Analysis
- max time kernel
82s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 22:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe
- Size 282KB
- Sample260701-143f2agy6y
- SHA256 7c9f2f0ce549c5b7ee0f3970a1b98c072c58c3dc567c851a0e38c91a23d4593c
- MD5 8deb190f37ee4e42ddac59c76f088a82
- SHA1 edd3cacc4d99c20d78fe93d2af328a4713cca4ac
- SHA512 ef2a3e7fb381d7ca5f1b857d0bfa6afd9b2b3d225dc21b31dbe11f2780f73f360cb914866dcb4aae37afd50fb5f2937f2849522b3575f327720ac28c73399045
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LO8kEjiPISUOgW9X+hOGzC/:RLWI09QZb6LO8kmZzcukG2/
- TLSH T134549F1776C28273D5A3037209DAC6E9773ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5636 FDKSG.exe 5240 BWBJNQL.exe 2444 LUOVVZ.exe 5200 OPGFOKJ.exe 3280 OVY.exe 3812 DQHYBK.exe 4260 MYJDMPP.exe 4104 WWXX.exe 4988 RJCGEX.exe 2780 RMGKJ.exe 2316 TKLW.exe 4748 NCB.exe 988 HQFZ.exe 1392 NLXZPSJ.exe 5984 TLEN.exe 1064 XTTNKMG.exe 2268 VPK.exe 252 QAA.exe 1888 LNFE.exe 2064 ADGVMN.exe 5944 GDO.exe 3152 IBT.exe 3340 DOYN.exe 1448 DRCRAG.exe 2504 PKFBJVK.exe 3760 TSMJV.exe 1624 NFRTXFV.exe 1452 RVXT.exe 1248 SYB.exe 2952 KTFSC.exe 4816 FPKCMLJ.exe 240 GKNFS.exe 5068 VNF.exe 1068 QACTN.exe 1956 ZAEGRT.exe 1880 KTH.exe 2384 WJNZL.exe 1760 PERVRJW.exe 5028 VEZJ.exe 4848 PAESKD.exe 1144 GAGFNIP.exe 1300 SSJ.exe 712 MGNHG.exe 1188 JLYWWL.exe 1092 SUACAQP.exe 5440 VHEL.exe 912 OKIHPG.exe 2508 XKKU.exe 1460 TQQJ.exe 5860 XYXRMF.exe 4380 JODRYY.exe 2400 LMR.exe 3872 TRJA.exe 2148 RSRNYN.exe 3520 XSY.exe 2616 OAAGT.exe 1912 JNFQVN.exe 5404 SOH.exe 2852 YOPQP.exe 1364 NEQ.exe 3568 FMEN.exe 1304 YFMY.exe 1324 FVNPZ.exe 3120 RLTX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RMGKJ.exe RJCGEX.exe File created C:\windows\SysWOW64\PKFBJVK.exe.bat DRCRAG.exe File opened for modification C:\windows\SysWOW64\JNFQVN.exe OAAGT.exe File created C:\windows\SysWOW64\PIGH.exe.bat CCYWWG.exe File created C:\windows\SysWOW64\VNGJRZN.exe EDPMJFR.exe File created C:\windows\SysWOW64\VNGJRZN.exe.bat EDPMJFR.exe File created C:\windows\SysWOW64\JTAE.exe ATYZHC.exe File created C:\windows\SysWOW64\JTAE.exe.bat ATYZHC.exe File created C:\windows\SysWOW64\DOYN.exe.bat IBT.exe File opened for modification C:\windows\SysWOW64\SJQQ.exe DGZMRPD.exe File opened for modification C:\windows\SysWOW64\DBPX.exe DYLBH.exe File created C:\windows\SysWOW64\MVSUM.exe HVLHC.exe File opened for modification C:\windows\SysWOW64\LEESJDQ.exe QRZJZ.exe File opened for modification C:\windows\SysWOW64\XULAW.exe LEESJDQ.exe File created C:\windows\SysWOW64\XADPX.exe XULAW.exe File created C:\windows\SysWOW64\WWXX.exe MYJDMPP.exe File opened for modification C:\windows\SysWOW64\SYB.exe RVXT.exe File opened for modification C:\windows\SysWOW64\XSY.exe RSRNYN.exe File opened for modification C:\windows\SysWOW64\YFMY.exe FMEN.exe File opened for modification C:\windows\SysWOW64\JTAE.exe ATYZHC.exe File opened for modification C:\windows\SysWOW64\MFA.exe RSVLGZR.exe File created C:\windows\SysWOW64\RMGKJ.exe.bat RJCGEX.exe File created C:\windows\SysWOW64\DRCRAG.exe DOYN.exe File created C:\windows\SysWOW64\VEZJ.exe PERVRJW.exe File created C:\windows\SysWOW64\QKS.exe ECLJLR.exe File created C:\windows\SysWOW64\MVYVG.exe.bat BCVC.exe File created C:\windows\SysWOW64\LEESJDQ.exe.bat QRZJZ.exe File created C:\windows\SysWOW64\TLEN.exe.bat NLXZPSJ.exe File created C:\windows\SysWOW64\NFRTXFV.exe.bat TSMJV.exe File created C:\windows\SysWOW64\SUACAQP.exe.bat JLYWWL.exe File opened for modification C:\windows\SysWOW64\VNGJRZN.exe EDPMJFR.exe File opened for modification C:\windows\SysWOW64\ATYZHC.exe VNGJRZN.exe File opened for modification C:\windows\SysWOW64\DGZMRPD.exe JTUDH.exe File opened for modification