Analysis
- max time kernel
84s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 18:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe
- Size 208KB
- Sample260714-xffetabv4r
- SHA256 b4d0e2950dcf027d6d40b30ba38334381c53a53893d5e90549d44c485a443ca2
- MD5 8bab4e4ddb4796726b225f3fb0338324
- SHA1 f83b7069ec98e2c27cec79499ca6f34a7e97be47
- SHA512 1f92c056ace1b7c68c018ce25ef10417ccf9df9bd1652b33d9e6f4b08880872cf3aa6a9a471a6a6f357d8e1bd737163d638d2b9b908a1bdb17084ecfabd40c34
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfy4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOqQEj1
- TLSH T105247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5952 YPV.exe 3728 WSUT.exe 5244 OTIQ.exe 2620 MLL.exe 5312 URYNELN.exe 2424 MZE.exe 5020 UFRZBBD.exe 1384 HPZXPMY.exe 5568 ISDT.exe 1668 CGIDFB.exe 4536 QEQO.exe 4112 DOYN.exe 3788 HWFNHIH.exe 4572 PKSCSG.exe 4300 XPWIUF.exe 5104 FDJPFD.exe 244 FGNLSBD.exe 1696 ERPBTH.exe 5812 MWCHEG.exe 1892 OUICT.exe 4476 PXLFZEF.exe 3660 IQBQIFN.exe 3616 UDIONH.exe 3836 CJMVYF.exe 3024 VJCGPG.exe 4264 BJK.exe 5028 SUMKHOL.exe 252 XUUX.exe 3304 NLVXWE.exe 2420 GDKIGF.exe 1140 ZGO.exe 2496 TTTNWV.exe 2612 UWX.exe 2548 WUC.exe 2856 GSQXY.exe 4832 VARX.exe 4384 XYXRMF.exe 1368 HWCLBO.exe 1068 GONTK.exe 1600 QMTOSCL.exe 4808 DPBMGNH.exe 5552 NXD.exe 1176 LIOHSYX.exe 1172 VGUCZ.exe 6056 XEZW.exe 3824 FJMD.exe 2732 RZSDEY.exe 4548 AZUIH.exe 2376 OKD.exe 2716 UGC.exe 4788 QLUW.exe 1704 WYTFV.exe 4348 XBXB.exe 6008 WZJENKN.exe 1988 MKTUWQ.exe 2984 PXY.exe 2100 WNZV.exe 4292 RBEEXM.exe 5624 MLMDDO.exe 5544 OJSX.exe 6064 JWXHD.exe 6120 JZBC.exe 4240 CDMGOL.exe 2348 TDGLR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RFPQQ.exe.bat NXIIEQA.exe File created C:\windows\SysWOW64\MVYVG.exe.bat ANR.exe File created C:\windows\SysWOW64\GYJI.exe RDAEZD.exe File created C:\windows\SysWOW64\OTIQ.exe.bat WSUT.exe File created C:\windows\SysWOW64\URYNELN.exe.bat MLL.exe File opened for modification C:\windows\SysWOW64\DOYN.exe QEQO.exe File created C:\windows\SysWOW64\OUICT.exe MWCHEG.exe File created C:\windows\SysWOW64\GONTK.exe HWCLBO.exe File created C:\windows\SysWOW64\GONTK.exe.bat HWCLBO.exe File created C:\windows\SysWOW64\PXY.exe MKTUWQ.exe File created C:\windows\SysWOW64\DMRRJN.exe.bat JZNH.exe File created C:\windows\SysWOW64\MLMDDO.exe.bat RBEEXM.exe File created C:\windows\SysWOW64\GYJI.exe.bat RDAEZD.exe File created C:\windows\SysWOW64\CMOMYC.exe EWDJL.exe File opened for modification C:\windows\SysWOW64\URYNELN.exe MLL.exe File opened for modification C:\windows\SysWOW64\VGUCZ.exe LIOHSYX.exe File created C:\windows\SysWOW64\MKTUWQ.exe.bat WZJENKN.exe File opened for modification C:\windows\SysWOW64\GYJI.exe RDAEZD.exe File opened for modification C:\windows\SysWOW64\NEREG.exe CMOMYC.exe File created C:\windows\SysWOW64\VGUCZ.exe LIOHSYX.exe File created C:\windows\SysWOW64\TGTV.exe.bat HQNNDJL.exe File created C:\windows\SysWOW64\UIPJA.exe.bat WVXI.exe File opened for modification C:\windows\SysWOW64\EWDJL.exe MVBE.exe File opened for modification C:\windows\SysWOW64\OUICT.exe MWCHEG.exe File opened for modification C:\windows\SysWOW64\UWX.exe TTTNWV.exe File created C:\windows\SysWOW64\DPBMGNH.exe.bat QMTOSCL.exe File opened for modification C:\windows\SysWOW64\QLE.exe MVYVG.exe File opened for modification C:\windows\SysWOW64\TGTV.exe HQNNDJL.exe File opened for modification C:\windows\SysWOW64\XNRLN.exe ONPG.exe File created C:\windows\SysWOW64\EWDJL.exe.bat MVBE.exe File opened for modification C:\windows\SysWOW64\OTIQ.exe WSUT.exe File opened for modification C:\windows\SysWOW64\XPWIUF.exe PKSCSG.exe File created C:\windows\SysWOW64\XPWIUF.exe.bat PKSCSG.exe File created C:\windows\SysWOW64\OUICT.exe.bat MWCHEG.exe File opened for modification C:\windows\SysWOW64\DPBMGNH.exe