Analysis
- max time kernel
84s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 15:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe
- Size 282KB
- Sample260711-sd17aads7m
- SHA256 a46cb7572b15a3e8aaf18e99ee1d4df61878cf311203ca0e1db9a5e523d6aed1
- MD5 def45aa79ef2dbd51c941c8ae0d3f335
- SHA1 384586a033dfda4a8aa316be6b01f0f6581a32a0
- SHA512 8a87e745480d27d6415ac25b770fd1f74800eefc94d7900ab6e6861102912eed990a74fe5f7252dd439dda178d01ca183b65e2b3f67559eef02da34670f5c4be
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LO6kEjiPISUOgW9X+hOGzC/:RLWI09QZb6LO6kmZzcukG2/
- TLSH T134549F1776C28273D5A3037209DAC6E9B73ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2280 UCV.exe 1892 ANZVCVE.exe 4180 IBECMU.exe 2288 DOVLYNO.exe 5336 YUVXHZ.exe 1084 THMZTK.exe 1132 TKQ.exe 1052 ZYPDDD.exe 2676 HLCKO.exe 5796 ERMZ.exe 3128 BRW.exe 5236 JXA.exe 2716 JAMMYXB.exe 4336 VSUXPQJ.exe 3112 FQZR.exe 4404 CQJ.exe 3900 VJY.exe 3936 NECAXTS.exe 5992 VSHPISN.exe 4204 YAQDPM.exe 4624 CQWLB.exe 1784 BBHTKKT.exe 256 FGR.exe 1320 MBD.exe 4612 EWHFLSG.exe 3580 SSSGZH.exe 5040 IITYG.exe 3304 VTC.exe 3016 FQPRBNP.exe 5800 AEUA.exe 2776 AJMON.exe 936 NUD.exe 2896 TUKBK.exe 5868 TADPMS.exe 1880 TDGLR.exe 2140 OQLUCI.exe 5788 SGSC.exe 1160 WOGCAS.exe 1508 IEN.exe 5304 AZRGSBV.exe 2192 ANR.exe 1240 KLXPBO.exe 5888 ZGG.exe 5136 AJKPZZR.exe 4936 LBNIHGY.exe 4884 XUQ.exe 5152 VMYOZ.exe 3508 KCZ.exe 5872 QCGB.exe 5036 ZLAHSDP.exe 2976 QYL.exe 1648 AYNELF.exe 4680 KWAY.exe 1556 CZEUGDQ.exe 2116 UAGH.exe 2460 FAVIKF.exe 5996 AVA.exe 5104 UJXBW.exe 3216 UOXQYK.exe 5936 EMDKN.exe 1464 SXT.exe 2760 HNUAAY.exe 1236 SFX.exe 4908 IAHXTS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\EMDKN.exe UOXQYK.exe File created C:\windows\SysWOW64\ZYPDDD.exe.bat TKQ.exe File opened for modification C:\windows\SysWOW64\ERMZ.exe HLCKO.exe File created C:\windows\SysWOW64\CQWLB.exe YAQDPM.exe File opened for modification C:\windows\SysWOW64\THMZTK.exe YUVXHZ.exe File created C:\windows\SysWOW64\CQJ.exe.bat FQZR.exe File opened for modification C:\windows\SysWOW64\FGR.exe BBHTKKT.exe File created C:\windows\SysWOW64\AJKPZZR.exe ZGG.exe File created C:\windows\SysWOW64\EMDKN.exe.bat UOXQYK.exe File created C:\windows\SysWOW64\ASUMB.exe.bat LPCAQAY.exe File created C:\windows\SysWOW64\DMQOQA.exe XLIA.exe File created C:\windows\SysWOW64\THMZTK.exe YUVXHZ.exe File created C:\windows\SysWOW64\FGR.exe BBHTKKT.exe File opened for modification C:\windows\SysWOW64\AJMON.exe AEUA.exe File opened for modification C:\windows\SysWOW64\QYL.exe ZLAHSDP.exe File opened for modification C:\windows\SysWOW64\VJY.exe CQJ.exe File created C:\windows\SysWOW64\VTC.exe.bat IITYG.exe File created C:\windows\SysWOW64\AZRGSBV.exe.bat IEN.exe File opened for modification C:\windows\SysWOW64\EMDKN.exe UOXQYK.exe File created C:\windows\SysWOW64\NECAXTS.exe.bat VJY.exe File created C:\windows\SysWOW64\BRW.exe ERMZ.exe File opened for modification C:\windows\SysWOW64\BRW.exe ERMZ.exe File opened for modification C:\windows\SysWOW64\AYNELF.exe QYL.exe File opened for modification C:\windows\SysWOW64\NDAU.exe TPDKQPP.exe File created C:\windows\SysWOW64\NDAU.exe.bat TPDKQPP.exe File created C:\windows\SysWOW64\ZYPDDD.exe TKQ.exe File created C:\windows\SysWOW64\AJMON.exe AEUA.exe File opened for modification C:\windows\SysWOW64\AZRGSBV.exe IEN.exe File created C:\windows\SysWOW64\QYL.exe.bat ZLAHSDP.exe File created C:\windows\SysWOW64\AYNELF.exe QYL.exe File created C:\windows\SysWOW64\AYNELF.exe.bat QYL.exe File created C:\windows\SysWOW64\SGFAVMU.exe MGXNMKT.exe File opened for modification C:\windows\SysWOW64\OFSOMOL.exe ESIWWR.exe File opened for modification C:\windows\SysWOW64\YAQDPM.exe VSHPISN.exe File opened for modification C:\windows\SysWOW64\CQWLB.exe YAQDPM.exe File created C:\windows\SysWOW64\KCZ.exe