Analysis
- max time kernel
71s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 17:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe
- Size 208KB
- Sample260729-v3lt1acb69
- SHA256 b16e98e00498f85309ddb3d9a7403c2f6d3f15ad7109ef1caa6741a8c823743c
- MD5 8426ba4bc955a2a69ad3eed0fb4360b3
- SHA1 1f011641de8fd6a6fc5a028f2057dc1dde7440b0
- SHA512 4556925b897f3ff10f87ff26b94de2358a586d30109ba037b5121c125e9427192b9104a8de2b3d56c2449eb935c29d676dfcc38a402e6b2dc6c78f06958912cf
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfU4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOskEj1
- TLSH T193247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6760 TPSQECP.exe 1600 RQN.exe 2900 KTRXBE.exe 6100 OJXX.exe 4464 SREFRP.exe 5840 CPSSGP.exe 5056 PMSD.exe 4964 OKD.exe 2072 SNBBDZ.exe 6256 EDQ.exe 1520 YRULS.exe 2376 RUYPXHS.exe 1500 SPCKLF.exe 6004 UMI.exe 3432 EKVZHWD.exe 2608 WNZV.exe 2856 XQD.exe 1480 VGOTFHW.exe 5228 FOQ.exe 7152 JWXHD.exe 2540 JZBC.exe 4400 NIPKVFK.exe 3540 OLTG.exe 6588 OQLUCI.exe 4840 IDQ.exe 3740 MTXMY.exe 4828 YCL.exe 7164 IKFR.exe 5408 XFXDZCX.exe 3504 XKP.exe 4248 MNYWTC.exe 3020 HBDGWCQ.exe 4668 NWCGA.exe 7004 REJ.exe 2436 BCXJU.exe 1460 TFAE.exe 3056 NXIP.exe 1556 FAUTWM.exe 6512 RJA.exe 5784 VMYOIY.exe 3984 SRJDZTO.exe 6680 SUUZ.exe 1812 WCBHQB.exe 1524 WQTOAOO.exe 5160 CQBJ.exe 2316 GYQJVB.exe 5760 XGKOY.exe 5280 FWLOFU.exe 5224 JCDDVXX.exe 4824 QPC.exe 6636 XKLIL.exe 760 FYMXNS.exe 904 UTVJ.exe 2140 WRODE.exe 6756 QETNOB.exe 2360 FKZ.exe 3256 NUH.exe 1844 JAN.exe 2944 ALE.exe 3416 RADBB.exe 5500 SDMQM.exe 1436 WTG.exe 5772 JWKWURJ.exe 1808 AMJHGLQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RUYPXHS.exe.bat YRULS.exe File created C:\windows\SysWOW64\SPCKLF.exe.bat RUYPXHS.exe File created C:\windows\SysWOW64\JAN.exe.bat NUH.exe File created C:\windows\SysWOW64\JDKTJ.exe.bat OPF.exe File created C:\windows\SysWOW64\EZPDDW.exe.bat ROZEOT.exe File opened for modification C:\windows\SysWOW64\PMSD.exe CPSSGP.exe File created C:\windows\SysWOW64\EDQ.exe.bat SNBBDZ.exe File created C:\windows\SysWOW64\NUH.exe FKZ.exe File created C:\windows\SysWOW64\NJOA.exe CQL.exe File opened for modification C:\windows\SysWOW64\JDKTJ.exe OPF.exe File created C:\windows\SysWOW64\VMYOIY.exe.bat RJA.exe File opened for modification C:\windows\SysWOW64\OJXX.exe KTRXBE.exe File created C:\windows\SysWOW64\PMSD.exe.bat CPSSGP.exe File opened for modification C:\windows\SysWOW64\UMI.exe SPCKLF.exe File opened for modification C:\windows\SysWOW64\WNZV.exe EKVZHWD.exe File created C:\windows\SysWOW64\OQLUCI.exe.bat OLTG.exe File opened for modification C:\windows\SysWOW64\WRODE.exe UTVJ.exe File opened for modification C:\windows\SysWOW64\MNYWTC.exe XKP.exe File created C:\windows\SysWOW64\RUYPXHS.exe YRULS.exe File created C:\windows\SysWOW64\OJXX.exe KTRXBE.exe File created C:\windows\SysWOW64\YRULS.exe.bat EDQ.exe File created C:\windows\SysWOW64\IKFR.exe.bat YCL.exe File opened for modification C:\windows\SysWOW64\CQL.exe ASSF.exe File opened for modification C:\windows\SysWOW64\EZPDDW.exe ROZEOT.exe File created C:\windows\SysWOW64\OLTG.exe NIPKVFK.exe File opened for modification C:\windows\SysWOW64\IKFR.exe YCL.exe File created C:\windows\SysWOW64\QUUA.exe.bat YMSNH.exe File created C:\windows\SysWOW64\UVNLRS.exe JDKTJ.exe File created C:\windows\SysWOW64\DSJVBY.exe DMWPRA.exe File created C:\windows\SysWOW64\HWWPCM.exe.bat XYQVUEJ.exe File created C:\windows\SysWOW64\EDQ.exe