Analysis
- max time kernel
80s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 04:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe
- Size 282KB
- Sample260718-eq47taa17s
- SHA256 f47a5d679c79381661febfc914e5d4bdffdcafb5af95a1e8eea3e5ec6a5553e6
- MD5 401cefd7caf0c55fced7b6c70c1c9b1d
- SHA1 f9bca139857afbdade34bc50ff1e87318dc05656
- SHA512 e57c2dfc466d5d466b898052e4dd418385c80e910a900cc32af506d92b64ff27726f91f8025d00205625d6f7241842283fc2484e8c39d097a9e834f8e9ccc252
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOUkEjiPISUOgW9X+hOGzC/:RLWI09QZb6LOUkmZzcukG2/
- TLSH T166549F1776C28273D5A3037209DAC6E9B73ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4172 YFPHULN.exe 2484 CYR.exe 748 MWFCT.exe 712 QHD.exe 5856 OXPTODQ.exe 1364 USA.exe 4512 KIBTA.exe 1548 UGHF.exe 3532 OTMPSV.exe 1112 HWP.exe 5792 LEESJDQ.exe 892 VCKNR.exe 4384 EKMSCJ.exe 4992 KKT.exe 4232 FYYPW.exe 2408 UOZ.exe 1536 YWGOHR.exe 5144 PEIBKWW.exe 2516 VEPP.exe 2124 OIT.exe 5072 PDXPM.exe 2572 JQCYWEX.exe 4048 PQJM.exe 5416 ARZX.exe 3420 EUXSX.exe 4336 MZCYH.exe 1900 IKSPV.exe 4792 ELUZ.exe 3696 XGY.exe 996 FTKCPUN.exe 1320 NZPIATR.exe 5412 IJFHO.exe 836 MZMPAOA.exe 2196 LKPXJC.exe 4168 AAQWQ.exe 5884 XGI.exe 4496 HEO.exe 3108 YOYWWHL.exe 5188 PPA.exe 3124 XCF.exe 5336 BKMIW.exe 1160 SSANJ.exe 1916 YOZ.exe 5840 VEGEB.exe 2148 DJSTL.exe 2588 BUVBUQ.exe 4476 PFLAIS.exe 1672 XSQGTZ.exe 3448 MJRG.exe 5644 FEDBFC.exe 4520 RUKJ.exe 5560 VCQJVN.exe 4532 PPV.exe 3192 VKUCKQ.exe 3164 BLC.exe 5508 FBIPF.exe 5460 FGBEHP.exe 1516 EWUHC.exe 2060 YRZQEU.exe 5332 ZMC.exe 4488 BKI.exe 4880 JYI.exe 5912 UQQG.exe 1376 LQSLV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\UQQG.exe.bat JYI.exe File created C:\windows\SysWOW64\HEO.exe XGI.exe File created C:\windows\SysWOW64\RUKJ.exe.bat FEDBFC.exe File created C:\windows\SysWOW64\VCKNR.exe LEESJDQ.exe File created C:\windows\SysWOW64\ZMC.exe YRZQEU.exe File created C:\windows\SysWOW64\ZNEWPP.exe MDV.exe File created C:\windows\SysWOW64\ZNFV.exe.bat KHAYFUA.exe File created C:\windows\SysWOW64\IKSPV.exe.bat MZCYH.exe File created C:\windows\SysWOW64\TPNTM.exe.bat PHYTIWT.exe File created C:\windows\SysWOW64\QNHAX.exe ZNFV.exe File opened for modification C:\windows\SysWOW64\QNHAX.exe ZNFV.exe File created C:\windows\SysWOW64\BLC.exe VKUCKQ.exe File opened for modification C:\windows\SysWOW64\TPNTM.exe PHYTIWT.exe File created C:\windows\SysWOW64\ZNFV.exe KHAYFUA.exe File created C:\windows\SysWOW64\PUX.exe.bat DEQN.exe File opened for modification C:\windows\SysWOW64\UQQG.exe JYI.exe File created C:\windows\SysWOW64\ELUZ.exe IKSPV.exe File opened for modification C:\windows\SysWOW64\YOZ.exe SSANJ.exe File created C:\windows\SysWOW64\ZKEURKE.exe.bat TPNTM.exe File created C:\windows\SysWOW64\ZNEWPP.exe.bat MDV.exe File created C:\windows\SysWOW64\VCKNR.exe.bat LEESJDQ.exe File created C:\windows\SysWOW64\YOZ.exe SSANJ.exe File created C:\windows\SysWOW64\XSQGTZ.exe.bat PFLAIS.exe File opened for modification C:\windows\SysWOW64\MJRG.exe XSQGTZ.exe File opened for modification C:\windows\SysWOW64\BLC.exe VKUCKQ.exe File created C:\windows\SysWOW64\HHBAM.exe.bat MMW.exe File created C:\windows\SysWOW64\LEESJDQ.exe HWP.exe File opened for modification C:\windows\SysWOW64\XSQGTZ.exe PFLAIS.exe File opened for modification C:\windows\SysWOW64\HHBAM.exe MMW.exe File created C:\windows\SysWOW64\PUX.exe DEQN.exe File opened for modification C:\windows\SysWOW64\PUX.exe DEQN.exe