QMTOSCL.exe File created C:\windows\SysWOW64\WRODE.exe.bat MTJJW.exe File created C:\windows\SysWOW64\URYNELN.exe MLL.exe File created C:\windows\SysWOW64\UFRZBBD.exe MZE.exe File created C:\windows\SysWOW64\ISDT.exe HPZXPMY.exe File created C:\windows\SysWOW64\DOYN.exe QEQO.exe File created C:\windows\SysWOW64\MVYVG.exe ANR.exe File opened for modification C:\windows\SysWOW64\WRODE.exe MTJJW.exe File created C:\windows\SysWOW64\XNRLN.exe ONPG.exe File created C:\windows\SysWOW64\EWDJL.exe MVBE.exe File created C:\windows\SysWOW64\CGIDFB.exe ISDT.exe File created C:\windows\SysWOW64\XPWIUF.exe PKSCSG.exe File created C:\windows\SysWOW64\UWX.exe.bat TTTNWV.exe File created C:\windows\SysWOW64\HWCLBO.exe XYXRMF.exe File created C:\windows\SysWOW64\TGTV.exe HQNNDJL.exe File created C:\windows\SysWOW64\WRODE.exe MTJJW.exe File opened for modification C:\windows\SysWOW64\CMOMYC.exe EWDJL.exe File created C:\windows\SysWOW64\CMOMYC.exe.bat EWDJL.exe File opened for modification C:\windows\SysWOW64\ISDT.exe HPZXPMY.exe File created C:\windows\SysWOW64\YPV.exe 2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe File created C:\windows\SysWOW64\UWX.exe TTTNWV.exe File created C:\windows\SysWOW64\WYTFV.exe.bat QLUW.exe File created C:\windows\SysWOW64\MLMDDO.exe RBEEXM.exe File opened for modification C:\windows\SysWOW64\RFPQQ.exe NXIIEQA.exe File created C:\windows\SysWOW64\XNRLN.exe.bat ONPG.exe File created C:\windows\SysWOW64\MVBE.exe.bat DNZYWUD.exe File created C:\windows\SysWOW64\UFRZBBD.exe.bat MZE.exe File created C:\windows\SysWOW64\ISDT.exe.bat HPZXPMY.exe File opened for modification C:\windows\SysWOW64\HWCLBO.exe XYXRMF.exe File created C:\windows\SysWOW64\RFPQQ.exe NXIIEQA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\UDIONH.exe.bat IQBQIFN.exe File opened for modification C:\windows\VJCGPG.exe CJMVYF.exe File created C:\windows\XYXRMF.exe VARX.exe File created C:\windows\system\RBEEXM.exe WNZV.exe File created C:\windows\NXIIEQA.exe.bat WOGCAS.exe File created C:\windows\GDKIGF.exe.bat NLVXWE.exe File created C:\windows\FJMD.exe XEZW.exe File created C:\windows\CDMGOL.exe.bat JZBC.exe File opened for modification C:\windows\HAGEKHZ.exe BEPV.exe File created C:\windows\system\MZE.exe URYNELN.exe File opened for modification C:\windows\system\PXLFZEF.exe OUICT.exe File opened for modification C:\windows\system\UGC.exe OKD.exe File opened for modification C:\windows\JDOM.exe OIJDOGH.exe File opened for modification C:\windows\system\RDAEZD.exe HUYZV.exe File created C:\windows\DNZYWUD.exe XNRLN.exe File created C:\windows\QEQO.exe CGIDFB.exe File created C:\windows\system\HWFNHIH.exe.bat DOYN.exe File created C:\windows\GSQXY.exe.bat WUC.exe File created C:\windows\XEZW.exe VGUCZ.exe File opened for modification C:\windows\system\DLDH.exe IYYPK.exe File created C:\windows\MTJJW.exe.bat GYJI.exe File created C:\windows\system\ERPBTH.exe.bat FGNLSBD.exe File created C:\windows\MWCHEG.exe.bat ERPBTH.exe File created C:\windows\CHVAS.exe TGTV.exe File opened for modification C:\windows\XYXRMF.exe VARX.exe File created C:\windows\system\RZSDEY.exe.bat FJMD.exe File created C:\windows\AZUIH.exe.bat RZSDEY.exe File created C:\windows\JZBC.exe.bat JWXHD.exe File created C:\windows\system\WOGCAS.exe DLDH.exe File created C:\windows\system\ANR.exe.bat RFPQQ.exe File opened for modification C:\windows\system\FGNLSBD.exe FDJPFD.exe File created C:\windows\GSQXY.exe WUC.exe File created C:\windows\XUQ.exe LBNIHGY.exe File opened for modification C:\windows\XUQ.exe LBNIHGY.exe File created C:\windows\KXY.exe XUQ.exe File created C:\windows\GYD.exe.bat UIPJA.exe File created C:\windows\MLL.exe OTIQ.exe File created C:\windows\FDJPFD.exe.bat XPWIUF.exe File opened for modification C:\windows\system\RZSDEY.exe FJMD.exe File