C:\windows\SysWOW64\QKS.exe ECLJLR.exe File created C:\windows\SysWOW64\WERCW.exe EBNYQC.exe File created C:\windows\SysWOW64\SYB.exe.bat RVXT.exe File created C:\windows\SysWOW64\XSY.exe.bat RSRNYN.exe File created C:\windows\SysWOW64\DGZMRPD.exe.bat JTUDH.exe File opened for modification C:\windows\SysWOW64\MVYVG.exe BCVC.exe File created C:\windows\SysWOW64\WERCW.exe.bat EBNYQC.exe File created C:\windows\SysWOW64\XULAW.exe.bat LEESJDQ.exe File opened for modification C:\windows\SysWOW64\DOYN.exe IBT.exe File opened for modification C:\windows\SysWOW64\WWXX.exe MYJDMPP.exe File opened for modification C:\windows\SysWOW64\NCB.exe TKLW.exe File created C:\windows\SysWOW64\NCB.exe.bat TKLW.exe File created C:\windows\SysWOW64\DRCRAG.exe.bat DOYN.exe File opened for modification C:\windows\SysWOW64\PIGH.exe CCYWWG.exe File created C:\windows\SysWOW64\VCLPRZ.exe.bat QCEC.exe File created C:\windows\SysWOW64\QKS.exe.bat ECLJLR.exe File created C:\windows\SysWOW64\LUOVVZ.exe.bat BWBJNQL.exe File created C:\windows\SysWOW64\PKFBJVK.exe DRCRAG.exe File opened for modification C:\windows\SysWOW64\PKFBJVK.exe DRCRAG.exe File created C:\windows\SysWOW64\SYB.exe RVXT.exe File created C:\windows\SysWOW64\XSY.exe RSRNYN.exe File created C:\windows\SysWOW64\FVNPZ.exe YFMY.exe File opened for modification C:\windows\SysWOW64\VCLPRZ.exe QCEC.exe File opened for modification C:\windows\SysWOW64\WERCW.exe EBNYQC.exe File created C:\windows\SysWOW64\ATYZHC.exe VNGJRZN.exe File created C:\windows\SysWOW64\VCLPRZ.exe QCEC.exe File created C:\windows\SysWOW64\MVYVG.exe BCVC.exe File created C:\windows\SysWOW64\DBPX.exe DYLBH.exe File created C:\windows\SysWOW64\LUOVVZ.exe BWBJNQL.exe File opened for modification C:\windows\SysWOW64\DQHYBK.exe OVY.exe File created C:\windows\SysWOW64\WWXX.exe.bat MYJDMPP.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\SSJ.exe.bat GAGFNIP.exe File created C:\windows\PUIS.exe.bat JTAE.exe File created C:\windows\system\DYLBH.exe UTAJ.exe File created C:\windows\system\HQXEWGZ.exe MVSUM.exe File created C:\windows\system\QRZJZ.exe.bat HQXEWGZ.exe File created C:\windows\MYJDMPP.exe DQHYBK.exe File created C:\windows\QACTN.exe VNF.exe File opened for modification C:\windows\GAGFNIP.exe PAESKD.exe File created C:\windows\system\OKIHPG.exe VHEL.exe File created C:\windows\system\LMR.exe JODRYY.exe File opened for modification C:\windows\OAAGT.exe XSY.exe File created C:\windows\OAAGT.exe.bat XSY.exe File opened for modification C:\windows\system\RLTX.exe FVNPZ.exe File created C:\windows\RVXT.exe.bat NFRTXFV.exe File created C:\windows\system\NEQ.exe.bat YOPQP.exe File opened for modification C:\windows\PUIS.exe JTAE.exe File created C:\windows\QCEC.exe.bat QXL.exe File created C:\windows\system\JTUDH.exe QQQ.exe File opened for modification C:\windows\system\BEHW.exe WDAIJVO.exe File opened for modification C:\windows\system\UTAJ.exe MFA.exe File opened for modification C:\windows\system\AMZ.exe FZURUH.exe File created C:\windows\system\VNF.exe.bat GKNFS.exe File created C:\windows\system\TQQJ.exe XKKU.exe File created C:\windows\system\YOPQP.exe SOH.exe File created C:\windows\system\ECLJLR.exe SJQQ.exe File created C:\windows\system\UTAJ.exe.bat MFA.exe File created C:\windows\LFCU.exe.bat AMZ.exe File opened for modification C:\windows\FPKCMLJ.exe KTFSC.exe File created C:\windows\XTTNKMG.exe.bat TLEN.exe File created C:\windows\system\VPK.exe.bat XTTNKMG.exe File opened for modification C:\windows\system\VNF.exe GKNFS.exe File opened for modification C:\windows\QACTN.exe VNF.exe File created C:\windows\WJNZL.exe KTH.exe File created C:\windows\system\QQQ.exe VCLPRZ.exe File created C:\windows\BCVC.exe QKS.exe File created C:\windows\HQFZ.exe