Analysis
- max time kernel
75s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 18:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_d46239af9b8a85db867a74d2ffb52c2e_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-07-28_d46239af9b8a85db867a74d2ffb52c2e_elex_emotet_stop.exe
- Size 208KB
- Sample260728-wtly3sag75
- SHA256 11949a46b4c7f1624cd81faf316799a71a093e0a8d9b6276aef79aa695d6da04
- MD5 d46239af9b8a85db867a74d2ffb52c2e
- SHA1 ce8fa078d9d0961a28ef2bf6ee7d3b0f54fda6e5
- SHA512 d885c3fe4fef5b8d5268656f8e5fb6add3a7d3b18d1c5f5f5ddf0c46a316eb3be98a3ce0c9004caba0fa828b075f9308a4938c5accea9f364ee5a2604d46c1f9
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb8lcdL+LOfA4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb8lc5+LOokEj1
- TLSH T169247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5864 VSUXPQJ.exe 4788 ADXMD.exe 5548 QTYLKGV.exe 3360 YHL.exe 2396 XRAA.exe 4556 XUE.exe 2068 SIJNU.exe 2092 CFOHJDM.exe 4740 PDWLLO.exe 1208 COFKZR.exe 972 QMFV.exe 792 JMUG.exe 3948 CHYKYT.exe 1180 RKIO.exe 2988 GAJ.exe 4608 FLTWY.exe 2056 GOX.exe 2912 EEIDZLF.exe 2376 VPLLZR.exe 4888 KFUK.exe 2724 OVBKSXM.exe 5768 KYJJG.exe 1728 ETOSRH.exe 2656 XOSWW.exe 5572 XRWRCNZ.exe 2000 BZCZO.exe 3908 PFK.exe 3276 OQNTYXT.exe 4712 IDSD.exe 6108 HBDGWCQ.exe 1552 FMOWEQ.exe 3112 FRGKGVP.exe 2272 IMLT.exe 2868 MUSTCN.exe 1468 FYDXI.exe 6080 WYKUU.exe 4268 IOY.exe 3092 ZZBSPAG.exe 2480 EZJG.exe 916 OXPTODQ.exe 4100 USOB.exe 4152 WQTOAOO.exe 4076 STKMGRJ.exe 4176 UQPH.exe 5308 SJS.exe 3372 APF.exe 4924 XPPGTQL.exe 5988 FVTMDOG.exe 3464 EFWCMU.exe 5604 CDPF.exe 3424 QBPRB.exe 5384 HJEON.exe 3420 GUGE.exe 5764 FFRUFW.exe 3932 YXZFOX.exe 5136 GLLMZ.exe 6096 TWUKN.exe 4780 BBGRX.exe 3052 JPLYI.exe 2612 KKXBOT.exe 3056 XPXNX.exe 2836 UVHCG.exe 5612 CAUJQ.exe 1680 KOGQB.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\PDWLLO.exe CFOHJDM.exe File created C:\windows\SysWOW64\IMLT.exe.bat FRGKGVP.exe File opened for modification C:\windows\SysWOW64\PXLKMQP.exe GWJX.exe File created C:\windows\SysWOW64\STKMGRJ.exe WQTOAOO.exe File created C:\windows\SysWOW64\JPLYI.exe.bat BBGRX.exe File created C:\windows\SysWOW64\KKXBOT.exe.bat JPLYI.exe File created C:\windows\SysWOW64\PXLKMQP.exe.bat GWJX.exe File created C:\windows\SysWOW64\PDWLLO.exe CFOHJDM.exe File created C:\windows\SysWOW64\PDWLLO.exe.bat CFOHJDM.exe File created C:\windows\SysWOW64\XRWRCNZ.exe XOSWW.exe File created C:\windows\SysWOW64\UQPH.exe STKMGRJ.exe File opened for modification C:\windows\SysWOW64\LNHSU.exe JSQQ.exe File created C:\windows\SysWOW64\XKXRXOK.exe.bat PXLKMQP.exe File created C:\windows\SysWOW64\QTYLKGV.exe.bat ADXMD.exe File created C:\windows\SysWOW64\FMOWEQ.exe HBDGWCQ.exe File created C:\windows\SysWOW64\FMOWEQ.exe.bat HBDGWCQ.exe File opened for modification C:\windows\SysWOW64\STKMGRJ.exe WQTOAOO.exe File created C:\windows\SysWOW64\QBPRB.exe.bat CDPF.exe File opened for modification C:\windows\SysWOW64\KKXBOT.exe JPLYI.exe File created C:\windows\SysWOW64\KOGQB.exe.bat CAUJQ.exe File opened for modification C:\windows\SysWOW64\SULW.exe KOGQB.exe File created C:\windows\SysWOW64\UVHCG.exe XPXNX.exe File created C:\windows\SysWOW64\SULW.exe KOGQB.exe File created C:\windows\SysWOW64\LNHSU.exe.bat JSQQ.exe File created C:\windows\SysWOW64\RGI.exe.bat QDRKO.exe File opened for modification C:\windows\SysWOW64\BUXI.exe AZTELPL.exe File created C:\windows\SysWOW64\QTYLKGV.exe ADXMD.exe File created C:\windows\SysWOW64\RKIO.exe.bat