VMYOZ.exe File opened for modification C:\windows\SysWOW64\PTB.exe JSUTID.exe File created C:\windows\SysWOW64\NDAU.exe TPDKQPP.exe File created C:\windows\SysWOW64\BRW.exe.bat ERMZ.exe File created C:\windows\SysWOW64\OQLUCI.exe TDGLR.exe File created C:\windows\SysWOW64\ASUMB.exe LPCAQAY.exe File created C:\windows\SysWOW64\DMQOQA.exe.bat XLIA.exe File created C:\windows\SysWOW64\VJY.exe.bat CQJ.exe File opened for modification C:\windows\SysWOW64\TKQ.exe THMZTK.exe File opened for modification C:\windows\SysWOW64\ZYPDDD.exe TKQ.exe File opened for modification C:\windows\SysWOW64\CQJ.exe FQZR.exe File created C:\windows\SysWOW64\OQLUCI.exe.bat TDGLR.exe File created C:\windows\SysWOW64\AJKPZZR.exe.bat ZGG.exe File created C:\windows\SysWOW64\SGFAVMU.exe.bat MGXNMKT.exe File created C:\windows\SysWOW64\UCV.exe 2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe File created C:\windows\SysWOW64\CQJ.exe FQZR.exe File created C:\windows\SysWOW64\FGR.exe.bat BBHTKKT.exe File created C:\windows\SysWOW64\QYL.exe ZLAHSDP.exe File opened for modification C:\windows\SysWOW64\AJKPZZR.exe ZGG.exe File created C:\windows\SysWOW64\KCZ.exe.bat VMYOZ.exe File created C:\windows\SysWOW64\AVMZD.exe WNG.exe File opened for modification C:\windows\SysWOW64\SGFAVMU.exe MGXNMKT.exe File created C:\windows\SysWOW64\PTB.exe.bat JSUTID.exe File opened for modification C:\windows\SysWOW64\ASUMB.exe LPCAQAY.exe File created C:\windows\SysWOW64\KFDNM.exe QREH.exe File opened for modification C:\windows\SysWOW64\NECAXTS.exe VJY.exe File created C:\windows\SysWOW64\KFDNM.exe.bat QREH.exe File created C:\windows\SysWOW64\AZRGSBV.exe IEN.exe File created C:\windows\SysWOW64\VJY.exe CQJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\AVA.exe FAVIKF.exe File created C:\windows\UJXBW.exe AVA.exe File created C:\windows\UJXBW.exe.bat AVA.exe File created C:\windows\system\VSUXPQJ.exe JAMMYXB.exe File opened for modification C:\windows\system\VSUXPQJ.exe JAMMYXB.exe File created C:\windows\IITYG.exe SSSGZH.exe File created C:\windows\system\FQZR.exe.bat VSUXPQJ.exe File created C:\windows\system\FAVIKF.exe.bat DNRZZ.exe File opened for modification C:\windows\system\SMRHD.exe XZV.exe File created C:\windows\JAMMYXB.exe.bat JXA.exe File opened for modification C:\windows\UOXQYK.exe UJXBW.exe File created C:\windows\HNUAAY.exe.bat SXT.exe File opened for modification C:\windows\system\RBJCFYM.exe IAHXTS.exe File created C:\windows\system\MGXNMKT.exe AVMZD.exe File created C:\windows\system\IBECMU.exe ANZVCVE.exe File created C:\windows\system\SGSC.exe.bat OQLUCI.exe File created C:\windows\system\VMYOZ.exe.bat XUQ.exe File created C:\windows\system\SFX.exe.bat HNUAAY.exe File created C:\windows\system\RXQPCFC.exe.bat OCLFS.exe File created C:\windows\KLXPBO.exe.bat ANR.exe File opened for modification C:\windows\system\KWAY.exe AYNELF.exe File created C:\windows\system\BZOWMG.exe RBJCFYM.exe File opened for modification C:\windows\system\UMMSR.exe MGTDP.exe File created C:\windows\system\TDGLR.exe.bat TADPMS.exe File created C:\windows\OCLFS.exe DJINKY.exe File opened for modification C:\windows\EIEWUIZ.exe GYU.exe File created C:\windows\OIWKRE.exe.bat OFSOMOL.exe File created C:\windows\AEP.exe SQL.exe File created C:\windows\system\JXA.exe BRW.exe File opened for modification C:\windows\system\DJINKY.exe OMCQ.exe File created C:\windows\VOBH.exe PTB.exe File created C:\windows\system\KWAY.exe.bat AYNELF.exe File created C:\windows\system\LPCAQAY.exe.bat QBXQG.exe File created C:\windows\system\XLIA.exe EIEWUIZ.exe File created C:\windows\system\SSSGZH.exe EWHFLSG.exe File opened for modification C:\windows\system\FAVIKF.exe DNRZZ.exe File created C:\windows\system\SFX.exe HNUAAY.exe File created C:\windows\system\QUQQNQ.exe AEP.exe File