exe File opened for modification C:\windows\system\UIZ.exe OIRMK.exe File opened for modification C:\windows\system\GUGE.exe XUEZS.exe File created C:\windows\EWPJ.exe OBYWBW.exe File created C:\windows\ZVGYAV.exe.bat XXBE.exe File created C:\windows\BDGSEZ.exe AACP.exe File created C:\windows\WFEUPLX.exe.bat MWCHEG.exe File created C:\windows\QCEC.exe QXL.exe File created C:\windows\DZDVTW.exe SHICT.exe File created C:\windows\AACP.exe.bat JSORES.exe File created C:\windows\system\JCMRGA.exe ZEG.exe File created C:\windows\MIZBO.exe.bat DIX.exe File created C:\windows\system\EUP.exe.bat AMILOB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 480 cmd.exe 468 cmd.exe 2368 cmd.exe 2916 cmd.exe 1688 cmd.exe 5148 cmd.exe 4288 cmd.exe 5704 cmd.exe 932 cmd.exe 3768 cmd.exe 5172 cmd.exe 4592 cmd.exe 1600 cmd.exe 2292 cmd.exe 5564 cmd.exe 5724 cmd.exe 712 cmd.exe 4620 cmd.exe 2548 cmd.exe 5532 cmd.exe 3848 cmd.exe 3388 cmd.exe 5828 cmd.exe 4656 cmd.exe 5884 cmd.exe 4072 cmd.exe 3488 cmd.exe 5860 cmd.exe 5944 cmd.exe 4700 cmd.exe 5632 cmd.exe 2064 cmd.exe 2880 cmd.exe 3264 cmd.exe 5812 cmd.exe 1968 cmd.exe 5212 cmd.exe 4664 cmd.exe 3572 cmd.exe 4744 cmd.exe 5112 cmd.exe 3436 cmd.exe 1940 cmd.exe 3484 cmd.exe 4332 cmd.exe 2752 cmd.exe 4988 cmd.exe 2668 cmd.exe 5332 cmd.exe 6088 cmd.exe 5268 cmd.exe 3664 cmd.exe 3032 cmd.exe 3156 cmd.exe 2280 cmd.exe 1196 cmd.exe 2708 cmd.exe 5192 cmd.exe 5244 cmd.exe 5500 cmd.exe 5996 cmd.exe 4720 cmd.exe 4676 cmd.exe 3804 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3488 4416 WerFault.exe 87 2364 1712 WerFault.exe 93 5792 2616 WerFault.exe 99 3956 4824 WerFault.exe 104 1340 5000 WerFault.exe 109 4980 1160 WerFault.exe 114 4172 1960 WerFault.exe 119 5008 1212 WerFault.exe 124 5248 3316 WerFault.exe 129 4628 1044 WerFault.exe 134 5684 3852 WerFault.exe 139 1924 3416 WerFault.exe 144 1108 4448 WerFault.exe 149 1572 2608 WerFault.exe 154 5852 2312 WerFault.exe 159 4336 4712 WerFault.exe 164 3132 4852 WerFault.exe 169 5876 4980 WerFault.exe 174 972 5740 WerFault.exe 178 1296 1236 WerFault.exe 184 4628 4296 WerFault.exe 189 4756 4264 WerFault.exe 194 1048 4860 WerFault.exe 199 5532 1924 WerFault.exe 204 5668 3920 WerFault.exe 209 5852 4804 WerFault.exe 214 6104 4624 WerFault.exe 219 5708 4832 WerFault.exe 224 2816 2536 WerFault.exe 229 1364 756 WerFault.exe 234 4904 1748 WerFault.exe 239 4232 5136 WerFault.exe 244 3136 2732 WerFault.exe 249 4544 4532 WerFault.exe 254 2800 5624 WerFault.exe 259 4124 2584 WerFault.exe 264 1444 2860 WerFault.exe 269 2432 2452 WerFault.exe 274 1848 2052 WerFault.exe 280 3492 1804 WerFault.exe 285 4380 3832 WerFault.exe 290 5008 5872 WerFault.exe 295 936 2412 WerFault.exe 300 4840 2252 WerFault.exe 305 5736 3384 WerFault.exe 310 1716 4092 WerFault.exe 315 2900 1332 WerFault.exe 320 2016 244 WerFault.exe 325 4592 5976 WerFault.exe 330 1592 3272 WerFault.exe 335 1588 2080 WerFault.exe 340 1932 4668 WerFault.exe 345 2928 3404 WerFault.exe 350 4920 5684 WerFault.exe 355 4064 3184 WerFault.exe 360 3040 4392 WerFault.exe 365 5984 2508 WerFault.exe 370 2792 3228 WerFault.exe 375 4656 2352 WerFault.exe 380 4468 2600 WerFault.exe 385 1104 5512 WerFault.exe 390 2968 5848 WerFault.exe 395 1412 896 WerFault.exe 400 1596 5936 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWUHDQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OBYWBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AACP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFRTXFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZDVTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIRMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMBXLRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TUTDUHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OYTF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYGB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VYYJYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SANO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDGSEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNYWTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAUBXYB.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4416 2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe 4416 2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe 1712 NFRTXFV.exe 1712 NFRTXFV.exe 2616 UYGB.exe 2616 UYGB.exe 4824 OLZZDAZ.exe 4824 OLZZDAZ.exe 5000 MWCHEG.exe 5000 MWCHEG.exe 1160 WFEUPLX.exe 1160 WFEUPLX.exe 1960 UUP.exe 1960 UUP.exe 1212 VXTTI.exe 1212 VXTTI.exe 3316 CNU.exe 3316 CNU.exe 1044 RILXZP.exe 1044 RILXZP.exe 3852 UWQ.exe 3852 UWQ.exe 3416 UBI.exe 3416 UBI.exe 4448 TUTDUHS.exe 4448 TUTDUHS.exe 2608 RKFGPN.exe 2608 RKFGPN.exe 2312 VNDB.exe 2312 VNDB.exe 4712 KQMFA.exe 4712 KQMFA.exe 4852 OYTF.exe 4852 OYTF.exe 4980 HBFJRB.exe 4980 HBFJRB.exe 5740 PHJPCH.exe 5740 PHJPCH.exe 1236 AZMIKOL.exe 1236 AZMIKOL.exe 4296 BCQE.exe 4296 BCQE.exe 4264 KCSRTCP.exe 4264 KCSRTCP.exe 4860 WSZR.exe 4860 WSZR.exe 1924 PWCVTK.exe 1924 PWCVTK.exe 3920 GBNN.exe 3920 GBNN.exe 4804 RTQYJ.exe 4804 RTQYJ.exe 4624 DMLQ.exe 4624 DMLQ.exe 4832 MUN.exe 4832 MUN.exe 2536 DIX.exe 2536 DIX.exe 756 MIZBO.exe 756 MIZBO.exe 1748 YACLWK.exe 1748 YACLWK.exe 5136 POND.exe 5136 POND.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4416 2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe 4416 2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe 1712 NFRTXFV.exe 1712 NFRTXFV.exe 2616 UYGB.exe 2616 UYGB.exe 4824 OLZZDAZ.exe 4824 OLZZDAZ.exe 5000 MWCHEG.exe 5000 MWCHEG.exe 1160 WFEUPLX.exe 1160 WFEUPLX.exe 1960 UUP.exe 1960 UUP.exe 1212 VXTTI.exe 1212 VXTTI.exe 3316 CNU.exe 3316 CNU.exe 1044 RILXZP.exe 1044 RILXZP.exe 3852 UWQ.exe 3852 UWQ.exe 3416 UBI.exe 3416 UBI.exe 4448 TUTDUHS.exe 4448 TUTDUHS.exe 2608 RKFGPN.exe 2608 RKFGPN.exe 2312 VNDB.exe 2312 VNDB.exe 4712 KQMFA.exe 4712 KQMFA.exe 4852 OYTF.exe 4852 OYTF.exe 4980 HBFJRB.exe 4980 HBFJRB.exe 5740 PHJPCH.exe 5740 PHJPCH.exe 1236 AZMIKOL.exe 1236 AZMIKOL.exe 4296 BCQE.exe 4296 BCQE.exe 4264 KCSRTCP.exe 4264 KCSRTCP.exe 4860 WSZR.exe 4860 WSZR.exe 1924 PWCVTK.exe 1924 PWCVTK.exe 3920 GBNN.exe 3920 GBNN.exe 4804 RTQYJ.exe 4804 RTQYJ.exe 4624 DMLQ.exe 4624 DMLQ.exe 4832 MUN.exe 4832 MUN.exe 2536 DIX.exe 2536 DIX.exe 756 MIZBO.exe 756 MIZBO.exe 1748 YACLWK.exe 1748 YACLWK.exe 5136 POND.exe 5136 POND.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4416 wrote to memory of 4720 4416 2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe 89 PID 4720 wrote to memory of 1712 4720 cmd.exe 93 PID 1712 wrote to memory of 4872 1712 NFRTXFV.exe 95 PID 4872 wrote to memory of 2616 4872 cmd.exe 99 PID 2616 wrote to memory of 4292 2616 UYGB.exe 100 PID 4292 wrote to memory of 4824 4292 cmd.exe 104 PID 4824 wrote to memory of 868 4824 OLZZDAZ.exe 105 PID 868 wrote to memory of 5000 868 cmd.exe 109 PID 5000 wrote to memory of 1680 5000 MWCHEG.exe 110 PID 1680 wrote to memory of 1160 1680 cmd.exe 114 PID 1160 wrote to memory of 5780 1160 WFEUPLX.exe 115 PID 5780 wrote to memory of 1960 5780 cmd.exe 119 PID 1960 wrote to memory of 3460 1960 UUP.exe 120 PID 3460 wrote to memory of 1212 3460 cmd.exe 124 PID 1212 wrote to memory of 4444 1212 VXTTI.exe 125 PID 4444 wrote to memory of 3316 4444 cmd.exe 129 PID 3316 wrote to memory of 712 3316 CNU.exe 130 PID 712 wrote to memory of 1044 712 cmd.exe 134 PID 1044 wrote to memory of 4620 1044 RILXZP.exe 135 PID 4620 wrote to memory of 3852 4620 cmd.exe 139 PID 3852 wrote to memory of 5688 3852 UWQ.exe 140 PID 5688 wrote to memory of 3416 5688 cmd.exe 144 PID 3416 wrote to memory of 3436 3416 UBI.exe 145 PID 3436 wrote to memory of 4448 3436 cmd.exe 149 PID 4448 wrote to memory of 1076 4448 TUTDUHS.exe 150 PID 