Analysis
- max time kernel
93s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe
- Size 208KB
- Sample260727-sxesdsbg44
- SHA256 59c244162598f52b5448126e411b3331e79d2b47c53f72e460e0b52d2af0bd3e
- MD5 cb43bca488890714e58e0928094543c6
- SHA1 1d511ec2eed9e9e6fdd0694a46900bf9a3b8eeb1
- SHA512 da9dc6eb808b41c84c10fb21214b6d5a857885c87a2a44f887f111ddb3785a5f0251ea62932312fd8fe03a71cdd3de4b70142527bd5ff949a51be463fe8076b2
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfH4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOvQEj1
- TLSH T16F247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5012 BFKG.exe 3436 ISDT.exe 3688 OOPUAQ.exe 5248 DEQMHMF.exe 996 LJCSSKA.exe 5316 TPHHCI.exe 6128 KXVE.exe 1656 SDI.exe 476 IBV.exe 4688 HLYSQTY.exe 1660 LRQ.exe 3060 THRZ.exe 3844 HCDATY.exe 5624 JAJU.exe 5324 AAXR.exe 4228 KYD.exe 4156 UWQ.exe 5544 YZOTJI.exe 1124 AXU.exe 5440 PAESKD.exe 6132 FQFR.exe 5044 IYLRDQX.exe 6024 HIWHLW.exe 5944 AMA.exe 5832 PHJPCH.exe 256 GPLUFFY.exe 4568 ZKPYTU.exe 3904 UVFX.exe 6080 PICGJ.exe 4972 COKS.exe 4264 WGSD.exe 5180 ZOYDPC.exe 4600 NUGPR.exe 3640 CPQ.exe 1080 IKPCGD.exe 2200 MSW.exe 2996 FWZFY.exe 264 ZJEPILJ.exe 916 LZLPVE.exe 3928 GMQ.exe 4848 PMSD.exe 4444 VNZRRD.exe 4184 FLFL.exe 1212 YOJ.exe 5992 PWLU.exe 4920 KJPEAZ.exe 1368 XUGC.exe 692 QPK.exe 5124 BFQGG.exe 4700 BLRVHF.exe 5488 FTX.exe 5572 AOCEE.exe 5836 PJL.exe 5436 TMKDPD.exe 6108 ZMR.exe 3032 FNZ.exe 404 AAEOZ.exe 3592 GVD.exe 2556 VQMBPP.exe 3916 ZGT.exe 2128 FCSKYK.exe 2016 ZPX.exe 3408 PKGYTX.exe 2848 PQHMUK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\BFKG.exe 2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe File created C:\windows\SysWOW64\HAY.exe SFHLD.exe File created C:\windows\SysWOW64\VSIT.exe.bat AFEKOGH.exe File created C:\windows\SysWOW64\AAXR.exe.bat JAJU.exe File created C:\windows\SysWOW64\WGSD.exe.bat COKS.exe File created C:\windows\SysWOW64\DDTHWK.exe LVRCL.exe File created C:\windows\SysWOW64\TTKQCAZ.exe GIGRWJ.exe File created C:\windows\SysWOW64\AAEOZ.exe.bat FNZ.exe File created C:\windows\SysWOW64\LRQ.exe.bat HLYSQTY.exe File opened for modification C:\windows\SysWOW64\WGSD.exe COKS.exe File opened for modification C:\windows\SysWOW64\AAEOZ.exe FNZ.exe File opened for modification C:\windows\SysWOW64\SFHLD.exe JXN.exe File created C:\windows\SysWOW64\QIWRCJT.exe WURHA.exe File created C:\windows\SysWOW64\VQMBPP.exe GVD.exe File created C:\windows\SysWOW64\RRYK.exe NOAPME.exe File created C:\windows\SysWOW64\XZSYNR.exe.bat IJRGO.exe File created C:\windows\SysWOW64\PICGJ.exe UVFX.exe File opened for modification C:\windows\SysWOW64\ZCAOB.exe VUT.exe File opened for modification C:\windows\SysWOW64\GPLUFFY.exe PHJPCH.exe File created C:\windows\SysWOW64\OWW.exe.bat DDTHWK.exe File created C:\windows\SysWOW64\IDCTCU.exe HAY.exe File created C:\windows\SysWOW64\BZM.exe.bat VZFKGP.exe File created C:\windows\SysWOW64\QIWRCJT.exe.bat WURHA.exe File created C:\windows\SysWOW64\ISDT.exe BFKG.exe File created C:\windows\SysWOW64\UWQ.exe.bat KYD.exe File opened for modification C:\windows\SysWOW64\MSW.exe IKPCGD.exe File created C:\windows\SysWOW64\TTKQCAZ.exe.bat GIGRWJ.exe File opened for modification C:\windows\SysWOW64\XZSYNR.exe IJRGO.exe File opened for modification C:\windows\SysWOW64\BFKG.exe 2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe File created C:\windows\SysWOW64\YZOTJI.exe.bat UWQ.exe File created C:\windows\SysWOW64\PMSD.exe.bat GMQ.exe File opened for modification C:\windows\SysWOW64\IJL.exe TTKQCAZ.exe File created C:\windows\SysWOW64\ZCAOB.exe.bat VUT.exe File created C:\windows\SysWOW64\WURHA.exe BZM.exe File created C:\windows\SysWOW64\GPLUFFY.exe.bat PHJPCH.exe File opened for modification C:\windows\SysWOW64\LRQ.exe HLYSQTY.exe File opened for modification C:\windows\SysWOW64\OWW.exe DDTHWK.exe File created C:\windows\SysWOW64\EPSLZBG.exe JEJU.exe File created C:\windows\SysWOW64\EPSLZBG.exe.bat JEJU.exe File created C:\windows\SysWOW64\AAEOZ.exe FNZ.exe File opened for modification C:\windows\SysWOW64\IDCTCU.exe HAY.exe File created C:\windows\SysWOW64\XZSYNR.exe IJRGO.exe File created C:\windows\SysWOW64\WGSD.exe COKS.exe File created C:\windows\SysWOW64\ZOYDPC.exe.bat WGSD.exe File opened for modification C:\windows\SysWOW64\HAY.exe SFHLD.exe File created C:\windows\SysWOW64\JEJU.exe.bat JZJGJLQ.exe File created C:\windows\SysWOW64\COKS.exe.bat PICGJ.exe File opened for modification C:\windows\SysWOW64\NUGPR.exe ZOYDPC.exe File opened for modification C:\windows\SysWOW64\YOJ.exe FLFL.exe File created C:\windows\SysWOW64\BFQGG.exe.bat QPK.exe File created C:\windows\SysWOW64\VQMBPP.exe.bat GVD.exe File created C:\windows\SysWOW64\HAY.exe.bat SFHLD.exe File opened for modification C:\windows\SysWOW64\UWQ.exe KYD.exe File created C:\windows\SysWOW64\COKS.exe PICGJ.exe File opened for modification C:\windows\SysWOW64\ZOYDPC.exe WGSD.exe File created C:\windows\SysWOW64\NUGPR.exe ZOYDPC.exe File opened for modification C:\windows\SysWOW64\SMX.exe XZSYNR.exe File opened for modification C:\windows\SysWOW64\PICGJ.exe UVFX.exe File created C:\windows\SysWOW64\FLFL.exe.bat VNZRRD.exe File created C:\windows\SysWOW64\IDCTCU.exe.bat HAY.exe File created C:\windows\SysWOW64\IJL.exe.bat TTKQCAZ.exe File opened for modification C:\windows\SysWOW64\EPSLZBG.exe JEJU.exe File opened for modification C:\windows\SysWOW64\NOAPME.exe LSVG.exe File created C:\windows\SysWOW64\NOAPME.exe.bat LSVG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\PPA.exe.bat OUPX.exe File opened for modification C:\windows\system\EKKFKZ.exe PPA.exe File opened for modification C:\windows\OEEWZ.exe DLBEZW.exe File created C:\windows\system\CPZZI.exe EPSLZBG.exe File created C:\windows\system\PQF.exe PCFYTHD.exe File opened for modification C:\windows\system\LZLPVE.exe ZJEPILJ.exe File created C:\windows\system\KJPEAZ.exe PWLU.exe File created C:\windows\system\FWZFY.exe.bat MSW.exe File created C:\windows\FTX.exe BLRVHF.exe File created C:\windows\VUT.exe IJL.exe File opened for modification C:\windows\system\OQS.exe CXPGGCW.exe File created C:\windows\HIWHLW.exe IYLRDQX.exe File created C:\windows\ZPX.exe FCSKYK.exe File opened for modification C:\windows\IJUIDHZ.exe IDCTCU.exe File created C:\windows\system\HHGTIM.exe.bat SMX.exe File created C:\windows\FTX.exe.bat BLRVHF.exe File created C:\windows\OJCV.exe IJUIDHZ.exe File created C:\windows\IJRGO.exe.bat PGNCBG.exe File created C:\windows\DLBEZW.exe OQS.exe File created C:\windows\JAJU.exe HCDATY.exe File opened for modification C:\windows\system\AXU.exe YZOTJI.exe File created C:\windows\PHJPCH.exe.bat AMA.exe File created C:\windows\BLRVHF.exe.bat BFQGG.exe File opened for modification C:\windows\GVD.exe AAEOZ.exe File created C:\windows\LVRCL.exe.bat PQHMUK.exe File created C:\windows\system\OUPX.exe WRLCHZC.exe File created C:\windows\PAESKD.exe.bat AXU.exe File created C:\windows\system\PPA.exe