created C:\windows\system\FQZR.exe VSUXPQJ.exe File opened for modification C:\windows\system\FQZR.exe VSUXPQJ.exe File created C:\windows\system\RBJCFYM.exe.bat IAHXTS.exe File created C:\windows\system\UMMSR.exe MGTDP.exe File created C:\windows\HZWKVAW.exe.bat BZOWMG.exe File opened for modification C:\windows\system\LPCAQAY.exe QBXQG.exe File created C:\windows\system\AEUA.exe.bat FQPRBNP.exe File created C:\windows\system\CZEUGDQ.exe.bat KWAY.exe File created C:\windows\system\NUD.exe AJMON.exe File created C:\windows\system\HLCKO.exe.bat ZYPDDD.exe File created C:\windows\ZLAHSDP.exe QCGB.exe File created C:\windows\system\DJINKY.exe.bat OMCQ.exe File created C:\windows\TPDKQPP.exe.bat SMRHD.exe File created C:\windows\ZUS.exe QUQQNQ.exe File opened for modification C:\windows\system\XSDYLT.exe ZUS.exe File created C:\windows\system\KWAY.exe AYNELF.exe File created C:\windows\UAGH.exe CZEUGDQ.exe File created C:\windows\system\SMRHD.exe XZV.exe File opened for modification C:\windows\ANZVCVE.exe UCV.exe File created C:\windows\TUKBK.exe.bat NUD.exe File created C:\windows\system\LBNIHGY.exe.bat AJKPZZR.exe File opened for modification C:\windows\TPDKQPP.exe SMRHD.exe File created C:\windows\system\SGSC.exe OQLUCI.exe File created C:\windows\QCGB.exe.bat KCZ.exe File opened for modification C:\windows\system\SXT.exe EMDKN.exe File created C:\windows\OCLFS.exe.bat DJINKY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 3544 1944 WerFault.exe 86 5512 2280 WerFault.exe 91 5996 1892 WerFault.exe 97 4788 4180 WerFault.exe 102 6056 2288 WerFault.exe 107 2192 5336 WerFault.exe 112 2216 1084 WerFault.exe 117 5972 1132 WerFault.exe 122 2840 1052 WerFault.exe 127 1712 2676 WerFault.exe 132 1048 5796 WerFault.exe 137 4836 3128 WerFault.exe 142 3768 5236 WerFault.exe 147 5068 2716 WerFault.exe 152 4720 4336 WerFault.exe 157 2956 3112 WerFault.exe 162 4976 4404 WerFault.exe 167 5360 3900 WerFault.exe 172 1396 3936 WerFault.exe 177 6108 5992 WerFault.exe 182 2840 4204 WerFault.exe 187 2884 4624 WerFault.exe 192 5000 1784 WerFault.exe 197 3276 256 WerFault.exe 202 2400 1320 WerFault.exe 207 3432 4612 WerFault.exe 212 3984 3580 WerFault.exe 217 3868 5040 WerFault.exe 222 3996 3304 WerFault.exe 227 860 3016 WerFault.exe 232 3540 5800 WerFault.exe 237 3964 2776 WerFault.exe 242 2888 936 WerFault.exe 247 2744 2896 WerFault.exe 252 4556 5868 WerFault.exe 257 5068 1880 WerFault.exe 262 3172 2140 WerFault.exe 267 2792 5788 WerFault.exe 272 1140 1160 WerFault.exe 277 5308 1508 WerFault.exe 282 2820 5304 WerFault.exe 287 3540 2192 WerFault.exe 292 1388 1240 WerFault.exe 297 1036 5888 WerFault.exe 302 5260 5136 WerFault.exe 307 2380 4936 WerFault.exe 312 5776 4884 WerFault.exe 317 3432 5152 WerFault.exe 322 4192 3508 WerFault.exe 327 4940 5872 WerFault.exe 332 2448 5036 WerFault.exe 337 1464 2976 WerFault.exe 342 4456 1648 WerFault.exe 347 1960 4680 WerFault.exe 352 2848 1556 WerFault.exe 357 4600 2116 WerFault.exe 362 296 5240 WerFault.exe 367 5772 2460 WerFault.exe 372 4432 5996 WerFault.exe 377 5488 5104 WerFault.exe 382 5360 3216 WerFault.exe 387 2444 5936 WerFault.exe 392 2784 1464 WerFault.exe 397 4580 2760 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMYOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFDNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSUXPQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJXBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMDKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBXQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NECAXTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BABIHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPDKQPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUQQNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSSGZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLXPBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAVIKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RXQPCFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOVLYNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJMON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVMZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUVXHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAMMYXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THMZTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMRHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1944 2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe 1944 2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe 2280 UCV.exe 2280 UCV.exe 1892 ANZVCVE.exe 1892 ANZVCVE.exe 4180 IBECMU.exe 4180 IBECMU.exe 2288 DOVLYNO.exe 2288 DOVLYNO.exe 5336 YUVXHZ.exe 5336 YUVXHZ.exe 1084 THMZTK.exe 1084 THMZTK.exe 1132 TKQ.exe 1132 TKQ.exe 1052 ZYPDDD.exe 1052 ZYPDDD.exe 2676 HLCKO.exe 2676 HLCKO.exe 5796 ERMZ.exe 5796 ERMZ.exe 3128 BRW.exe 3128 BRW.exe 5236 JXA.exe 5236 JXA.exe 2716 JAMMYXB.exe 2716 JAMMYXB.exe 4336 VSUXPQJ.exe 4336 VSUXPQJ.exe 3112 FQZR.exe 3112 FQZR.exe 4404 CQJ.exe 4404 CQJ.exe 3900 VJY.exe 3900 VJY.exe 3936 NECAXTS.exe 3936 NECAXTS.exe 5992 VSHPISN.exe 5992 VSHPISN.exe 4204 YAQDPM.exe 4204 YAQDPM.exe 4624 CQWLB.exe 4624 CQWLB.exe 1784 BBHTKKT.exe 1784 BBHTKKT.exe 256 FGR.exe 256 FGR.exe 1320 MBD.exe 1320 MBD.exe 4612 EWHFLSG.exe 4612 EWHFLSG.exe 3580 SSSGZH.exe 3580 SSSGZH.exe 5040 IITYG.exe 5040 IITYG.exe 3304 VTC.exe 3304 VTC.exe 3016 FQPRBNP.exe 3016 FQPRBNP.exe 5800 AEUA.exe 5800 AEUA.exe 2776 AJMON.exe 2776 AJMON.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1944 2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe 1944 2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe 2280 UCV.exe 2280 UCV.exe 1892 ANZVCVE.exe 1892 ANZVCVE.exe 4180 IBECMU.exe 4180 IBECMU.exe 2288 DOVLYNO.exe 2288 DOVLYNO.exe 5336 YUVXHZ.exe 5336 YUVXHZ.exe 1084 THMZTK.exe 1084 THMZTK.exe 1132 TKQ.exe 1132 TKQ.exe 1052 ZYPDDD.exe 1052 ZYPDDD.exe 2676 HLCKO.exe 2676 HLCKO.exe 5796 ERMZ.exe 5796 ERMZ.exe 3128 BRW.exe 3128 BRW.exe 5236 JXA.exe 5236 JXA.exe 2716 JAMMYXB.exe 2716 JAMMYXB.exe 4336 VSUXPQJ.exe 4336 VSUXPQJ.exe 3112 FQZR.exe 3112 FQZR.exe 4404 CQJ.exe 4404 CQJ.exe 3900 VJY.exe 3900 VJY.exe 3936 NECAXTS.exe 3936 NECAXTS.exe 5992 VSHPISN.exe 5992 VSHPISN.exe 4204 YAQDPM.exe 4204 YAQDPM.exe 4624 CQWLB.exe 4624 CQWLB.exe 1784 BBHTKKT.exe 1784 BBHTKKT.exe 256 FGR.exe 256 FGR.exe 1320 MBD.exe 1320 MBD.exe 4612 EWHFLSG.exe 4612 EWHFLSG.exe 3580 SSSGZH.exe 3580 SSSGZH.exe 5040 IITYG.exe 5040 IITYG.exe 3304 VTC.exe 3304 VTC.exe 3016 FQPRBNP.exe 3016 FQPRBNP.exe 5800 AEUA.exe 5800 AEUA.exe 2776 AJMON.exe 2776 AJMON.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1944 wrote to memory of 4480 1944 2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe 87 PID 4480 wrote to memory of 2280 4480 cmd.exe 91 PID 2280 wrote to memory of 2268 2280 UCV.exe 93 PID 2268 wrote to memory of 1892 2268 cmd.exe 97 PID 1892 wrote to memory of 5516 1892 ANZVCVE.exe 98 PID 5516 wrote to memory of 4180 5516 cmd.exe 102 PID 4180 wrote to memory of 2892 4180 IBECMU.exe 103 PID 2892 wrote to memory of 2288 2892 cmd.exe 107 PID 2288 wrote to memory of 3904 2288 DOVLYNO.exe 108 PID 3904 wrote to memory of 5336 3904 cmd.exe 112 PID 5336 wrote to memory of 4768 5336 YUVXHZ.exe 113 PID 4768 wrote to memory of 1084 4768 cmd.exe 117 PID 1084 wrote to memory of 1692 1084 THMZTK.exe 118 PID 1692 wrote to memory of 1132 1692 cmd.exe 122 PID 1132 wrote to memory of 5968 1132 TKQ.exe 123 PID 5968 wrote to memory of 1052 5968 cmd.exe 127 PID 1052 wrote to memory of 3136 1052 ZYPDDD.exe 128 PID 3136 wrote to memory of 2676 3136 cmd.exe 132 PID 2676 wrote to