Analysis
- max time kernel
97s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 04:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe
- Size 208KB
- Sample260707-fe3qaae17n
- SHA256 2af4eb6df15d0efd6efc8417b726d26556372991299f10be79df8d2a2febd82b
- MD5 265cb57b442f844ea7e99710b82f72fd
- SHA1 c9a6c684f814ecbb2fdfa88f9fae75f6b53969d7
- SHA512 9c937f14f87bbd24bf473b2988f4e51a37d2b619c027abb7c861ace3e15ff2fc4cb53914a8aa73cc2a189df98e85a31399f996451d1e80bb1d989257a945f942
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf94pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOFkEj1
- TLSH T100247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3880 UJSDPT.exe 2412 UELOYE.exe 624 AESBHY.exe 1304 JMUG.exe 2636 NUBOFOP.exe 904 EDD.exe 6024 XYHPO.exe 5492 MBQ.exe 252 FWUXMUK.exe 5580 IRZH.exe 3488 TKCZX.exe 4264 RKJNG.exe 1896 TXOXQVE.exe 3240 MSSAVT.exe 1988 HOXKGTV.exe 2144 BBCT.exe 1332 MTXMY.exe 6020 SUE.exe 2940 YPDA.exe 3540 HUOSCU.exe 5672 KQT.exe 5036 KVTQ.exe 5584 FJYAQG.exe 3876 ZWDJAGY.exe 2512 HOD.exe 3820 WUJI.exe 5416 EAJWW.exe 5304 DKKPK.exe 3096 PDNISB.exe 2060 XVVKYFC.exe 5668 GWXPK.exe 4088 ROSI.exe 3244 CHVAS.exe 5896 CZEUGDQ.exe 4964 ZFKRNNS.exe 4384 KXF.exe 4228 OFMKIN.exe 3416 AVA.exe 6132 UJXBW.exe 2328 PWCKGFV.exe 3964 VRBL.exe 2432 KPHI.exe 4076 EKMSCJ.exe 5084 QSSAH.exe 1412 BLVTP.exe 1360 HLDGYLG.exe 1148 RTFLJ.exe 5464 LHCVMIW.exe 964 XZFOUY.exe 3856 CAM.exe 5328 CKVV.exe 1732 KYNJSJ.exe 1564 QYVXJLY.exe 5248 QEVLLQB.exe 4872 WEDZU.exe 4244 CEKNDVD.exe 3424 QKQK.exe 4824 HVGIRRB.exe 2584 NVOV.exe 4444 TVWJKN.exe 5340 KVYONTF.exe 6036 XGGNBWB.exe 2228 HHIS.exe 6084 DMO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\YPDA.exe SUE.exe File created C:\windows\SysWOW64\KXF.exe ZFKRNNS.exe File created C:\windows\SysWOW64\HVGIRRB.exe QKQK.exe File opened for modification C:\windows\SysWOW64\DYZIV.exe VKHUT.exe File opened for modification C:\windows\SysWOW64\WCDFKX.exe CGZW.exe File created C:\windows\SysWOW64\VNBNYEN.exe ICSOSBR.exe File created C:\windows\SysWOW64\WGTHN.exe.bat BSO.exe File created C:\windows\SysWOW64\YTSZUS.exe.bat JYI.exe File created C:\windows\SysWOW64\EAJWW.exe WUJI.exe File opened for modification C:\windows\SysWOW64\HTU.exe YTSZUS.exe File created C:\windows\SysWOW64\ZFKRNNS.exe.bat CZEUGDQ.exe File opened for modification C:\windows\SysWOW64\RTFLJ.exe HLDGYLG.exe File created C:\windows\SysWOW64\YTSZUS.exe JYI.exe File opened for modification C:\windows\SysWOW64\QAEXMP.exe BFU.exe File opened for modification C:\windows\SysWOW64\ZWDJAGY.exe FJYAQG.exe File created C:\windows\SysWOW64\KXF.exe.bat ZFKRNNS.exe File opened for modification C:\windows\SysWOW64\WGTHN.exe BSO.exe File created C:\windows\SysWOW64\CXRERQL.exe.bat IBUVP.exe File created C:\windows\SysWOW64\AESBHY.exe UELOYE.exe File opened for modification C:\windows\SysWOW64\TXOXQVE.exe RKJNG.exe File opened for modification C:\windows\SysWOW64\GWXPK.exe XVVKYFC.exe File created C:\windows\SysWOW64\GKV.exe.bat MXQLSN.exe File created C:\windows\SysWOW64\ITSFABS.exe NGNWQ.exe File created C:\windows\SysWOW64\CPXP.exe ITSFABS.exe File created C:\windows\SysWOW64\QAEXMP.exe BFU.exe File created C:\windows\SysWOW64\TBJ.exe.bat LWJ.exe File created C:\windows\SysWOW64\GWXPK.exe.bat XVVKYFC.exe File opened for modification C:\windows\SysWOW64\PWCKGFV.exe UJXBW.exe File opened for modification C:\windows\SysWOW64\YTSZUS.exe JYI.exe File opened for modification C:\windows\SysWOW64\VNBNYEN.exe ICSOSBR.exe File created C:\windows\SysWOW64\UELOYE.exe UJSDPT.exe File created C:\windows\SysWOW64\WCDFKX.exe.bat CGZW.exe File created C:\windows\SysWOW64\LWJ.exe QAEXMP.exe File opened for modification C:\windows\SysWOW64\ZFKRNNS.exe CZEUGDQ.exe File opened for modification C:\windows\SysWOW64\KYNJSJ.exe