NCB.exe File created C:\windows\RVXT.exe NFRTXFV.exe File created C:\windows\OWMB.exe.bat TBHKSOO.exe File created C:\windows\system\YBFL.exe BEHW.exe File created C:\windows\HVLHC.exe MIG.exe File created C:\windows\WJNZL.exe.bat KTH.exe File created C:\windows\GAGFNIP.exe PAESKD.exe File created C:\windows\system\QXL.exe PUIS.exe File created C:\windows\system\RSVLGZR.exe WERCW.exe File opened for modification C:\windows\system\HQXEWGZ.exe MVSUM.exe File opened for modification C:\windows\system\VPK.exe XTTNKMG.exe File created C:\windows\system\TSMJV.exe PKFBJVK.exe File created C:\windows\system\VNF.exe GKNFS.exe File created C:\windows\YUR.exe OWMB.exe File opened for modification C:\windows\BCVC.exe QKS.exe File created C:\windows\system\HQXEWGZ.exe.bat MVSUM.exe File created C:\windows\system\QRZJZ.exe HQXEWGZ.exe File created C:\windows\MYJDMPP.exe.bat DQHYBK.exe File opened for modification C:\windows\GDO.exe ADGVMN.exe File opened for modification C:\windows\system\IBT.exe GDO.exe File opened for modification C:\windows\system\TSMJV.exe PKFBJVK.exe File created C:\windows\system\JODRYY.exe XYXRMF.exe File opened for modification C:\windows\system\LMR.exe JODRYY.exe File created C:\windows\OPGFOKJ.exe LUOVVZ.exe File created C:\windows\system\KTFSC.exe.bat SYB.exe File created C:\windows\MGNHG.exe SSJ.exe File created C:\windows\system\RSRNYN.exe TRJA.exe File created C:\windows\system\RSRNYN.exe.bat TRJA.exe File opened for modification C:\windows\system\NEQ.exe YOPQP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 4072 6084 WerFault.exe 87 4380 5636 WerFault.exe 92 2432 5240 WerFault.exe 98 2940 2444 WerFault.exe 103 1784 5200 WerFault.exe 108 4896 3280 WerFault.exe 113 4360 3812 WerFault.exe 118 2284 4260 WerFault.exe 123 3608 4104 WerFault.exe 128 3500 4988 WerFault.exe 133 3836 2780 WerFault.exe 138 2800 2316 WerFault.exe 143 3652 4748 WerFault.exe 148 2088 988 WerFault.exe 153 5004 1392 WerFault.exe 158 1528 5984 WerFault.exe 163 6104 1064 WerFault.exe 168 1132 2268 WerFault.exe 173 4496 252 WerFault.exe 178 1504 1888 WerFault.exe 183 5724 2064 WerFault.exe 188 1956 5944 WerFault.exe 193 776 3152 WerFault.exe 198 3616 3340 WerFault.exe 203 2136 1448 WerFault.exe 208 5332 2504 WerFault.exe 213 5836 3760 WerFault.exe 218 2760 1624 WerFault.exe 223 2940 1452 WerFault.exe 228 5884 1248 WerFault.exe 233 1132 2952 WerFault.exe 238 5400 4816 WerFault.exe 243 3772 240 WerFault.exe 248 1264 5068 WerFault.exe 253 4180 1068 WerFault.exe 258 704 1956 WerFault.exe 263 1276 1880 WerFault.exe 268 708 2384 WerFault.exe 273 2540 1760 WerFault.exe 278 2040 5028 WerFault.exe 283 3876 4848 WerFault.exe 288 752 1144 WerFault.exe 293 1272 1300 WerFault.exe 298 2696 712 WerFault.exe 303 6052 1188 WerFault.exe 308 4140 1092 WerFault.exe 313 4376 5440 WerFault.exe 318 3840 912 WerFault.exe 323 3148 2508 WerFault.exe 328 3856 1460 WerFault.exe 333 2760 5860 WerFault.exe 338 5072 4380 WerFault.exe 343 5884 2400 WerFault.exe 348 5764 3872 WerFault.exe 353 5532 2148 WerFault.exe 358 5076 3520 WerFault.exe 363 796 2616 WerFault.exe 368 5016 1912 WerFault.exe 373 4668 5404 WerFault.exe 378 2136 2852 WerFault.exe 383 4288 1364 WerFault.exe 388 1240 3568 WerFault.exe 393 5644 1304 WerFault.exe 398 1604 1324 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVSUM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRZJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PAESKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LNFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKIHPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYLBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HQXEWGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYJDMPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTFSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAEGRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BWBJNQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZURUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTUDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCVC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6084 