Analysis
- max time kernel
76s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 17:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe
- Size 208KB
- Sample260816-wgrnssfa24
- SHA256 b4809d7cc5584ff3d24ebcaa56c570b2ffbc403b44ce0a9e5e3858d6ff24fa14
- MD5 62dc522dd223c4a50f60d1419a41f5e3
- SHA1 b34ea91d17297927325c4233487e6224d7f2f77d
- SHA512 e9aeb7f1f686c2aa0ac285770c1e63d5f5afa7804fbfaa90b2d927188b1171a76534db4da437a26e783e9ded55cb8298652ea95b25d98736cc06aeac2383f373
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfL4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOzkEj1
- TLSH T1F5247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2552 UTO.exe 2568 REUQK.exe 6044 KXCBT.exe 4484 LASXIK.exe 5264 JLVNQ.exe 3428 KJDWTA.exe 1844 HOVLJ.exe 6004 NJHEXS.exe 6020 IHHQZ.exe 3784 JKXLNF.exe 5732 YAK.exe 3188 BITS.exe 424 EEKBV.exe 3132 KZWU.exe 2916 UXCP.exe 3352 GKB.exe 6032 ZDQ.exe 1700 HIDEQYB.exe 4524 PWHTAWF.exe 5488 RUVF.exe 6072 UCWCPZ.exe 4548 EAJWW.exe 2856 AFTL.exe 1568 BIXHSSO.exe 5984 IQGG.exe 4764 QEL.exe 3604 YJX.exe 1648 GXC.exe 5912 FINQNXL.exe 3472 NNSXYW.exe 4664 STKMGRJ.exe 1676 DGJKL.exe 1172 WHYDC.exe 856 DUKWI.exe 4580 QFSVW.exe 4712 YSFBH.exe 1084 GYJI.exe 5072 FIU.exe 5596 YBCJKF.exe 2972 CMAE.exe 3164 RHJJDLY.exe 4968 BFXDKTG.exe 1096 KFZ.exe 1340 UDFCDZR.exe 1412 WBKXK.exe 5900 OJZUXYV.exe 4564 MUJK.exe 2284 WRPE.exe 772 EIQWUIP.exe 1576 TDZAF.exe 5688 SNKQNJM.exe 2460 JWRV.exe 4596 YMSNH.exe 2220 IJFHO.exe 1688 UCNSG.exe 1624 JSORES.exe 2136 TQBMUA.exe 1064 VOHYB.exe 5160 KEIXIWP.exe 5936 AZRCT.exe 2968 PPA.exe 5672 IHI.exe 4332 SPKR.exe 2584 WYQRZVL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\BWDC.exe BTZGN.exe File created C:\windows\SysWOW64\TMXX.exe YYSOVFY.exe File opened for modification C:\windows\SysWOW64\GYJI.exe YSFBH.exe File opened for modification C:\windows\SysWOW64\IXP.exe OCSCWG.exe File created C:\windows\SysWOW64\IXP.exe.bat OCSCWG.exe File created C:\windows\SysWOW64\KJDWTA.exe JLVNQ.exe File created C:\windows\SysWOW64\VOHYB.exe.bat TQBMUA.exe File created C:\windows\SysWOW64\YYSOVFY.exe.bat UQDNJ.exe File created C:\windows\SysWOW64\REUQK.exe.bat UTO.exe File created C:\windows\SysWOW64\KXCBT.exe.bat REUQK.exe File created C:\windows\SysWOW64\TDZAF.exe.bat EIQWUIP.exe File created C:\windows\SysWOW64\STKMGRJ.exe NNSXYW.exe File opened for modification C:\windows\SysWOW64\YAK.exe JKXLNF.exe File created C:\windows\SysWOW64\YBCJKF.exe FIU.exe File opened for modification C:\windows\SysWOW64\YBCJKF.exe FIU.exe File created C:\windows\SysWOW64\UDFCDZR.exe.bat KFZ.exe File created C:\windows\SysWOW64\QCAQMIA.exe XJLFCHR.exe File created C:\windows\SysWOW64\QCAQMIA.exe.bat XJLFCHR.exe File opened for modification C:\windows\SysWOW64\KFZ.exe BFXDKTG.exe File created C:\windows\SysWOW64\UTO.exe 2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\UTO.exe 2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe File created C:\windows\SysWOW64\KJDWTA.exe.bat JLVNQ.exe File created C:\windows\SysWOW64\HOVLJ.exe KJDWTA.exe File opened for modification C:\windows\SysWOW64\KZWU.exe EEKBV.exe File created C:\windows\SysWOW64\STKMGRJ.exe.bat NNSXYW.exe File created C:\windows\SysWOW64\YMSNH.exe.bat JWRV.exe File opened for modification C:\windows\SysWOW64\BFXDKTG.exe RHJJDLY.exe File created C:\windows\SysWOW64\KFZ.exe BFXDKTG.exe File opened for modification C:\windows\SysWOW64\VOHYB.exe TQBMUA.exe File opened for modification