Analysis
- max time kernel
90s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 22:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe
- Size 208KB
- Sample260724-2vcdxsef44
- SHA256 0b133a5d622d1a8e7d19a50921fe93d3c61a1896a3fdf8435965106d9d3b9d93
- MD5 8542ed5072b0f15a212a843df88e0a01
- SHA1 91eee97a2cdfa1eb05ffeded41a70a95960df2ac
- SHA512 d1726055692f8460d6e64030e5cf69d4921ee8940bbabf5e41555b49b956bfe6c4adc28b2f8cf6ad766d7d56756b282ac09ad29d01daa98d51f78fcae4d09381
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUWL+LOfn4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUu+LOvkEj1
- TLSH T12E247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1404 VIOVHU.exe 4608 YQBK.exe 1756 GWBQZNJ.exe 3660 KMIYL.exe 1444 DHLURV.exe 1844 FCDEKGO.exe 5972 XCF.exe 5824 PFIETCA.exe 5236 KTNW.exe 5392 BBPBH.exe 1812 WOUKRZF.exe 5604 UEFFEE.exe 5124 KUGF.exe 2636 ANR.exe 4476 ISW.exe 2156 UICBQ.exe 544 RBMM.exe 2580 QZX.exe 2728 UCWCPZ.exe 4844 QHORFU.exe 2640 MFODH.exe 600 ILG.exe 1784 OGSLD.exe 3028 EWTKKL.exe 2168 EZWGP.exe 4464 FCNCEK.exe 5052 ENQSM.exe 3884 GKDM.exe 1732 STKMGRJ.exe 5376 KWOQ.exe 3668 OMUQGZ.exe 4732 PHYUL.exe 2196 PUYINC.exe 5928 QPC.exe 1696 TFJEE.exe 2908 SQLU.exe 3832 UOZ.exe 2944 YWGOHR.exe 5864 ZZJSM.exe 2704 MKA.exe 4648 FXZPFT.exe 5608 JFGPSM.exe 1688 XQWN.exe 6100 XTARLM.exe 5652 BBGRX.exe 856 WOLBIXQ.exe 1384 LEM.exe 1220 PVTAT.exe 4612 KIYJDKQ.exe 2820 XGY.exe 4868 SQOUTZ.exe 4356 UOU.exe 4556 EMZ.exe 984 XPDEV.exe 2684 IIGXEV.exe 3012 AIIC.exe 5724 DYPCTKM.exe 5168 PQS.exe 3064 NGDYOX.exe 2784 TCCYTAY.exe 1648 ZCKM.exe 4496 FCRALXB.exe 3548 OCT.exe 2052 HFXJC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\PFIETCA.exe XCF.exe File created C:\windows\SysWOW64\LEM.exe.bat WOLBIXQ.exe File created C:\windows\SysWOW64\DJGDE.exe YJYPVJW.exe File created C:\windows\SysWOW64\GSRI.exe OPOFI.exe File opened for modification C:\windows\SysWOW64\STKMGRJ.exe GKDM.exe File created C:\windows\SysWOW64\ZCKM.exe.bat TCCYTAY.exe File opened for modification C:\windows\SysWOW64\BQW.exe OFG.exe File created C:\windows\SysWOW64\TCCYTAY.exe.bat NGDYOX.exe File opened for modification C:\windows\SysWOW64\YPFXWHV.exe YMB.exe File created C:\windows\SysWOW64\QZX.exe RBMM.exe File created C:\windows\SysWOW64\LEM.exe WOLBIXQ.exe File created C:\windows\SysWOW64\IGF.exe.bat TQEM.exe File opened for modification C:\windows\SysWOW64\PUYINC.exe PHYUL.exe File opened for modification C:\windows\SysWOW64\XTARLM.exe XQWN.exe File opened for modification C:\windows\SysWOW64\LEM.exe WOLBIXQ.exe File opened for modification C:\windows\SysWOW64\DJGDE.exe YJYPVJW.exe File opened for modification C:\windows\SysWOW64\URGF.exe UNC.exe File created C:\windows\SysWOW64\HPNZE.exe.bat PUJ.exe File opened for modification C:\windows\SysWOW64\SYABKZ.exe HFXJC.exe File created C:\windows\SysWOW64\BQW.exe OFG.exe File created C:\windows\SysWOW64\PUYINC.exe PHYUL.exe File created C:\windows\SysWOW64\BBGRX.exe XTARLM.exe File created C:\windows\SysWOW64\LHD.exe WMTFL.exe File created C:\windows\SysWOW64\XTARLM.exe XQWN.exe File created C:\windows\SysWOW64\QZX.exe.bat RBMM.exe File opened for modification C:\windows\SysWOW64\ENQSM.exe FCNCEK.exe File created C:\windows\SysWOW64\KWOQ.exe.bat STKMGRJ.exe File created C:\windows\SysWOW64\HZMLQWL.exe.bat DJGDE.exe File created C:\windows\SysWOW64\QQN.exe.bat MZGWP.exe File opened for modification C:\windows\SysWOW64\VIOVHU.exe 