CKVV.exe File opened for modification C:\windows\SysWOW64\AKKF.exe WCDFKX.exe File opened for modification C:\windows\SysWOW64\TBJ.exe LWJ.exe File opened for modification C:\windows\SysWOW64\CJBOMAN.exe BGPLH.exe File created C:\windows\SysWOW64\PWCKGFV.exe.bat UJXBW.exe File created C:\windows\SysWOW64\RJLBI.exe CGCXXAR.exe File opened for modification C:\windows\SysWOW64\RJLBI.exe CGCXXAR.exe File created C:\windows\SysWOW64\TXOXQVE.exe.bat RKJNG.exe File opened for modification C:\windows\SysWOW64\SUE.exe MTXMY.exe File created C:\windows\SysWOW64\YPDA.exe SUE.exe File created C:\windows\SysWOW64\YPDA.exe.bat SUE.exe File created C:\windows\SysWOW64\RTFLJ.exe HLDGYLG.exe File created C:\windows\SysWOW64\TKCZX.exe IRZH.exe File created C:\windows\SysWOW64\RJLBI.exe.bat CGCXXAR.exe File created C:\windows\SysWOW64\LWJ.exe.bat QAEXMP.exe File created C:\windows\SysWOW64\SUE.exe MTXMY.exe File created C:\windows\SysWOW64\KYNJSJ.exe CKVV.exe File created C:\windows\SysWOW64\QEVLLQB.exe QYVXJLY.exe File opened for modification C:\windows\SysWOW64\CPXP.exe ITSFABS.exe File opened for modification C:\windows\SysWOW64\AESBHY.exe UELOYE.exe File opened for modification C:\windows\SysWOW64\WEDZU.exe QEVLLQB.exe File created C:\windows\SysWOW64\CPXP.exe.bat ITSFABS.exe File created C:\windows\SysWOW64\VNBNYEN.exe.bat ICSOSBR.exe File opened for modification C:\windows\SysWOW64\TKCZX.exe IRZH.exe File created C:\windows\SysWOW64\KYNJSJ.exe.bat CKVV.exe File created C:\windows\SysWOW64\WEDZU.exe.bat QEVLLQB.exe File created C:\windows\SysWOW64\HVGIRRB.exe.bat QKQK.exe File opened for modification C:\windows\SysWOW64\LBGMV.exe QNB.exe File created C:\windows\SysWOW64\HTU.exe YTSZUS.exe File opened for modification C:\windows\SysWOW64\PDNISB.exe DKKPK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\AVA.exe OFMKIN.exe File created C:\windows\CAM.exe XZFOUY.exe File created C:\windows\system\ECGPPSJ.exe.bat BPBXN.exe File created C:\windows\JYI.exe OCDLQGG.exe File created C:\windows\CAM.exe.bat XZFOUY.exe File opened for modification C:\windows\NBZJS.exe NYV.exe File created C:\windows\XZFOUY.exe LHCVMIW.exe File opened for modification C:\windows\LYBCC.exe PSVF.exe File created C:\windows\NQBYQ.exe.bat XFKKDI.exe File created C:\windows\system\HUOSCU.exe.bat YPDA.exe File created C:\windows\system\XGGNBWB.exe KVYONTF.exe File created C:\windows\system\LCKYY.exe.bat NHTXTMG.exe File opened for modification C:\windows\system\IBUVP.exe IWUG.exe File opened for modification C:\windows\system\BGPLH.exe ULFGWPD.exe File created C:\windows\system\KQT.exe HUOSCU.exe File created C:\windows\system\HHIS.exe.bat XGGNBWB.exe File created C:\windows\VAURI.exe.bat RRG.exe File created C:\windows\system\DSOEVQ.exe.bat DMO.exe File created C:\windows\system\CZEUGDQ.exe.bat CHVAS.exe File created C:\windows\system\BLVTP.exe QSSAH.exe File created C:\windows\system\QYVXJLY.exe.bat KYNJSJ.exe File created C:\windows\NQBYQ.exe XFKKDI.exe File created C:\windows\NBZJS.exe.bat NYV.exe File created C:\windows\ULFGWPD.exe.bat SXBXL.exe File opened for modification C:\windows\WUJI.exe HOD.exe File created C:\windows\QSSAH.exe.bat EKMSCJ.exe File opened for modification C:\windows\LHCVMIW.exe RTFLJ.exe File opened for modification C:\windows\ICSOSBR.exe OPOFI.exe File created C:\windows\COT.exe.bat CJBOMAN.exe File created C:\windows\UJSDPT.exe 2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe File created C:\windows\system\NTD.exe WGTHN.exe File created C:\windows\system\NYV.exe.bat NTD.exe File created C:\windows\QNZASUG.exe.bat VAURI.exe File opened for modification C:\windows\BFU.exe QNZASUG.exe File created C:\windows\OPOFI.exe TBJ.exe File opened for modification C:\windows\system\HUOSCU.exe YPDA.exe File created