CHYKYT.exe File opened for modification C:\windows\SysWOW64\XRWRCNZ.exe XOSWW.exe File opened for modification C:\windows\SysWOW64\UQPH.exe STKMGRJ.exe File created C:\windows\SysWOW64\UQPH.exe.bat STKMGRJ.exe File opened for modification C:\windows\SysWOW64\QBPRB.exe CDPF.exe File created C:\windows\SysWOW64\HJEON.exe.bat QBPRB.exe File created C:\windows\SysWOW64\JPLYI.exe BBGRX.exe File created C:\windows\SysWOW64\JSQQ.exe QOMMW.exe File opened for modification C:\windows\SysWOW64\QTYLKGV.exe ADXMD.exe File created C:\windows\SysWOW64\MUSTCN.exe IMLT.exe File created C:\windows\SysWOW64\QBPRB.exe CDPF.exe File created C:\windows\SysWOW64\JSQQ.exe.bat QOMMW.exe File created C:\windows\SysWOW64\PXLKMQP.exe GWJX.exe File created C:\windows\SysWOW64\BUXI.exe AZTELPL.exe File created C:\windows\SysWOW64\BUXI.exe.bat AZTELPL.exe File created C:\windows\SysWOW64\HBDGWCQ.exe.bat IDSD.exe File opened for modification C:\windows\SysWOW64\FMOWEQ.exe HBDGWCQ.exe File opened for modification C:\windows\SysWOW64\JPLYI.exe BBGRX.exe File created C:\windows\SysWOW64\KOGQB.exe CAUJQ.exe File opened for modification C:\windows\SysWOW64\JSQQ.exe QOMMW.exe File created C:\windows\SysWOW64\IMLT.exe FRGKGVP.exe File created C:\windows\SysWOW64\BBGRX.exe TWUKN.exe File opened for modification C:\windows\SysWOW64\UVHCG.exe XPXNX.exe File created C:\windows\SysWOW64\RGI.exe QDRKO.exe File created C:\windows\SysWOW64\MUSTCN.exe.bat IMLT.exe File created C:\windows\SysWOW64\SULW.exe.bat KOGQB.exe File created C:\windows\SysWOW64\LNHSU.exe JSQQ.exe File opened for modification C:\windows\SysWOW64\MUSTCN.exe IMLT.exe File opened for modification C:\windows\SysWOW64\RGI.exe QDRKO.exe File created C:\windows\SysWOW64\RKIO.exe CHYKYT.exe File opened for modification C:\windows\SysWOW64\HJEON.exe QBPRB.exe File created C:\windows\SysWOW64\KKXBOT.exe JPLYI.exe File created C:\windows\SysWOW64\UVHCG.exe.bat XPXNX.exe File created C:\windows\SysWOW64\XKXRXOK.exe PXLKMQP.exe File opened for modification C:\windows\SysWOW64\RKIO.exe CHYKYT.exe File created C:\windows\SysWOW64\HBDGWCQ.exe IDSD.exe File opened for modification C:\windows\SysWOW64\HBDGWCQ.exe IDSD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\FRGKGVP.exe FMOWEQ.exe File created C:\windows\system\CDPF.exe EFWCMU.exe File created C:\windows\system\EKWYWVV.exe TXPSRT.exe File created C:\windows\DYMQU.exe.bat LQKL.exe File created C:\windows\AZTELPL.exe.bat DYMQU.exe File opened for modification C:\windows\JHKO.exe BUXI.exe File created C:\windows\RFXW.exe EVOYLD.exe File opened for modification C:\windows\system\CHYKYT.exe JMUG.exe File created C:\windows\system\XPPGTQL.exe.bat APF.exe File created C:\windows\FFRUFW.exe GUGE.exe File created C:\windows\system\CHYKYT.exe JMUG.exe File opened for modification C:\windows\system\GAJ.exe RKIO.exe File created C:\windows\system\XOSWW.exe ETOSRH.exe File created C:\windows\PFK.exe.bat BZCZO.exe File created C:\windows\EZJG.exe.bat ZZBSPAG.exe File created C:\windows\system\SJS.exe UQPH.exe File created C:\windows\KDKWF.exe.bat BVIRBO.exe File created C:\windows\system\GWJX.exe RGI.exe File opened for modification C:\windows\system\XUE.exe XRAA.exe File created C:\windows\system\FLTWY.exe GAJ.exe File created C:\windows\ETOSRH.exe KYJJG.exe File opened for modification C:\windows\PFK.exe BZCZO.exe File created C:\windows\system\XPPGTQL.exe APF.exe File opened for modification C:\windows\EFWCMU.exe FVTMDOG.exe File created