Analysis
- max time kernel
85s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 12:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe
- Size 208KB
- Sample260711-pva5msct9x
- SHA256 00ba80ac959f2b96e517ba61867aec48f9d9e3ca28ba5782851a1f5705ba9bed
- MD5 ae38159c88d82a4a2ceb6a48140ea035
- SHA1 8790401aaf1630eb2f60260753b541ef52092290
- SHA512 f8909dbd112539649ca14524f9c172ced15b9cf2e7d828eb25470b54f7fd5d536ad5440f5401b0db0f7c812cd5018fa64a1f27fb6ee381b09f15f176a7c02f70
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfi4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LO6kEj1
- TLSH T154247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1300 XFAF.exe 5996 VQSC.exe 4284 ZGY.exe 1184 TTDTX.exe 4100 MWHPDWL.exe 2700 YEOXP.exe 2092 FUP.exe 1144 PSUJD.exe 1108 TAJRP.exe 4612 UDNMVTC.exe 824 ORR.exe 5412 DUBAQF.exe 4968 TKCZX.exe 4236 CKEFAY.exe 5056 MIJZPH.exe 5776 FLNDVXB.exe 2884 DBGYIK.exe 2040 JWGY.exe 6048 ZRPLYAZ.exe 2196 BPVF.exe 4368 SXXKR.exe 4784 WFDKD.exe 5676 FFFPGV.exe 5084 LGN.exe 3776 COPQB.exe 4704 CYYJH.exe 3504 RPZ.exe 1172 BXBO.exe 2656 ZNM.exe 1888 UIRAW.exe 2868 AVQ.exe 4360 ELWBF.exe 5164 VMYOIY.exe 3040 UJKJD.exe 2576 DKM.exe 240 HASWT.exe 1332 KNXGDTO.exe 796 IIW.exe 3972 XDGTTI.exe 1952 RRL.exe 1612 SUOYJGC.exe 5700 LXS.exe 2420 HUYZV.exe 4924 RDAEZD.exe 1168 DLHE.exe 2500 MTJJW.exe 472 KJCM.exe 1680 FWZVU.exe 5060 QPCOUNK.exe 2556 CHF.exe 4760 NAAA.exe 5052 TAHNUE.exe 1100 NVM.exe 5428 RDTXQ.exe 5720 JMVCTUV.exe 3780 OMCQ.exe 5780 AFFIL.exe 5864 USKSVDA.exe 2736 NVOV.exe 3560 IYWU.exe 2380 ZIVK.exe 4112 DZBSAJ.exe 4116 JZJGJLQ.exe 4420 DMO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\NVM.exe TAHNUE.exe File created C:\windows\SysWOW64\NVM.exe.bat TAHNUE.exe File created C:\windows\SysWOW64\OGGPMOD.exe.bat NDDMH.exe File created C:\windows\SysWOW64\CLWS.exe TCUFILM.exe File created C:\windows\SysWOW64\XYABWI.exe CLWS.exe File created C:\windows\SysWOW64\TKCZX.exe DUBAQF.exe File created C:\windows\SysWOW64\MIJZPH.exe.bat CKEFAY.exe File created C:\windows\SysWOW64\BPVF.exe.bat ZRPLYAZ.exe File created C:\windows\SysWOW64\ZNM.exe.bat BXBO.exe File created C:\windows\SysWOW64\LXS.exe SUOYJGC.exe File created C:\windows\SysWOW64\NAAA.exe.bat CHF.exe File opened for modification C:\windows\SysWOW64\NVM.exe TAHNUE.exe File opened for modification C:\windows\SysWOW64\JMVCTUV.exe RDTXQ.exe File opened for modification C:\windows\SysWOW64\XFAF.exe 2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe File created C:\windows\SysWOW64\TTDTX.exe.bat ZGY.exe File created C:\windows\SysWOW64\BPVF.exe ZRPLYAZ.exe File created C:\windows\SysWOW64\LGN.exe FFFPGV.exe File created C:\windows\SysWOW64\QPCOUNK.exe.bat FWZVU.exe File created C:\windows\SysWOW64\KVZNS.exe CPZZI.exe File opened for modification C:\windows\SysWOW64\XJT.exe OGGPMOD.exe File created C:\windows\SysWOW64\XJT.exe.bat OGGPMOD.exe File opened for modification C:\windows\SysWOW64\BXBO.exe RPZ.exe File created C:\windows\SysWOW64\VMYOIY.exe ELWBF.exe File opened for modification C:\windows\SysWOW64\VMYOIY.exe ELWBF.exe File created C:\windows\SysWOW64\WCU.exe.bat BHPFEZU.exe File opened for modification C:\windows\SysWOW64\OGGPMOD.exe NDDMH.exe File created C:\windows\SysWOW64\TKCZX.exe.bat DUBAQF.exe File created C:\windows\SysWOW64\DBGYIK.exe FLNDVXB.exe File created C:\windows\SysWOW64\SXXKR.exe BPVF.exe File opened for modification C:\windows\SysWOW64\LGN.exe FFFPGV.exe File opened for modification C:\windows\SysWOW64\ZNM.exe BXBO.exe File opened for modification C:\windows\SysWOW64\UJKJD.exe VMYOIY.exe File opened for modification C:\windows\SysWOW64\KNXGDTO.exe HASWT.exe File created C:\windows\SysWOW64\LXS.exe.bat SUOYJGC.exe File created C:\windows\SysWOW64\CKEFAY.exe.bat TKCZX.exe File opened for modification