2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe 6084 2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe 5636 FDKSG.exe 5636 FDKSG.exe 5240 BWBJNQL.exe 5240 BWBJNQL.exe 2444 LUOVVZ.exe 2444 LUOVVZ.exe 5200 OPGFOKJ.exe 5200 OPGFOKJ.exe 3280 OVY.exe 3280 OVY.exe 3812 DQHYBK.exe 3812 DQHYBK.exe 4260 MYJDMPP.exe 4260 MYJDMPP.exe 4104 WWXX.exe 4104 WWXX.exe 4988 RJCGEX.exe 4988 RJCGEX.exe 2780 RMGKJ.exe 2780 RMGKJ.exe 2316 TKLW.exe 2316 TKLW.exe 4748 NCB.exe 4748 NCB.exe 988 HQFZ.exe 988 HQFZ.exe 1392 NLXZPSJ.exe 1392 NLXZPSJ.exe 5984 TLEN.exe 5984 TLEN.exe 1064 XTTNKMG.exe 1064 XTTNKMG.exe 2268 VPK.exe 2268 VPK.exe 252 QAA.exe 252 QAA.exe 1888 LNFE.exe 1888 LNFE.exe 2064 ADGVMN.exe 2064 ADGVMN.exe 5944 GDO.exe 5944 GDO.exe 3152 IBT.exe 3152 IBT.exe 3340 DOYN.exe 3340 DOYN.exe 1448 DRCRAG.exe 1448 DRCRAG.exe 2504 PKFBJVK.exe 2504 PKFBJVK.exe 3760 TSMJV.exe 3760 TSMJV.exe 1624 NFRTXFV.exe 1624 NFRTXFV.exe 1452 RVXT.exe 1452 RVXT.exe 1248 SYB.exe 1248 SYB.exe 2952 KTFSC.exe 2952 KTFSC.exe 4816 FPKCMLJ.exe 4816 FPKCMLJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6084 2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe 6084 2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe 5636 FDKSG.exe 5636 FDKSG.exe 5240 BWBJNQL.exe 5240 BWBJNQL.exe 2444 LUOVVZ.exe 2444 LUOVVZ.exe 5200 OPGFOKJ.exe 5200 OPGFOKJ.exe 3280 OVY.exe 3280 OVY.exe 3812 DQHYBK.exe 3812 DQHYBK.exe 4260 MYJDMPP.exe 4260 MYJDMPP.exe 4104 WWXX.exe 4104 WWXX.exe 4988 RJCGEX.exe 4988 RJCGEX.exe 2780 RMGKJ.exe 2780 RMGKJ.exe 2316 TKLW.exe 2316 TKLW.exe 4748 NCB.exe 4748 NCB.exe 988 HQFZ.exe 988 HQFZ.exe 1392 NLXZPSJ.exe 1392 NLXZPSJ.exe 5984 TLEN.exe 5984 TLEN.exe 1064 XTTNKMG.exe 1064 XTTNKMG.exe 2268 VPK.exe 2268 VPK.exe 252 QAA.exe 252 QAA.exe 1888 LNFE.exe 1888 LNFE.exe 2064 ADGVMN.exe 2064 ADGVMN.exe 5944 GDO.exe 5944 GDO.exe 3152 IBT.exe 3152 IBT.exe 3340 DOYN.exe 3340 DOYN.exe 1448 DRCRAG.exe 1448 DRCRAG.exe 2504 PKFBJVK.exe 2504 PKFBJVK.exe 3760 TSMJV.exe 3760 TSMJV.exe 1624 NFRTXFV.exe 1624 NFRTXFV.exe 1452 RVXT.exe 1452 RVXT.exe 1248 SYB.exe 1248 SYB.exe 2952 KTFSC.exe 2952 KTFSC.exe 4816 FPKCMLJ.exe 4816 FPKCMLJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6084 wrote to memory of 3716 6084 2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe 88 PID 3716 wrote to memory of 5636 3716 cmd.exe 92 PID 5636 wrote to memory of 5192 5636 FDKSG.exe 94 PID 5192 wrote to memory of 5240 5192 cmd.exe 98 PID 5240 wrote to memory of 2500 5240 BWBJNQL.exe 99 PID 2500 wrote to memory of 2444 2500 cmd.exe 103 PID 2444 wrote to memory of 4944 2444 LUOVVZ.exe 104 PID 4944 wrote to memory of 5200 4944 cmd.exe 108 PID 5200 wrote to memory of 4048 5200 OPGFOKJ.exe 109 PID 4048 wrote to memory of 3280 4048 cmd.exe 113 PID 3280 wrote to memory of 4216 3280 OVY.exe 114 PID 4216 wrote to memory of 3812 4216 cmd.exe 118 PID 3812 wrote to memory of 1860 3812 DQHYBK.exe 119 PID 1860 wrote to memory of 4260 1860 cmd.exe 123 PID 4260 wrote to memory of 1964 4260 MYJDMPP.exe 124 PID 1964 wrote to memory of 4104 1964 cmd.exe 128 PID 4104 wrote to memory of 5508 4104 WWXX.exe 129 PID 5508 wrote to memory of 4988 5508 cmd.exe 133 PID 4988 wrote to memory of 4468 4988 RJCGEX.exe 134 PID 4468 wrote to memory of 2780 4468 cmd.exe 138 PID 2780 wrote to memory of 2380 2780 RMGKJ.exe 