OUPX.exe File created C:\windows\KXVE.exe TPHHCI.exe File opened for modification C:\windows\system\SDI.exe KXVE.exe File created C:\windows\AMA.exe HIWHLW.exe File opened for modification C:\windows\IKPCGD.exe CPQ.exe File opened for modification C:\windows\PJL.exe AOCEE.exe File created C:\windows\system\ZMR.exe.bat TMKDPD.exe File opened for modification C:\windows\system\ZGT.exe VQMBPP.exe File opened for modification C:\windows\ZPX.exe FCSKYK.exe File created C:\windows\OOPUAQ.exe ISDT.exe File created C:\windows\TMKDPD.exe PJL.exe File created C:\windows\PKGYTX.exe ZPX.exe File created C:\windows\system\HHGTIM.exe SMX.exe File opened for modification C:\windows\DLBEZW.exe OQS.exe File opened for modification C:\windows\system\ZMR.exe TMKDPD.exe File created C:\windows\GVD.exe.bat AAEOZ.exe File created C:\windows\PKGYTX.exe.bat ZPX.exe File created C:\windows\IJRGO.exe PGNCBG.exe File opened for modification C:\windows\system\ZKPYTU.exe GPLUFFY.exe File created C:\windows\IKPCGD.exe CPQ.exe File created C:\windows\PQHMUK.exe PKGYTX.exe File created C:\windows\system\GIGRWJ.exe.bat LVBA.exe File created C:\windows\FCSKYK.exe ZGT.exe File created C:\windows\system\AOCEE.exe FTX.exe File created C:\windows\PQHMUK.exe.bat PKGYTX.exe File opened for modification C:\windows\system\LSVG.exe NSOS.exe File opened for modification C:\windows\system\OUPX.exe WRLCHZC.exe File opened for modification C:\windows\system\TPHHCI.exe LJCSSKA.exe File opened for modification C:\windows\system\FQFR.exe PAESKD.exe File created C:\windows\FCSKYK.exe.bat ZGT.exe File created C:\windows\CZT.exe FCNCEK.exe File created C:\windows\system\LZLPVE.exe ZJEPILJ.exe File opened for modification C:\windows\system\AOCEE.exe FTX.exe File created C:\windows\CZT.exe.bat FCNCEK.exe File created C:\windows\ZPX.exe.bat FCSKYK.exe File opened for modification C:\windows\system\DRFEP.exe OWW.exe File created C:\windows\system\ZCFO.exe OJCV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 236 cmd.exe 4896 cmd.exe 5988 cmd.exe 1316 cmd.exe 2676 cmd.exe 5608 cmd.exe 4628 cmd.exe 2384 cmd.exe 6072 cmd.exe 3268 cmd.exe 4732 cmd.exe 4832 cmd.exe 3420 cmd.exe 4636 cmd.exe 5916 cmd.exe 5252 cmd.exe 1472 cmd.exe 3492 cmd.exe 4348 cmd.exe 4168 cmd.exe 1460 cmd.exe 3160 cmd.exe 4776 cmd.exe 2596 cmd.exe 1852 cmd.exe 5616 cmd.exe 3576 cmd.exe 1912 cmd.exe 4820 cmd.exe 5660 cmd.exe 1000 cmd.exe 4720 cmd.exe 2156 cmd.exe 5960 cmd.exe 852 cmd.exe 3324 cmd.exe 5508 cmd.exe 4516 cmd.exe 2244 cmd.exe 5532 cmd.exe 1672 cmd.exe 1736 cmd.exe 2036 cmd.exe 5160 cmd.exe 2684 cmd.exe 3428 cmd.exe 2908 cmd.exe 6036 cmd.exe 2168 cmd.exe 1604 cmd.exe 992 cmd.exe 4544 cmd.exe 2464 cmd.exe 5724 cmd.exe 3424 cmd.exe 5652 cmd.exe 3340 cmd.exe 4916 cmd.exe 1884 cmd.exe 2536 cmd.exe 1048 cmd.exe 2476 cmd.exe 4460 cmd.exe 3068 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5420 3048 WerFault.exe 87 6100 5012 WerFault.exe 93 928 3436 WerFault.exe 99 2472 3688 WerFault.exe 104 5920 5248 WerFault.exe 109 3280 996 WerFault.exe 114 5132 5316 WerFault.exe 119 2084 6128 WerFault.exe 124 3500 1656 WerFault.exe 129 5340 476 WerFault.exe 134 3752 4688 WerFault.exe 139 1220 1660 WerFault.exe 144 2360 3060 WerFault.exe 149 2960 3844 WerFault.exe 154 5052 5624 WerFault.exe 159 5608 5324 WerFault.exe 164 5940 4228 WerFault.exe 169 2888 4156 WerFault.exe 174 1800 5544 WerFault.exe 179 4176 1124 WerFault.exe 184 2128 5440 WerFault.exe 189 3160 6132 WerFault.exe 194 4736 