SNBBDZ.exe File created C:\windows\SysWOW64\SPCKLF.exe RUYPXHS.exe File created C:\windows\SysWOW64\IDQ.exe.bat OQLUCI.exe File opened for modification C:\windows\SysWOW64\NJOA.exe CQL.exe File opened for modification C:\windows\SysWOW64\YMSNH.exe NTXU.exe File created C:\windows\SysWOW64\YMSNH.exe.bat NTXU.exe File created C:\windows\SysWOW64\WNZV.exe.bat EKVZHWD.exe File created C:\windows\SysWOW64\OLTG.exe.bat NIPKVFK.exe File created C:\windows\SysWOW64\MNYWTC.exe XKP.exe File created C:\windows\SysWOW64\WCBHQB.exe SUUZ.exe File created C:\windows\SysWOW64\WRODE.exe.bat UTVJ.exe File opened for modification C:\windows\SysWOW64\JAN.exe NUH.exe File opened for modification C:\windows\SysWOW64\UVNLRS.exe JDKTJ.exe File opened for modification C:\windows\SysWOW64\EDQ.exe SNBBDZ.exe File opened for modification C:\windows\SysWOW64\HBDGWCQ.exe MNYWTC.exe File created C:\windows\SysWOW64\WCDPJKL.exe AMJHGLQ.exe File created C:\windows\SysWOW64\YMSNH.exe NTXU.exe File created C:\windows\SysWOW64\JDKTJ.exe OPF.exe File opened for modification C:\windows\SysWOW64\XKP.exe XFXDZCX.exe File created C:\windows\SysWOW64\HBDGWCQ.exe MNYWTC.exe File created C:\windows\SysWOW64\VMYOIY.exe RJA.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe SUUZ.exe File opened for modification C:\windows\SysWOW64\AMJHGLQ.exe JWKWURJ.exe File created C:\windows\SysWOW64\CQL.exe ASSF.exe File created C:\windows\SysWOW64\QUUA.exe YMSNH.exe File created C:\windows\SysWOW64\UVNLRS.exe.bat JDKTJ.exe File opened for modification C:\windows\SysWOW64\YRULS.exe EDQ.exe File opened for modification C:\windows\SysWOW64\SPCKLF.exe RUYPXHS.exe File created C:\windows\SysWOW64\XKP.exe XFXDZCX.exe File opened for modification C:\windows\SysWOW64\DSJVBY.exe DMWPRA.exe File created C:\windows\SysWOW64\WCBHQB.exe.bat SUUZ.exe File created C:\windows\SysWOW64\OJXX.exe.bat KTRXBE.exe File created C:\windows\SysWOW64\YRULS.exe EDQ.exe File created C:\windows\SysWOW64\FOQ.exe.bat VGOTFHW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\WTG.exe SDMQM.exe File created C:\windows\system\KHYJUS.exe QUUA.exe File created C:\windows\system\ICO.exe EZPDDW.exe File created C:\windows\JFHNOBO.exe.bat WCDPJKL.exe File created C:\windows\system\NWCGA.exe.bat HBDGWCQ.exe File opened for modification C:\windows\system\JCDDVXX.exe FWLOFU.exe File created C:\windows\system\ROZEOT.exe UVXCKP.exe File opened for modification C:\windows\system\ROZEOT.exe UVXCKP.exe File opened for modification C:\windows\system\ICO.exe EZPDDW.exe File created C:\windows\system\TPSQECP.exe 2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe File created C:\windows\JZBC.exe.bat JWXHD.exe File created C:\windows\system\JCDDVXX.exe.bat FWLOFU.exe File opened for modification C:\windows\system\NXIP.exe TFAE.exe File created C:\windows\FAUTWM.exe.bat NXIP.exe File opened for modification C:\windows\system\FWLOFU.exe XGKOY.exe File created C:\windows\FKZ.exe.bat QETNOB.exe File created C:\windows\DWE.exe GWC.exe File created C:\windows\NIPKVFK.exe.bat JZBC.exe File created C:\windows\XFXDZCX.exe IKFR.exe File created C:\windows\system\RJA.exe.bat FAUTWM.exe File created C:\windows\KTRXBE.exe RQN.exe File created C:\windows\system\OKD.exe.bat PMSD.exe File opened for modification C:\windows\YCL.exe MTXMY.exe File created C:\windows\GYQJVB.exe.bat CQBJ.exe File opened for modification C:\windows\RADBB.exe ALE.exe File created C:\windows\system\PQS.exe.bat UVNLRS.exe