C:\windows\system\TWUKN.exe.bat GLLMZ.exe File created C:\windows\system\JSER.exe.bat XKXRXOK.exe File created C:\windows\system\COFKZR.exe PDWLLO.exe File created C:\windows\VPLLZR.exe.bat EEIDZLF.exe File created C:\windows\ETOSRH.exe.bat KYJJG.exe File created C:\windows\system\OXPTODQ.exe.bat EZJG.exe File opened for modification C:\windows\system\GLLMZ.exe YXZFOX.exe File created C:\windows\RFXW.exe.bat EVOYLD.exe File opened for modification C:\windows\system\ZLXD.exe RFXW.exe File created C:\windows\OVBKSXM.exe.bat KFUK.exe File created C:\windows\system\GAJ.exe RKIO.exe File opened for modification C:\windows\ETOSRH.exe KYJJG.exe File opened for modification C:\windows\XRAA.exe YHL.exe File created C:\windows\system\XUE.exe XRAA.exe File created C:\windows\system\XUE.exe.bat XRAA.exe File created C:\windows\system\KYJJG.exe OVBKSXM.exe File created C:\windows\system\XOSWW.exe.bat ETOSRH.exe File created C:\windows\system\GWJX.exe.bat RGI.exe File created C:\windows\system\QMFV.exe.bat COFKZR.exe File created C:\windows\system\KYJJG.exe.bat OVBKSXM.exe File opened for modification C:\windows\system\XOSWW.exe ETOSRH.exe File created C:\windows\BZCZO.exe.bat XRWRCNZ.exe File created C:\windows\system\USOB.exe.bat OXPTODQ.exe File opened for modification C:\windows\CAUJQ.exe UVHCG.exe File opened for modification C:\windows\TXPSRT.exe SULW.exe File created C:\windows\system\RBFB.exe FIQQ.exe File created C:\windows\SIJNU.exe.bat XUE.exe File opened for modification C:\windows\system\KYJJG.exe OVBKSXM.exe File opened for modification C:\windows\system\APF.exe SJS.exe File created C:\windows\system\CDPF.exe.bat EFWCMU.exe File opened for modification C:\windows\system\RBFB.exe FIQQ.exe File created C:\windows\QDRKO.exe KDKWF.exe File created C:\windows\system\LQKL.exe.bat JSER.exe File opened for modification C:\windows\ADXMD.exe VSUXPQJ.exe File created C:\windows\ADXMD.exe.bat VSUXPQJ.exe File opened for modification C:\windows\system\CFOHJDM.exe SIJNU.exe File opened for modification C:\windows\BZCZO.exe XRWRCNZ.exe File created C:\windows\system\OXPTODQ.exe EZJG.exe File created C:\windows\system\FVTMDOG.exe XPPGTQL.exe File opened for modification C:\windows\YXZFOX.exe FFRUFW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3000 cmd.exe 2588 cmd.exe 4916 cmd.exe 476 cmd.exe 1568 cmd.exe 844 cmd.exe 3844 cmd.exe 5824 cmd.exe 4232 cmd.exe 2940 cmd.exe 4512 cmd.exe 5488 cmd.exe 5720 cmd.exe 5744 cmd.exe 4340 cmd.exe 1244 cmd.exe 4544 cmd.exe 4752 cmd.exe 4204 cmd.exe 4704 cmd.exe 944 cmd.exe 3144 cmd.exe 6060 cmd.exe 4108 cmd.exe 5340 cmd.exe 4892 cmd.exe 2560 cmd.exe 1604 cmd.exe 5392 cmd.exe 1360 cmd.exe 1472 cmd.exe 5912 cmd.exe 4584 cmd.exe 5480 cmd.exe 628 cmd.exe 1156 cmd.exe 3120 cmd.exe 1096 cmd.exe 2412 cmd.exe 3268 cmd.exe 2120 cmd.exe 4792 cmd.exe 3640 cmd.exe 5016 cmd.exe 6128 cmd.exe 4736 cmd.exe 5976 cmd.exe 3208 cmd.exe 5216 cmd.exe 5344 cmd.exe 3664 cmd.exe 2932 cmd.exe 5832 cmd.exe 1492 cmd.exe 4956 cmd.exe 5516 cmd.exe 5048 cmd.exe 3232 cmd.exe 1152 cmd.exe 5244 cmd.exe 1960 cmd.exe 4800 cmd.exe 3156 cmd.exe 6004 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 792 4624 WerFault.exe 87 2836 5864 WerFault.exe 93 5940 4788 WerFault.exe 99 1672 5548 WerFault.exe 104 628 3360 WerFault.exe 109 2024 2396 WerFault.exe 114 4892 4556 WerFault.exe 119 5200 2068 WerFault.exe 124 756 2092 WerFault.exe 129 3200 4740 WerFault.exe 134 3388 1208 WerFault.exe 139 5488 972 WerFault.exe 144 4300 792 WerFault.exe 