2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe File created C:\windows\SysWOW64\HFXJC.exe OCT.exe File created C:\windows\SysWOW64\EWTKKL.exe OGSLD.exe File opened for modification C:\windows\SysWOW64\NFUNJ.exe TRP.exe File created C:\windows\SysWOW64\DED.exe.bat TEBQJAV.exe File opened for modification C:\windows\SysWOW64\EWTKKL.exe OGSLD.exe File opened for modification C:\windows\SysWOW64\WOLBIXQ.exe BBGRX.exe File opened for modification C:\windows\SysWOW64\HPNZE.exe PUJ.exe File created C:\windows\SysWOW64\EWTKKL.exe.bat OGSLD.exe File created C:\windows\SysWOW64\YWGOHR.exe.bat UOZ.exe File created C:\windows\SysWOW64\XTARLM.exe.bat XQWN.exe File created C:\windows\SysWOW64\ZCKM.exe TCCYTAY.exe File created C:\windows\SysWOW64\DED.exe TEBQJAV.exe File created C:\windows\SysWOW64\VIOVHU.exe 2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe File created C:\windows\SysWOW64\FCDEKGO.exe DHLURV.exe File opened for modification C:\windows\SysWOW64\XQWN.exe JFGPSM.exe File created C:\windows\SysWOW64\WOLBIXQ.exe.bat BBGRX.exe File created C:\windows\SysWOW64\NTBZXH.exe.bat XCA.exe File opened for modification C:\windows\SysWOW64\SIQRMN.exe HPNZE.exe File created C:\windows\SysWOW64\SIQRMN.exe.bat HPNZE.exe File created C:\windows\SysWOW64\IGF.exe TQEM.exe File created C:\windows\SysWOW64\SQOUTZ.exe XGY.exe File opened for modification C:\windows\SysWOW64\PFIETCA.exe XCF.exe File created C:\windows\SysWOW64\PFIETCA.exe.bat XCF.exe File created C:\windows\SysWOW64\KUGF.exe UEFFEE.exe File created C:\windows\SysWOW64\GKDM.exe.bat ENQSM.exe File created C:\windows\SysWOW64\XQWN.exe.bat JFGPSM.exe File opened for modification C:\windows\SysWOW64\NTBZXH.exe XCA.exe File created C:\windows\SysWOW64\STKMGRJ.exe GKDM.exe File created C:\windows\SysWOW64\NFUNJ.exe.bat TRP.exe File created C:\windows\SysWOW64\WMTFL.exe NDRA.exe File created C:\windows\SysWOW64\LHD.exe.bat WMTFL.exe File opened for modification C:\windows\SysWOW64\KWOQ.exe STKMGRJ.exe File created C:\windows\SysWOW64\PUYINC.exe.bat PHYUL.exe File opened for modification C:\windows\SysWOW64\BBGRX.exe XTARLM.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\ISW.exe ANR.exe File opened for modification C:\windows\EMZ.exe UOU.exe File created C:\windows\system\IRRPY.exe.bat SYABKZ.exe File created C:\windows\system\BJV.exe.bat YBPQG.exe File created C:\windows\IIY.exe RAWQYI.exe File created C:\windows\system\MQNDO.exe IIY.exe File created C:\windows\MFODH.exe QHORFU.exe File opened for modification C:\windows\system\OGSLD.exe ILG.exe File opened for modification C:\windows\FXZPFT.exe MKA.exe File created C:\windows\XPDEV.exe.bat EMZ.exe File created C:\windows\system\UECT.exe IOWT.exe File opened for modification C:\windows\system\MQNDO.exe IIY.exe File created C:\windows\system\PTI.exe FKOHO.exe File opened for modification C:\windows\UEFFEE.exe WOUKRZF.exe File created C:\windows\system\UICBQ.exe.bat ISW.exe File opened for modification C:\windows\system\PHYUL.exe OMUQGZ.exe File created C:\windows\system\XGY.exe.bat KIYJDKQ.exe File created C:\windows\system\UECT.exe.bat IOWT.exe File opened for modification C:\windows\HDKMYGQ.exe MQNDO.exe File created C:\windows\system\UNC.exe.bat ZAXAZY.exe File opened for modification C:\windows\KHH.exe URGF.exe File created C:\windows\WOUKRZF.exe BBPBH.exe File created C:\windows\UCWCPZ.exe.bat QZX.exe File created