C:\windows\SysWOW64\SXXKR.exe BPVF.exe File created C:\windows\SysWOW64\UJKJD.exe VMYOIY.exe File created C:\windows\SysWOW64\JMVCTUV.exe.bat RDTXQ.exe File opened for modification C:\windows\SysWOW64\NVOV.exe USKSVDA.exe File opened for modification C:\windows\SysWOW64\KVZNS.exe CPZZI.exe File created C:\windows\SysWOW64\ZKCV.exe.bat ZEC.exe File created C:\windows\SysWOW64\SZQJ.exe XMLZSVO.exe File created C:\windows\SysWOW64\XFAF.exe 2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe File created C:\windows\SysWOW64\MWHPDWL.exe.bat TTDTX.exe File opened for modification C:\windows\SysWOW64\DBGYIK.exe FLNDVXB.exe File created C:\windows\SysWOW64\VMYOIY.exe.bat ELWBF.exe File created C:\windows\SysWOW64\KJCM.exe MTJJW.exe File opened for modification C:\windows\SysWOW64\CKK.exe HXFQQU.exe File created C:\windows\SysWOW64\XFAF.exe.bat 2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\MWHPDWL.exe TTDTX.exe File created C:\windows\SysWOW64\LGN.exe.bat FFFPGV.exe File created C:\windows\SysWOW64\COPQB.exe LGN.exe File opened for modification C:\windows\SysWOW64\COPQB.exe LGN.exe File created C:\windows\SysWOW64\KNXGDTO.exe.bat HASWT.exe File opened for modification C:\windows\SysWOW64\WCU.exe BHPFEZU.exe File created C:\windows\SysWOW64\OGGPMOD.exe NDDMH.exe File created C:\windows\SysWOW64\TTDTX.exe ZGY.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat FLNDVXB.exe File created C:\windows\SysWOW64\UJKJD.exe.bat VMYOIY.exe File opened for modification C:\windows\SysWOW64\QPCOUNK.exe FWZVU.exe File created C:\windows\SysWOW64\QRT.exe.bat POIS.exe File opened for modification C:\windows\SysWOW64\SMDMBTN.exe ILB.exe File opened for modification C:\windows\SysWOW64\XYABWI.exe CLWS.exe File opened for modification C:\windows\SysWOW64\MIJZPH.exe CKEFAY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\PSUJD.exe FUP.exe File created C:\windows\system\DLHE.exe.bat RDAEZD.exe File opened for modification C:\windows\system\CPZZI.exe YZTZE.exe File created C:\windows\ZQJ.exe KVZNS.exe File created C:\windows\system\PFLAIS.exe ZKCV.exe File created C:\windows\JHKO.exe AZI.exe File opened for modification C:\windows\system\PSUJD.exe FUP.exe File opened for modification C:\windows\system\JWGY.exe DBGYIK.exe File created C:\windows\system\HUYZV.exe.bat LXS.exe File opened for modification C:\windows\system\TAHNUE.exe NAAA.exe File created C:\windows\IYWU.exe.bat NVOV.exe File created C:\windows\system\CPZZI.exe YZTZE.exe File created C:\windows\ZQJ.exe.bat KVZNS.exe File created C:\windows\system\ORBBL.exe QRT.exe File opened for modification C:\windows\system\TQYC.exe EVOYLD.exe File created C:\windows\system\TQYC.exe.bat EVOYLD.exe File opened for modification C:\windows\system\NDDMH.exe TQYC.exe File created C:\windows\system\NDDMH.exe.bat TQYC.exe File opened for modification C:\windows\system\ILB.exe PLUOO.exe File created C:\windows\system\ILB.exe.bat PLUOO.exe File created C:\windows\FLNDVXB.exe MIJZPH.exe File opened for modification C:\windows\BHPFEZU.exe HUKWU.exe File created C:\windows\ZEC.exe.bat MUL.exe File opened for modification C:\windows\system\PFLAIS.exe ZKCV.exe File opened for modification C:\windows\AZI.exe ORBBL.exe File created C:\windows\system\AVQ.exe UIRAW.exe File created C:\windows\ZGY.exe.bat VQSC.exe File opened for modification C:\windows\WFDKD.exe SXXKR.exe File created C:\windows\system\DKM.exe UJKJD.exe File created C:\windows\system\AFFIL.exe OMCQ.exe File created C:\windows\VBHD.exe ZWBG.exe File created C:\windows\system\QNXAMMQ.exe.bat XJT.exe File created C:\windows\FIONX.exe QNXAMMQ.exe File opened for modification C:\windows\TAJRP.exe PSUJD.exe File opened for modification C:\windows\system\ZRPLYAZ.exe JWGY.exe File opened for modification C:\windows\system\ZIVK.exe IYWU.exe