5044 WerFault.exe 199 2936 6024 WerFault.exe 204 4556 5944 WerFault.exe 209 3032 5832 WerFault.exe 214 5980 256 WerFault.exe 219 2388 4568 WerFault.exe 224 5908 3904 WerFault.exe 229 1272 6080 WerFault.exe 234 4788 4972 WerFault.exe 239 2228 4264 WerFault.exe 244 3876 5180 WerFault.exe 249 1212 4600 WerFault.exe 254 1600 3640 WerFault.exe 259 4108 1080 WerFault.exe 264 3032 2200 WerFault.exe 270 3112 2996 WerFault.exe 275 2928 264 WerFault.exe 280 2908 916 WerFault.exe 285 6104 3928 WerFault.exe 290 1720 4848 WerFault.exe 295 3264 4444 WerFault.exe 300 3496 4184 WerFault.exe 305 4408 1212 WerFault.exe 310 5280 5992 WerFault.exe 315 260 4920 WerFault.exe 320 3404 1368 WerFault.exe 325 484 692 WerFault.exe 330 1000 5124 WerFault.exe 335 2004 4700 WerFault.exe 340 3948 5488 WerFault.exe 345 3668 5572 WerFault.exe 350 3940 5836 WerFault.exe 355 3960 5436 WerFault.exe 360 4840 6108 WerFault.exe 365 2600 3032 WerFault.exe 370 852 404 WerFault.exe 375 2908 3592 WerFault.exe 380 4144 2556 WerFault.exe 385 1440 3916 WerFault.exe 390 2428 2128 WerFault.exe 395 940 2016 WerFault.exe 400 3936 3408 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDTHWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WURHA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJUIDHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKGYTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ISDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJCSSKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTKQCAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEQMHMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXPGGCW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRLCHZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCNCEK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCDATY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOCEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHGTIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCSKYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GPLUFFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOAPME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGNCBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZSYNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLYSQTY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDGSEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LRQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAEOZ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3048 2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe 3048 2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe 5012 BFKG.exe 5012 BFKG.exe 3436 ISDT.exe 3436 ISDT.exe 3688 OOPUAQ.exe 3688 OOPUAQ.exe 5248 DEQMHMF.exe 5248 DEQMHMF.exe 996 LJCSSKA.exe 996 LJCSSKA.exe 5316 TPHHCI.exe 5316 TPHHCI.exe 6128 KXVE.exe 6128 KXVE.exe 1656 SDI.exe 1656 SDI.exe 476 IBV.exe 476 IBV.exe 4688 HLYSQTY.exe 4688 HLYSQTY.exe 1660 LRQ.exe 1660 LRQ.exe 3060 THRZ.exe 3060 THRZ.exe 3844 HCDATY.exe 3844 HCDATY.exe 5624 JAJU.exe 5624 JAJU.exe 5324 AAXR.exe 5324 AAXR.exe 4228 KYD.exe 4228 KYD.exe 4156 UWQ.exe 4156 UWQ.exe 5544 YZOTJI.exe 5544 YZOTJI.exe 1124 AXU.exe 1124 AXU.exe 5440 PAESKD.exe 5440 PAESKD.exe 6132 FQFR.exe 6132 FQFR.exe 5044 IYLRDQX.exe 5044 IYLRDQX.exe 6024 HIWHLW.exe 6024 HIWHLW.exe 5944 AMA.exe 5944 AMA.exe 5832 PHJPCH.exe 5832 PHJPCH.exe 256 GPLUFFY.exe 256 GPLUFFY.exe 4568 ZKPYTU.exe 4568 ZKPYTU.exe 3904 UVFX.exe 3904 UVFX.exe 6080 PICGJ.exe 6080 PICGJ.exe 