C:\windows\SysWOW64\LORRF.exe WYQRZVL.exe File opened for modification C:\windows\SysWOW64\QCAQMIA.exe XJLFCHR.exe File created C:\windows\SysWOW64\CUQT.exe.bat RBNAMCE.exe File created C:\windows\SysWOW64\QFSVW.exe.bat DUKWI.exe File created C:\windows\SysWOW64\CMAE.exe.bat YBCJKF.exe File created C:\windows\SysWOW64\LORRF.exe.bat WYQRZVL.exe File created C:\windows\SysWOW64\KFZ.exe.bat BFXDKTG.exe File created C:\windows\SysWOW64\REUQK.exe UTO.exe File opened for modification C:\windows\SysWOW64\KXCBT.exe REUQK.exe File created C:\windows\SysWOW64\YAK.exe.bat JKXLNF.exe File opened for modification C:\windows\SysWOW64\EAJWW.exe UCWCPZ.exe File created C:\windows\SysWOW64\GYJI.exe YSFBH.exe File opened for modification C:\windows\SysWOW64\YYSOVFY.exe UQDNJ.exe File created C:\windows\SysWOW64\EAJWW.exe.bat UCWCPZ.exe File created C:\windows\SysWOW64\QEL.exe.bat IQGG.exe File created C:\windows\SysWOW64\GYJI.exe.bat YSFBH.exe File created C:\windows\SysWOW64\LORRF.exe WYQRZVL.exe File created C:\windows\SysWOW64\CUQT.exe RBNAMCE.exe File opened for modification C:\windows\SysWOW64\CUQT.exe RBNAMCE.exe File created C:\windows\SysWOW64\UTO.exe.bat 2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe File created C:\windows\SysWOW64\CMAE.exe YBCJKF.exe File created C:\windows\SysWOW64\UDFCDZR.exe KFZ.exe File opened for modification C:\windows\SysWOW64\YMSNH.exe JWRV.exe File created C:\windows\SysWOW64\VOHYB.exe TQBMUA.exe File created C:\windows\SysWOW64\BWDC.exe.bat BTZGN.exe File opened for modification C:\windows\SysWOW64\HOVLJ.exe KJDWTA.exe File created C:\windows\SysWOW64\YAK.exe JKXLNF.exe File created C:\windows\SysWOW64\MFBUNY.exe.bat ZUS.exe File opened for modification C:\windows\SysWOW64\TMXX.exe YYSOVFY.exe File created C:\windows\SysWOW64\IXP.exe OCSCWG.exe File created C:\windows\SysWOW64\QEL.exe IQGG.exe File created C:\windows\SysWOW64\KXCBT.exe REUQK.exe File opened for modification C:\windows\SysWOW64\STKMGRJ.exe NNSXYW.exe File opened for modification C:\windows\SysWOW64\QFSVW.exe DUKWI.exe File created C:\windows\SysWOW64\YYSOVFY.exe UQDNJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\RWA.exe TMXX.exe File created C:\windows\HIDEQYB.exe ZDQ.exe File created C:\windows\system\GXC.exe.bat YJX.exe File opened for modification C:\windows\FINQNXL.exe GXC.exe File opened for modification C:\windows\system\WBKXK.exe UDFCDZR.exe File created C:\windows\IJFHO.exe YMSNH.exe File created C:\windows\system\DFDZQWS.exe MFBUNY.exe File opened for modification C:\windows\TNZ.exe EXMSO.exe File opened for modification C:\windows\RWA.exe TMXX.exe File created C:\windows\system\YSFBH.exe QFSVW.exe File opened for modification C:\windows\KEIXIWP.exe VOHYB.exe File opened for modification C:\windows\system\SPKR.exe IHI.exe File opened for modification C:\windows\ZUS.exe CUQT.exe File created C:\windows\UQDNJ.exe.bat TNZ.exe File created C:\windows\system\OCSCWG.exe RWA.exe File opened for modification C:\windows\system\NJHEXS.exe HOVLJ.exe File opened for modification C:\windows\system\RUVF.exe PWHTAWF.exe File opened for modification C:\windows\FIU.exe GYJI.exe File created C:\windows\system\SPKR.exe.bat IHI.exe File created C:\windows\system\LASXIK.exe KXCBT.exe File created C:\windows\system\NJHEXS.exe.bat HOVLJ.exe File opened for modification C:\windows\WHYDC.exe DGJKL.exe File created C:\windows\DUKWI.exe.bat WHYDC.exe File created C:\windows\system\AZRCT.exe KEIXIWP.exe File created