File created C:\windows\system\ZWBG.exe.bat ZQJ.exe File opened for modification C:\windows\system\RTCC.exe GAZ.exe File created C:\windows\PLUOO.exe JYVNKRN.exe File created C:\windows\system\TCUFILM.exe.bat SZQJ.exe File created C:\windows\system\VTMKK.exe.bat AGH.exe File created C:\windows\system\ORR.exe.bat UDNMVTC.exe File opened for modification C:\windows\system\DKM.exe UJKJD.exe File created C:\windows\system\GAZ.exe WCU.exe File created C:\windows\PTKP.exe RTCC.exe File opened for modification C:\windows\system\VTRDWLJ.exe PTKP.exe File opened for modification C:\windows\XMLZSVO.exe SMDMBTN.exe File opened for modification C:\windows\AGH.exe XYABWI.exe File created C:\windows\TAJRP.exe.bat PSUJD.exe File created C:\windows\system\RPZ.exe CYYJH.exe File created C:\windows\RRL.exe.bat XDGTTI.exe File opened for modification C:\windows\OMCQ.exe JMVCTUV.exe File created C:\windows\YZTZE.exe DMO.exe File created C:\windows\system\CPZZI.exe.bat YZTZE.exe File created C:\windows\system\ORBBL.exe.bat QRT.exe File created C:\windows\EVOYLD.exe JHKO.exe File created C:\windows\VBHD.exe.bat ZWBG.exe File opened for modification C:\windows\POIS.exe GNN.exe File created C:\windows\JHKO.exe.bat AZI.exe File created C:\windows\PLUOO.exe.bat JYVNKRN.exe File created C:\windows\AGH.exe XYABWI.exe File created C:\windows\system\VTMKK.exe AGH.exe File opened for modification C:\windows\system\VTMKK.exe AGH.exe File created C:\windows\HJSSWSC.exe.bat VTMKK.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 5892 5888 WerFault.exe 86 2920 1300 WerFault.exe 91 4256 5996 WerFault.exe 97 3264 4284 WerFault.exe 102 3804 1184 WerFault.exe 107 1728 4100 WerFault.exe 112 5124 2700 WerFault.exe 117 1960 2092 WerFault.exe 122 4276 1144 WerFault.exe 127 4360 1108 WerFault.exe 132 4552 4612 WerFault.exe 137 1340 824 WerFault.exe 142 3536 5412 WerFault.exe 147 5144 4968 WerFault.exe 152 1680 4236 WerFault.exe 157 5060 5056 WerFault.exe 162 3560 5776 WerFault.exe 167 5524 2884 WerFault.exe 172 2028 2040 WerFault.exe 177 3716 6048 WerFault.exe 182 4848 2196 WerFault.exe 187 4668 4368 WerFault.exe 192 3864 4784 WerFault.exe 197 4608 5676 WerFault.exe 202 2260 5084 WerFault.exe 207 1680 3776 WerFault.exe 212 5060 4704 WerFault.exe 217 4444 3504 WerFault.exe 222 1396 1172 WerFault.exe 227 2952 2656 WerFault.exe 232 5700 1888 WerFault.exe 237 3400 2868 WerFault.exe 242 1432 4360 WerFault.exe 247 1388 5164 WerFault.exe 252 4392 3040 WerFault.exe 257 2212 2576 WerFault.exe 262 2336 240 WerFault.exe 267 3856 1332 WerFault.exe 272 1564 796 WerFault.exe 277 2140 3972 WerFault.exe 282 1984 1952 WerFault.exe 287 3960 1612 WerFault.exe 292 692 5700 WerFault.exe 297 1556 2420 WerFault.exe 302 3628 4924 WerFault.exe 307 4512 1168 WerFault.exe 312 5924 2500 WerFault.exe 317 4532 472 WerFault.exe 322 2756 1680 WerFault.exe 327 4304 5060 WerFault.exe 332 1584 2556 WerFault.exe 337 3092 4760 WerFault.exe 342 2684 5052 WerFault.exe 347 4712 1100 WerFault.exe 352 5556 5428 WerFault.exe 357 3536 5720 WerFault.exe 362 4516 3780 WerFault.exe 367 1040 5780 WerFault.exe 372 5704 5864 WerFault.exe 377 828 2736 WerFault.exe 382 1584 3560 WerFault.exe 387 3828 2380 WerFault.exe 392 616 4112 WerFault.exe 397 4556 4116 