File created C:\windows\SysWOW64\LEESJDQ.exe.bat HWP.exe File opened for modification C:\windows\SysWOW64\VCKNR.exe LEESJDQ.exe File created C:\windows\SysWOW64\YWGOHR.exe.bat UOZ.exe File created C:\windows\SysWOW64\MZCYH.exe.bat EUXSX.exe File created C:\windows\SysWOW64\IKSPV.exe MZCYH.exe File created C:\windows\SysWOW64\ELUZ.exe.bat IKSPV.exe File created C:\windows\SysWOW64\MJRG.exe XSQGTZ.exe File opened for modification C:\windows\SysWOW64\ZKEURKE.exe TPNTM.exe File opened for modification C:\windows\SysWOW64\PHYTIWT.exe LQSLV.exe File created C:\windows\SysWOW64\VEGEB.exe YOZ.exe File opened for modification C:\windows\SysWOW64\RUKJ.exe FEDBFC.exe File created C:\windows\SysWOW64\ZMC.exe.bat YRZQEU.exe File created C:\windows\SysWOW64\ZKEURKE.exe TPNTM.exe File created C:\windows\SysWOW64\HDFERZV.exe HHBAM.exe File opened for modification C:\windows\SysWOW64\ZNEWPP.exe MDV.exe File created C:\windows\SysWOW64\MZCYH.exe EUXSX.exe File created C:\windows\SysWOW64\USA.exe.bat OXPTODQ.exe File created C:\windows\SysWOW64\XSQGTZ.exe PFLAIS.exe File created C:\windows\SysWOW64\MJRG.exe.bat XSQGTZ.exe File created C:\windows\SysWOW64\RUKJ.exe FEDBFC.exe File created C:\windows\SysWOW64\QNHAX.exe.bat ZNFV.exe File opened for modification C:\windows\SysWOW64\YWGOHR.exe UOZ.exe File opened for modification C:\windows\SysWOW64\HEO.exe XGI.exe File opened for modification C:\windows\SysWOW64\VEGEB.exe YOZ.exe File created C:\windows\SysWOW64\BUVBUQ.exe DJSTL.exe File created C:\windows\SysWOW64\BLC.exe.bat VKUCKQ.exe File opened for modification C:\windows\SysWOW64\ZMC.exe YRZQEU.exe File created C:\windows\SysWOW64\PHYTIWT.exe.bat LQSLV.exe File created C:\windows\SysWOW64\TPNTM.exe PHYTIWT.exe File opened for modification C:\windows\SysWOW64\USA.exe OXPTODQ.exe File created C:\windows\SysWOW64\YWGOHR.exe UOZ.exe File created C:\windows\SysWOW64\HEO.exe.bat XGI.exe File opened for modification C:\windows\SysWOW64\BUVBUQ.exe DJSTL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\YNYLNCH.exe.bat YAXXMP.exe File opened for modification C:\windows\ILDFVK.exe YNYLNCH.exe File opened for modification C:\windows\system\KGHPXWM.exe ZNEWPP.exe File created C:\windows\YOYWWHL.exe HEO.exe File created C:\windows\system\PPA.exe YOYWWHL.exe File created C:\windows\LQSLV.exe UQQG.exe File created C:\windows\IZQCO.exe OLL.exe File opened for modification C:\windows\system\SZSIRK.exe IZQCO.exe File created C:\windows\OYJX.exe HDFERZV.exe File created C:\windows\DEQN.exe.bat ZWJNBH.exe File created C:\windows\OYMPD.exe OCI.exe File opened for modification C:\windows\system\CYR.exe YFPHULN.exe File created C:\windows\system\QHD.exe MWFCT.exe File created C:\windows\system\OXPTODQ.exe.bat QHD.exe File created C:\windows\KIBTA.exe USA.exe File created C:\windows\KKT.exe EKMSCJ.exe File opened for modification C:\windows\KKT.exe EKMSCJ.exe File created C:\windows\system\PEIBKWW.exe YWGOHR.exe File created C:\windows\system\XGY.exe.bat ELUZ.exe File created C:\windows\EUXSX.exe ARZX.exe File opened for modification C:\windows\IJFHO.exe NZPIATR.exe File opened for modification C:\windows\SSANJ.exe BKMIW.exe File opened for modification C:\windows\DJSTL.exe VEGEB.exe File opened for modification C:\windows\system\BKI.exe ZMC.exe File created C:\windows\system\SZSIRK.exe IZQCO.exe File created C:\windows\system\ITNGH.exe.bat OYJX.exe File created C:\windows\IVPXX.exe CZP.exe File created