C:\windows\system\AZRCT.exe.bat KEIXIWP.exe File created C:\windows\system\TCJG.exe JFEM.exe File opened for modification C:\windows\BTZGN.exe VGAY.exe File created C:\windows\system\ZDQ.exe.bat GKB.exe File opened for modification C:\windows\BIXHSSO.exe AFTL.exe File created C:\windows\DUKWI.exe WHYDC.exe File opened for modification C:\windows\system\EIQWUIP.exe WRPE.exe File opened for modification C:\windows\ITKYN.exe TCJG.exe File created C:\windows\AMO.exe BWDC.exe File created C:\windows\UQDNJ.exe TNZ.exe File created C:\windows\system\IHHQZ.exe NJHEXS.exe File opened for modification C:\windows\system\BITS.exe YAK.exe File opened for modification C:\windows\UCWCPZ.exe RUVF.exe File created C:\windows\system\NNSXYW.exe.bat FINQNXL.exe File created C:\windows\system\YYI.exe LORRF.exe File opened for modification C:\windows\system\XJLFCHR.exe YYI.exe File created C:\windows\EXMSO.exe AMO.exe File opened for modification C:\windows\UQDNJ.exe TNZ.exe File created C:\windows\BIXHSSO.exe AFTL.exe File opened for modification C:\windows\system\YSFBH.exe QFSVW.exe File created C:\windows\system\WBKXK.exe.bat UDFCDZR.exe File created C:\windows\KEIXIWP.exe.bat VOHYB.exe File opened for modification C:\windows\system\AZRCT.exe KEIXIWP.exe File created C:\windows\system\NJHEXS.exe HOVLJ.exe File opened for modification C:\windows\JKXLNF.exe IHHQZ.exe File created C:\windows\UXCP.exe KZWU.exe File created C:\windows\IQGG.exe.bat BIXHSSO.exe File opened for modification C:\windows\system\JSORES.exe UCNSG.exe File created C:\windows\system\TQBMUA.exe.bat JSORES.exe File opened for modification C:\windows\system\RBNAMCE.exe ITKYN.exe File created C:\windows\UCWCPZ.exe RUVF.exe File created C:\windows\system\YSFBH.exe.bat QFSVW.exe File created C:\windows\OJZUXYV.exe WBKXK.exe File opened for modification C:\windows\system\SNKQNJM.exe TDZAF.exe File created C:\windows\system\JSORES.exe.bat UCNSG.exe File created C:\windows\system\PPA.exe.bat AZRCT.exe File created C:\windows\JFEM.exe.bat QCAQMIA.exe File created C:\windows\ITKYN.exe.bat TCJG.exe File created C:\windows\DGJKL.exe.bat STKMGRJ.exe File created C:\windows\FIU.exe GYJI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3360 cmd.exe 4916 cmd.exe 2636 cmd.exe 6132 cmd.exe 2472 cmd.exe 3236 cmd.exe 5100 cmd.exe 6016 cmd.exe 4576 cmd.exe 4620 cmd.exe 2700 cmd.exe 3036 cmd.exe 1736 cmd.exe 704 cmd.exe 6140 cmd.exe 760 cmd.exe 2608 cmd.exe 5676 cmd.exe 1136 cmd.exe 4348 cmd.exe 2008 cmd.exe 3912 cmd.exe 1076 cmd.exe 668 cmd.exe 3184 cmd.exe 796 cmd.exe 5864 cmd.exe 5368 cmd.exe 2816 cmd.exe 956 cmd.exe 4744 cmd.exe 4960 cmd.exe 3356 cmd.exe 1460 cmd.exe 2348 cmd.exe 4288 cmd.exe 5108 cmd.exe 2556 cmd.exe 4312 cmd.exe 5044 cmd.exe 1000 cmd.exe 4944 cmd.exe 5140 cmd.exe 1432 cmd.exe 1728 cmd.exe 3464 cmd.exe 5516 cmd.exe 3364 cmd.exe 4404 cmd.exe 2572 cmd.exe 3536 cmd.exe 4600 cmd.exe 2116 cmd.exe 4200 cmd.exe 1592 cmd.exe 2336 cmd.exe 5856 cmd.exe 1540 cmd.exe 3028 cmd.exe 2652 cmd.exe 3000 cmd.exe 1264 cmd.exe 2044 cmd.exe 1820 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3764 4972 WerFault.exe 87 2140 2552 WerFault.exe 93 1524 2568 WerFault.exe 99 944 6044 WerFault.exe 104 2192 4484 WerFault.exe 109 4272 5264 WerFault.exe 114 4608 3428 WerFault.exe 119 1768 1844 WerFault.exe 124 1064 6004 WerFault.exe 128 4672 6020 WerFault.exe 134 5688 3784 WerFault.exe 139 5948 5732 WerFault.exe 144 3008 3188 WerFault.exe 149 4600 424 WerFault.exe 