File created C:\windows\system\RQN.exe TPSQECP.exe File created C:\windows\system\RQN.exe.bat TPSQECP.exe File opened for modification C:\windows\SRJDZTO.exe VMYOIY.exe File opened for modification C:\windows\system\CQBJ.exe WQTOAOO.exe File created C:\windows\system\XGKOY.exe.bat GYQJVB.exe File created C:\windows\system\VIWQNZC.exe NUSJDBG.exe File opened for modification C:\windows\SREFRP.exe OJXX.exe File opened for modification C:\windows\MTXMY.exe IDQ.exe File opened for modification C:\windows\system\BCXJU.exe REJ.exe File opened for modification C:\windows\system\FYMXNS.exe XKLIL.exe File created C:\windows\REJ.exe.bat NWCGA.exe File created C:\windows\WQTOAOO.exe WCBHQB.exe File created C:\windows\GYQJVB.exe CQBJ.exe File created C:\windows\system\QPC.exe JCDDVXX.exe File created C:\windows\FKZ.exe QETNOB.exe File created C:\windows\system\JWKWURJ.exe WTG.exe File created C:\windows\system\JWKWURJ.exe.bat WTG.exe File created C:\windows\ASSF.exe.bat JFHNOBO.exe File created C:\windows\YCL.exe MTXMY.exe File opened for modification C:\windows\REJ.exe NWCGA.exe File opened for modification C:\windows\system\RJA.exe FAUTWM.exe File created C:\windows\system\XKLIL.exe.bat QPC.exe File opened for modification C:\windows\QETNOB.exe WRODE.exe File created C:\windows\system\NUSJDBG.exe DWE.exe File created C:\windows\system\DMWPRA.exe.bat ICO.exe File opened for modification C:\windows\FAUTWM.exe NXIP.exe File created C:\windows\system\XKLIL.exe QPC.exe File opened for modification C:\windows\system\UTVJ.exe FYMXNS.exe File opened for modification C:\windows\FKZ.exe QETNOB.exe File created C:\windows\ALE.exe JAN.exe File created C:\windows\JFHNOBO.exe WCDPJKL.exe File created C:\windows\system\OPF.exe.bat KHYJUS.exe File created C:\windows\system\ROZEOT.exe.bat UVXCKP.exe File opened for modification C:\windows\system\XQD.exe WNZV.exe File created C:\windows\MTXMY.exe IDQ.exe File created C:\windows\system\NWCGA.exe HBDGWCQ.exe File created C:\windows\REJ.exe NWCGA.exe File created C:\windows\ASSF.exe JFHNOBO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6428 cmd.exe 5808 cmd.exe 5676 cmd.exe 3000 cmd.exe 2264 cmd.exe 1020 cmd.exe 3344 cmd.exe 6444 cmd.exe 2948 cmd.exe 396 cmd.exe 4628 cmd.exe 6416 cmd.exe 2256 cmd.exe 5216 cmd.exe 2296 cmd.exe 3840 cmd.exe 1220 cmd.exe 6728 cmd.exe 6352 cmd.exe 6520 cmd.exe 2424 cmd.exe 1700 cmd.exe 5076 cmd.exe 2440 cmd.exe 3352 cmd.exe 6628 cmd.exe 2496 cmd.exe 5696 cmd.exe 4640 cmd.exe 2192 cmd.exe 6668 cmd.exe 6212 cmd.exe 4548 cmd.exe 6476 cmd.exe 5616 cmd.exe 6112 cmd.exe 6924 cmd.exe 1596 cmd.exe 3852 cmd.exe 4636 cmd.exe 1688 cmd.exe 6220 cmd.exe 6096 cmd.exe 1424 cmd.exe 3688 cmd.exe 2696 cmd.exe 6308 cmd.exe 6288 cmd.exe 3324 cmd.exe 6548 cmd.exe 3700 cmd.exe 1864 cmd.exe 5380 cmd.exe 5688 cmd.exe 1104 cmd.exe 2460 cmd.exe 1064 cmd.exe 2800 cmd.exe 2872 cmd.exe 2052 cmd.exe 2032 cmd.exe 3136 cmd.exe 2036 cmd.exe 6140 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4924 2348 WerFault.exe 90 1480 6760 WerFault.exe 95 800 1600 WerFault.exe 101 2436 2900 WerFault.exe 106 3040 6100 WerFault.exe 111 4724 4464 WerFault.exe 116 6564 5840 WerFault.exe 121 6688 5056 WerFault.exe 126 5360 4964 WerFault.exe 131 5376 2072 WerFault.exe 136 940 6256 WerFault.exe 141 3532 1520 WerFault.exe 146 1688 2376 WerFault.exe 151 5308 1500 WerFault.exe 156 4648 6004 WerFault.exe 161 6732 3432 WerFault.exe 166 1904 2608 WerFault.exe 171 6416 2856 WerFault.exe 