C:\windows\HOD.exe.bat ZWDJAGY.exe File opened for modification C:\windows\GLGMNWB.exe LYBCC.exe File created C:\windows\RRG.exe.bat NBZJS.exe File created C:\windows\system\IWUG.exe TBLUUQ.exe File opened for modification C:\windows\EDD.exe NUBOFOP.exe File created C:\windows\CEKNDVD.exe WEDZU.exe File opened for modification C:\windows\PSVF.exe SNXIGKI.exe File created C:\windows\system\GPPPAPL.exe LCKYY.exe File opened for modification C:\windows\system\IRZH.exe FWUXMUK.exe File created C:\windows\RKJNG.exe TKCZX.exe File created C:\windows\system\MGF.exe GLGMNWB.exe File opened for modification C:\windows\ULFGWPD.exe SXBXL.exe File created C:\windows\system\KVYONTF.exe.bat TVWJKN.exe File opened for modification C:\windows\DMO.exe HHIS.exe File created C:\windows\PSVF.exe SNXIGKI.exe File created C:\windows\PSVF.exe.bat SNXIGKI.exe File opened for modification C:\windows\QNB.exe GQVJ.exe File opened for modification C:\windows\HOXKGTV.exe MSSAVT.exe File opened for modification C:\windows\system\DSOEVQ.exe DMO.exe File created C:\windows\system\VKHUT.exe.bat GPPPAPL.exe File opened for modification C:\windows\CHVAS.exe ROSI.exe File opened for modification C:\windows\system\RBNAMCE.exe LBGMV.exe File created C:\windows\YLESFOD.exe.bat DYZIV.exe File created C:\windows\UCBWHNZ.exe.bat CXRERQL.exe File created C:\windows\UJSDPT.exe.bat 2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe File created C:\windows\FWUXMUK.exe.bat MBQ.exe File created C:\windows\DKKPK.exe.bat EAJWW.exe File opened for modification C:\windows\BPBXN.exe FKJIXPS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 1388 4772 WerFault.exe 85 1360 3880 WerFault.exe 90 1204 2412 WerFault.exe 96 4824 624 WerFault.exe 101 3996 1304 WerFault.exe 106 3096 2636 WerFault.exe 111 5292 904 WerFault.exe 116 5768 6024 WerFault.exe 121 236 5492 WerFault.exe 126 3760 252 WerFault.exe 131 5840 5580 WerFault.exe 136 752 3488 WerFault.exe 141 5112 4264 WerFault.exe 146 3984 1896 WerFault.exe 151 3020 3240 WerFault.exe 156 6132 1988 WerFault.exe 161 2160 2144 WerFault.exe 166 1832 1332 WerFault.exe 171 5732 6020 WerFault.exe 176 4748 2940 WerFault.exe 181 2676 3540 WerFault.exe 186 5032 5672 WerFault.exe 191 4576 5036 WerFault.exe 196 4128 5584 WerFault.exe 201 616 3876 WerFault.exe 206 3372 2512 WerFault.exe 211 3480 3820 WerFault.exe 216 896 5416 WerFault.exe 221 3664 5304 WerFault.exe 226 5572 3096 WerFault.exe 231 1084 2060 WerFault.exe 236 2248 5668 WerFault.exe 241 4976 4088 WerFault.exe 246 4564 3244 WerFault.exe 251 1920 5896 WerFault.exe 256 2404 4964 WerFault.exe 261 5704 4384 WerFault.exe 266 5208 4228 WerFault.exe 271 3024 3416 WerFault.exe 276 1236 6132 WerFault.exe 281 3164 2328 WerFault.exe 286 5468 3964 WerFault.exe 291 2504 2432 WerFault.exe 296 6040 4076 WerFault.exe 301 1944 5084 WerFault.exe 306 2392 1412 WerFault.exe 311 6000 1360 WerFault.exe 316 1600 1148 WerFault.exe 321 1220 5464 WerFault.exe 326 944 964 WerFault.exe 331 4904 3856 WerFault.exe 336 1928 5328 WerFault.exe 341 3360 1732 WerFault.exe 346 2016 1564 WerFault.exe 351 5968 5248 WerFault.exe 356 2548 4872 WerFault.exe 361 5608 4244 WerFault.exe 366 5720 3424 WerFault.exe 371 2308 4824 WerFault.exe 376 2488 2584 WerFault.exe 381 5952 4444 WerFault.exe 386 5732 5340 WerFault.exe 391 5100 6036 WerFault.exe 396 2724 2228 WerFault.exe 401 