C:\windows\system\CYR.exe YFPHULN.exe File created C:\windows\system\UGHF.exe KIBTA.exe File created C:\windows\system\OTMPSV.exe.bat UGHF.exe File created C:\windows\system\AAQWQ.exe LKPXJC.exe File created C:\windows\DJSTL.exe.bat VEGEB.exe File opened for modification C:\windows\system\VKUCKQ.exe PPV.exe File created C:\windows\system\BKI.exe.bat ZMC.exe File opened for modification C:\windows\system\YNYLNCH.exe YAXXMP.exe File created C:\windows\system\UGHF.exe.bat KIBTA.exe File created C:\windows\FYYPW.exe KKT.exe File created C:\windows\PQJM.exe.bat JQCYWEX.exe File opened for modification C:\windows\system\NZPIATR.exe FTKCPUN.exe File created C:\windows\IJFHO.exe.bat NZPIATR.exe File opened for modification C:\windows\system\PPA.exe YOYWWHL.exe File created C:\windows\system\PPV.exe.bat VCQJVN.exe File created C:\windows\JYI.exe.bat BKI.exe File created C:\windows\system\FEDBFC.exe MJRG.exe File created C:\windows\system\OIT.exe.bat VEPP.exe File created C:\windows\system\ARZX.exe.bat PQJM.exe File opened for modification C:\windows\system\FTKCPUN.exe XGY.exe File created C:\windows\system\FTKCPUN.exe.bat XGY.exe File created C:\windows\XGI.exe.bat AAQWQ.exe File created C:\windows\SSANJ.exe BKMIW.exe File created C:\windows\system\EWUHC.exe FGBEHP.exe File opened for modification C:\windows\system\HWP.exe OTMPSV.exe File created C:\windows\system\JQCYWEX.exe.bat PDXPM.exe File opened for modification C:\windows\EUXSX.exe ARZX.exe File created C:\windows\MZMPAOA.exe IJFHO.exe File created C:\windows\system\PPA.exe.bat YOYWWHL.exe File opened for modification C:\windows\OYJX.exe HDFERZV.exe File opened for modification C:\windows\system\FUXH.exe XOF.exe File created C:\windows\system\KHCWC.exe PUX.exe File created C:\windows\YFPHULN.exe 2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe File opened for modification C:\windows\YFPHULN.exe 2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe File opened for modification C:\windows\system\EKMSCJ.exe VCKNR.exe File created C:\windows\system\EKMSCJ.exe.bat VCKNR.exe File opened for modification C:\windows\system\PEIBKWW.exe YWGOHR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5324 cmd.exe 2972 cmd.exe 1812 cmd.exe 4940 cmd.exe 4388 cmd.exe 2688 cmd.exe 5860 cmd.exe 5104 cmd.exe 2968 cmd.exe 2144 cmd.exe 3744 cmd.exe 5948 cmd.exe 5344 cmd.exe 6004 cmd.exe 5304 cmd.exe 5468 cmd.exe 5852 cmd.exe 5716 cmd.exe 5060 cmd.exe 2560 cmd.exe 816 cmd.exe 4000 cmd.exe 5024 cmd.exe 2552 cmd.exe 260 cmd.exe 3984 cmd.exe 744 cmd.exe 3728 cmd.exe 424 cmd.exe 3524 cmd.exe 5844 cmd.exe 2796 cmd.exe 5788 cmd.exe 4548 cmd.exe 4596 cmd.exe 4084 cmd.exe 2016 cmd.exe 5584 cmd.exe 1800 cmd.exe 4524 cmd.exe 5568 cmd.exe 824 cmd.exe 1484 cmd.exe 4736 cmd.exe 4832 cmd.exe 2852 cmd.exe 4784 cmd.exe 5916 cmd.exe 3004 cmd.exe 4284 cmd.exe 4492 cmd.exe 4296 cmd.exe 3160 cmd.exe 2600 cmd.exe 3920 cmd.exe 2312 cmd.exe 2912 cmd.exe 4060 cmd.exe 3824 cmd.exe 6048 cmd.exe 2012 cmd.exe 1456 cmd.exe 5156 cmd.exe 2828 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 400 4340 WerFault.exe 86 3656 4172 WerFault.exe 92 3116 2484 WerFault.exe 98 2380 748 WerFault.exe 103 3208 712 WerFault.exe 108 3148 5856 WerFault.exe 113 3744 1364 WerFault.exe 118 5188 4512 WerFault.exe 123 4040 1548 WerFault.exe 128 3672 3532 WerFault.exe 133 5612 1112 WerFault.exe 138 1888 5792 WerFault.exe 143 2464 892 WerFault.exe 148 2960 4384 WerFault.exe 153 4600 4992 WerFault.exe 158 