149 564 3948 WerFault.exe 154 3336 1180 WerFault.exe 159 1816 2988 WerFault.exe 164 2924 4608 WerFault.exe 169 4280 2056 WerFault.exe 174 2612 2912 WerFault.exe 179 2892 2376 WerFault.exe 184 3476 4888 WerFault.exe 189 4660 2724 WerFault.exe 194 3172 5768 WerFault.exe 199 4148 1728 WerFault.exe 204 2596 2656 WerFault.exe 209 1548 5572 WerFault.exe 214 4388 2000 WerFault.exe 219 1060 3908 WerFault.exe 224 2480 3276 WerFault.exe 229 5816 4712 WerFault.exe 234 3600 6108 WerFault.exe 239 4152 1552 WerFault.exe 244 5468 3112 WerFault.exe 249 1780 2272 WerFault.exe 254 1536 2868 WerFault.exe 259 5396 1468 WerFault.exe 264 4928 6080 WerFault.exe 269 4512 4268 WerFault.exe 275 2856 3092 WerFault.exe 280 3724 2480 WerFault.exe 285 6004 916 WerFault.exe 290 2388 4100 WerFault.exe 295 3236 4152 WerFault.exe 300 3344 4076 WerFault.exe 305 2212 4176 WerFault.exe 310 4724 5308 WerFault.exe 315 5004 3372 WerFault.exe 320 4512 4924 WerFault.exe 325 2856 5988 WerFault.exe 330 2932 3464 WerFault.exe 335 2652 5604 WerFault.exe 340 3684 3424 WerFault.exe 345 4284 5384 WerFault.exe 350 5336 3420 WerFault.exe 355 1236 5764 WerFault.exe 360 2144 3932 WerFault.exe 365 4124 5136 WerFault.exe 370 4168 6096 WerFault.exe 375 428 4780 WerFault.exe 380 2932 3052 WerFault.exe 385 6112 2612 WerFault.exe 390 784 3056 WerFault.exe 395 1316 2836 WerFault.exe 400 2356 5612 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYJJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAJQMCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FIQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFOHJDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFUK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDRKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKXBOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSUXPQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRWRCNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOGQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTYLKGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUSTCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQTOAOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAUJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIJNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZBSPAG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBFB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXLKMQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQPH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVOYLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDWLLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYMQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZJG.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4624 2026-07-28_d46239af9b8a85db867a74d2ffb52c2e_elex_emotet_stop.exe 4624 2026-07-28_d46239af9b8a85db867a74d2ffb52c2e_elex_emotet_stop.exe 5864 VSUXPQJ.exe 5864 VSUXPQJ.exe 4788 ADXMD.exe 4788 ADXMD.exe 5548 QTYLKGV.exe 5548 QTYLKGV.exe 3360 YHL.exe 3360 YHL.exe 2396 XRAA.exe 2396 XRAA.exe 4556 XUE.exe 4556 XUE.exe 2068 SIJNU.exe 2068 SIJNU.exe 2092 CFOHJDM.exe 2092 CFOHJDM.exe 4740 PDWLLO.exe 4740 PDWLLO.exe 1208 COFKZR.exe 1208 COFKZR.exe 972 QMFV.exe 972 QMFV.exe 792 JMUG.exe 792 JMUG.exe 3948 CHYKYT.exe 3948 CHYKYT.exe 1180 RKIO.exe 1180 RKIO.exe 2988 GAJ.exe 2988 GAJ.exe 4608 FLTWY.exe 4608 FLTWY.exe 2056 GOX.exe 2056 GOX.exe 2912 EEIDZLF.exe 2912 EEIDZLF.exe 2376 VPLLZR.exe 2376 VPLLZR.exe 4888 KFUK.exe 4888 KFUK.exe 2724 