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDDMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMLZSVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMDMBTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZBSAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUKWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PLUOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZJGJLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPZZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXFQQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDAEZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNXAMMQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYABWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTMKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJSSWSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWHPDWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZIVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJCM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKAG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIJZPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5888 2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe 5888 2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe 1300 XFAF.exe 1300 XFAF.exe 5996 VQSC.exe 5996 VQSC.exe 4284 ZGY.exe 4284 ZGY.exe 1184 TTDTX.exe 1184 TTDTX.exe 4100 MWHPDWL.exe 4100 MWHPDWL.exe 2700 YEOXP.exe 2700 YEOXP.exe 2092 FUP.exe 2092 FUP.exe 1144 PSUJD.exe 1144 PSUJD.exe 1108 TAJRP.exe 1108 TAJRP.exe 4612 UDNMVTC.exe 4612 UDNMVTC.exe 824 ORR.exe 824 ORR.exe 5412 DUBAQF.exe 5412 DUBAQF.exe 4968 TKCZX.exe 4968 TKCZX.exe 4236 CKEFAY.exe 4236 CKEFAY.exe 5056 MIJZPH.exe 5056 MIJZPH.exe 5776 FLNDVXB.exe 5776 FLNDVXB.exe 2884 DBGYIK.exe 2884 DBGYIK.exe 2040 JWGY.exe 2040 JWGY.exe 6048 ZRPLYAZ.exe 6048 ZRPLYAZ.exe 2196 BPVF.exe 2196 BPVF.exe 4368 SXXKR.exe 4368 SXXKR.exe 4784 WFDKD.exe 4784 WFDKD.exe 5676 FFFPGV.exe 5676 FFFPGV.exe 5084 LGN.exe 5084 LGN.exe 3776 COPQB.exe 3776 COPQB.exe 4704 CYYJH.exe 4704 CYYJH.exe 3504 RPZ.exe 3504 RPZ.exe 1172 BXBO.exe 1172 BXBO.exe 2656 ZNM.exe 2656 ZNM.exe 1888 UIRAW.exe 1888 UIRAW.exe 2868 AVQ.exe 2868 AVQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5888 2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe 5888 2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe 1300 XFAF.exe 1300 XFAF.exe 5996 VQSC.exe 5996 VQSC.exe 4284 ZGY.exe 4284 ZGY.exe 1184 TTDTX.exe 1184 TTDTX.exe 4100 MWHPDWL.exe 4100 MWHPDWL.exe 2700 YEOXP.exe 2700 YEOXP.exe 2092 FUP.exe 2092 FUP.exe 1144 PSUJD.exe 1144 PSUJD.exe 1108 TAJRP.exe 1108 TAJRP.exe 4612 UDNMVTC.exe 4612 UDNMVTC.exe 824 ORR.exe 824 ORR.exe 5412 DUBAQF.exe 5412 DUBAQF.exe 4968 TKCZX.exe 4968 TKCZX.exe 4236 CKEFAY.exe 4236 CKEFAY.exe 5056 MIJZPH.exe 5056 MIJZPH.exe 5776 FLNDVXB.exe 5776 FLNDVXB.exe 2884 DBGYIK.exe 2884 DBGYIK.exe 2040 JWGY.exe 2040 JWGY.exe 6048 ZRPLYAZ.exe 6048 ZRPLYAZ.exe 2196 BPVF.exe 2196 BPVF.exe 4368 SXXKR.exe 4368 SXXKR.exe 4784 WFDKD.exe 4784 WFDKD.exe 5676 FFFPGV.exe 5676 FFFPGV.exe 5084 LGN.exe 5084 LGN.exe 3776 COPQB.exe 3776 COPQB.exe 4704 CYYJH.exe 4704 CYYJH.exe 3504 RPZ.exe 3504 RPZ.exe 1172 BXBO.exe 1172 BXBO.exe 2656 ZNM.exe 2656 ZNM.exe 1888 UIRAW.exe 1888 UIRAW.exe 2868 AVQ.exe 2868 AVQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5888 wrote to memory of 1560 5888 2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe 87 PID 1560 wrote to memory of 1300 1560 cmd.exe 91 PID 1300 wrote to memory of 1792 1300 XFAF.exe 93 PID 1792 wrote to memory of 5996 1792 cmd.exe 97 PID 5996 wrote to memory of 4264 5996 VQSC.exe 98 PID 4264 wrote to memory of 4284 4264 cmd.exe 102 PID 4284 wrote to memory of 1804 4284 ZGY.exe 103 PID 1804 wrote to memory of 1184 1804 cmd.exe 107 PID 1184 wrote to memory of 3636 1184 TTDTX.exe 108 PID 3636 wrote to memory of 4100 3636 cmd.exe 112 PID 4100 wrote to memory of 868 4100 MWHPDWL.exe 113 PID 868 wrote to memory of 2700 868 cmd.exe 117 PID 2700 wrote to memory of 2704 2700 YEOXP.exe 118 PID 2704 wrote to memory of 2092 2704 cmd.exe 122 PID 2092 wrote to memory of 1204 2092 FUP.exe 123 PID 1204 wrote to memory of 1144 1204 cmd.exe 127 PID 1144 wrote to memory of 2168 1144 PSUJD.exe 128 PID 2168 wrote to memory of 1108 2168 cmd.exe 132 PID 1108 wrote to memory of 5560 1108 TAJRP.exe 133 PID 5560 wrote to memory of 4612 5560 