4972 COKS.exe 4972 COKS.exe 4264 WGSD.exe 4264 WGSD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3048 2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe 3048 2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe 5012 BFKG.exe 5012 BFKG.exe 3436 ISDT.exe 3436 ISDT.exe 3688 OOPUAQ.exe 3688 OOPUAQ.exe 5248 DEQMHMF.exe 5248 DEQMHMF.exe 996 LJCSSKA.exe 996 LJCSSKA.exe 5316 TPHHCI.exe 5316 TPHHCI.exe 6128 KXVE.exe 6128 KXVE.exe 1656 SDI.exe 1656 SDI.exe 476 IBV.exe 476 IBV.exe 4688 HLYSQTY.exe 4688 HLYSQTY.exe 1660 LRQ.exe 1660 LRQ.exe 3060 THRZ.exe 3060 THRZ.exe 3844 HCDATY.exe 3844 HCDATY.exe 5624 JAJU.exe 5624 JAJU.exe 5324 AAXR.exe 5324 AAXR.exe 4228 KYD.exe 4228 KYD.exe 4156 UWQ.exe 4156 UWQ.exe 5544 YZOTJI.exe 5544 YZOTJI.exe 1124 AXU.exe 1124 AXU.exe 5440 PAESKD.exe 5440 PAESKD.exe 6132 FQFR.exe 6132 FQFR.exe 5044 IYLRDQX.exe 5044 IYLRDQX.exe 6024 HIWHLW.exe 6024 HIWHLW.exe 5944 AMA.exe 5944 AMA.exe 5832 PHJPCH.exe 5832 PHJPCH.exe 256 GPLUFFY.exe 256 GPLUFFY.exe 4568 ZKPYTU.exe 4568 ZKPYTU.exe 3904 UVFX.exe 3904 UVFX.exe 6080 PICGJ.exe 6080 PICGJ.exe 4972 COKS.exe 4972 COKS.exe 4264 WGSD.exe 4264 WGSD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 5744 3048 2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe 89 PID 5744 wrote to memory of 5012 5744 cmd.exe 93 PID 5012 wrote to memory of 4584 5012 BFKG.exe 95 PID 4584 wrote to memory of 3436 4584 cmd.exe 99 PID 3436 wrote to memory of 3300 3436 ISDT.exe 100 PID 3300 wrote to memory of 3688 3300 cmd.exe 104 PID 3688 wrote to memory of 4300 3688 OOPUAQ.exe 105 PID 4300 wrote to memory of 5248 4300 cmd.exe 109 PID 5248 wrote to memory of 2040 5248 DEQMHMF.exe 110 PID 2040 wrote to memory of 996 2040 cmd.exe 114 PID 996 wrote to memory of 2384 996 LJCSSKA.exe 115 PID 2384 wrote to memory of 5316 2384 cmd.exe 119 PID 5316 wrote to memory of 5268 5316 TPHHCI.exe 120 PID 5268 wrote to memory of 6128 5268 cmd.exe 124 PID 6128 wrote to memory of 6072 6128 KXVE.exe 125 PID 6072 wrote to memory of 1656 6072 cmd.exe 129 PID 1656 wrote to memory of 2536 1656 SDI.exe 130 PID 2536 wrote to memory of 476 2536 cmd.exe 134 PID 476 wrote to memory of 5144 476 IBV.exe 135 PID 5144 wrote to memory of 4688 5144 cmd.exe 139 PID 4688 wrote to memory of 3800 4688 HLYSQTY.exe 140 PID 3800 wrote to memory of 1660 3800 cmd.exe 144 PID 1660 wrote to memory of 5252 1660 LRQ.exe 145 PID 5252 wrote to memory of 3060 5252 cmd.exe 149 PID 3060 wrote to memory of 2896 3060 THRZ.exe 150 PID 2896 wrote to memory of 3844 2896 cmd.exe 154 PID 3844 wrote to memory of 5160 3844 HCDATY.exe 155 PID 5160 wrote to memory of 5624 5160 cmd.exe 159 PID 5624 wrote to memory of 236 5624 JAJU.exe 160 PID 236 wrote to memory of 5324 236 cmd.exe 164 PID 5324 wrote to memory of 3268 5324 AAXR.exe 165 PID 3268 wrote to memory of 4228 3268 cmd.exe 169 PID 4228 wrote to memory of 2244 4228 KYD.exe 170 PID 2244 wrote to memory of 4156 2244 cmd.exe 174 PID 4156 wrote to memory of 4404 4156 UWQ.exe 175 PID 4404 wrote to memory of 5544 4404 cmd.exe 179 PID 5544 wrote to memory of 2684 5544 YZOTJI.exe 180 PID 2684 wrote to memory of 1124 2684 cmd.exe 184 PID 1124 wrote to memory of 1472 1124 AXU.exe 185 PID 1472 wrote to memory of 5440 1472 cmd.exe 189 PID 5440 wrote to memory of 4332 5440 PAESKD.exe 190 PID 4332 wrote to memory of 6132 4332 cmd.exe 194 PID 6132 wrote to memory of 4088 6132 FQFR.exe 195 PID 4088 wrote to memory of 5044 4088 cmd.exe 199 PID 5044 wrote to memory