OVBKSXM.exe 2724 OVBKSXM.exe 5768 KYJJG.exe 5768 KYJJG.exe 1728 ETOSRH.exe 1728 ETOSRH.exe 2656 XOSWW.exe 2656 XOSWW.exe 5572 XRWRCNZ.exe 5572 XRWRCNZ.exe 2000 BZCZO.exe 2000 BZCZO.exe 3908 PFK.exe 3908 PFK.exe 3276 OQNTYXT.exe 3276 OQNTYXT.exe 4712 IDSD.exe 4712 IDSD.exe 6108 HBDGWCQ.exe 6108 HBDGWCQ.exe 1552 FMOWEQ.exe 1552 FMOWEQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4624 2026-07-28_d46239af9b8a85db867a74d2ffb52c2e_elex_emotet_stop.exe 4624 2026-07-28_d46239af9b8a85db867a74d2ffb52c2e_elex_emotet_stop.exe 5864 VSUXPQJ.exe 5864 VSUXPQJ.exe 4788 ADXMD.exe 4788 ADXMD.exe 5548 QTYLKGV.exe 5548 QTYLKGV.exe 3360 YHL.exe 3360 YHL.exe 2396 XRAA.exe 2396 XRAA.exe 4556 XUE.exe 4556 XUE.exe 2068 SIJNU.exe 2068 SIJNU.exe 2092 CFOHJDM.exe 2092 CFOHJDM.exe 4740 PDWLLO.exe 4740 PDWLLO.exe 1208 COFKZR.exe 1208 COFKZR.exe 972 QMFV.exe 972 QMFV.exe 792 JMUG.exe 792 JMUG.exe 3948 CHYKYT.exe 3948 CHYKYT.exe 1180 RKIO.exe 1180 RKIO.exe 2988 GAJ.exe 2988 GAJ.exe 4608 FLTWY.exe 4608 FLTWY.exe 2056 GOX.exe 2056 GOX.exe 2912 EEIDZLF.exe 2912 EEIDZLF.exe 2376 VPLLZR.exe 2376 VPLLZR.exe 4888 KFUK.exe 4888 KFUK.exe 2724 OVBKSXM.exe 2724 OVBKSXM.exe 5768 KYJJG.exe 5768 KYJJG.exe 1728 ETOSRH.exe 1728 ETOSRH.exe 2656 XOSWW.exe 2656 XOSWW.exe 5572 XRWRCNZ.exe 5572 XRWRCNZ.exe 2000 BZCZO.exe 2000 BZCZO.exe 3908 PFK.exe 3908 PFK.exe 3276 OQNTYXT.exe 3276 OQNTYXT.exe 4712 IDSD.exe 4712 IDSD.exe 6108 HBDGWCQ.exe 6108 HBDGWCQ.exe 1552 FMOWEQ.exe 1552 FMOWEQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4624 wrote to memory of 256 4624 2026-07-28_d46239af9b8a85db867a74d2ffb52c2e_elex_emotet_stop.exe 89 PID 256 wrote to memory of 5864 256 cmd.exe 93 PID 5864 wrote to memory of 5092 5864 VSUXPQJ.exe 95 PID 5092 wrote to memory of 4788 5092 cmd.exe 99 PID 4788 wrote to memory of 5512 4788 ADXMD.exe 100 PID 5512 wrote to memory of 5548 5512 cmd.exe 104 PID 5548 wrote to memory of 2088 5548 QTYLKGV.exe 105 PID 2088 wrote to memory of 3360 2088 cmd.exe 109 PID 3360 wrote to memory of 2560 3360 YHL.exe 110 PID 2560 wrote to memory of 2396 2560 cmd.exe 114 PID 2396 wrote to memory of 2412 2396 XRAA.exe 115 PID 2412 wrote to memory of 4556 2412 cmd.exe 119 PID 4556 wrote to memory of 844 4556 XUE.exe 120 PID 844 wrote to memory of 2068 844 cmd.exe 124 PID 2068 wrote to memory of 1604 2068 SIJNU.exe 125 PID 1604 wrote to memory of 2092 1604 cmd.exe 129 PID 2092 wrote to memory of 1960 2092 CFOHJDM.exe 130 PID 1960 wrote to memory of 4740 1960 cmd.exe 134 PID 4740 wrote to memory of 712 4740 PDWLLO.exe 135 PID 712 wrote to memory of 1208 712 cmd.exe 139 PID 1208 wrote to memory of 4136 1208 COFKZR.exe 140 PID 4136 wrote to memory of 972 4136 cmd.exe 144 PID 972 wrote to memory of 1432 972 QMFV.exe 145 PID 1432 wrote to memory of 792 1432 cmd.exe 149 PID 792 wrote to memory of 1504 792 JMUG.exe 150 PID 1504 wrote to memory of 3948 1504 cmd.exe 154 PID 3948 wrote to memory of 4184 3948 CHYKYT.exe 155 PID 4184 wrote to memory of 1180 4184 cmd.exe 159 PID 1180 wrote to memory of 3640 1180 RKIO.exe 160 PID 3640 wrote to memory of 2988 3640 cmd.exe 164 PID 2988 wrote to memory of 3596 2988 GAJ.exe 165 PID 3596 wrote to memory of 4608 3596 cmd.exe 169 PID 4608 wrote to memory of 4328 4608 FLTWY.exe 170 PID 4328 wrote to memory of 2056 4328 cmd.exe 174 PID 2056 wrote to memory of 4684 2056 GOX.exe 175 PID 4684 wrote to memory of 2912 4684 cmd.exe 179 PID 2912 wrote to memory of 5392 2912 EEIDZLF.exe 180 PID 5392 wrote to memory of 2376 5392 