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKMSCJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHCVMIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGGNBWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNZASUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVKGTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEKNDVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJLBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCKYY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLVTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYHPO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYNJSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYBCC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GPPPAPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCBWHNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXBXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAEXMP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AESBHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGCXXAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYZIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBLUUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHTXTMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPDA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4772 2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe 4772 2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe 3880 UJSDPT.exe 3880 UJSDPT.exe 2412 UELOYE.exe 2412 UELOYE.exe 624 AESBHY.exe 624 AESBHY.exe 1304 JMUG.exe 1304 JMUG.exe 2636 NUBOFOP.exe 2636 NUBOFOP.exe 904 EDD.exe 904 EDD.exe 6024 XYHPO.exe 6024 XYHPO.exe 5492 MBQ.exe 5492 MBQ.exe 252 FWUXMUK.exe 252 FWUXMUK.exe 5580 IRZH.exe 5580 IRZH.exe 3488 TKCZX.exe 3488 TKCZX.exe 4264 RKJNG.exe 4264 RKJNG.exe 1896 TXOXQVE.exe 1896 TXOXQVE.exe 3240 MSSAVT.exe 3240 MSSAVT.exe 1988 HOXKGTV.exe 1988 HOXKGTV.exe 2144 BBCT.exe 2144 BBCT.exe 1332 MTXMY.exe 1332 MTXMY.exe 6020 SUE.exe 6020 SUE.exe 2940 YPDA.exe 2940 YPDA.exe 3540 HUOSCU.exe 3540 HUOSCU.exe 5672 KQT.exe 5672 KQT.exe 5036 KVTQ.exe 5036 KVTQ.exe 5584 FJYAQG.exe 5584 FJYAQG.exe 3876 ZWDJAGY.exe 3876 ZWDJAGY.exe 2512 HOD.exe 2512 HOD.exe 3820 WUJI.exe 3820 WUJI.exe 5416 EAJWW.exe 5416 EAJWW.exe 5304 DKKPK.exe 5304 DKKPK.exe 3096 PDNISB.exe 3096 PDNISB.exe 2060 XVVKYFC.exe 2060 XVVKYFC.exe 5668 GWXPK.exe 5668 GWXPK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4772 2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe 4772 2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe 3880 UJSDPT.exe 3880 UJSDPT.exe 2412 UELOYE.exe 2412 UELOYE.exe 624 AESBHY.exe 624 AESBHY.exe 1304 JMUG.exe 1304 JMUG.exe 2636 NUBOFOP.exe 2636 NUBOFOP.exe 904 EDD.exe 904 EDD.exe 6024 XYHPO.exe 6024 XYHPO.exe 5492 MBQ.exe 5492 MBQ.exe 252 FWUXMUK.exe 252 FWUXMUK.exe 5580 IRZH.exe 5580 IRZH.exe 3488 TKCZX.exe 3488 TKCZX.exe 4264 RKJNG.exe 4264 RKJNG.exe 1896 TXOXQVE.exe 1896 TXOXQVE.exe 3240 MSSAVT.exe 3240 MSSAVT.exe 1988 HOXKGTV.exe 1988 HOXKGTV.exe 2144 BBCT.exe 2144 BBCT.exe 1332 MTXMY.exe 1332 MTXMY.exe 6020 SUE.exe 6020 SUE.exe 2940 YPDA.exe 2940 YPDA.exe 3540 HUOSCU.exe 3540 HUOSCU.exe 5672 KQT.exe 5672 KQT.exe 5036 KVTQ.exe 5036 KVTQ.exe 5584 FJYAQG.exe 5584 FJYAQG.exe 3876 ZWDJAGY.exe 3876 ZWDJAGY.exe 2512 HOD.exe 2512 HOD.exe 3820 WUJI.exe 3820 WUJI.exe 5416 EAJWW.exe 5416 EAJWW.exe 5304 DKKPK.exe 5304 DKKPK.exe 3096 PDNISB.exe 3096 PDNISB.exe 2060 XVVKYFC.exe 2060 XVVKYFC.exe 5668 GWXPK.exe 5668 GWXPK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4772 wrote to memory of 5176 4772 2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe 86 PID 5176 wrote to memory of 3880 5176 cmd.exe 90 PID 3880 wrote to memory of 4232 3880 UJSDPT.exe 92 PID 4232 wrote to memory of 2412 4232 cmd.exe 96 PID 2412 wrote to memory of 4920 2412 UELOYE.exe 97 PID 4920 wrote to memory of 624 4920 cmd.exe 101 PID 624 wrote to memory of 5692 624 AESBHY.exe 102 PID 5692 wrote to memory of 1304 5692 cmd.exe 106 PID 1304 wrote to memory of 1096 1304 JMUG.exe 107 PID 1096 wrote to memory of 2636 1096 cmd.exe 111 PID 2636 wrote to memory of 4496 2636 NUBOFOP.exe 112 PID 4496 wrote to memory of 904 4496 cmd.exe 116 PID 904 wrote to memory of 1380 904 EDD.exe 