memory of 3100 2676 HLCKO.exe 133 PID 3100 wrote to memory of 5796 3100 cmd.exe 137 PID 5796 wrote to memory of 5712 5796 ERMZ.exe 138 PID 5712 wrote to memory of 3128 5712 cmd.exe 142 PID 3128 wrote to memory of 4420 3128 BRW.exe 143 PID 4420 wrote to memory of 5236 4420 cmd.exe 147 PID 5236 wrote to memory of 8 5236 JXA.exe 148 PID 8 wrote to memory of 2716 8 cmd.exe 152 PID 2716 wrote to memory of 880 2716 JAMMYXB.exe 153 PID 880 wrote to memory of 4336 880 cmd.exe 157 PID 4336 wrote to memory of 1104 4336 VSUXPQJ.exe 158 PID 1104 wrote to memory of 3112 1104 cmd.exe 162 PID 3112 wrote to memory of 3528 3112 FQZR.exe 163 PID 3528 wrote to memory of 4404 3528 cmd.exe 167 PID 4404 wrote to memory of 4640 4404 CQJ.exe 168 PID 4640 wrote to memory of 3900 4640 cmd.exe 172 PID 3900 wrote to memory of 5300 3900 VJY.exe 173 PID 5300 wrote to memory of 3936 5300 cmd.exe 177 PID 3936 wrote to memory of 1468 3936 NECAXTS.exe 178 PID 1468 wrote to memory of 5992 1468 cmd.exe 182 PID 5992 wrote to memory of 2724 5992 VSHPISN.exe 183 PID 2724 wrote to memory of 4204 2724 cmd.exe 187 PID 4204 wrote to memory of 5908 4204 YAQDPM.exe 188 PID 5908 wrote to memory of 4624 5908 cmd.exe 192 PID 4624 wrote to memory of 1884 4624 CQWLB.exe 193 PID 1884 wrote to memory of 1784 1884 cmd.exe 197 PID 1784 wrote to memory of 4620 1784 BBHTKKT.exe 198 PID 4620 wrote to memory of 256 4620 cmd.exe 202 PID 256 wrote to memory of 2452 256 FGR.exe 203 PID 2452 wrote to memory of 1320 2452 cmd.exe 207 PID 1320 wrote to memory of 5960 1320 MBD.exe 208 PID 5960 wrote to memory of 4612 5960 cmd.exe 212 PID 4612 wrote to memory of 6120 4612 EWHFLSG.exe 213 PID 6120 wrote to memory of 3580 6120 cmd.exe 217 PID 3580 wrote to memory of 2068 3580 SSSGZH.exe 218 PID 2068 wrote to memory of 5040 2068 cmd.exe 222 PID 5040 wrote to memory of 3920 5040 IITYG.exe 223 PID 3920 wrote to memory of 3304 3920 cmd.exe 227 PID 3304 wrote to memory of 5292 3304 VTC.exe 228 PID 5292 wrote to memory of 3016 5292 cmd.exe 232 PID 3016 wrote to memory of 2220 3016 FQPRBNP.exe 233 PID 2220 wrote to memory of 5800 2220 cmd.exe 237 PID 5800 wrote to memory of 5272 5800 AEUA.exe 238 PID 5272 wrote to memory of 2776 5272 cmd.exe 242 PID 2776 wrote to memory of 3132 2776 AJMON.exe 243 PID 3132 wrote to memory of 936 3132 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_def45aa79ef2dbd51c941c8ae0d3f335_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCV.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\windows\SysWOW64\UCV.exeC:\windows\system32\UCV.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ANZVCVE.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\ANZVCVE.exeC:\windows\ANZVCVE.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBECMU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\system\IBECMU.exeC:\windows\system\IBECMU.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DOVLYNO.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\system\DOVLYNO.exeC:\windows\system\DOVLYNO.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUVXHZ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\windows\system\YUVXHZ.exeC:\windows\system\YUVXHZ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THMZTK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\windows\SysWOW64\THMZTK.exeC:\windows\system32\THMZTK.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKQ.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\windows\SysWOW64\TKQ.exeC:\windows\system32\TKQ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYPDDD.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\SysWOW64\ZYPDDD.exeC:\windows\system32\ZYPDDD.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HLCKO.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\system\HLCKO.exeC:\windows\system\HLCKO.