created C:\windows\IYYPK.exe.bat TDGLR.exe File created C:\windows\system\HPZXPMY.exe.bat UFRZBBD.exe File created C:\windows\NLVXWE.exe.bat XUUX.exe File created C:\windows\CDMGOL.exe JZBC.exe File opened for modification C:\windows\system\ERPBTH.exe FGNLSBD.exe File created C:\windows\system\XBXB.exe WYTFV.exe File created C:\windows\KXY.exe.bat XUQ.exe File created C:\windows\system\MUEUL.exe KXY.exe File created C:\windows\system\HQNNDJL.exe JDOM.exe File created C:\windows\system\HUYZV.exe.bat DMRRJN.exe File created C:\windows\MTJJW.exe GYJI.exe File created C:\windows\system\LMGIPWP.exe WRODE.exe File created C:\windows\PKSCSG.exe HWFNHIH.exe File opened for modification C:\windows\NLVXWE.exe XUUX.exe File opened for modification C:\windows\system\OKD.exe AZUIH.exe File created C:\windows\system\XBXB.exe.bat WYTFV.exe File created C:\windows\system\LBNIHGY.exe QRFR.exe File opened for modification C:\windows\system\WVXI.exe HAGEKHZ.exe File created C:\windows\system\ERPBTH.exe FGNLSBD.exe File opened for modification C:\windows\system\SUMKHOL.exe BJK.exe File created C:\windows\QLUW.exe UGC.exe File opened for modification C:\windows\system\JWXHD.exe OJSX.exe File opened for modification C:\windows\system\WOGCAS.exe DLDH.exe File opened for modification C:\windows\system\LBNIHGY.exe QRFR.exe File created C:\windows\JDOM.exe.bat OIJDOGH.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 2376 5780 WerFault.exe 86 1872 5952 WerFault.exe 91 3488 3728 WerFault.exe 97 4700 5244 WerFault.exe 102 5196 2620 WerFault.exe 107 2420 5312 WerFault.exe 112 6120 2424 WerFault.exe 117 2496 5020 WerFault.exe 122 1192 1384 WerFault.exe 127 1468 5568 WerFault.exe 131 3680 1668 WerFault.exe 137 5868 4536 WerFault.exe 142 4292 4112 WerFault.exe 147 4596 3788 WerFault.exe 152 4764 4572 WerFault.exe 157 268 4300 WerFault.exe 162 5480 5104 WerFault.exe 167 2420 244 WerFault.exe 172 4612 1696 WerFault.exe 177 4084 5812 WerFault.exe 182 4244 1892 WerFault.exe 187 6052 4476 WerFault.exe 192 4156 3660 WerFault.exe 197 3956 3616 WerFault.exe 202 3568 3836 WerFault.exe 207 3416 3024 WerFault.exe 212 1924 4264 WerFault.exe 217 1324 5028 WerFault.exe 222 5452 252 WerFault.exe 227 2968 3304 WerFault.exe 232 760 2420 WerFault.exe 237 856 1140 WerFault.exe 241 6100 2496 WerFault.exe 246 5336 2612 WerFault.exe 252 1200 2548 WerFault.exe 257 2168 2856 WerFault.exe 263 4316 4832 WerFault.exe 268 6108 4384 WerFault.exe 273 2232 1368 WerFault.exe 278 6060 1068 WerFault.exe 283 2600 1600 WerFault.exe 288 5464 4808 WerFault.exe 293 4144 5552 WerFault.exe 298 4956 1176 WerFault.exe 303 1144 1172 WerFault.exe 308 2984 6056 WerFault.exe 313 4768 3824 WerFault.exe 318 4172 2732 WerFault.exe 323 892 4548 WerFault.exe 328 2936 2376 WerFault.exe 333 4344 2716 WerFault.exe 338 3256 4788 WerFault.exe 343 1676 1704 WerFault.exe 348 5852 4348 WerFault.exe 353 5136 6008 WerFault.exe 358 3760 1988 WerFault.exe 363 5368 2984 WerFault.exe 368 2560 2100 WerFault.exe 373 4488 4292 WerFault.exe 378 4108 5624 WerFault.exe 383 1324 5544 WerFault.exe 388 4552 6064 WerFault.exe 393 3500 6120 WerFault.exe 398 3360 4240 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGIDFB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDIONH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSQXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYTFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QEQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FGNLSBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJMVYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDMGOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYYPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIOHSYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOGCAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDAEZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMGIPWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMTOSCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HQNNDJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPZXPMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDJPFD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYXRMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBEEXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5780 