C:\windows\system\IIGXEV.exe.bat XPDEV.exe File opened for modification C:\windows\system\ADRY.exe NTBZXH.exe File opened for modification C:\windows\system\TQEM.exe GGWWIJ.exe File opened for modification C:\windows\RAWQYI.exe BJV.exe File created C:\windows\system\MQNDO.exe.bat IIY.exe File opened for modification C:\windows\GTKR.exe PTI.exe File opened for modification C:\windows\GWBQZNJ.exe YQBK.exe File opened for modification C:\windows\system\IRRPY.exe SYABKZ.exe File created C:\windows\system\TRP.exe HZMLQWL.exe File created C:\windows\KMIYL.exe.bat GWBQZNJ.exe File created C:\windows\FCRALXB.exe ZCKM.exe File opened for modification C:\windows\system\OCT.exe FCRALXB.exe File created C:\windows\OFG.exe.bat YPFXWHV.exe File created C:\windows\system\XCA.exe NFUNJ.exe File created C:\windows\system\TEBQJAV.exe.bat GTKR.exe File created C:\windows\system\PHYUL.exe.bat OMUQGZ.exe File created C:\windows\system\QPC.exe.bat PUYINC.exe File opened for modification C:\windows\system\ZZJSM.exe YWGOHR.exe File opened for modification C:\windows\system\MZGWP.exe UECT.exe File created C:\windows\GTKR.exe PTI.exe File created C:\windows\system\TEBQJAV.exe GTKR.exe File opened for modification C:\windows\KMIYL.exe GWBQZNJ.exe File opened for modification C:\windows\DHLURV.exe KMIYL.exe File opened for modification C:\windows\XCF.exe FCDEKGO.exe File created C:\windows\system\ISW.exe ANR.exe File created C:\windows\system\ISW.exe.bat ANR.exe File opened for modification C:\windows\FCNCEK.exe EZWGP.exe File created C:\windows\system\PQS.exe.bat DYPCTKM.exe File created C:\windows\NGDYOX.exe.bat PQS.exe File created C:\windows\system\ZZJSM.exe YWGOHR.exe File created C:\windows\FXZPFT.exe.bat MKA.exe File created C:\windows\FCRALXB.exe.bat ZCKM.exe File created C:\windows\system\JETDOPL.exe.bat ADRY.exe File created C:\windows\system\TQEM.exe GGWWIJ.exe File created C:\windows\NDRA.exe.bat HDKMYGQ.exe File opened for modification C:\windows\OPOFI.exe KHH.exe File created C:\windows\WOUKRZF.exe.bat BBPBH.exe File created C:\windows\FXZPFT.exe MKA.exe File created C:\windows\system\JFGPSM.exe.bat FXZPFT.exe File opened for modification C:\windows\FCRALXB.exe ZCKM.exe File created C:\windows\system\OCT.exe FCRALXB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2304 cmd.exe 1768 cmd.exe 4768 cmd.exe 3796 cmd.exe 1060 cmd.exe 5496 cmd.exe 4084 cmd.exe 1540 cmd.exe 4220 cmd.exe 2532 cmd.exe 3184 cmd.exe 4248 cmd.exe 2260 cmd.exe 4176 cmd.exe 6136 cmd.exe 2488 cmd.exe 5860 cmd.exe 752 cmd.exe 5372 cmd.exe 3052 cmd.exe 4776 cmd.exe 4472 cmd.exe 2968 cmd.exe 3736 cmd.exe 1848 cmd.exe 3744 cmd.exe 3500 cmd.exe 4816 cmd.exe 556 cmd.exe 4288 cmd.exe 3484 cmd.exe 5484 cmd.exe 4364 cmd.exe 5032 cmd.exe 5028 cmd.exe 5264 cmd.exe 3448 cmd.exe 5936 cmd.exe 4724 cmd.exe 548 cmd.exe 1824 cmd.exe 4124 cmd.exe 1168 cmd.exe 3496 cmd.exe 3504 cmd.exe 5056 cmd.exe 4296 cmd.exe 6044 cmd.exe 1828 cmd.exe 4920 cmd.exe 4344 cmd.exe 5388 cmd.exe 3392 cmd.exe 5636 cmd.exe 3476 cmd.exe 3368 cmd.exe 2264 cmd.exe 4264 cmd.exe 1484 cmd.exe 2644 cmd.exe 1428 cmd.exe 5752 cmd.exe 5100 cmd.exe 1884 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 6040 1924 WerFault.exe 87 2496 1404 WerFault.exe 92 3504 4608 WerFault.exe 98 5540 1756 WerFault.exe 103 1352 3660 WerFault.exe 108 3832 1444 WerFault.exe 113 1704 1844 WerFault.exe 118 5188 5972 WerFault.exe 123 5864 5824 WerFault.exe 128 5388 5236 WerFault.exe 