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ERMZ.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\windows\SysWOW64\ERMZ.exeC:\windows\system32\ERMZ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRW.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\windows\SysWOW64\BRW.exeC:\windows\system32\BRW.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXA.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\windows\system\JXA.exeC:\windows\system\JXA.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAMMYXB.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8 -
C:\windows\JAMMYXB.exeC:\windows\JAMMYXB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSUXPQJ.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880 -
C:\windows\system\VSUXPQJ.exeC:\windows\system\VSUXPQJ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQZR.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\system\FQZR.exeC:\windows\system\FQZR.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQJ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\SysWOW64\CQJ.exeC:\windows\system32\CQJ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJY.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\SysWOW64\VJY.exeC:\windows\system32\VJY.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NECAXTS.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\windows\SysWOW64\NECAXTS.exeC:\windows\system32\NECAXTS.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSHPISN.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\windows\VSHPISN.exeC:\windows\VSHPISN.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAQDPM.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\SysWOW64\YAQDPM.exeC:\windows\system32\YAQDPM.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQWLB.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\windows\SysWOW64\CQWLB.exeC:\windows\system32\CQWLB.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBHTKKT.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\windows\system\BBHTKKT.exeC:\windows\system\BBHTKKT.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGR.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\windows\SysWOW64\FGR.exeC:\windows\system32\FGR.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBD.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\MBD.exeC:\windows\MBD.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWHFLSG.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\system\EWHFLSG.exeC:\windows\system\EWHFLSG.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSSGZH.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\windows\system\SSSGZH.exeC:\windows\system\SSSGZH.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IITYG.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\windows\IITYG.exeC:\windows\IITYG.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTC.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\windows\SysWOW64\VTC.exeC:\windows\system32\VTC.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQPRBNP.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\windows\system\FQPRBNP.exeC:\windows\system\FQPRBNP.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AEUA.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\windows\system\AEUA.exeC:\windows\system\AEUA.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJMON.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\windows\SysWOW64\AJMON.exeC:\windows\system32\AJMON.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUD.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\windows\system\NUD.exeC:\windows\system\NUD.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUKBK.exe.bat" "66⤵PID:2608
-
C:\windows\TUKBK.exeC:\windows\TUKBK.exe67⤵
- Executes dropped EXE