1076 wrote to memory of 2608 1076 cmd.exe 154 PID 2608 wrote to memory of 1740 2608 RKFGPN.exe 155 PID 1740 wrote to memory of 2312 1740 cmd.exe 159 PID 2312 wrote to memory of 1720 2312 VNDB.exe 160 PID 1720 wrote to memory of 4712 1720 cmd.exe 164 PID 4712 wrote to memory of 468 4712 KQMFA.exe 165 PID 468 wrote to memory of 4852 468 cmd.exe 169 PID 4852 wrote to memory of 5304 4852 OYTF.exe 170 PID 5304 wrote to memory of 4980 5304 cmd.exe 174 PID 4980 wrote to memory of 2268 4980 HBFJRB.exe 175 PID 2268 wrote to memory of 5740 2268 cmd.exe 178 PID 5740 wrote to memory of 932 5740 PHJPCH.exe 180 PID 932 wrote to memory of 1236 932 cmd.exe 184 PID 1236 wrote to memory of 2368 1236 AZMIKOL.exe 185 PID 2368 wrote to memory of 4296 2368 cmd.exe 189 PID 4296 wrote to memory of 5772 4296 BCQE.exe 190 PID 5772 wrote to memory of 4264 5772 cmd.exe 194 PID 4264 wrote to memory of 5336 4264 KCSRTCP.exe 195 PID 5336 wrote to memory of 4860 5336 cmd.exe 199 PID 4860 wrote to memory of 2668 4860 WSZR.exe 200 PID 2668 wrote to memory of 1924 2668 cmd.exe 204 PID 1924 wrote to memory of 3264 1924 PWCVTK.exe 205 PID 3264 wrote to memory of 3920 3264 cmd.exe 209 PID 3920 wrote to memory of 2548 3920 GBNN.exe 210 PID 2548 wrote to memory of 4804 2548 cmd.exe 214 PID 4804 wrote to memory of 2592 4804 RTQYJ.exe 215 PID 2592 wrote to memory of 4624 2592 cmd.exe 219 PID 4624 wrote to memory of 2652 4624 DMLQ.exe 220 PID 2652 wrote to memory of 4832 2652 cmd.exe 224 PID 4832 wrote to memory of 4084 4832 MUN.exe 225 PID 4084 wrote to memory of 2536 4084 cmd.exe 229 PID 2536 wrote to memory of 3388 2536 DIX.exe 230 PID 3388 wrote to memory of 756 3388 cmd.exe 234 PID 756 wrote to memory of 4828 756 MIZBO.exe 235 PID 4828 wrote to memory of 1748 4828 cmd.exe 239 PID 1748 wrote to memory of 5788 1748 YACLWK.exe 240 PID 5788 wrote to memory of 5136 5788 cmd.exe 244 PID 5136 wrote to memory of 2916 5136 POND.exe 245 PID 2916 wrote to memory of 2732 2916 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_294cd3e081c37a90c75a502d276a8900_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFRTXFV.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\windows\SysWOW64\NFRTXFV.exeC:\windows\system32\NFRTXFV.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UYGB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\windows\system\UYGB.exeC:\windows\system\UYGB.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OLZZDAZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\windows\system\OLZZDAZ.exeC:\windows\system\OLZZDAZ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWCHEG.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:868 -
C:\windows\MWCHEG.exeC:\windows\MWCHEG.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFEUPLX.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\windows\WFEUPLX.exeC:\windows\WFEUPLX.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUP.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\UUP.exeC:\windows\UUP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VXTTI.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\windows\system\VXTTI.exeC:\windows\system\VXTTI.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNU.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\windows\SysWOW64\CNU.exeC:\windows\system32\CNU.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RILXZP.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:712 -