154 4508 3132 WerFault.exe 159 2860 2916 WerFault.exe 164 5072 3352 WerFault.exe 169 896 6032 WerFault.exe 174 3952 1700 WerFault.exe 179 2312 4524 WerFault.exe 183 2888 5488 WerFault.exe 189 4784 6072 WerFault.exe 194 2756 4548 WerFault.exe 199 3744 2856 WerFault.exe 204 4540 1568 WerFault.exe 208 5276 5984 WerFault.exe 214 3272 4764 WerFault.exe 219 740 3604 WerFault.exe 224 4080 1648 WerFault.exe 229 4076 5912 WerFault.exe 234 200 3472 WerFault.exe 239 1848 4664 WerFault.exe 244 5156 1676 WerFault.exe 249 4744 1172 WerFault.exe 255 2212 856 WerFault.exe 260 1688 4580 WerFault.exe 265 1360 4712 WerFault.exe 270 4488 1084 WerFault.exe 275 2852 5072 WerFault.exe 280 2644 5596 WerFault.exe 285 704 2972 WerFault.exe 290 2448 3164 WerFault.exe 295 1316 4968 WerFault.exe 300 3276 1096 WerFault.exe 305 3392 1340 WerFault.exe 310 5296 1412 WerFault.exe 315 4412 5900 WerFault.exe 320 5208 4564 WerFault.exe 325 5624 2284 WerFault.exe 330 5400 772 WerFault.exe 335 5964 1576 WerFault.exe 340 5952 5688 WerFault.exe 345 1552 2460 WerFault.exe 350 2164 4596 WerFault.exe 355 5812 2220 WerFault.exe 360 4996 1688 WerFault.exe 365 4720 1624 WerFault.exe 370 3600 2136 WerFault.exe 375 6012 1064 WerFault.exe 380 3340 5160 WerFault.exe 385 6080 5936 WerFault.exe 390 3896 2968 WerFault.exe 395 1000 5672 WerFault.exe 400 1752 4332 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BITS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STKMGRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCAQMIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFDZQWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHJJDLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KEIXIWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFBUNY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFXDKTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXCBT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBKXK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEKBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIXHSSO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITKYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXMSO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYSOVFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFSVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REUQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWHTAWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBCJKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIDEQYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJDWTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UXCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCWCPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FIU.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4972 2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe 4972 2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe 2552 UTO.exe 2552 UTO.exe 2568 REUQK.exe 2568 REUQK.exe 6044 KXCBT.exe 6044 KXCBT.exe 4484 LASXIK.exe 4484 LASXIK.exe 5264 JLVNQ.exe 5264 JLVNQ.exe 3428 KJDWTA.exe 3428 KJDWTA.exe 1844 HOVLJ.exe 1844 HOVLJ.exe 6004 NJHEXS.exe 6004 NJHEXS.exe 6020 IHHQZ.exe 6020 IHHQZ.exe 3784 JKXLNF.exe 3784 JKXLNF.exe 5732 YAK.exe 5732 YAK.exe 3188 BITS.exe 3188 BITS.exe 424 EEKBV.exe 424 EEKBV.exe 3132 KZWU.exe 3132 KZWU.exe 2916 UXCP.exe 2916 UXCP.exe 3352 GKB.exe 3352 GKB.exe 6032 ZDQ.exe 6032 ZDQ.exe 1700 HIDEQYB.exe 1700 HIDEQYB.exe 4524 PWHTAWF.exe 4524 PWHTAWF.exe 