176 5756 1480 WerFault.exe 181 2812 5228 WerFault.exe 186 2496 7152 WerFault.exe 191 2628 2540 WerFault.exe 196 4848 4400 WerFault.exe 201 2988 3540 WerFault.exe 206 3356 6588 WerFault.exe 211 6752 4840 WerFault.exe 216 5032 3740 WerFault.exe 221 952 4828 WerFault.exe 226 2764 7164 WerFault.exe 231 4240 5408 WerFault.exe 236 4568 3504 WerFault.exe 241 980 4248 WerFault.exe 246 3060 3020 WerFault.exe 251 4112 4668 WerFault.exe 256 4312 7004 WerFault.exe 261 2164 2436 WerFault.exe 266 1272 1460 WerFault.exe 271 4864 3056 WerFault.exe 276 4744 1556 WerFault.exe 281 6620 6512 WerFault.exe 286 3024 5784 WerFault.exe 291 2816 3984 WerFault.exe 295 2052 6680 WerFault.exe 301 2332 1812 WerFault.exe 306 6316 1524 WerFault.exe 311 7024 5160 WerFault.exe 316 5884 2316 WerFault.exe 321 1536 5760 WerFault.exe 326 3268 5280 WerFault.exe 331 6844 5224 WerFault.exe 336 1140 4824 WerFault.exe 341 3772 6636 WerFault.exe 346 6796 760 WerFault.exe 351 1080 904 WerFault.exe 356 3792 2140 WerFault.exe 361 6652 6756 WerFault.exe 366 1156 2360 WerFault.exe 371 2704 3256 WerFault.exe 376 4472 1844 WerFault.exe 381 3260 2944 WerFault.exe 386 4880 3416 WerFault.exe 391 3840 5500 WerFault.exe 396 5580 1436 WerFault.exe 401 4624 5772 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWLOFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROZEOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JCDDVXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDKTJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKVZHWD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YMSNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYQJVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNBBDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VGOTFHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RADBB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZPDDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBDGWCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMYOIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFHNOBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUYPXHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPCKLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DSJVBY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWXHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTXMY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2348 2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe 2348 2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe 6760 TPSQECP.exe 6760 TPSQECP.exe 1600 RQN.exe 1600 RQN.exe 2900 KTRXBE.exe 2900 KTRXBE.exe 6100 OJXX.exe 6100 OJXX.exe 4464 SREFRP.exe 4464 SREFRP.exe 5840 CPSSGP.exe 5840 CPSSGP.exe 5056 PMSD.exe 5056 PMSD.exe 4964 OKD.exe 4964 OKD.exe 2072 SNBBDZ.exe 2072 SNBBDZ.exe 6256 EDQ.exe 6256 EDQ.exe 1520 YRULS.exe 1520 YRULS.exe 2376 RUYPXHS.exe 2376 RUYPXHS.exe 1500 SPCKLF.exe 1500 SPCKLF.exe 6004 UMI.exe 6004 UMI.exe 3432 EKVZHWD.exe 3432 EKVZHWD.exe 2608 WNZV.exe 2608 WNZV.exe 2856 XQD.exe 2856 XQD.exe 1480 VGOTFHW.exe 1480 VGOTFHW.exe 5228 FOQ.exe 5228 FOQ.exe 7152 JWXHD.exe 7152 JWXHD.exe 2540 JZBC.exe 2540 JZBC.exe 4400 NIPKVFK.exe 4400 NIPKVFK.exe 3540 OLTG.exe 3540 OLTG.exe 6588 OQLUCI.exe 6588 OQLUCI.exe 4840 IDQ.exe 4840 IDQ.exe 3740 MTXMY.exe 3740 MTXMY.exe 4828 YCL.exe 4828 YCL.exe 7164 IKFR.exe 7164 IKFR.exe 5408 XFXDZCX.exe 5408 XFXDZCX.exe 3504 XKP.exe 3504 XKP.exe 4248 MNYWTC.exe 4248 MNYWTC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2348 