C:\windows\system\RILXZP.exeC:\windows\system\RILXZP.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWQ.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\SysWOW64\UWQ.exeC:\windows\system32\UWQ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBI.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\system\UBI.exeC:\windows\system\UBI.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TUTDUHS.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\SysWOW64\TUTDUHS.exeC:\windows\system32\TUTDUHS.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKFGPN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\windows\RKFGPN.exeC:\windows\RKFGPN.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNDB.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\windows\system\VNDB.exeC:\windows\system\VNDB.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KQMFA.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\windows\SysWOW64\KQMFA.exeC:\windows\system32\KQMFA.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OYTF.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:468 -
C:\windows\SysWOW64\OYTF.exeC:\windows\system32\OYTF.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBFJRB.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\windows\SysWOW64\HBFJRB.exeC:\windows\system32\HBFJRB.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHJPCH.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\PHJPCH.exeC:\windows\PHJPCH.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZMIKOL.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:932 -
C:\windows\SysWOW64\AZMIKOL.exeC:\windows\system32\AZMIKOL.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BCQE.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\windows\SysWOW64\BCQE.exeC:\windows\system32\BCQE.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCSRTCP.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\KCSRTCP.exeC:\windows\KCSRTCP.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSZR.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\windows\SysWOW64\WSZR.exeC:\windows\system32\WSZR.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWCVTK.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\windows\PWCVTK.exeC:\windows\PWCVTK.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBNN.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\SysWOW64\GBNN.exeC:\windows\system32\GBNN.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RTQYJ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\system\RTQYJ.exeC:\windows\system\RTQYJ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMLQ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\DMLQ.exeC:\windows\DMLQ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUN.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\windows\MUN.exeC:\windows\MUN.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DIX.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\windows\DIX.exeC:\windows\DIX.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MIZBO.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\windows\MIZBO.exeC:\windows\MIZBO.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YACLWK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\system\YACLWK.exeC:\windows\system\YACLWK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\POND.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\windows\POND.exeC:\windows\POND.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBSNO.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\system\JBSNO.exeC:\windows\system\JBSNO.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMILOB.exe.bat" "66⤵PID:2008
-
C:\windows\AMILOB.exeC:\windows\AMILOB.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EUP.exe.bat" "68⤵PID:2476
-
C:\windows\system\EUP.exeC:\windows\system\EUP.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPTCK.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5944 -
C:\windows\ZPTCK.exeC:\windows\ZPTCK.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKD.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3768 -
C:\windows\system\OKD.exeC:\windows\system\OKD.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLFL.exe.bat" "74⤵PID:6140
-