cmd.exe 137 PID 4612 wrote to memory of 5632 4612 UDNMVTC.exe 138 PID 5632 wrote to memory of 824 5632 cmd.exe 142 PID 824 wrote to memory of 3580 824 ORR.exe 143 PID 3580 wrote to memory of 5412 3580 cmd.exe 147 PID 5412 wrote to memory of 4152 5412 DUBAQF.exe 148 PID 4152 wrote to memory of 4968 4152 cmd.exe 152 PID 4968 wrote to memory of 3084 4968 TKCZX.exe 153 PID 3084 wrote to memory of 4236 3084 cmd.exe 157 PID 4236 wrote to memory of 3016 4236 CKEFAY.exe 158 PID 3016 wrote to memory of 5056 3016 cmd.exe 162 PID 5056 wrote to memory of 1748 5056 MIJZPH.exe 163 PID 1748 wrote to memory of 5776 1748 cmd.exe 167 PID 5776 wrote to memory of 3124 5776 FLNDVXB.exe 168 PID 3124 wrote to memory of 2884 3124 cmd.exe 172 PID 2884 wrote to memory of 4652 2884 DBGYIK.exe 173 PID 4652 wrote to memory of 2040 4652 cmd.exe 177 PID 2040 wrote to memory of 4592 2040 JWGY.exe 178 PID 4592 wrote to memory of 6048 4592 cmd.exe 182 PID 6048 wrote to memory of 4384 6048 ZRPLYAZ.exe 183 PID 4384 wrote to memory of 2196 4384 cmd.exe 187 PID 2196 wrote to memory of 2432 2196 BPVF.exe 188 PID 2432 wrote to memory of 4368 2432 cmd.exe 192 PID 4368 wrote to memory of 5568 4368 SXXKR.exe 193 PID 5568 wrote to memory of 4784 5568 cmd.exe 197 PID 4784 wrote to memory of 6072 4784 WFDKD.exe 198 PID 6072 wrote to memory of 5676 6072 cmd.exe 202 PID 5676 wrote to memory of 2408 5676 FFFPGV.exe 203 PID 2408 wrote to memory of 5084 2408 cmd.exe 207 PID 5084 wrote to memory of 2384 5084 LGN.exe 208 PID 2384 wrote to memory of 3776 2384 cmd.exe 212 PID 3776 wrote to memory of 4636 3776 COPQB.exe 213 PID 4636 wrote to memory of 4704 4636 cmd.exe 217 PID 4704 wrote to memory of 2632 4704 CYYJH.exe 218 PID 2632 wrote to memory of 3504 2632 cmd.exe 222 PID 3504 wrote to memory of 1576 3504 RPZ.exe 223 PID 1576 wrote to memory of 1172 1576 cmd.exe 227 PID 1172 wrote to memory of 4248 1172 BXBO.exe 228 PID 4248 wrote to memory of 2656 4248 cmd.exe 232 PID 2656 wrote to memory of 5064 2656 ZNM.exe 233 PID 5064 wrote to memory of 1888 5064 cmd.exe 237 PID 1888 wrote to memory of 2128 1888 UIRAW.exe 238 PID 2128 wrote to memory of 2868 2128 cmd.exe 242 PID 2868 wrote to memory of 3736 2868 AVQ.exe 243 PID 3736 wrote to memory of 4360 3736 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_ae38159c88d82a4a2ceb6a48140ea035_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFAF.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\windows\SysWOW64\XFAF.exeC:\windows\system32\XFAF.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQSC.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\windows\system\VQSC.exeC:\windows\system\VQSC.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGY.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\windows\ZGY.exeC:\windows\ZGY.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTDTX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\windows\SysWOW64\TTDTX.exeC:\windows\system32\TTDTX.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MWHPDWL.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\windows\SysWOW64\MWHPDWL.exeC:\windows\system32\MWHPDWL.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEOXP.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:868 -