2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe 5780 2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe 5952 YPV.exe 5952 YPV.exe 3728 WSUT.exe 3728 WSUT.exe 5244 OTIQ.exe 5244 OTIQ.exe 2620 MLL.exe 2620 MLL.exe 5312 URYNELN.exe 5312 URYNELN.exe 2424 MZE.exe 2424 MZE.exe 5020 UFRZBBD.exe 5020 UFRZBBD.exe 1384 HPZXPMY.exe 1384 HPZXPMY.exe 5568 ISDT.exe 5568 ISDT.exe 1668 CGIDFB.exe 1668 CGIDFB.exe 4536 QEQO.exe 4536 QEQO.exe 4112 DOYN.exe 4112 DOYN.exe 3788 HWFNHIH.exe 3788 HWFNHIH.exe 4572 PKSCSG.exe 4572 PKSCSG.exe 4300 XPWIUF.exe 4300 XPWIUF.exe 5104 FDJPFD.exe 5104 FDJPFD.exe 244 FGNLSBD.exe 244 FGNLSBD.exe 1696 ERPBTH.exe 1696 ERPBTH.exe 5812 MWCHEG.exe 5812 MWCHEG.exe 1892 OUICT.exe 1892 OUICT.exe 4476 PXLFZEF.exe 4476 PXLFZEF.exe 3660 IQBQIFN.exe 3660 IQBQIFN.exe 3616 UDIONH.exe 3616 UDIONH.exe 3836 CJMVYF.exe 3836 CJMVYF.exe 3024 VJCGPG.exe 3024 VJCGPG.exe 4264 BJK.exe 4264 BJK.exe 5028 SUMKHOL.exe 5028 SUMKHOL.exe 252 XUUX.exe 252 XUUX.exe 3304 NLVXWE.exe 3304 NLVXWE.exe 2420 GDKIGF.exe 2420 GDKIGF.exe 1140 ZGO.exe 1140 ZGO.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5780 2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe 5780 2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe 5952 YPV.exe 5952 YPV.exe 3728 WSUT.exe 3728 WSUT.exe 5244 OTIQ.exe 5244 OTIQ.exe 2620 MLL.exe 2620 MLL.exe 5312 URYNELN.exe 5312 URYNELN.exe 2424 MZE.exe 2424 MZE.exe 5020 UFRZBBD.exe 5020 UFRZBBD.exe 1384 HPZXPMY.exe 1384 HPZXPMY.exe 5568 ISDT.exe 5568 ISDT.exe 1668 CGIDFB.exe 1668 CGIDFB.exe 4536 QEQO.exe 4536 QEQO.exe 4112 DOYN.exe 4112 DOYN.exe 3788 HWFNHIH.exe 3788 HWFNHIH.exe 4572 PKSCSG.exe 4572 PKSCSG.exe 4300 XPWIUF.exe 4300 XPWIUF.exe 5104 FDJPFD.exe 5104 FDJPFD.exe 244 FGNLSBD.exe 244 FGNLSBD.exe 1696 ERPBTH.exe 1696 ERPBTH.exe 5812 MWCHEG.exe 5812 MWCHEG.exe 1892 OUICT.exe 1892 OUICT.exe 4476 PXLFZEF.exe 4476 PXLFZEF.exe 3660 IQBQIFN.exe 3660 IQBQIFN.exe 3616 UDIONH.exe 3616 UDIONH.exe 3836 CJMVYF.exe 3836 CJMVYF.exe 3024 VJCGPG.exe 3024 VJCGPG.exe 4264 BJK.exe 4264 BJK.exe 5028 SUMKHOL.exe 5028 SUMKHOL.exe 252 XUUX.exe 252 XUUX.exe 3304 NLVXWE.exe 3304 NLVXWE.exe 2420 GDKIGF.exe 2420 GDKIGF.exe 1140 ZGO.exe 1140 ZGO.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5780 wrote to memory of 1708 5780 2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe 87 PID 1708 wrote to memory of 5952 1708 cmd.exe 91 PID 5952 wrote to memory of 864 5952 YPV.exe 93 PID 864 wrote to memory of 3728 864 cmd.exe 97 PID 3728 wrote to memory of 2928 3728 WSUT.exe 98 PID 2928 wrote to memory of 5244 2928 cmd.exe 102 PID 5244 wrote to memory of 2688 5244 OTIQ.exe 103 PID 2688 wrote to memory of 2620 2688 cmd.exe 107 PID 2620 wrote to memory of 5320 2620 MLL.exe 108 PID 5320 wrote to memory of 5312 5320 cmd.exe 112 PID 5312 wrote to memory of 1760 5312 URYNELN.exe 113 PID 1760 wrote to memory of 2424 1760 cmd.exe 117 PID 2424 wrote to memory of 3384 2424 MZE.exe 118 PID 3384 wrote to memory of 5020 3384 cmd.exe 122 PID 5020 wrote to memory of 3936 5020 UFRZBBD.exe 123 PID 3936 wrote to memory of 1384 3936 cmd.exe 127 PID 1384 wrote to memory of 5760 1384 HPZXPMY.exe 128 PID 5760 wrote to memory of 5568 5760 cmd.exe 131 PID 5568 wrote to memory of 1684 5568 ISDT.exe 133 PID 1684 wrote to memory of 1668 1684 cmd.exe 137 PID 1668 wrote to