139 PID 2380 wrote to memory of 2316 2380 cmd.exe 143 PID 2316 wrote to memory of 2676 2316 TKLW.exe 144 PID 2676 wrote to memory of 4748 2676 cmd.exe 148 PID 4748 wrote to memory of 1208 4748 NCB.exe 149 PID 1208 wrote to memory of 988 1208 cmd.exe 153 PID 988 wrote to memory of 5300 988 HQFZ.exe 154 PID 5300 wrote to memory of 1392 5300 cmd.exe 158 PID 1392 wrote to memory of 5288 1392 NLXZPSJ.exe 159 PID 5288 wrote to memory of 5984 5288 cmd.exe 163 PID 5984 wrote to memory of 2476 5984 TLEN.exe 164 PID 2476 wrote to memory of 1064 2476 cmd.exe 168 PID 1064 wrote to memory of 3612 1064 XTTNKMG.exe 169 PID 3612 wrote to memory of 2268 3612 cmd.exe 173 PID 2268 wrote to memory of 3308 2268 VPK.exe 174 PID 3308 wrote to memory of 252 3308 cmd.exe 178 PID 252 wrote to memory of 4108 252 QAA.exe 179 PID 4108 wrote to memory of 1888 4108 cmd.exe 183 PID 1888 wrote to memory of 2264 1888 LNFE.exe 184 PID 2264 wrote to memory of 2064 2264 cmd.exe 188 PID 2064 wrote to memory of 3040 2064 ADGVMN.exe 189 PID 3040 wrote to memory of 5944 3040 cmd.exe 193 PID 5944 wrote to memory of 4780 5944 GDO.exe 194 PID 4780 wrote to memory of 3152 4780 cmd.exe 198 PID 3152 wrote to memory of 4536 3152 IBT.exe 199 PID 4536 wrote to memory of 3340 4536 cmd.exe 203 PID 3340 wrote to memory of 3836 3340 DOYN.exe 204 PID 3836 wrote to memory of 1448 3836 cmd.exe 208 PID 1448 wrote to memory of 5236 1448 DRCRAG.exe 209 PID 5236 wrote to memory of 2504 5236 cmd.exe 213 PID 2504 wrote to memory of 5928 2504 PKFBJVK.exe 214 PID 5928 wrote to memory of 3760 5928 cmd.exe 218 PID 3760 wrote to memory of 4768 3760 TSMJV.exe 219 PID 4768 wrote to memory of 1624 4768 cmd.exe 223 PID 1624 wrote to memory of 1524 1624 NFRTXFV.exe 224 PID 1524 wrote to memory of 1452 1524 cmd.exe 228 PID 1452 wrote to memory of 4644 1452 RVXT.exe 229 PID 4644 wrote to memory of 1248 4644 cmd.exe 233 PID 1248 wrote to memory of 2980 1248 SYB.exe 234 PID 2980 wrote to memory of 2952 2980 cmd.exe 238 PID 2952 wrote to memory of 804 2952 KTFSC.exe 239 PID 804 wrote to memory of 4816 804 cmd.exe 243 PID 4816 wrote to memory of 5716 4816 FPKCMLJ.exe 244 PID 5716 wrote to memory of 240 5716 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_8deb190f37ee4e42ddac59c76f088a82_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FDKSG.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\windows\FDKSG.exeC:\windows\FDKSG.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BWBJNQL.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\windows\BWBJNQL.exeC:\windows\BWBJNQL.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LUOVVZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\SysWOW64\LUOVVZ.exeC:\windows\system32\LUOVVZ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OPGFOKJ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\windows\OPGFOKJ.exeC:\windows\OPGFOKJ.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVY.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\windows\system\OVY.exeC:\windows\system\OVY.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQHYBK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\SysWOW64\DQHYBK.exeC:\windows\system32\DQHYBK.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYJDMPP.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\windows\MYJDMPP.exeC:\windows\MYJDMPP.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWXX.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\windows\SysWOW64\WWXX.exeC:\windows\system32\WWXX.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJCGEX.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\system\RJCGEX.exeC:\windows\system\RJCGEX.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RMGKJ.