117 PID 1380 wrote to memory of 6024 1380 cmd.exe 121 PID 6024 wrote to memory of 1248 6024 XYHPO.exe 122 PID 1248 wrote to memory of 5492 1248 cmd.exe 126 PID 5492 wrote to memory of 3444 5492 MBQ.exe 127 PID 3444 wrote to memory of 252 3444 cmd.exe 131 PID 252 wrote to memory of 3904 252 FWUXMUK.exe 132 PID 3904 wrote to memory of 5580 3904 cmd.exe 136 PID 5580 wrote to memory of 352 5580 IRZH.exe 137 PID 352 wrote to memory of 3488 352 cmd.exe 141 PID 3488 wrote to memory of 1016 3488 TKCZX.exe 142 PID 1016 wrote to memory of 4264 1016 cmd.exe 146 PID 4264 wrote to memory of 1328 4264 RKJNG.exe 147 PID 1328 wrote to memory of 1896 1328 cmd.exe 151 PID 1896 wrote to memory of 5508 1896 TXOXQVE.exe 152 PID 5508 wrote to memory of 3240 5508 cmd.exe 156 PID 3240 wrote to memory of 3636 3240 MSSAVT.exe 157 PID 3636 wrote to memory of 1988 3636 cmd.exe 161 PID 1988 wrote to memory of 2148 1988 HOXKGTV.exe 162 PID 2148 wrote to memory of 2144 2148 cmd.exe 166 PID 2144 wrote to memory of 3332 2144 BBCT.exe 167 PID 3332 wrote to memory of 1332 3332 cmd.exe 171 PID 1332 wrote to memory of 2928 1332 MTXMY.exe 172 PID 2928 wrote to memory of 6020 2928 cmd.exe 176 PID 6020 wrote to memory of 1420 6020 SUE.exe 177 PID 1420 wrote to memory of 2940 1420 cmd.exe 181 PID 2940 wrote to memory of 5844 2940 YPDA.exe 182 PID 5844 wrote to memory of 3540 5844 cmd.exe 186 PID 3540 wrote to memory of 1424 3540 HUOSCU.exe 187 PID 1424 wrote to memory of 5672 1424 cmd.exe 191 PID 5672 wrote to memory of 2876 5672 KQT.exe 192 PID 2876 wrote to memory of 5036 2876 cmd.exe 196 PID 5036 wrote to memory of 5396 5036 KVTQ.exe 197 PID 5396 wrote to memory of 5584 5396 cmd.exe 201 PID 5584 wrote to memory of 4260 5584 FJYAQG.exe 202 PID 4260 wrote to memory of 3876 4260 cmd.exe 206 PID 3876 wrote to memory of 4136 3876 ZWDJAGY.exe 207 PID 4136 wrote to memory of 2512 4136 cmd.exe 211 PID 2512 wrote to memory of 4400 2512 HOD.exe 212 PID 4400 wrote to memory of 3820 4400 cmd.exe 216 PID 3820 wrote to memory of 3612 3820 WUJI.exe 217 PID 3612 wrote to memory of 5416 3612 cmd.exe 221 PID 5416 wrote to memory of 1256 5416 EAJWW.exe 222 PID 1256 wrote to memory of 5304 1256 cmd.exe 226 PID 5304 wrote to memory of 2508 5304 DKKPK.exe 227 PID 2508 wrote to memory of 3096 2508 cmd.exe 231 PID 3096 wrote to memory of 296 3096 PDNISB.exe 232 PID 296 wrote to memory of 2060 296 cmd.exe 236 PID 2060 wrote to memory of 892 2060 XVVKYFC.exe 237 PID 892 wrote to memory of 5668 892 cmd.exe 241 PID 5668 wrote to memory of 1660 5668 GWXPK.exe 242 PID 1660 wrote to memory of 4088 1660 cmd.exe 246
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_265cb57b442f844ea7e99710b82f72fd_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJSDPT.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\UJSDPT.exeC:\windows\UJSDPT.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UELOYE.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\windows\SysWOW64\UELOYE.exeC:\windows\system32\UELOYE.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AESBHY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\SysWOW64\AESBHY.exeC:\windows\system32\AESBHY.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMUG.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\JMUG.exeC:\windows\JMUG.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NUBOFOP.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\windows\NUBOFOP.exeC:\windows\NUBOFOP.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDD.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\windows\EDD.exeC:\windows\EDD.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBQ.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\MBQ.exeC:\windows\MBQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWUXMUK.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\FWUXMUK.exeC:\windows\FWUXMUK.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRZH.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\windows\system\IRZH.exeC:\windows\system\IRZH.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKCZX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:352 -