memory of 4196 1668 CGIDFB.exe 138 PID 4196 wrote to memory of 4536 4196 cmd.exe 142 PID 4536 wrote to memory of 5024 4536 QEQO.exe 143 PID 5024 wrote to memory of 4112 5024 cmd.exe 147 PID 4112 wrote to memory of 3528 4112 DOYN.exe 148 PID 3528 wrote to memory of 3788 3528 cmd.exe 152 PID 3788 wrote to memory of 5356 3788 HWFNHIH.exe 153 PID 5356 wrote to memory of 4572 5356 cmd.exe 157 PID 4572 wrote to memory of 4604 4572 PKSCSG.exe 158 PID 4604 wrote to memory of 4300 4604 cmd.exe 162 PID 4300 wrote to memory of 2932 4300 XPWIUF.exe 163 PID 2932 wrote to memory of 5104 2932 cmd.exe 167 PID 5104 wrote to memory of 4580 5104 FDJPFD.exe 168 PID 4580 wrote to memory of 244 4580 cmd.exe 172 PID 244 wrote to memory of 6012 244 FGNLSBD.exe 173 PID 6012 wrote to memory of 1696 6012 cmd.exe 177 PID 1696 wrote to memory of 5124 1696 ERPBTH.exe 178 PID 5124 wrote to memory of 5812 5124 cmd.exe 182 PID 5812 wrote to memory of 1688 5812 MWCHEG.exe 183 PID 1688 wrote to memory of 1892 1688 cmd.exe 187 PID 1892 wrote to memory of 1364 1892 OUICT.exe 188 PID 1364 wrote to memory of 4476 1364 cmd.exe 192 PID 4476 wrote to memory of 3016 4476 PXLFZEF.exe 193 PID 3016 wrote to memory of 3660 3016 cmd.exe 197 PID 3660 wrote to memory of 1584 3660 IQBQIFN.exe 198 PID 1584 wrote to memory of 3616 1584 cmd.exe 202 PID 3616 wrote to memory of 1840 3616 UDIONH.exe 203 PID 1840 wrote to memory of 3836 1840 cmd.exe 207 PID 3836 wrote to memory of 3908 3836 CJMVYF.exe 208 PID 3024 wrote to memory of 2960 3024 VJCGPG.exe 213 PID 2960 wrote to memory of 4264 2960 cmd.exe 217 PID 4264 wrote to memory of 800 4264 BJK.exe 218 PID 800 wrote to memory of 5028 800 cmd.exe 222 PID 5028 wrote to memory of 3544 5028 SUMKHOL.exe 223 PID 3544 wrote to memory of 252 3544 cmd.exe 227 PID 252 wrote to memory of 5060 252 XUUX.exe 228 PID 5060 wrote to memory of 3304 5060 cmd.exe 232 PID 3304 wrote to memory of 6076 3304 NLVXWE.exe 233 PID 6076 wrote to memory of 2420 6076 cmd.exe 237 PID 2420 wrote to memory of 5032 2420 GDKIGF.exe 238 PID 5032 wrote to memory of 1140 5032 cmd.exe 241 PID 1140 wrote to memory of 3584 1140 ZGO.exe 243 PID 3584 wrote to memory of 2496 3584 cmd.exe 246 PID 2496 wrote to memory of 708 2496 TTTNWV.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_8bab4e4ddb4796726b225f3fb0338324_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPV.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\windows\SysWOW64\YPV.exeC:\windows\system32\YPV.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSUT.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:864 -
C:\windows\system\WSUT.exeC:\windows\system\WSUT.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OTIQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\SysWOW64\OTIQ.exeC:\windows\system32\OTIQ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MLL.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\MLL.exeC:\windows\MLL.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URYNELN.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\windows\SysWOW64\URYNELN.exeC:\windows\system32\URYNELN.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MZE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\windows\system\MZE.exeC:\windows\system\MZE.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFRZBBD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\SysWOW64\UFRZBBD.exeC:\windows\system32\UFRZBBD.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HPZXPMY.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\windows\system\HPZXPMY.exeC:\windows\system\HPZXPMY.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ISDT.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\windows\SysWOW64\ISDT.exeC:\windows\system32\ISDT.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CGIDFB.