C:\windows\SysWOW64\FLFL.exeC:\windows\system32\FLFL.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGKVJL.exe.bat" "76⤵PID:1340
-
C:\windows\AGKVJL.exeC:\windows\AGKVJL.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTO.exe.bat" "78⤵PID:2168
-
C:\windows\SysWOW64\UTO.exeC:\windows\system32\UTO.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETQR.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2920 -
C:\windows\SysWOW64\ETQR.exeC:\windows\system32\ETQR.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPVBHI.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1940 -
C:\windows\system\YPVBHI.exeC:\windows\system\YPVBHI.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPD.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5692 -
C:\windows\system\EPD.exeC:\windows\system\EPD.exe85⤵
- Executes dropped EXE
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPFU.exe.bat" "86⤵PID:4564
-
C:\windows\SysWOW64\VPFU.exeC:\windows\system32\VPFU.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKOYMDE.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3156 -
C:\windows\LKOYMDE.exeC:\windows\LKOYMDE.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYP.exe.bat" "90⤵PID:1668
-
C:\windows\LYP.exeC:\windows\LYP.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWUHDQQ.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5828 -
C:\windows\SysWOW64\NWUHDQQ.exeC:\windows\system32\NWUHDQQ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRELO.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5812 -
C:\windows\CRELO.exeC:\windows\CRELO.exe95⤵
- Executes dropped EXE
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEIDZLF.exe.bat" "96⤵
- Executes a command shell one-liner
PID:2280 -
C:\windows\EEIDZLF.exeC:\windows\EEIDZLF.exe97⤵
- Executes dropped EXE
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QXL.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1196 -
C:\windows\system\QXL.exeC:\windows\system\QXL.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCEC.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4676 -
C:\windows\QCEC.exeC:\windows\QCEC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OAXFVKF.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2040 -
C:\windows\system\OAXFVKF.exeC:\windows\system\OAXFVKF.exe103⤵
- Executes dropped EXE
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTAX.exe.bat" "104⤵PID:5168
-
C:\windows\ZTAX.exeC:\windows\ZTAX.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLVQE.exe.bat" "106⤵PID:1084
-
C:\windows\system\LLVQE.exeC:\windows\system\LLVQE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLCEVBD.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3804 -
C:\windows\system\RLCEVBD.exeC:\windows\system\RLCEVBD.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRD.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1048 -
C:\windows\RRD.exeC:\windows\RRD.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WRK.exe.bat" "112⤵PID:2828
-
C:\windows\SysWOW64\WRK.exeC:\windows\system32\WRK.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFPQQ.exe.bat" "114⤵
- Executes a command shell one-liner
PID:2708 -
C:\windows\SysWOW64\RFPQQ.exeC:\windows\system32\RFPQQ.exe115⤵
- Executes dropped EXE
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANR.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4700 -
C:\windows\system\ANR.exeC:\windows\system\ANR.exe117⤵
- Executes dropped EXE
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DAOEE.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5192 -
C:\windows\system\DAOEE.exeC:\windows\system\DAOEE.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MNYWTC.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5332 -
C:\windows\SysWOW64\MNYWTC.exeC:\windows\system32\MNYWTC.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-