2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe 2348 2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe 6760 TPSQECP.exe 6760 TPSQECP.exe 1600 RQN.exe 1600 RQN.exe 2900 KTRXBE.exe 2900 KTRXBE.exe 6100 OJXX.exe 6100 OJXX.exe 4464 SREFRP.exe 4464 SREFRP.exe 5840 CPSSGP.exe 5840 CPSSGP.exe 5056 PMSD.exe 5056 PMSD.exe 4964 OKD.exe 4964 OKD.exe 2072 SNBBDZ.exe 2072 SNBBDZ.exe 6256 EDQ.exe 6256 EDQ.exe 1520 YRULS.exe 1520 YRULS.exe 2376 RUYPXHS.exe 2376 RUYPXHS.exe 1500 SPCKLF.exe 1500 SPCKLF.exe 6004 UMI.exe 6004 UMI.exe 3432 EKVZHWD.exe 3432 EKVZHWD.exe 2608 WNZV.exe 2608 WNZV.exe 2856 XQD.exe 2856 XQD.exe 1480 VGOTFHW.exe 1480 VGOTFHW.exe 5228 FOQ.exe 5228 FOQ.exe 7152 JWXHD.exe 7152 JWXHD.exe 2540 JZBC.exe 2540 JZBC.exe 4400 NIPKVFK.exe 4400 NIPKVFK.exe 3540 OLTG.exe 3540 OLTG.exe 6588 OQLUCI.exe 6588 OQLUCI.exe 4840 IDQ.exe 4840 IDQ.exe 3740 MTXMY.exe 3740 MTXMY.exe 4828 YCL.exe 4828 YCL.exe 7164 IKFR.exe 7164 IKFR.exe 5408 XFXDZCX.exe 5408 XFXDZCX.exe 3504 XKP.exe 3504 XKP.exe 4248 MNYWTC.exe 4248 MNYWTC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 6352 2348 2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe 91 PID 6352 wrote to memory of 6760 6352 cmd.exe 95 PID 6760 wrote to memory of 6660 6760 TPSQECP.exe 97 PID 6660 wrote to memory of 1600 6660 cmd.exe 101 PID 1600 wrote to memory of 252 1600 RQN.exe 102 PID 252 wrote to memory of 2900 252 cmd.exe 106 PID 2900 wrote to memory of 6188 2900 KTRXBE.exe 107 PID 6188 wrote to memory of 6100 6188 cmd.exe 111 PID 6100 wrote to memory of 3724 6100 OJXX.exe 112 PID 3724 wrote to memory of 4464 3724 cmd.exe 116 PID 4464 wrote to memory of 6272 4464 SREFRP.exe 117 PID 6272 wrote to memory of 5840 6272 cmd.exe 121 PID 5840 wrote to memory of 6484 5840 CPSSGP.exe 122 PID 6484 wrote to memory of 5056 6484 cmd.exe 126 PID 5056 wrote to memory of 5564 5056 PMSD.exe 127 PID 5564 wrote to memory of 4964 5564 cmd.exe 131 PID 4964 wrote to memory of 7088 4964 OKD.exe 132 PID 7088 wrote to memory of 2072 7088 cmd.exe 136 PID 2072 wrote to memory of 6220 2072 SNBBDZ.exe 137 PID 6220 wrote to memory of 6256 6220 cmd.exe 141 PID 6256 wrote to memory of 3000 6256 EDQ.exe 142 PID 3000 wrote to memory of 1520 3000 cmd.exe 146 PID 1520 wrote to memory of 2404 1520 YRULS.exe 147 PID 2404 wrote to memory of 2376 2404 cmd.exe 151 PID 2376 wrote to memory of 5860 2376 RUYPXHS.exe 152 PID 5860 wrote to memory of 1500 5860 cmd.exe 156 PID 1500 wrote to memory of 860 1500 SPCKLF.exe 157 PID 860 wrote to memory of 6004 860 cmd.exe 161 PID 6004 wrote to memory of 6924 6004 UMI.exe 162 PID 6924 wrote to memory of 3432 6924 cmd.exe 166 PID 3432 wrote to memory of 1160 3432 EKVZHWD.exe 167 PID 1160 wrote to memory of 2608 1160 cmd.exe 171 PID 2608 wrote to memory of 5344 2608 WNZV.exe 172 PID 5344 wrote to memory of 2856 5344 cmd.exe 176 PID 2856 wrote to memory of 6568 2856 XQD.exe 177 PID 6568 wrote to memory of 1480 6568 cmd.exe 181 PID 1480 wrote to memory of 6096 1480 VGOTFHW.exe 182 PID 6096 wrote to memory of 5228 6096 cmd.exe 186 PID 5228 wrote to memory of 6572 5228 FOQ.exe 187 PID 6572 wrote to memory of 7152 6572 cmd.exe 191 PID 7152 wrote to memory of 4676 7152 JWXHD.exe 192 PID 4676 wrote to memory of 2540 4676 cmd.exe 196 PID 2540 wrote to memory of 2296 2540 JZBC.exe 197 PID 2296 wrote to memory of 4400 2296 cmd.exe 201 PID 4400 wrote to memory of 3520 4400 NIPKVFK.exe 202 PID 3520 wrote to memory of 3540 3520 cmd.exe 