5488 RUVF.exe 5488 RUVF.exe 6072 UCWCPZ.exe 6072 UCWCPZ.exe 4548 EAJWW.exe 4548 EAJWW.exe 2856 AFTL.exe 2856 AFTL.exe 1568 BIXHSSO.exe 1568 BIXHSSO.exe 5984 IQGG.exe 5984 IQGG.exe 4764 QEL.exe 4764 QEL.exe 3604 YJX.exe 3604 YJX.exe 1648 GXC.exe 1648 GXC.exe 5912 FINQNXL.exe 5912 FINQNXL.exe 3472 NNSXYW.exe 3472 NNSXYW.exe 4664 STKMGRJ.exe 4664 STKMGRJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4972 2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe 4972 2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe 2552 UTO.exe 2552 UTO.exe 2568 REUQK.exe 2568 REUQK.exe 6044 KXCBT.exe 6044 KXCBT.exe 4484 LASXIK.exe 4484 LASXIK.exe 5264 JLVNQ.exe 5264 JLVNQ.exe 3428 KJDWTA.exe 3428 KJDWTA.exe 1844 HOVLJ.exe 1844 HOVLJ.exe 6004 NJHEXS.exe 6004 NJHEXS.exe 6020 IHHQZ.exe 6020 IHHQZ.exe 3784 JKXLNF.exe 3784 JKXLNF.exe 5732 YAK.exe 5732 YAK.exe 3188 BITS.exe 3188 BITS.exe 424 EEKBV.exe 424 EEKBV.exe 3132 KZWU.exe 3132 KZWU.exe 2916 UXCP.exe 2916 UXCP.exe 3352 GKB.exe 3352 GKB.exe 6032 ZDQ.exe 6032 ZDQ.exe 1700 HIDEQYB.exe 1700 HIDEQYB.exe 4524 PWHTAWF.exe 4524 PWHTAWF.exe 5488 RUVF.exe 5488 RUVF.exe 6072 UCWCPZ.exe 6072 UCWCPZ.exe 4548 EAJWW.exe 4548 EAJWW.exe 2856 AFTL.exe 2856 AFTL.exe 1568 BIXHSSO.exe 1568 BIXHSSO.exe 5984 IQGG.exe 5984 IQGG.exe 4764 QEL.exe 4764 QEL.exe 3604 YJX.exe 3604 YJX.exe 1648 GXC.exe 1648 GXC.exe 5912 FINQNXL.exe 5912 FINQNXL.exe 3472 NNSXYW.exe 3472 NNSXYW.exe 4664 STKMGRJ.exe 4664 STKMGRJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4972 wrote to memory of 3360 4972 2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe 89 PID 3360 wrote to memory of 2552 3360 cmd.exe 93 PID 2552 wrote to memory of 4148 2552 UTO.exe 95 PID 4148 wrote to memory of 2568 4148 cmd.exe 99 PID 2568 wrote to memory of 1480 2568 REUQK.exe 100 PID 1480 wrote to memory of 6044 1480 cmd.exe 104 PID 6044 wrote to memory of 2556 6044 KXCBT.exe 105 PID 2556 wrote to memory of 4484 2556 cmd.exe 109 PID 4484 wrote to memory of 3320 4484 LASXIK.exe 110 PID 3320 wrote to memory of 5264 3320 cmd.exe 114 PID 5264 wrote to memory of 4736 5264 JLVNQ.exe 115 PID 4736 wrote to memory of 3428 4736 cmd.exe 119 PID 3428 wrote to memory of 1460 3428 KJDWTA.exe 120 PID 1460 wrote to memory of 1844 1460 cmd.exe 124 PID 1844 wrote to memory of 796 1844 HOVLJ.exe 125 PID 796 wrote to memory of 6004 796 cmd.exe 128 PID 6004 wrote to memory of 1620 6004 NJHEXS.exe 130 PID 1620 wrote to memory of 6020 1620 cmd.exe 134 PID 6020 wrote to memory of 5864 6020 IHHQZ.exe 135 PID 5864 wrote to memory of 3784 5864 cmd.exe 139 PID 3784 wrote to memory of 1600 3784 JKXLNF.exe 140 PID 1600 wrote to memory of 5732 1600 cmd.exe 144 PID 5732 wrote to memory of 2944 5732 YAK.exe 145 PID 2944 wrote to memory of 3188 2944 cmd.exe 149 PID 3188 wrote to memory of 5340 3188 BITS.exe 150 PID 5340 wrote to memory of 424 5340 cmd.exe 154 PID 424 wrote to memory of 3364 424 EEKBV.exe 155 PID 3364 wrote to memory of 3132 3364 cmd.exe 159 PID 3132 wrote to memory of 1384 3132 KZWU.exe 160 PID 1384 wrote to memory of 2916 1384 cmd.exe 164 PID 2916 wrote to memory of 4312 2916 UXCP.exe 165 PID 4312 wrote to memory of 3352 4312 cmd.exe 169 PID 3352 wrote to memory of 2348 3352 GKB.exe 170 PID 2348 wrote to memory of 6032 2348 cmd.exe 174 PID 6032 wrote to memory of 5676 6032 ZDQ.exe 175 PID 5676 wrote to memory of 1700 5676 cmd.exe 179 PID 1700 wrote to memory of 5168 1700 HIDEQYB.exe 180 PID 5168 wrote to memory of 4524 5168 cmd.exe 