2144 4232 WerFault.exe 163 5304 2408 WerFault.exe 168 3156 1536 WerFault.exe 173 4828 5144 WerFault.exe 178 4520 2516 WerFault.exe 183 5316 2124 WerFault.exe 188 2780 5072 WerFault.exe 193 3512 2572 WerFault.exe 198 4684 4048 WerFault.exe 203 5932 5416 WerFault.exe 208 3208 3420 WerFault.exe 213 3120 4336 WerFault.exe 217 4240 1900 WerFault.exe 223 2056 4792 WerFault.exe 228 1636 3696 WerFault.exe 233 5624 996 WerFault.exe 238 4932 1320 WerFault.exe 243 1692 5412 WerFault.exe 248 1720 836 WerFault.exe 253 1368 2196 WerFault.exe 258 5024 4168 WerFault.exe 263 4180 5884 WerFault.exe 268 688 4496 WerFault.exe 274 6008 3108 WerFault.exe 279 3452 5188 WerFault.exe 284 2348 3124 WerFault.exe 289 5428 5336 WerFault.exe 294 2648 1160 WerFault.exe 299 6064 1916 WerFault.exe 304 4236 5840 WerFault.exe 309 2976 2148 WerFault.exe 314 5940 2588 WerFault.exe 319 2372 4476 WerFault.exe 324 2540 1672 WerFault.exe 329 4632 3448 WerFault.exe 334 4524 5644 WerFault.exe 339 5036 4520 WerFault.exe 344 5080 5560 WerFault.exe 349 3656 4532 WerFault.exe 354 2676 3192 WerFault.exe 359 4760 3164 WerFault.exe 364 3692 5508 WerFault.exe 369 2404 5460 WerFault.exe 374 5832 1516 WerFault.exe 379 4252 2060 WerFault.exe 384 4012 5332 WerFault.exe 389 5036 4488 WerFault.exe 394 2948 4880 WerFault.exe 399 1372 5912 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKSPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKPXJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWUHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTMPSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQCYWEX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKMIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCQJVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAXXMP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEIBKWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHYTIWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEGEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWJNBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJFHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFLAIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHAYFUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNFV.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4340 2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe 4340 2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe 4172 YFPHULN.exe 4172 YFPHULN.exe 2484 CYR.exe 2484 CYR.exe 748 MWFCT.exe 748 MWFCT.exe 712 QHD.exe 712 QHD.exe 5856 OXPTODQ.exe 5856 OXPTODQ.exe 1364 USA.exe 1364 USA.exe 4512 KIBTA.exe 4512 KIBTA.exe 1548 UGHF.exe 1548 UGHF.exe 3532 OTMPSV.exe 3532 OTMPSV.exe 1112 HWP.exe 1112 HWP.exe 5792 LEESJDQ.exe 5792 LEESJDQ.exe 892 VCKNR.exe 892 VCKNR.exe 4384 EKMSCJ.exe 4384 EKMSCJ.exe 4992 KKT.exe 4992 KKT.exe 4232 FYYPW.exe 4232 FYYPW.exe 2408 UOZ.exe 2408 UOZ.exe 1536 YWGOHR.exe 1536 YWGOHR.exe 5144 PEIBKWW.exe 5144 PEIBKWW.exe 2516 VEPP.exe 2516 VEPP.exe 2124 OIT.exe 2124 OIT.exe 5072 PDXPM.exe 5072 PDXPM.exe 2572 JQCYWEX.exe 2572 JQCYWEX.exe 4048 PQJM.exe 4048 PQJM.exe 5416 ARZX.exe 5416 ARZX.exe 3420 EUXSX.exe 3420 EUXSX.exe 4336 MZCYH.exe 4336 MZCYH.exe 1900 IKSPV.exe 1900 IKSPV.exe 4792 ELUZ.exe 4792 ELUZ.exe 3696 XGY.exe 3696 XGY.exe 996 FTKCPUN.exe 996 FTKCPUN.exe 1320 NZPIATR.exe 1320 NZPIATR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4340 2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe 4340 