206 PID 3540 wrote to memory of 6688 3540 OLTG.exe 207 PID 6688 wrote to memory of 6588 6688 cmd.exe 211 PID 6588 wrote to memory of 6520 6588 OQLUCI.exe 212 PID 6520 wrote to memory of 4840 6520 cmd.exe 216 PID 4840 wrote to memory of 2032 4840 IDQ.exe 217 PID 2032 wrote to memory of 3740 2032 cmd.exe 221 PID 3740 wrote to memory of 1168 3740 MTXMY.exe 222 PID 1168 wrote to memory of 4828 1168 cmd.exe 226 PID 4828 wrote to memory of 1604 4828 YCL.exe 227 PID 1604 wrote to memory of 7164 1604 cmd.exe 231 PID 7164 wrote to memory of 4188 7164 IKFR.exe 232 PID 4188 wrote to memory of 5408 4188 cmd.exe 236 PID 5408 wrote to memory of 1816 5408 XFXDZCX.exe 237 PID 1816 wrote to memory of 3504 1816 cmd.exe 241 PID 3504 wrote to memory of 4868 3504 XKP.exe 242 PID 4868 wrote to memory of 4248 4868 cmd.exe 246 PID 4248 wrote to memory of 1092 4248 MNYWTC.exe 247 PID 3020 wrote to memory of 6184 3020 HBDGWCQ.exe 252
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_8426ba4bc955a2a69ad3eed0fb4360b3_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TPSQECP.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6352 -
C:\windows\system\TPSQECP.exeC:\windows\system\TPSQECP.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RQN.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6660 -
C:\windows\system\RQN.exeC:\windows\system\RQN.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTRXBE.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:252 -
C:\windows\KTRXBE.exeC:\windows\KTRXBE.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJXX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:6188 -
C:\windows\SysWOW64\OJXX.exeC:\windows\system32\OJXX.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SREFRP.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\windows\SREFRP.exeC:\windows\SREFRP.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPSSGP.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6272 -
C:\windows\CPSSGP.exeC:\windows\CPSSGP.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMSD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:6484 -
C:\windows\SysWOW64\PMSD.exeC:\windows\system32\PMSD.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKD.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\windows\system\OKD.exeC:\windows\system\OKD.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNBBDZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:7088 -
C:\windows\SNBBDZ.exeC:\windows\SNBBDZ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDQ.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6220 -
C:\windows\SysWOW64\EDQ.exeC:\windows\system32\EDQ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRULS.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\windows\SysWOW64\YRULS.exeC:\windows\system32\YRULS.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUYPXHS.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\SysWOW64\RUYPXHS.exeC:\windows\system32\RUYPXHS.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SPCKLF.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\windows\SysWOW64\SPCKLF.exeC:\windows\system32\SPCKLF.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMI.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860 -
C:\windows\SysWOW64\UMI.exeC:\windows\system32\UMI.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKVZHWD.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6924 -