of 4544 5044 IYLRDQX.exe 200 PID 6024 wrote to memory of 4896 6024 HIWHLW.exe 205 PID 4896 wrote to memory of 5944 4896 cmd.exe 209 PID 5944 wrote to memory of 4984 5944 AMA.exe 210 PID 4984 wrote to memory of 5832 4984 cmd.exe 214 PID 5832 wrote to memory of 1048 5832 PHJPCH.exe 215 PID 1048 wrote to memory of 256 1048 cmd.exe 219 PID 256 wrote to memory of 5500 256 GPLUFFY.exe 220 PID 5500 wrote to memory of 4568 5500 cmd.exe 224 PID 4568 wrote to memory of 4704 4568 ZKPYTU.exe 225 PID 4704 wrote to memory of 3904 4704 cmd.exe 229 PID 3904 wrote to memory of 5988 3904 UVFX.exe 230 PID 5988 wrote to memory of 6080 5988 cmd.exe 234 PID 6080 wrote to memory of 4676 6080 PICGJ.exe 235 PID 4676 wrote to memory of 4972 4676 cmd.exe 239 PID 4972 wrote to memory of 4356 4972 COKS.exe 240 PID 4356 wrote to memory of 4264 4356 cmd.exe 244 PID 4264 wrote to memory of 5024 4264 WGSD.exe 245 PID 5024 wrote to memory of 5180 5024 cmd.exe 249 PID 5180 wrote to memory of 1852 5180 ZOYDPC.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_cb43bca488890714e58e0928094543c6_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFKG.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\windows\SysWOW64\BFKG.exeC:\windows\system32\BFKG.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ISDT.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\SysWOW64\ISDT.exeC:\windows\system32\ISDT.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OOPUAQ.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\windows\OOPUAQ.exeC:\windows\OOPUAQ.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DEQMHMF.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\windows\DEQMHMF.exeC:\windows\DEQMHMF.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJCSSKA.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\LJCSSKA.exeC:\windows\LJCSSKA.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TPHHCI.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\windows\system\TPHHCI.exeC:\windows\system\TPHHCI.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXVE.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\windows\KXVE.exeC:\windows\KXVE.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SDI.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\windows\system\SDI.exeC:\windows\system\SDI.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBV.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\windows\system\IBV.exeC:\windows\system\IBV.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HLYSQTY.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\windows\SysWOW64\HLYSQTY.exeC:\windows\system32\HLYSQTY.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LRQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\windows\SysWOW64\LRQ.exeC:\windows\system32\LRQ.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THRZ.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\windows\SysWOW64\THRZ.exeC:\windows\system32\THRZ.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCDATY.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\windows\HCDATY.exeC:\windows\HCDATY.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAJU.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\windows\JAJU.exeC:\windows\JAJU.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAXR.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:236 -