2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe 4172 YFPHULN.exe 4172 YFPHULN.exe 2484 CYR.exe 2484 CYR.exe 748 MWFCT.exe 748 MWFCT.exe 712 QHD.exe 712 QHD.exe 5856 OXPTODQ.exe 5856 OXPTODQ.exe 1364 USA.exe 1364 USA.exe 4512 KIBTA.exe 4512 KIBTA.exe 1548 UGHF.exe 1548 UGHF.exe 3532 OTMPSV.exe 3532 OTMPSV.exe 1112 HWP.exe 1112 HWP.exe 5792 LEESJDQ.exe 5792 LEESJDQ.exe 892 VCKNR.exe 892 VCKNR.exe 4384 EKMSCJ.exe 4384 EKMSCJ.exe 4992 KKT.exe 4992 KKT.exe 4232 FYYPW.exe 4232 FYYPW.exe 2408 UOZ.exe 2408 UOZ.exe 1536 YWGOHR.exe 1536 YWGOHR.exe 5144 PEIBKWW.exe 5144 PEIBKWW.exe 2516 VEPP.exe 2516 VEPP.exe 2124 OIT.exe 2124 OIT.exe 5072 PDXPM.exe 5072 PDXPM.exe 2572 JQCYWEX.exe 2572 JQCYWEX.exe 4048 PQJM.exe 4048 PQJM.exe 5416 ARZX.exe 5416 ARZX.exe 3420 EUXSX.exe 3420 EUXSX.exe 4336 MZCYH.exe 4336 MZCYH.exe 1900 IKSPV.exe 1900 IKSPV.exe 4792 ELUZ.exe 4792 ELUZ.exe 3696 XGY.exe 3696 XGY.exe 996 FTKCPUN.exe 996 FTKCPUN.exe 1320 NZPIATR.exe 1320 NZPIATR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4340 wrote to memory of 2552 4340 2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe 88 PID 2552 wrote to memory of 4172 2552 cmd.exe 92 PID 4172 wrote to memory of 424 4172 YFPHULN.exe 94 PID 424 wrote to memory of 2484 424 cmd.exe 98 PID 2484 wrote to memory of 260 2484 CYR.exe 99 PID 260 wrote to memory of 748 260 cmd.exe 103 PID 748 wrote to memory of 1508 748 MWFCT.exe 104 PID 1508 wrote to memory of 712 1508 cmd.exe 108 PID 712 wrote to memory of 1820 712 QHD.exe 109 PID 1820 wrote to memory of 5856 1820 cmd.exe 113 PID 5856 wrote to memory of 5468 5856 OXPTODQ.exe 114 PID 5468 wrote to memory of 1364 5468 cmd.exe 118 PID 1364 wrote to memory of 256 1364 USA.exe 119 PID 256 wrote to memory of 4512 256 cmd.exe 123 PID 4512 wrote to memory of 4140 4512 KIBTA.exe 124 PID 4140 wrote to memory of 1548 4140 cmd.exe 128 PID 1548 wrote to memory of 3960 1548 UGHF.exe 129 PID 3960 wrote to memory of 3532 3960 cmd.exe 133 PID 3532 wrote to memory of 4892 3532 OTMPSV.exe 134 PID 4892 wrote to memory of 1112 4892 cmd.exe 138 PID 1112 wrote to memory of 5040 1112 HWP.exe 139 PID 5040 wrote to memory of 5792 5040 cmd.exe 143 PID 5792 wrote to memory of 3984 5792 LEESJDQ.exe 144 PID 3984 wrote to memory of 892 3984 cmd.exe 148 PID 892 wrote to memory of 4756 892 VCKNR.exe 149 PID 4756 wrote to memory of 4384 4756 cmd.exe 153 PID 4384 wrote to memory of 6048 4384 EKMSCJ.exe 154 PID 6048 wrote to memory of 4992 6048 cmd.exe 158 PID 4992 wrote to memory of 2016 4992 KKT.exe 159 PID 2016 wrote to memory of 4232 2016 cmd.exe 163 PID 4232 wrote to memory of 5628 4232 FYYPW.exe 164 PID 5628 wrote to memory of 2408 5628 cmd.exe 168 PID 2408 wrote to memory of 3128 2408 UOZ.exe 169 PID 3128 wrote to memory of 1536 3128 cmd.exe 173 PID 1536 wrote to memory of 1696 1536 YWGOHR.exe 174 PID 1696 wrote to memory of 5144 1696 cmd.exe 178 PID 5144 wrote to memory of 744 5144 PEIBKWW.exe 179 PID 744 wrote to memory of 2516 744 cmd.exe 183 PID 2516 wrote to memory of 4832 2516 VEPP.exe 184 PID 4832 wrote to memory of 2124 4832 cmd.exe 188 PID 2124 wrote to memory of 764 2124 OIT.exe 189 PID 764 wrote to memory of 5072 764 cmd.exe 193 PID 5072 wrote to memory of 4540 5072 PDXPM.exe 194 PID 4540 wrote to memory of 2572 4540 cmd.exe 198 PID 2572 wrote to memory of 3324 2572 JQCYWEX.exe 199 PID 3324 wrote to memory of 4048 3324 cmd.exe 203 PID 4048 wrote to memory of 3620 4048 PQJM.exe 204 PID 3620 wrote to memory of 5416 3620 