cmd.exe 184 PID 2376 wrote to memory of 1492 2376 VPLLZR.exe 185 PID 1492 wrote to memory of 4888 1492 cmd.exe 189 PID 4888 wrote to memory of 1360 4888 KFUK.exe 190 PID 1360 wrote to memory of 2724 1360 cmd.exe 194 PID 2724 wrote to memory of 4120 2724 OVBKSXM.exe 195 PID 4120 wrote to memory of 5768 4120 cmd.exe 199 PID 5768 wrote to memory of 4956 5768 KYJJG.exe 200 PID 4956 wrote to memory of 1728 4956 cmd.exe 204 PID 1728 wrote to memory of 4204 1728 ETOSRH.exe 205 PID 4204 wrote to memory of 2656 4204 cmd.exe 209 PID 2656 wrote to memory of 4800 2656 XOSWW.exe 210 PID 4800 wrote to memory of 5572 4800 cmd.exe 214 PID 5572 wrote to memory of 5976 5572 XRWRCNZ.exe 215 PID 5976 wrote to memory of 2000 5976 cmd.exe 219 PID 2000 wrote to memory of 1464 2000 BZCZO.exe 220 PID 1464 wrote to memory of 3908 1464 cmd.exe 224 PID 3908 wrote to memory of 5232 3908 PFK.exe 225 PID 5232 wrote to memory of 3276 5232 cmd.exe 229 PID 3276 wrote to memory of 5016 3276 OQNTYXT.exe 230 PID 5016 wrote to memory of 4712 5016 cmd.exe 234 PID 4712 wrote to memory of 2400 4712 IDSD.exe 235 PID 2400 wrote to memory of 6108 2400 cmd.exe 239 PID 6108 wrote to memory of 2892 6108 HBDGWCQ.exe 240 PID 2892 wrote to memory of 1552 2892 cmd.exe 244 PID 1552 wrote to memory of 6128 1552 FMOWEQ.exe 245 PID 6128 wrote to memory of 3112 6128 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_d46239af9b8a85db867a74d2ffb52c2e_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_d46239af9b8a85db867a74d2ffb52c2e_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSUXPQJ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\system\VSUXPQJ.exeC:\windows\system\VSUXPQJ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADXMD.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\windows\ADXMD.exeC:\windows\ADXMD.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QTYLKGV.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\windows\SysWOW64\QTYLKGV.exeC:\windows\system32\QTYLKGV.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\windows\YHL.exeC:\windows\YHL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRAA.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\windows\XRAA.exeC:\windows\XRAA.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUE.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\system\XUE.exeC:\windows\system\XUE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIJNU.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:844 -
C:\windows\SIJNU.exeC:\windows\SIJNU.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CFOHJDM.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\system\CFOHJDM.exeC:\windows\system\CFOHJDM.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDWLLO.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\windows\SysWOW64\PDWLLO.exeC:\windows\system32\PDWLLO.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COFKZR.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:712 -