133 2288 5392 WerFault.exe 138 2744 1812 WerFault.exe 143 1264 5604 WerFault.exe 148 2452 5124 WerFault.exe 153 6120 2636 WerFault.exe 158 5452 4476 WerFault.exe 163 5400 2156 WerFault.exe 168 5804 544 WerFault.exe 173 3644 2580 WerFault.exe 178 5396 2728 WerFault.exe 183 5484 4844 WerFault.exe 188 3396 2640 WerFault.exe 193 2260 600 WerFault.exe 198 4716 1784 WerFault.exe 203 2956 3028 WerFault.exe 208 5060 2168 WerFault.exe 213 4120 4464 WerFault.exe 218 2904 5052 WerFault.exe 223 4408 3884 WerFault.exe 228 5712 1732 WerFault.exe 233 4840 5376 WerFault.exe 238 4320 3668 WerFault.exe 243 2264 4732 WerFault.exe 248 3260 2196 WerFault.exe 253 3368 5928 WerFault.exe 258 5828 1696 WerFault.exe 263 4064 2908 WerFault.exe 269 472 3832 WerFault.exe 274 2252 2944 WerFault.exe 279 1196 5864 WerFault.exe 284 3240 2704 WerFault.exe 289 1152 4648 WerFault.exe 294 1856 5608 WerFault.exe 299 2204 1688 WerFault.exe 304 3144 6100 WerFault.exe 309 5584 5652 WerFault.exe 314 1572 856 WerFault.exe 319 3740 1384 WerFault.exe 324 844 1220 WerFault.exe 329 3448 4612 WerFault.exe 334 2676 2820 WerFault.exe 339 5716 4868 WerFault.exe 344 4440 4356 WerFault.exe 349 2956 4556 WerFault.exe 354 5556 984 WerFault.exe 359 5448 2684 WerFault.exe 364 4460 3012 WerFault.exe 369 3412 5724 WerFault.exe 374 2612 5168 WerFault.exe 379 5592 3064 WerFault.exe 384 1480 2784 WerFault.exe 389 3308 1648 WerFault.exe 394 264 4496 WerFault.exe 399 3480 3548 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBPBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOUKRZF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPFXWHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UICBQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZJSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZMLQWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUGF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMUQGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTARLM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDRA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PHYUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFXJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTBZXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OPOFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEFFEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCRALXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEBQJAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPNZE.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1924 2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe 1924 2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe 1404 VIOVHU.exe 1404 VIOVHU.exe 4608 YQBK.exe 4608 YQBK.exe 1756 GWBQZNJ.exe 1756 GWBQZNJ.exe 3660 KMIYL.exe 3660 KMIYL.exe 1444 DHLURV.exe 1444 DHLURV.exe 1844 FCDEKGO.exe 1844 FCDEKGO.exe 5972 XCF.exe 5972 XCF.exe 5824 PFIETCA.exe 5824 PFIETCA.exe 5236 KTNW.exe 5236 KTNW.exe 5392 BBPBH.exe 5392 BBPBH.exe 1812 WOUKRZF.exe 1812 WOUKRZF.exe 5604 UEFFEE.exe 5604 UEFFEE.exe 5124 KUGF.exe 5124 KUGF.exe 2636 ANR.exe 2636 ANR.exe 4476 ISW.exe 4476 ISW.exe 2156 UICBQ.exe 2156 UICBQ.exe 544 RBMM.exe 544 RBMM.exe 2580 QZX.exe 2580 QZX.exe 2728 UCWCPZ.exe 2728 UCWCPZ.exe 4844 QHORFU.exe 4844 QHORFU.exe 2640 MFODH.exe 2640 MFODH.exe 600 ILG.exe 600 ILG.exe 1784 OGSLD.exe 1784 OGSLD.exe 3028 EWTKKL.exe 3028 EWTKKL.exe 2168 EZWGP.exe 2168 EZWGP.exe 4464 FCNCEK.exe 4464 