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TADPMS.exe.bat" "68⤵PID:2100
-
C:\windows\TADPMS.exeC:\windows\TADPMS.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDGLR.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:436 -
C:\windows\system\TDGLR.exeC:\windows\system\TDGLR.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQLUCI.exe.bat" "72⤵PID:4160
-
C:\windows\SysWOW64\OQLUCI.exeC:\windows\system32\OQLUCI.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGSC.exe.bat" "74⤵PID:1220
-
C:\windows\system\SGSC.exeC:\windows\system\SGSC.exe75⤵
- Executes dropped EXE
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOGCAS.exe.bat" "76⤵PID:5512
-
C:\windows\system\WOGCAS.exeC:\windows\system\WOGCAS.exe77⤵
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEN.exe.bat" "78⤵PID:4280
-
C:\windows\system\IEN.exeC:\windows\system\IEN.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZRGSBV.exe.bat" "80⤵PID:1680
-
C:\windows\SysWOW64\AZRGSBV.exeC:\windows\system32\AZRGSBV.exe81⤵
- Executes dropped EXE
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANR.exe.bat" "82⤵PID:3480
-
C:\windows\system\ANR.exeC:\windows\system\ANR.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KLXPBO.exe.bat" "84⤵PID:5144
-
C:\windows\KLXPBO.exeC:\windows\KLXPBO.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4256 -
C:\windows\system\ZGG.exeC:\windows\system\ZGG.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJKPZZR.exe.bat" "88⤵PID:384
-
C:\windows\SysWOW64\AJKPZZR.exeC:\windows\system32\AJKPZZR.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LBNIHGY.exe.bat" "90⤵PID:2764
-
C:\windows\system\LBNIHGY.exeC:\windows\system\LBNIHGY.exe91⤵
- Executes dropped EXE
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUQ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3544 -
C:\windows\XUQ.exeC:\windows\XUQ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMYOZ.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:3564 -
C:\windows\system\VMYOZ.exeC:\windows\system\VMYOZ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KCZ.exe.bat" "96⤵PID:6084
-
C:\windows\SysWOW64\KCZ.exeC:\windows\system32\KCZ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCGB.exe.bat" "98⤵PID:3080
-
C:\windows\QCGB.exeC:\windows\QCGB.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:200 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QYL.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1396 -
C:\windows\SysWOW64\QYL.exeC:\windows\system32\QYL.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AYNELF.exe.bat" "104⤵PID:2820
-
C:\windows\SysWOW64\AYNELF.exeC:\windows\system32\AYNELF.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWAY.exe.bat" "106⤵PID:3652
-
C:\windows\system\KWAY.exeC:\windows\system\KWAY.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZEUGDQ.exe.bat" "108⤵PID:6048
-
C:\windows\system\CZEUGDQ.exeC:\windows\system\CZEUGDQ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAGH.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4520 -
C:\windows\UAGH.exeC:\windows\UAGH.exe111⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DNRZZ.exe.bat" "112⤵PID:4556
-
C:\windows\DNRZZ.exeC:\windows\DNRZZ.exe113⤵
- Drops file in Windows directory
PID:5240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAVIKF.exe.bat" "114⤵PID:3008
-
C:\windows\system\FAVIKF.exeC:\windows\system\FAVIKF.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AVA.exe.bat" "116⤵PID:2984
-
C:\windows\AVA.exeC:\windows\AVA.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UJXBW.exe.bat" "118⤵PID:4488
-
C:\windows\UJXBW.exeC:\windows\UJXBW.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UOXQYK.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5576 -
C:\windows\UOXQYK.exeC:\windows\UOXQYK.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-