cmd.exe 208 PID 5416 wrote to memory of 1416 5416 ARZX.exe 209 PID 1416 wrote to memory of 3420 1416 cmd.exe 213 PID 3420 wrote to memory of 3160 3420 EUXSX.exe 214 PID 3160 wrote to memory of 4336 3160 cmd.exe 217 PID 4336 wrote to memory of 928 4336 MZCYH.exe 219 PID 928 wrote to memory of 1900 928 cmd.exe 223 PID 1900 wrote to memory of 3728 1900 IKSPV.exe 224 PID 3728 wrote to memory of 4792 3728 cmd.exe 228 PID 4792 wrote to memory of 2852 4792 ELUZ.exe 229 PID 2852 wrote to memory of 3696 2852 cmd.exe 233 PID 3696 wrote to memory of 1144 3696 XGY.exe 234 PID 1144 wrote to memory of 996 1144 cmd.exe 238 PID 996 wrote to memory of 2012 996 FTKCPUN.exe 239 PID 2012 wrote to memory of 1320 2012 cmd.exe 243 PID 1320 wrote to memory of 992 1320 NZPIATR.exe 244 PID 992 wrote to memory of 5412 992 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_401cefd7caf0c55fced7b6c70c1c9b1d_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YFPHULN.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\windows\YFPHULN.exeC:\windows\YFPHULN.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYR.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:424 -
C:\windows\system\CYR.exeC:\windows\system\CYR.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWFCT.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260 -
C:\windows\system\MWFCT.exeC:\windows\system\MWFCT.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHD.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\system\QHD.exeC:\windows\system\QHD.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXPTODQ.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\windows\system\OXPTODQ.exeC:\windows\system\OXPTODQ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USA.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\SysWOW64\USA.exeC:\windows\system32\USA.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIBTA.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\KIBTA.exeC:\windows\KIBTA.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGHF.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\windows\system\UGHF.exeC:\windows\system\UGHF.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OTMPSV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\windows\system\OTMPSV.exeC:\windows\system\OTMPSV.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWP.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\windows\system\HWP.exeC:\windows\system\HWP.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LEESJDQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\SysWOW64\LEESJDQ.exeC:\windows\system32\LEESJDQ.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCKNR.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\windows\SysWOW64\VCKNR.exeC:\windows\system32\VCKNR.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EKMSCJ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\windows\system\EKMSCJ.exeC:\windows\system\EKMSCJ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KKT.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\windows\KKT.exeC:\windows\KKT.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYYPW.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\windows\FYYPW.exeC:\windows\FYYPW.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOZ.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\system\UOZ.exeC:\windows\system\UOZ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWGOHR.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\windows\SysWOW64\YWGOHR.exeC:\windows\system32\YWGOHR.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PEIBKWW.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\windows\system\PEIBKWW.exeC:\windows\system\PEIBKWW.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VEPP.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:744 -