FCNCEK.exe 5052 ENQSM.exe 5052 ENQSM.exe 3884 GKDM.exe 3884 GKDM.exe 1732 STKMGRJ.exe 1732 STKMGRJ.exe 5376 KWOQ.exe 5376 KWOQ.exe 3668 OMUQGZ.exe 3668 OMUQGZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1924 2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe 1924 2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe 1404 VIOVHU.exe 1404 VIOVHU.exe 4608 YQBK.exe 4608 YQBK.exe 1756 GWBQZNJ.exe 1756 GWBQZNJ.exe 3660 KMIYL.exe 3660 KMIYL.exe 1444 DHLURV.exe 1444 DHLURV.exe 1844 FCDEKGO.exe 1844 FCDEKGO.exe 5972 XCF.exe 5972 XCF.exe 5824 PFIETCA.exe 5824 PFIETCA.exe 5236 KTNW.exe 5236 KTNW.exe 5392 BBPBH.exe 5392 BBPBH.exe 1812 WOUKRZF.exe 1812 WOUKRZF.exe 5604 UEFFEE.exe 5604 UEFFEE.exe 5124 KUGF.exe 5124 KUGF.exe 2636 ANR.exe 2636 ANR.exe 4476 ISW.exe 4476 ISW.exe 2156 UICBQ.exe 2156 UICBQ.exe 544 RBMM.exe 544 RBMM.exe 2580 QZX.exe 2580 QZX.exe 2728 UCWCPZ.exe 2728 UCWCPZ.exe 4844 QHORFU.exe 4844 QHORFU.exe 2640 MFODH.exe 2640 MFODH.exe 600 ILG.exe 600 ILG.exe 1784 OGSLD.exe 1784 OGSLD.exe 3028 EWTKKL.exe 3028 EWTKKL.exe 2168 EZWGP.exe 2168 EZWGP.exe 4464 FCNCEK.exe 4464 FCNCEK.exe 5052 ENQSM.exe 5052 ENQSM.exe 3884 GKDM.exe 3884 GKDM.exe 1732 STKMGRJ.exe 1732 STKMGRJ.exe 5376 KWOQ.exe 5376 KWOQ.exe 3668 OMUQGZ.exe 3668 OMUQGZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 5368 1924 2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe 88 PID 5368 wrote to memory of 1404 5368 cmd.exe 92 PID 1404 wrote to memory of 4344 1404 VIOVHU.exe 94 PID 4344 wrote to memory of 4608 4344 cmd.exe 98 PID 4608 wrote to memory of 3136 4608 YQBK.exe 99 PID 3136 wrote to memory of 1756 3136 cmd.exe 103 PID 1756 wrote to memory of 3796 1756 GWBQZNJ.exe 104 PID 3796 wrote to memory of 3660 3796 cmd.exe 108 PID 3660 wrote to memory of 2656 3660 KMIYL.exe 109 PID 2656 wrote to memory of 1444 2656 cmd.exe 113 PID 1444 wrote to memory of 4988 1444 DHLURV.exe 114 PID 4988 wrote to memory of 1844 4988 cmd.exe 118 PID 1844 wrote to memory of 4816 1844 FCDEKGO.exe 119 PID 4816 wrote to memory of 5972 4816 cmd.exe 123 PID 5972 wrote to memory of 3208 5972 XCF.exe 124 PID 3208 wrote to memory of 5824 3208 cmd.exe 128 PID 5824 wrote to memory of 1060 5824 PFIETCA.exe 129 PID 1060 wrote to memory of 5236 1060 cmd.exe 133 PID 5236 wrote to memory of 4864 5236 KTNW.exe 134 PID 4864 wrote to memory of 5392 4864 cmd.exe 138 PID 5392 wrote to memory of 916 5392 BBPBH.exe 139 PID 916 wrote to memory of 1812 916 cmd.exe 143 PID 1812 wrote to memory of 4248 1812 WOUKRZF.exe 144 PID 4248 wrote to memory of 5604 4248 cmd.exe 148 PID 5604 wrote to memory of 4260 5604 UEFFEE.exe 149 PID 4260 wrote to memory of 5124 4260 cmd.exe 153 PID 5124 wrote to memory of 6096 5124 KUGF.exe 154 PID 6096 wrote to memory of 2636 6096 cmd.exe 158 PID 2636 wrote to memory of 4736 2636 ANR.exe 159 PID 4736 wrote to memory of 4476 4736 cmd.exe 163 PID 4476 wrote to memory of 3052 4476 ISW.exe 164 PID 3052 wrote to memory of 2156 3052 cmd.exe 168 PID 2156 wrote to memory of 5848 2156 UICBQ.exe 169 PID 5848 wrote to memory of 544 5848 cmd.exe 173 PID 544 wrote to memory of 2172 544 RBMM.exe 174 PID 2172 wrote to memory of 2580 2172 cmd.exe 178 PID 2580 wrote to memory of 2540 2580 QZX.exe 179 PID 2540 wrote to memory of 2728 2540 cmd.exe 183 PID 2728 wrote to memory of 5028 2728 UCWCPZ.exe 184 PID 5028 wrote to memory of 4844 5028 cmd.exe 188 PID 4844 wrote to memory of 3312 4844 QHORFU.exe 189 PID 