C:\windows\SysWOW64\TKCZX.exeC:\windows\system32\TKCZX.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKJNG.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\windows\RKJNG.exeC:\windows\RKJNG.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXOXQVE.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\SysWOW64\TXOXQVE.exeC:\windows\system32\TXOXQVE.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSSAVT.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\MSSAVT.exeC:\windows\MSSAVT.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOXKGTV.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\windows\HOXKGTV.exeC:\windows\HOXKGTV.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBCT.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\system\BBCT.exeC:\windows\system\BBCT.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTXMY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\windows\MTXMY.exeC:\windows\MTXMY.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUE.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\SysWOW64\SUE.exeC:\windows\system32\SUE.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPDA.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\windows\SysWOW64\YPDA.exeC:\windows\system32\YPDA.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUOSCU.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\system\HUOSCU.exeC:\windows\system\HUOSCU.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\windows\system\KQT.exeC:\windows\system\KQT.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KVTQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\windows\system\KVTQ.exeC:\windows\system\KVTQ.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJYAQG.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\windows\FJYAQG.exeC:\windows\FJYAQG.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZWDJAGY.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\SysWOW64\ZWDJAGY.exeC:\windows\system32\ZWDJAGY.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOD.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\HOD.exeC:\windows\HOD.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUJI.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\WUJI.exeC:\windows\WUJI.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EAJWW.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\SysWOW64\EAJWW.exeC:\windows\system32\EAJWW.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DKKPK.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\windows\DKKPK.exeC:\windows\DKKPK.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDNISB.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\SysWOW64\PDNISB.exeC:\windows\system32\PDNISB.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XVVKYFC.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:296 -
C:\windows\system\XVVKYFC.exeC:\windows\system\XVVKYFC.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWXPK.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\windows\SysWOW64\GWXPK.exeC:\windows\system32\GWXPK.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROSI.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\windows\system\ROSI.exeC:\windows\system\ROSI.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CHVAS.exe.bat" "66⤵PID:3528
-
C:\windows\CHVAS.exeC:\windows\CHVAS.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZEUGDQ.exe.bat" "68⤵PID:5744
-