C:\windows\EKVZHWD.exeC:\windows\EKVZHWD.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WNZV.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\windows\SysWOW64\WNZV.exeC:\windows\system32\WNZV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XQD.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\windows\system\XQD.exeC:\windows\system\XQD.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VGOTFHW.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:6568 -
C:\windows\system\VGOTFHW.exeC:\windows\system\VGOTFHW.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOQ.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\SysWOW64\FOQ.exeC:\windows\system32\FOQ.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWXHD.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6572 -
C:\windows\system\JWXHD.exeC:\windows\system\JWXHD.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZBC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\JZBC.exeC:\windows\JZBC.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIPKVFK.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\NIPKVFK.exeC:\windows\NIPKVFK.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLTG.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\windows\SysWOW64\OLTG.exeC:\windows\system32\OLTG.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQLUCI.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:6688 -
C:\windows\SysWOW64\OQLUCI.exeC:\windows\system32\OQLUCI.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IDQ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6520 -
C:\windows\SysWOW64\IDQ.exeC:\windows\system32\IDQ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTXMY.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\MTXMY.exeC:\windows\MTXMY.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCL.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\windows\YCL.exeC:\windows\YCL.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKFR.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\SysWOW64\IKFR.exeC:\windows\system32\IKFR.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:7164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFXDZCX.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\XFXDZCX.exeC:\windows\XFXDZCX.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKP.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\SysWOW64\XKP.exeC:\windows\system32\XKP.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MNYWTC.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\windows\SysWOW64\MNYWTC.exeC:\windows\system32\MNYWTC.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBDGWCQ.exe.bat" "64⤵PID:1092
-
C:\windows\SysWOW64\HBDGWCQ.exeC:\windows\system32\HBDGWCQ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWCGA.exe.bat" "66⤵PID:6184
-
C:\windows\system\NWCGA.exeC:\windows\system\NWCGA.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REJ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:1424 -
C:\windows\REJ.exeC:\windows\REJ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:7004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCXJU.exe.bat" "70⤵
- Executes a command shell one-liner
PID:2264 -
C:\windows\system\BCXJU.exeC:\windows\system\BCXJU.exe71⤵
- Executes dropped EXE
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4708 -
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXIP.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2496 -