C:\windows\system\VEPP.exeC:\windows\system\VEPP.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIT.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\windows\system\OIT.exeC:\windows\system\OIT.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PDXPM.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764 -
C:\windows\system\PDXPM.exeC:\windows\system\PDXPM.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQCYWEX.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\system\JQCYWEX.exeC:\windows\system\JQCYWEX.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQJM.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\PQJM.exeC:\windows\PQJM.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARZX.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\windows\system\ARZX.exeC:\windows\system\ARZX.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUXSX.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\windows\EUXSX.exeC:\windows\EUXSX.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZCYH.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\SysWOW64\MZCYH.exeC:\windows\system32\MZCYH.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKSPV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\windows\SysWOW64\IKSPV.exeC:\windows\system32\IKSPV.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELUZ.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\SysWOW64\ELUZ.exeC:\windows\system32\ELUZ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XGY.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\system\XGY.exeC:\windows\system\XGY.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FTKCPUN.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\windows\system\FTKCPUN.exeC:\windows\system\FTKCPUN.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NZPIATR.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\windows\system\NZPIATR.exeC:\windows\system\NZPIATR.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJFHO.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\windows\IJFHO.exeC:\windows\IJFHO.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MZMPAOA.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:2260 -
C:\windows\MZMPAOA.exeC:\windows\MZMPAOA.exe67⤵
- Executes dropped EXE
PID:836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKPXJC.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4784 -
C:\windows\LKPXJC.exeC:\windows\LKPXJC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AAQWQ.exe.bat" "70⤵
- Executes a command shell one-liner
PID:5584 -
C:\windows\system\AAQWQ.exeC:\windows\system\AAQWQ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGI.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5916 -
C:\windows\XGI.exeC:\windows\XGI.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEO.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3524 -
C:\windows\SysWOW64\HEO.exeC:\windows\system32\HEO.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOYWWHL.exe.bat" "76⤵PID:3460
-
C:\windows\YOYWWHL.exeC:\windows\YOYWWHL.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PPA.exe.bat" "78⤵PID:1428