C:\windows\SysWOW64\AAXR.exeC:\windows\system32\AAXR.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KYD.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\KYD.exeC:\windows\KYD.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWQ.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\windows\SysWOW64\UWQ.exeC:\windows\system32\UWQ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YZOTJI.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\SysWOW64\YZOTJI.exeC:\windows\system32\YZOTJI.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AXU.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\windows\system\AXU.exeC:\windows\system\AXU.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PAESKD.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\windows\PAESKD.exeC:\windows\PAESKD.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQFR.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\system\FQFR.exeC:\windows\system\FQFR.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IYLRDQX.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\windows\system\IYLRDQX.exeC:\windows\system\IYLRDQX.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIWHLW.exe.bat" "46⤵
- Executes a command shell one-liner
PID:4544 -
C:\windows\HIWHLW.exeC:\windows\HIWHLW.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMA.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\AMA.exeC:\windows\AMA.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHJPCH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\windows\PHJPCH.exeC:\windows\PHJPCH.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPLUFFY.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\windows\SysWOW64\GPLUFFY.exeC:\windows\system32\GPLUFFY.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZKPYTU.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\windows\system\ZKPYTU.exeC:\windows\system\ZKPYTU.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVFX.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\windows\system\UVFX.exeC:\windows\system\UVFX.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PICGJ.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\windows\SysWOW64\PICGJ.exeC:\windows\system32\PICGJ.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COKS.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\SysWOW64\COKS.exeC:\windows\system32\COKS.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGSD.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\SysWOW64\WGSD.exeC:\windows\system32\WGSD.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOYDPC.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\SysWOW64\ZOYDPC.exeC:\windows\system32\ZOYDPC.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUGPR.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1852 -
C:\windows\SysWOW64\NUGPR.exeC:\windows\system32\NUGPR.exe67⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPQ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2156 -
C:\windows\system\CPQ.exeC:\windows\system\CPQ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKPCGD.exe.bat" "70⤵PID:4372
-
C:\windows\IKPCGD.exeC:\windows\IKPCGD.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSW.exe.bat" "72⤵PID:5668
-
C:\windows\SysWOW64\MSW.exeC:\windows\system32\MSW.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZFY.exe.bat" "74⤵PID:124
-
C:\windows\system\FWZFY.exeC:\windows\system\FWZFY.exe75⤵
- Executes dropped EXE
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZJEPILJ.exe.bat" "76⤵PID:5700
-