C:\windows\system\NXIP.exeC:\windows\system\NXIP.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:756 -
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJA.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2424 -
C:\windows\system\RJA.exeC:\windows\system\RJA.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMYOIY.exe.bat" "80⤵PID:2132
-
C:\windows\SysWOW64\VMYOIY.exeC:\windows\system32\VMYOIY.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRJDZTO.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4628 -
C:\windows\SRJDZTO.exeC:\windows\SRJDZTO.exe83⤵
- Executes dropped EXE
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SUUZ.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1020 -
C:\windows\SUUZ.exeC:\windows\SUUZ.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCBHQB.exe.bat" "86⤵PID:6396
-
C:\windows\SysWOW64\WCBHQB.exeC:\windows\system32\WCBHQB.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQTOAOO.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3700 -
C:\windows\WQTOAOO.exeC:\windows\WQTOAOO.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQBJ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2672 -
C:\windows\system\CQBJ.exeC:\windows\system\CQBJ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYQJVB.exe.bat" "92⤵PID:4240
-
C:\windows\GYQJVB.exeC:\windows\GYQJVB.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XGKOY.exe.bat" "94⤵PID:1016
-
C:\windows\system\XGKOY.exeC:\windows\system\XGKOY.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWLOFU.exe.bat" "96⤵PID:3108
-
C:\windows\system\FWLOFU.exeC:\windows\system\FWLOFU.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JCDDVXX.exe.bat" "98⤵PID:4428
-
C:\windows\system\JCDDVXX.exeC:\windows\system\JCDDVXX.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPC.exe.bat" "100⤵
- Executes a command shell one-liner
PID:6416 -
C:\windows\system\QPC.exeC:\windows\system\QPC.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XKLIL.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5676 -
C:\windows\system\XKLIL.exeC:\windows\system\XKLIL.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FYMXNS.exe.bat" "104⤵PID:2492
-
C:\windows\system\FYMXNS.exeC:\windows\system\FYMXNS.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTVJ.exe.bat" "106⤵PID:6676
-
C:\windows\system\UTVJ.exeC:\windows\system\UTVJ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WRODE.exe.bat" "108⤵
- Executes a command shell one-liner
PID:6548 -
C:\windows\SysWOW64\WRODE.exeC:\windows\system32\WRODE.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QETNOB.exe.bat" "110⤵PID:3632
-
C:\windows\QETNOB.exeC:\windows\QETNOB.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKZ.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1064 -
C:\windows\FKZ.exeC:\windows\FKZ.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUH.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5984 -
C:\windows\SysWOW64\NUH.exeC:\windows\system32\NUH.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAN.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2256 -
C:\windows\SysWOW64\JAN.exeC:\windows\system32\JAN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ALE.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5696 -
C:\windows\ALE.exeC:\windows\ALE.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RADBB.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2580 -
C:\windows\RADBB.exeC:\windows\RADBB.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-