C:\windows\system\COFKZR.exeC:\windows\system\COFKZR.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMFV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\system\QMFV.exeC:\windows\system\QMFV.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMUG.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\JMUG.exeC:\windows\JMUG.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHYKYT.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\windows\system\CHYKYT.exeC:\windows\system\CHYKYT.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RKIO.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\windows\SysWOW64\RKIO.exeC:\windows\system32\RKIO.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GAJ.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\windows\system\GAJ.exeC:\windows\system\GAJ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLTWY.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\windows\system\FLTWY.exeC:\windows\system\FLTWY.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GOX.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\system\GOX.exeC:\windows\system\GOX.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEIDZLF.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\EEIDZLF.exeC:\windows\EEIDZLF.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPLLZR.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\windows\VPLLZR.exeC:\windows\VPLLZR.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KFUK.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\windows\KFUK.exeC:\windows\KFUK.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVBKSXM.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\windows\OVBKSXM.exeC:\windows\OVBKSXM.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYJJG.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\system\KYJJG.exeC:\windows\system\KYJJG.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ETOSRH.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\ETOSRH.exeC:\windows\ETOSRH.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOSWW.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\system\XOSWW.exeC:\windows\system\XOSWW.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRWRCNZ.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\windows\SysWOW64\XRWRCNZ.exeC:\windows\system32\XRWRCNZ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZCZO.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\windows\BZCZO.exeC:\windows\BZCZO.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFK.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\windows\PFK.exeC:\windows\PFK.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OQNTYXT.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\windows\system\OQNTYXT.exeC:\windows\system\OQNTYXT.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IDSD.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\windows\IDSD.exeC:\windows\IDSD.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBDGWCQ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\SysWOW64\HBDGWCQ.exeC:\windows\system32\HBDGWCQ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FMOWEQ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\SysWOW64\FMOWEQ.exeC:\windows\system32\FMOWEQ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FRGKGVP.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\windows\system\FRGKGVP.exeC:\windows\system\FRGKGVP.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMLT.exe.bat" "66⤵PID:1460
-
C:\windows\SysWOW64\IMLT.exeC:\windows\system32\IMLT.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUSTCN.exe.bat" "68⤵PID:3172
-
C:\windows\SysWOW64\MUSTCN.exeC:\windows\system32\MUSTCN.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\windows\FYDXI.exeC:\windows\FYDXI.exe71⤵
- Executes dropped EXE
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WYKUU.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:2380 -
C:\windows\WYKUU.exeC:\windows\WYKUU.exe73⤵
- Executes dropped EXE