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\windows\SysWOW64\CGIDFB.exeC:\windows\system32\CGIDFB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QEQO.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\windows\QEQO.exeC:\windows\QEQO.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DOYN.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\SysWOW64\DOYN.exeC:\windows\system32\DOYN.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWFNHIH.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\system\HWFNHIH.exeC:\windows\system\HWFNHIH.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKSCSG.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\PKSCSG.exeC:\windows\PKSCSG.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XPWIUF.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\windows\SysWOW64\XPWIUF.exeC:\windows\system32\XPWIUF.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FDJPFD.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\windows\FDJPFD.exeC:\windows\FDJPFD.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FGNLSBD.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\system\FGNLSBD.exeC:\windows\system\FGNLSBD.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ERPBTH.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\system\ERPBTH.exeC:\windows\system\ERPBTH.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWCHEG.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\windows\MWCHEG.exeC:\windows\MWCHEG.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUICT.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\windows\SysWOW64\OUICT.exeC:\windows\system32\OUICT.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PXLFZEF.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\windows\system\PXLFZEF.exeC:\windows\system\PXLFZEF.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQBQIFN.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\windows\IQBQIFN.exeC:\windows\IQBQIFN.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDIONH.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\windows\system\UDIONH.exeC:\windows\system\UDIONH.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJMVYF.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\windows\CJMVYF.exeC:\windows\CJMVYF.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VJCGPG.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
PID:3908 -
C:\windows\VJCGPG.exeC:\windows\VJCGPG.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BJK.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\windows\BJK.exeC:\windows\BJK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUMKHOL.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\windows\system\SUMKHOL.exeC:\windows\system\SUMKHOL.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUUX.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\system\XUUX.exeC:\windows\system\XUUX.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLVXWE.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\windows\NLVXWE.exeC:\windows\NLVXWE.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GDKIGF.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\windows\GDKIGF.exeC:\windows\GDKIGF.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\windows\ZGO.exeC:\windows\ZGO.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TTTNWV.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\windows\system\TTTNWV.exeC:\windows\system\TTTNWV.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWX.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:708 -
C:\windows\SysWOW64\UWX.exeC:\windows\system32\UWX.exe67⤵
- Executes dropped EXE
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUC.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3184 -