3312 wrote to memory of 2640 3312 cmd.exe 193 PID 2640 wrote to memory of 5624 2640 MFODH.exe 194 PID 5624 wrote to memory of 600 5624 cmd.exe 198 PID 600 wrote to memory of 1192 600 ILG.exe 199 PID 1192 wrote to memory of 1784 1192 cmd.exe 203 PID 1784 wrote to memory of 236 1784 OGSLD.exe 204 PID 236 wrote to memory of 3028 236 cmd.exe 208 PID 3028 wrote to memory of 2412 3028 EWTKKL.exe 209 PID 2412 wrote to memory of 2168 2412 cmd.exe 213 PID 2168 wrote to memory of 1484 2168 EZWGP.exe 214 PID 1484 wrote to memory of 4464 1484 cmd.exe 218 PID 4464 wrote to memory of 4692 4464 FCNCEK.exe 219 PID 4692 wrote to memory of 5052 4692 cmd.exe 223 PID 5052 wrote to memory of 3808 5052 ENQSM.exe 224 PID 3808 wrote to memory of 3884 3808 cmd.exe 228 PID 3884 wrote to memory of 2972 3884 GKDM.exe 229 PID 2972 wrote to memory of 1732 2972 cmd.exe 233 PID 1732 wrote to memory of 556 1732 STKMGRJ.exe 234 PID 556 wrote to memory of 5376 556 cmd.exe 238 PID 5376 wrote to memory of 2584 5376 KWOQ.exe 239 PID 2584 wrote to memory of 3668 2584 cmd.exe 243 PID 3668 wrote to memory of 4940 3668 OMUQGZ.exe 244 PID 4940 wrote to memory of 4732 4940 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_8542ed5072b0f15a212a843df88e0a01_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VIOVHU.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\windows\SysWOW64\VIOVHU.exeC:\windows\system32\VIOVHU.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQBK.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\YQBK.exeC:\windows\YQBK.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWBQZNJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\GWBQZNJ.exeC:\windows\GWBQZNJ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMIYL.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\windows\KMIYL.exeC:\windows\KMIYL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHLURV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\windows\DHLURV.exeC:\windows\DHLURV.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCDEKGO.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\SysWOW64\FCDEKGO.exeC:\windows\system32\FCDEKGO.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XCF.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\XCF.exeC:\windows\XCF.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PFIETCA.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\windows\SysWOW64\PFIETCA.exeC:\windows\system32\PFIETCA.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KTNW.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\windows\system\KTNW.exeC:\windows\system\KTNW.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBPBH.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\BBPBH.exeC:\windows\BBPBH.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUKRZF.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:916 -
C:\windows\WOUKRZF.exeC:\windows\WOUKRZF.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEFFEE.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\windows\UEFFEE.exeC:\windows\UEFFEE.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUGF.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\SysWOW64\KUGF.exeC:\windows\system32\KUGF.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANR.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\system\ANR.exeC:\windows\system\ANR.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ISW.