C:\windows\YEOXP.exeC:\windows\YEOXP.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUP.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\system\FUP.exeC:\windows\system\FUP.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSUJD.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\windows\system\PSUJD.exeC:\windows\system\PSUJD.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAJRP.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\windows\TAJRP.exeC:\windows\TAJRP.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDNMVTC.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\system\UDNMVTC.exeC:\windows\system\UDNMVTC.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORR.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\system\ORR.exeC:\windows\system\ORR.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DUBAQF.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\windows\system\DUBAQF.exeC:\windows\system\DUBAQF.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKCZX.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\SysWOW64\TKCZX.exeC:\windows\system32\TKCZX.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKEFAY.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\windows\SysWOW64\CKEFAY.exeC:\windows\system32\CKEFAY.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIJZPH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\windows\SysWOW64\MIJZPH.exeC:\windows\system32\MIJZPH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLNDVXB.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\windows\FLNDVXB.exeC:\windows\FLNDVXB.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWGY.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\system\JWGY.exeC:\windows\system\JWGY.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRPLYAZ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\system\ZRPLYAZ.exeC:\windows\system\ZRPLYAZ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPVF.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\windows\SysWOW64\BPVF.exeC:\windows\system32\BPVF.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SXXKR.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\windows\SysWOW64\SXXKR.exeC:\windows\system32\SXXKR.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFDKD.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\windows\WFDKD.exeC:\windows\WFDKD.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFFPGV.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\windows\system\FFFPGV.exeC:\windows\system\FFFPGV.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGN.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\windows\SysWOW64\LGN.exeC:\windows\system32\LGN.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COPQB.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\windows\SysWOW64\COPQB.exeC:\windows\system32\COPQB.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYYJH.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\windows\system\CYYJH.exeC:\windows\system\CYYJH.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPZ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\system\RPZ.exeC:\windows\system\RPZ.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BXBO.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\windows\SysWOW64\BXBO.exeC:\windows\system32\BXBO.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNM.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\SysWOW64\ZNM.exeC:\windows\system32\ZNM.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UIRAW.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\windows\UIRAW.exeC:\windows\UIRAW.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVQ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\windows\system\AVQ.exeC:\windows\system\AVQ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELWBF.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\windows\ELWBF.exeC:\windows\ELWBF.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMYOIY.exe.bat" "66⤵PID:2580
-
C:\windows\SysWOW64\VMYOIY.exeC:\windows\system32\VMYOIY.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UJKJD.exe.bat" "68⤵PID:5188
-
C:\windows\SysWOW64\UJKJD.exeC:\windows\system32\UJKJD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "70⤵PID:2624
-
C:\windows\system\DKM.exeC:\windows\system\DKM.exe71⤵
- Executes dropped EXE