183 PID 4524 wrote to memory of 3516 4524 PWHTAWF.exe 185 PID 3516 wrote to memory of 5488 3516 cmd.exe 189 PID 5488 wrote to memory of 5368 5488 RUVF.exe 190 PID 5368 wrote to memory of 6072 5368 cmd.exe 194 PID 6072 wrote to memory of 4288 6072 UCWCPZ.exe 195 PID 4288 wrote to memory of 4548 4288 cmd.exe 199 PID 4548 wrote to memory of 1580 4548 EAJWW.exe 200 PID 1580 wrote to memory of 2856 1580 cmd.exe 204 PID 2856 wrote to memory of 5476 2856 AFTL.exe 205 PID 5476 wrote to memory of 1568 5476 cmd.exe 208 PID 1568 wrote to memory of 1736 1568 BIXHSSO.exe 210 PID 1736 wrote to memory of 5984 1736 cmd.exe 214 PID 5984 wrote to memory of 3036 5984 IQGG.exe 215 PID 3036 wrote to memory of 4764 3036 cmd.exe 219 PID 4764 wrote to memory of 3820 4764 QEL.exe 220 PID 3820 wrote to memory of 3604 3820 cmd.exe 224 PID 3604 wrote to memory of 4632 3604 YJX.exe 225 PID 4632 wrote to memory of 1648 4632 cmd.exe 229 PID 1648 wrote to memory of 5460 1648 GXC.exe 230 PID 5460 wrote to memory of 5912 5460 cmd.exe 234 PID 5912 wrote to memory of 4668 5912 FINQNXL.exe 235 PID 4668 wrote to memory of 3472 4668 cmd.exe 239 PID 3472 wrote to memory of 4216 3472 NNSXYW.exe 240 PID 4216 wrote to memory of 4664 4216 cmd.exe 244 PID 4664 wrote to memory of 4404 4664 STKMGRJ.exe 245 PID 4404 wrote to memory of 1676 4404 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_62dc522dd223c4a50f60d1419a41f5e3_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTO.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\windows\SysWOW64\UTO.exeC:\windows\system32\UTO.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\REUQK.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\windows\SysWOW64\REUQK.exeC:\windows\system32\REUQK.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXCBT.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\windows\SysWOW64\KXCBT.exeC:\windows\system32\KXCBT.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LASXIK.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\windows\system\LASXIK.exeC:\windows\system\LASXIK.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLVNQ.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\windows\system\JLVNQ.exeC:\windows\system\JLVNQ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOVLJ.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\windows\SysWOW64\HOVLJ.exeC:\windows\system32\HOVLJ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJHEXS.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:796 -
C:\windows\system\NJHEXS.exeC:\windows\system\NJHEXS.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHHQZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\windows\system\IHHQZ.exeC:\windows\system\IHHQZ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKXLNF.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\JKXLNF.exeC:\windows\JKXLNF.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\windows\SysWOW64\YAK.exeC:\windows\system32\YAK.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BITS.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\windows\system\BITS.exeC:\windows\system\BITS.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EEKBV.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\windows\system\EEKBV.exeC:\windows\system\EEKBV.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZWU.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\SysWOW64\KZWU.exeC:\windows\system32\KZWU.