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\system\ISW.exeC:\windows\system\ISW.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UICBQ.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\windows\system\UICBQ.exeC:\windows\system\UICBQ.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBMM.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\windows\system\RBMM.exeC:\windows\system\RBMM.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\windows\SysWOW64\QZX.exeC:\windows\system32\QZX.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCWCPZ.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\UCWCPZ.exeC:\windows\UCWCPZ.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHORFU.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\windows\system\QHORFU.exeC:\windows\system\QHORFU.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFODH.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\windows\MFODH.exeC:\windows\MFODH.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ILG.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\ILG.exeC:\windows\ILG.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGSLD.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\windows\system\OGSLD.exeC:\windows\system\OGSLD.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWTKKL.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\SysWOW64\EWTKKL.exeC:\windows\system32\EWTKKL.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZWGP.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\EZWGP.exeC:\windows\EZWGP.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCNCEK.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\FCNCEK.exeC:\windows\FCNCEK.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENQSM.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\SysWOW64\ENQSM.exeC:\windows\system32\ENQSM.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKDM.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\windows\SysWOW64\GKDM.exeC:\windows\system32\GKDM.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWOQ.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:556 -
C:\windows\SysWOW64\KWOQ.exeC:\windows\system32\KWOQ.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OMUQGZ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\SysWOW64\OMUQGZ.exeC:\windows\system32\OMUQGZ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHYUL.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\system\PHYUL.exeC:\windows\system\PHYUL.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUYINC.exe.bat" "66⤵
- Executes a command shell one-liner
PID:1168 -
C:\windows\SysWOW64\PUYINC.exeC:\windows\system32\PUYINC.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPC.exe.bat" "68⤵PID:3056
-
C:\windows\system\QPC.exeC:\windows\system\QPC.exe69⤵
- Executes dropped EXE
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TFJEE.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:992 -
C:\windows\TFJEE.exeC:\windows\TFJEE.exe71⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQLU.exe.bat" "72⤵PID:2556
-
C:\windows\system\SQLU.exeC:\windows\system\SQLU.exe73⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOZ.exe.bat" "74⤵PID:2068
-
C:\windows\system\UOZ.exeC:\windows\system\UOZ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWGOHR.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4288 -