C:\windows\system\ZJEPILJ.exeC:\windows\system\ZJEPILJ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZLPVE.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5616 -
C:\windows\system\LZLPVE.exeC:\windows\system\LZLPVE.exe79⤵
- Executes dropped EXE
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMQ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2476 -
C:\windows\GMQ.exeC:\windows\GMQ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMSD.exe.bat" "82⤵
- Executes a command shell one-liner
PID:3428 -
C:\windows\SysWOW64\PMSD.exeC:\windows\system32\PMSD.exe83⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VNZRRD.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\windows\VNZRRD.exeC:\windows\VNZRRD.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLFL.exe.bat" "86⤵PID:6124
-
C:\windows\SysWOW64\FLFL.exeC:\windows\system32\FLFL.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOJ.exe.bat" "88⤵PID:2068
-
C:\windows\SysWOW64\YOJ.exeC:\windows\system32\YOJ.exe89⤵
- Executes dropped EXE
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWLU.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1460 -
C:\windows\PWLU.exeC:\windows\PWLU.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJPEAZ.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5532 -
C:\windows\system\KJPEAZ.exeC:\windows\system\KJPEAZ.exe93⤵
- Executes dropped EXE
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "94⤵PID:3956
-
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe95⤵
- Executes dropped EXE
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPK.exe.bat" "96⤵PID:1256
-
C:\windows\QPK.exeC:\windows\QPK.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFQGG.exe.bat" "98⤵
- Executes a command shell one-liner
PID:5960 -
C:\windows\SysWOW64\BFQGG.exeC:\windows\system32\BFQGG.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BLRVHF.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3576 -
C:\windows\BLRVHF.exeC:\windows\BLRVHF.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTX.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1912 -
C:\windows\FTX.exeC:\windows\FTX.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOCEE.exe.bat" "104⤵PID:4176
-
C:\windows\system\AOCEE.exeC:\windows\system\AOCEE.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJL.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4756 -
C:\windows\PJL.exeC:\windows\PJL.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TMKDPD.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3160 -
C:\windows\TMKDPD.exeC:\windows\TMKDPD.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZMR.exe.bat" "110⤵PID:4292
-
C:\windows\system\ZMR.exeC:\windows\system\ZMR.exe111⤵
- Executes dropped EXE
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FNZ.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2252 -
C:\windows\FNZ.exeC:\windows\FNZ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAEOZ.exe.bat" "114⤵PID:3000
-
C:\windows\SysWOW64\AAEOZ.exeC:\windows\system32\AAEOZ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVD.exe.bat" "116⤵PID:2772
-
C:\windows\GVD.exeC:\windows\GVD.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQMBPP.exe.bat" "118⤵PID:3672
-
C:\windows\SysWOW64\VQMBPP.exeC:\windows\system32\VQMBPP.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGT.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:1664 -
C:\windows\system\ZGT.exeC:\windows\system\ZGT.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-