C:\windows\WUC.exeC:\windows\WUC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSQXY.exe.bat" "70⤵PID:5460
-
C:\windows\GSQXY.exeC:\windows\GSQXY.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VARX.exe.bat" "72⤵PID:2072
-
C:\windows\system\VARX.exeC:\windows\system\VARX.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYXRMF.exe.bat" "74⤵PID:5348
-
C:\windows\XYXRMF.exeC:\windows\XYXRMF.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWCLBO.exe.bat" "76⤵PID:2700
-
C:\windows\SysWOW64\HWCLBO.exeC:\windows\system32\HWCLBO.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GONTK.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2504 -
C:\windows\SysWOW64\GONTK.exeC:\windows\system32\GONTK.exe79⤵
- Executes dropped EXE
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMTOSCL.exe.bat" "80⤵PID:5340
-
C:\windows\QMTOSCL.exeC:\windows\QMTOSCL.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPBMGNH.exe.bat" "82⤵PID:5948
-
C:\windows\SysWOW64\DPBMGNH.exeC:\windows\system32\DPBMGNH.exe83⤵
- Executes dropped EXE
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXD.exe.bat" "84⤵PID:2012
-
C:\windows\NXD.exeC:\windows\NXD.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIOHSYX.exe.bat" "86⤵PID:5644
-
C:\windows\system\LIOHSYX.exeC:\windows\system\LIOHSYX.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VGUCZ.exe.bat" "88⤵PID:5436
-
C:\windows\SysWOW64\VGUCZ.exeC:\windows\system32\VGUCZ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XEZW.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2032 -
C:\windows\XEZW.exeC:\windows\XEZW.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJMD.exe.bat" "92⤵PID:4900
-
C:\windows\FJMD.exeC:\windows\FJMD.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZSDEY.exe.bat" "94⤵PID:1400
-
C:\windows\system\RZSDEY.exeC:\windows\system\RZSDEY.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZUIH.exe.bat" "96⤵PID:4912
-
C:\windows\AZUIH.exeC:\windows\AZUIH.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKD.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2680 -
C:\windows\system\OKD.exeC:\windows\system\OKD.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGC.exe.bat" "100⤵PID:2020
-
C:\windows\system\UGC.exeC:\windows\system\UGC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLUW.exe.bat" "102⤵PID:4452
-
C:\windows\QLUW.exeC:\windows\QLUW.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYTFV.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3776 -
C:\windows\SysWOW64\WYTFV.exeC:\windows\system32\WYTFV.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XBXB.exe.bat" "106⤵PID:5720
-
C:\windows\system\XBXB.exeC:\windows\system\XBXB.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZJENKN.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:6068 -
C:\windows\system\WZJENKN.exeC:\windows\system\WZJENKN.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKTUWQ.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2532 -
C:\windows\SysWOW64\MKTUWQ.exeC:\windows\system32\MKTUWQ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXY.exe.bat" "112⤵PID:3320
-
C:\windows\SysWOW64\PXY.exeC:\windows\system32\PXY.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WNZV.exe.bat" "114⤵PID:3564
-
C:\windows\SysWOW64\WNZV.exeC:\windows\system32\WNZV.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBEEXM.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:6140 -
C:\windows\system\RBEEXM.exeC:\windows\system\RBEEXM.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLMDDO.exe.bat" "118⤵PID:4068
-
C:\windows\SysWOW64\MLMDDO.exeC:\windows\system32\MLMDDO.exe119⤵
- Executes dropped EXE
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJSX.exe.bat" "120⤵PID:4936
-
C:\windows\OJSX.exeC:\windows\OJSX.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-