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UXCP.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\UXCP.exeC:\windows\UXCP.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GKB.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\GKB.exeC:\windows\GKB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDQ.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\system\ZDQ.exeC:\windows\system\ZDQ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIDEQYB.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\HIDEQYB.exeC:\windows\HIDEQYB.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWHTAWF.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\windows\system\PWHTAWF.exeC:\windows\system\PWHTAWF.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUVF.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\windows\system\RUVF.exeC:\windows\system\RUVF.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCWCPZ.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\windows\UCWCPZ.exeC:\windows\UCWCPZ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAJWW.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\windows\SysWOW64\EAJWW.exeC:\windows\system32\EAJWW.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFTL.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\windows\AFTL.exeC:\windows\AFTL.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIXHSSO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\windows\BIXHSSO.exeC:\windows\BIXHSSO.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQGG.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\windows\IQGG.exeC:\windows\IQGG.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEL.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\windows\SysWOW64\QEL.exeC:\windows\system32\QEL.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YJX.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\windows\system\YJX.exeC:\windows\system\YJX.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXC.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\windows\system\GXC.exeC:\windows\system\GXC.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FINQNXL.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\windows\FINQNXL.exeC:\windows\FINQNXL.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNSXYW.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\windows\system\NNSXYW.exeC:\windows\system\NNSXYW.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DGJKL.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\DGJKL.exeC:\windows\DGJKL.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WHYDC.exe.bat" "66⤵PID:5948
-
C:\windows\WHYDC.exeC:\windows\WHYDC.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DUKWI.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:2416 -
C:\windows\DUKWI.exeC:\windows\DUKWI.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFSVW.exe.bat" "70⤵PID:5428
-
C:\windows\SysWOW64\QFSVW.exeC:\windows\system32\QFSVW.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSFBH.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4128 -
C:\windows\system\YSFBH.exeC:\windows\system\YSFBH.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYJI.exe.bat" "74⤵PID:5584
-
C:\windows\SysWOW64\GYJI.exeC:\windows\system32\GYJI.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FIU.exe.bat" "76⤵PID:2028
-
C:\windows\FIU.exeC:\windows\FIU.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBCJKF.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2572 -