C:\windows\system\CZEUGDQ.exeC:\windows\system\CZEUGDQ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFKRNNS.exe.bat" "70⤵PID:1840
-
C:\windows\SysWOW64\ZFKRNNS.exeC:\windows\system32\ZFKRNNS.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXF.exe.bat" "72⤵PID:3180
-
C:\windows\SysWOW64\KXF.exeC:\windows\system32\KXF.exe73⤵
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OFMKIN.exe.bat" "74⤵PID:2068
-
C:\windows\system\OFMKIN.exeC:\windows\system\OFMKIN.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AVA.exe.bat" "76⤵PID:3372
-
C:\windows\AVA.exeC:\windows\AVA.exe77⤵
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJXBW.exe.bat" "78⤵PID:4980
-
C:\windows\UJXBW.exeC:\windows\UJXBW.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PWCKGFV.exe.bat" "80⤵PID:2076
-
C:\windows\SysWOW64\PWCKGFV.exeC:\windows\system32\PWCKGFV.exe81⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRBL.exe.bat" "82⤵PID:2208
-
C:\windows\system\VRBL.exeC:\windows\system\VRBL.exe83⤵
- Executes dropped EXE
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPHI.exe.bat" "84⤵PID:2260
-
C:\windows\KPHI.exeC:\windows\KPHI.exe85⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EKMSCJ.exe.bat" "86⤵PID:4456
-
C:\windows\system\EKMSCJ.exeC:\windows\system\EKMSCJ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSSAH.exe.bat" "88⤵PID:4740
-
C:\windows\QSSAH.exeC:\windows\QSSAH.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BLVTP.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2752 -
C:\windows\system\BLVTP.exeC:\windows\system\BLVTP.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLDGYLG.exe.bat" "92⤵PID:792
-
C:\windows\system\HLDGYLG.exeC:\windows\system\HLDGYLG.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RTFLJ.exe.bat" "94⤵PID:672
-
C:\windows\SysWOW64\RTFLJ.exeC:\windows\system32\RTFLJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHCVMIW.exe.bat" "96⤵PID:4636
-
C:\windows\LHCVMIW.exeC:\windows\LHCVMIW.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XZFOUY.exe.bat" "98⤵PID:5828
-
C:\windows\XZFOUY.exeC:\windows\XZFOUY.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAM.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4348 -
C:\windows\CAM.exeC:\windows\CAM.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKVV.exe.bat" "102⤵PID:1472
-
C:\windows\CKVV.exeC:\windows\CKVV.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYNJSJ.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1800 -
C:\windows\SysWOW64\KYNJSJ.exeC:\windows\system32\KYNJSJ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QYVXJLY.exe.bat" "106⤵PID:2588
-
C:\windows\system\QYVXJLY.exeC:\windows\system\QYVXJLY.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEVLLQB.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\windows\SysWOW64\QEVLLQB.exeC:\windows\system32\QEVLLQB.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEDZU.exe.bat" "110⤵PID:2036
-
C:\windows\SysWOW64\WEDZU.exeC:\windows\system32\WEDZU.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEKNDVD.exe.bat" "112⤵PID:5228
-
C:\windows\CEKNDVD.exeC:\windows\CEKNDVD.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKQK.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:2704 -
C:\windows\SysWOW64\QKQK.exeC:\windows\system32\QKQK.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVGIRRB.exe.bat" "116⤵PID:912
-
C:\windows\SysWOW64\HVGIRRB.exeC:\windows\system32\HVGIRRB.exe117⤵
- Executes dropped EXE
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVOV.exe.bat" "118⤵PID:260
-
C:\windows\SysWOW64\NVOV.exeC:\windows\system32\NVOV.exe119⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TVWJKN.exe.bat" "120⤵PID:4020
-
C:\windows\TVWJKN.exeC:\windows\TVWJKN.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-