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\SysWOW64\RMGKJ.exeC:\windows\system32\RMGKJ.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKLW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\windows\SysWOW64\TKLW.exeC:\windows\system32\TKLW.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NCB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\SysWOW64\NCB.exeC:\windows\system32\NCB.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HQFZ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\windows\HQFZ.exeC:\windows\HQFZ.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLXZPSJ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\windows\NLXZPSJ.exeC:\windows\NLXZPSJ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TLEN.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\windows\SysWOW64\TLEN.exeC:\windows\system32\TLEN.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTTNKMG.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\windows\XTTNKMG.exeC:\windows\XTTNKMG.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VPK.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\system\VPK.exeC:\windows\system\VPK.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QAA.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\windows\SysWOW64\QAA.exeC:\windows\system32\QAA.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LNFE.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\system\LNFE.exeC:\windows\system\LNFE.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADGVMN.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\system\ADGVMN.exeC:\windows\system\ADGVMN.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GDO.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\GDO.exeC:\windows\GDO.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBT.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\system\IBT.exeC:\windows\system\IBT.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DOYN.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\SysWOW64\DOYN.exeC:\windows\system32\DOYN.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DRCRAG.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\windows\SysWOW64\DRCRAG.exeC:\windows\system32\DRCRAG.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PKFBJVK.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\windows\SysWOW64\PKFBJVK.exeC:\windows\system32\PKFBJVK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TSMJV.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\system\TSMJV.exeC:\windows\system\TSMJV.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFRTXFV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\SysWOW64\NFRTXFV.exeC:\windows\system32\NFRTXFV.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVXT.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\windows\RVXT.exeC:\windows\RVXT.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SYB.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\windows\SysWOW64\SYB.exeC:\windows\system32\SYB.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTFSC.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\system\KTFSC.exeC:\windows\system\KTFSC.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPKCMLJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\windows\FPKCMLJ.exeC:\windows\FPKCMLJ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKNFS.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\windows\system\GKNFS.exeC:\windows\system\GKNFS.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNF.exe.bat" "66⤵PID:2308
-
C:\windows\system\VNF.exeC:\windows\system\VNF.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QACTN.exe.bat" "68⤵PID:832
-