C:\windows\SysWOW64\YBCJKF.exeC:\windows\system32\YBCJKF.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMAE.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5100 -
C:\windows\SysWOW64\CMAE.exeC:\windows\system32\CMAE.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHJJDLY.exe.bat" "82⤵PID:4672
-
C:\windows\system\RHJJDLY.exeC:\windows\system\RHJJDLY.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFXDKTG.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3216 -
C:\windows\SysWOW64\BFXDKTG.exeC:\windows\system32\BFXDKTG.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KFZ.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2652 -
C:\windows\SysWOW64\KFZ.exeC:\windows\system32\KFZ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UDFCDZR.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1820 -
C:\windows\SysWOW64\UDFCDZR.exeC:\windows\system32\UDFCDZR.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WBKXK.exe.bat" "90⤵PID:4100
-
C:\windows\system\WBKXK.exeC:\windows\system\WBKXK.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJZUXYV.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:1400 -
C:\windows\OJZUXYV.exeC:\windows\OJZUXYV.exe93⤵
- Executes dropped EXE
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUJK.exe.bat" "94⤵
- Executes a command shell one-liner
PID:6016 -
C:\windows\MUJK.exeC:\windows\MUJK.exe95⤵
- Executes dropped EXE
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRPE.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4812 -
C:\windows\system\WRPE.exeC:\windows\system\WRPE.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EIQWUIP.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4576 -
C:\windows\system\EIQWUIP.exeC:\windows\system\EIQWUIP.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDZAF.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2736 -
C:\windows\SysWOW64\TDZAF.exeC:\windows\system32\TDZAF.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SNKQNJM.exe.bat" "102⤵PID:3244
-
C:\windows\system\SNKQNJM.exeC:\windows\system\SNKQNJM.exe103⤵
- Executes dropped EXE
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWRV.exe.bat" "104⤵PID:5880
-
C:\windows\system\JWRV.exeC:\windows\system\JWRV.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YMSNH.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2760 -
C:\windows\SysWOW64\YMSNH.exeC:\windows\system32\YMSNH.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJFHO.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1136 -
C:\windows\IJFHO.exeC:\windows\IJFHO.exe109⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCNSG.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\windows\UCNSG.exeC:\windows\UCNSG.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JSORES.exe.bat" "112⤵PID:5296
-
C:\windows\system\JSORES.exeC:\windows\system\JSORES.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQBMUA.exe.bat" "114⤵PID:4412
-
C:\windows\system\TQBMUA.exeC:\windows\system\TQBMUA.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VOHYB.exe.bat" "116⤵PID:2992
-
C:\windows\SysWOW64\VOHYB.exeC:\windows\system32\VOHYB.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KEIXIWP.exe.bat" "118⤵PID:5868
-
C:\windows\KEIXIWP.exeC:\windows\KEIXIWP.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZRCT.exe.bat" "120⤵PID:4076
-
C:\windows\system\AZRCT.exeC:\windows\system\AZRCT.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-