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HASWT.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3616 -
C:\windows\SysWOW64\HASWT.exeC:\windows\system32\HASWT.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNXGDTO.exe.bat" "74⤵PID:4484
-
C:\windows\SysWOW64\KNXGDTO.exeC:\windows\system32\KNXGDTO.exe75⤵
- Executes dropped EXE
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIW.exe.bat" "76⤵PID:5532
-
C:\windows\IIW.exeC:\windows\IIW.exe77⤵
- Executes dropped EXE
PID:796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDGTTI.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4440 -
C:\windows\XDGTTI.exeC:\windows\XDGTTI.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRL.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5264 -
C:\windows\RRL.exeC:\windows\RRL.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUOYJGC.exe.bat" "82⤵PID:5512
-
C:\windows\SUOYJGC.exeC:\windows\SUOYJGC.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LXS.exe.bat" "84⤵PID:2124
-
C:\windows\SysWOW64\LXS.exeC:\windows\system32\LXS.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUYZV.exe.bat" "86⤵PID:5840
-
C:\windows\system\HUYZV.exeC:\windows\system\HUYZV.exe87⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDAEZD.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1084 -
C:\windows\system\RDAEZD.exeC:\windows\system\RDAEZD.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLHE.exe.bat" "90⤵PID:3300
-
C:\windows\system\DLHE.exeC:\windows\system\DLHE.exe91⤵
- Executes dropped EXE
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTJJW.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:1404 -
C:\windows\MTJJW.exeC:\windows\MTJJW.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCM.exe.bat" "94⤵PID:5892
-
C:\windows\SysWOW64\KJCM.exeC:\windows\system32\KJCM.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZVU.exe.bat" "96⤵PID:244
-
C:\windows\system\FWZVU.exeC:\windows\system\FWZVU.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QPCOUNK.exe.bat" "98⤵PID:3496
-
C:\windows\SysWOW64\QPCOUNK.exeC:\windows\system32\QPCOUNK.exe99⤵
- Executes dropped EXE
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHF.exe.bat" "100⤵PID:5956
-
C:\windows\system\CHF.exeC:\windows\system\CHF.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NAAA.exe.bat" "102⤵PID:3080
-
C:\windows\SysWOW64\NAAA.exeC:\windows\system32\NAAA.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TAHNUE.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1920 -
C:\windows\system\TAHNUE.exeC:\windows\system\TAHNUE.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVM.exe.bat" "106⤵PID:2944
-
C:\windows\SysWOW64\NVM.exeC:\windows\system32\NVM.exe107⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDTXQ.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5076 -
C:\windows\system\RDTXQ.exeC:\windows\system\RDTXQ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMVCTUV.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:1916 -
C:\windows\SysWOW64\JMVCTUV.exeC:\windows\system32\JMVCTUV.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMCQ.exe.bat" "112⤵PID:5684
-
C:\windows\OMCQ.exeC:\windows\OMCQ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AFFIL.exe.bat" "114⤵PID:5308
-
C:\windows\system\AFFIL.exeC:\windows\system\AFFIL.exe115⤵
- Executes dropped EXE
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USKSVDA.exe.bat" "116⤵PID:5588
-
C:\windows\system\USKSVDA.exeC:\windows\system\USKSVDA.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVOV.exe.bat" "118⤵PID:2388
-
C:\windows\SysWOW64\NVOV.exeC:\windows\system32\NVOV.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYWU.exe.bat" "120⤵PID:1564
-
C:\windows\IYWU.exeC:\windows\IYWU.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-