C:\windows\SysWOW64\YWGOHR.exeC:\windows\system32\YWGOHR.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZJSM.exe.bat" "78⤵PID:3456
-
C:\windows\system\ZZJSM.exeC:\windows\system\ZZJSM.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKA.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5496 -
C:\windows\MKA.exeC:\windows\MKA.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXZPFT.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:4628 -
C:\windows\FXZPFT.exeC:\windows\FXZPFT.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JFGPSM.exe.bat" "84⤵PID:4524
-
C:\windows\system\JFGPSM.exeC:\windows\system\JFGPSM.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQWN.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:696 -
C:\windows\SysWOW64\XQWN.exeC:\windows\system32\XQWN.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XTARLM.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2260 -
C:\windows\SysWOW64\XTARLM.exeC:\windows\system32\XTARLM.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBGRX.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3204 -
C:\windows\SysWOW64\BBGRX.exeC:\windows\system32\BBGRX.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOLBIXQ.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4776 -
C:\windows\SysWOW64\WOLBIXQ.exeC:\windows\system32\WOLBIXQ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LEM.exe.bat" "94⤵PID:1092
-
C:\windows\SysWOW64\LEM.exeC:\windows\system32\LEM.exe95⤵
- Executes dropped EXE
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PVTAT.exe.bat" "96⤵PID:4228
-
C:\windows\system\PVTAT.exeC:\windows\system\PVTAT.exe97⤵
- Executes dropped EXE
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIYJDKQ.exe.bat" "98⤵PID:2012
-
C:\windows\KIYJDKQ.exeC:\windows\KIYJDKQ.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XGY.exe.bat" "100⤵PID:1396
-
C:\windows\system\XGY.exeC:\windows\system\XGY.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQOUTZ.exe.bat" "102⤵PID:4140
-
C:\windows\SysWOW64\SQOUTZ.exeC:\windows\system32\SQOUTZ.exe103⤵
- Executes dropped EXE
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UOU.exe.bat" "104⤵PID:1816
-
C:\windows\SysWOW64\UOU.exeC:\windows\system32\UOU.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EMZ.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2568 -
C:\windows\EMZ.exeC:\windows\EMZ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPDEV.exe.bat" "108⤵PID:552
-
C:\windows\XPDEV.exeC:\windows\XPDEV.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIGXEV.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2304 -
C:\windows\system\IIGXEV.exeC:\windows\system\IIGXEV.exe111⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AIIC.exe.bat" "112⤵
- Executes a command shell one-liner
PID:4084 -
C:\windows\AIIC.exeC:\windows\AIIC.exe113⤵
- Executes dropped EXE
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYPCTKM.exe.bat" "114⤵PID:4572
-
C:\windows\system\DYPCTKM.exeC:\windows\system\DYPCTKM.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQS.exe.bat" "116⤵PID:8
-
C:\windows\system\PQS.exeC:\windows\system\PQS.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NGDYOX.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3484 -
C:\windows\NGDYOX.exeC:\windows\NGDYOX.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCCYTAY.exe.bat" "120⤵PID:5880
-
C:\windows\SysWOW64\TCCYTAY.exeC:\windows\system32\TCCYTAY.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-