C:\windows\QACTN.exeC:\windows\QACTN.exe69⤵
- Executes dropped EXE
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZAEGRT.exe.bat" "70⤵PID:5672
-
C:\windows\system\ZAEGRT.exeC:\windows\system\ZAEGRT.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTH.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5964 -
C:\windows\system\KTH.exeC:\windows\system\KTH.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJNZL.exe.bat" "74⤵PID:5536
-
C:\windows\WJNZL.exeC:\windows\WJNZL.exe75⤵
- Executes dropped EXE
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PERVRJW.exe.bat" "76⤵PID:1344
-
C:\windows\system\PERVRJW.exeC:\windows\system\PERVRJW.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEZJ.exe.bat" "78⤵PID:2088
-
C:\windows\SysWOW64\VEZJ.exeC:\windows\system32\VEZJ.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PAESKD.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3512 -
C:\windows\PAESKD.exeC:\windows\PAESKD.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAGFNIP.exe.bat" "82⤵PID:2920
-
C:\windows\GAGFNIP.exeC:\windows\GAGFNIP.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSJ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4092 -
C:\windows\system\SSJ.exeC:\windows\system\SSJ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGNHG.exe.bat" "86⤵PID:808
-
C:\windows\MGNHG.exeC:\windows\MGNHG.exe87⤵
- Executes dropped EXE
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLYWWL.exe.bat" "88⤵PID:6064
-
C:\windows\system\JLYWWL.exeC:\windows\system\JLYWWL.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUACAQP.exe.bat" "90⤵PID:3004
-
C:\windows\SysWOW64\SUACAQP.exeC:\windows\system32\SUACAQP.exe91⤵
- Executes dropped EXE
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHEL.exe.bat" "92⤵PID:4912
-
C:\windows\VHEL.exeC:\windows\VHEL.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKIHPG.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:3752 -
C:\windows\system\OKIHPG.exeC:\windows\system\OKIHPG.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XKKU.exe.bat" "96⤵PID:4264
-
C:\windows\system\XKKU.exeC:\windows\system\XKKU.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQQJ.exe.bat" "98⤵PID:3396
-
C:\windows\system\TQQJ.exeC:\windows\system\TQQJ.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYXRMF.exe.bat" "100⤵PID:4864
-
C:\windows\XYXRMF.exeC:\windows\XYXRMF.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JODRYY.exe.bat" "102⤵PID:5836
-
C:\windows\system\JODRYY.exeC:\windows\system\JODRYY.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "104⤵PID:1284
-
C:\windows\system\LMR.exeC:\windows\system\LMR.exe105⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRJA.exe.bat" "106⤵PID:4220
-
C:\windows\TRJA.exeC:\windows\TRJA.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4704 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSY.exe.bat" "110⤵PID:2324
-
C:\windows\SysWOW64\XSY.exeC:\windows\system32\XSY.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OAAGT.exe.bat" "112⤵PID:468
-
C:\windows\OAAGT.exeC:\windows\OAAGT.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNFQVN.exe.bat" "114⤵PID:5632
-
C:\windows\SysWOW64\JNFQVN.exeC:\windows\system32\JNFQVN.exe115⤵
- Executes dropped EXE
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOH.exe.bat" "116⤵PID:4916
-
C:\windows\SOH.exeC:\windows\SOH.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOPQP.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4804 -
C:\windows\system\YOPQP.exeC:\windows\system\YOPQP.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEQ.exe.bat" "120⤵PID:5196
-
C:\windows\system\NEQ.exeC:\windows\system\NEQ.exe121⤵
- Executes dropped EXE
PID:1364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-