-
C:\windows\system\PPA.exeC:\windows\system\PPA.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XCF.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3196 -
C:\windows\XCF.exeC:\windows\XCF.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKMIW.exe.bat" "82⤵PID:464
-
C:\windows\BKMIW.exeC:\windows\BKMIW.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSANJ.exe.bat" "84⤵PID:1828
-
C:\windows\SSANJ.exeC:\windows\SSANJ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOZ.exe.bat" "86⤵PID:6080
-
C:\windows\SysWOW64\YOZ.exeC:\windows\system32\YOZ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEGEB.exe.bat" "88⤵PID:6108
-
C:\windows\SysWOW64\VEGEB.exeC:\windows\system32\VEGEB.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DJSTL.exe.bat" "90⤵PID:2192
-
C:\windows\DJSTL.exeC:\windows\DJSTL.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUVBUQ.exe.bat" "92⤵PID:2740
-
C:\windows\SysWOW64\BUVBUQ.exeC:\windows\system32\BUVBUQ.exe93⤵
- Executes dropped EXE
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PFLAIS.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1800 -
C:\windows\system\PFLAIS.exeC:\windows\system\PFLAIS.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSQGTZ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\windows\SysWOW64\XSQGTZ.exeC:\windows\system32\XSQGTZ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJRG.exe.bat" "98⤵PID:2400
-
C:\windows\SysWOW64\MJRG.exeC:\windows\system32\MJRG.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FEDBFC.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3144 -
C:\windows\system\FEDBFC.exeC:\windows\system\FEDBFC.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUKJ.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5328 -
C:\windows\SysWOW64\RUKJ.exeC:\windows\system32\RUKJ.exe103⤵
- Executes dropped EXE
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCQJVN.exe.bat" "104⤵PID:4788
-
C:\windows\system\VCQJVN.exeC:\windows\system\VCQJVN.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PPV.exe.bat" "106⤵PID:1692
-
C:\windows\system\PPV.exeC:\windows\system\PPV.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VKUCKQ.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3476 -
C:\windows\system\VKUCKQ.exeC:\windows\system\VKUCKQ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLC.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5844 -
C:\windows\SysWOW64\BLC.exeC:\windows\system32\BLC.exe111⤵
- Executes dropped EXE
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBIPF.exe.bat" "112⤵
- Executes a command shell one-liner
PID:5024 -
C:\windows\FBIPF.exeC:\windows\FBIPF.exe113⤵
- Executes dropped EXE
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FGBEHP.exe.bat" "114⤵
- Executes a command shell one-liner
PID:2600 -
C:\windows\system\FGBEHP.exeC:\windows\system\FGBEHP.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWUHC.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3920 -
C:\windows\system\EWUHC.exeC:\windows\system\EWUHC.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YRZQEU.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3004 -
C:\windows\YRZQEU.exeC:\windows\YRZQEU.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZMC.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5324 -
C:\windows\SysWOW64\ZMC.exeC:\windows\system32\ZMC.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-