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOY.exe.bat" "74⤵
- Executes a command shell one-liner
PID:4704 -
C:\windows\IOY.exeC:\windows\IOY.exe75⤵
- Executes dropped EXE
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZBSPAG.exe.bat" "76⤵PID:2976
-
C:\windows\system\ZZBSPAG.exeC:\windows\system\ZZBSPAG.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZJG.exe.bat" "78⤵PID:1112
-
C:\windows\EZJG.exeC:\windows\EZJG.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXPTODQ.exe.bat" "80⤵PID:4804
-
C:\windows\system\OXPTODQ.exeC:\windows\system\OXPTODQ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USOB.exe.bat" "82⤵PID:3404
-
C:\windows\system\USOB.exeC:\windows\system\USOB.exe83⤵
- Executes dropped EXE
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQTOAOO.exe.bat" "84⤵PID:6084
-
C:\windows\WQTOAOO.exeC:\windows\WQTOAOO.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5516 -
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQPH.exe.bat" "88⤵PID:4604
-
C:\windows\SysWOW64\UQPH.exeC:\windows\system32\UQPH.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SJS.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\windows\system\SJS.exeC:\windows\system\SJS.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APF.exe.bat" "92⤵PID:3132
-
C:\windows\system\APF.exeC:\windows\system\APF.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPPGTQL.exe.bat" "94⤵
- Executes a command shell one-liner
PID:3156 -
C:\windows\system\XPPGTQL.exeC:\windows\system\XPPGTQL.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FVTMDOG.exe.bat" "96⤵
- Executes a command shell one-liner
PID:944 -
C:\windows\system\FVTMDOG.exeC:\windows\system\FVTMDOG.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EFWCMU.exe.bat" "98⤵PID:1588
-
C:\windows\EFWCMU.exeC:\windows\EFWCMU.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDPF.exe.bat" "100⤵PID:3200
-
C:\windows\system\CDPF.exeC:\windows\system\CDPF.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QBPRB.exe.bat" "102⤵PID:3784
-
C:\windows\SysWOW64\QBPRB.exeC:\windows\system32\QBPRB.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HJEON.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\windows\SysWOW64\HJEON.exeC:\windows\system32\HJEON.exe105⤵
- Executes dropped EXE
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GUGE.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5324 -
C:\windows\system\GUGE.exeC:\windows\system\GUGE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FFRUFW.exe.bat" "108⤵PID:4932
-
C:\windows\FFRUFW.exeC:\windows\FFRUFW.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YXZFOX.exe.bat" "110⤵PID:4240
-
C:\windows\YXZFOX.exeC:\windows\YXZFOX.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLLMZ.exe.bat" "112⤵PID:2584
-
C:\windows\system\GLLMZ.exeC:\windows\system\GLLMZ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWUKN.exe.bat" "114⤵PID:4832
-
C:\windows\system\TWUKN.exeC:\windows\system\TWUKN.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBGRX.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4512 -
C:\windows\SysWOW64\BBGRX.exeC:\windows\system32\BBGRX.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JPLYI.exe.bat" "118⤵PID:5404
-
C:\windows\SysWOW64\JPLYI.exeC:\windows\system32\JPLYI.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKXBOT.exe.bat" "120⤵PID:5496
-
C:\windows\SysWOW64\KKXBOT.exeC:\windows\system32\KKXBOT.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-