Analysis
- max time kernel
89s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 02:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe
- Size 208KB
- Sample260731-c61hfssbne
- SHA256 07d608c6ea36a5d2831985be2eb49bbe74478c7930590489c0b32a4fee94f4f8
- MD5 a87887d416a819883f666a6280a4fedb
- SHA1 7cb1b7c5ecb021d67479d18579405fbe57485ae6
- SHA512 4c88875efa0a4ee827687f2530019e7f8b43881279d288a8cac96e3081a5c243bca695bd7efa1bc5ec25e78a3d6a7987cc6be921179677f114ecc79a4a300942
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfV4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LO9kEj1
- TLSH T150247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4596 UFZGDG.exe 260 XGBPURQ.exe 5368 LEBBD.exe 4676 AZT.exe 1904 MPZFBI.exe 4224 TFAE.exe 3992 DDGZPE.exe 4604 FAUTWM.exe 1452 BYUF.exe 5100 FJQBZ.exe 4300 PHWNOAD.exe 1004 IKIRUY.exe 2312 XAJQAMC.exe 1648 QDNMGB.exe 6124 LOVK.exe 3144 PWCKGFV.exe 5400 OHNBPL.exe 4172 IURKRKX.exe 3248 BXVOFA.exe 4116 HXDBODI.exe 4228 NTCC.exe 2452 AEKBHIT.exe 3068 EMRBL.exe 1232 DWUR.exe 2108 CHF.exe 6028 FXLHO.exe 4912 NDMVQS.exe 3452 TDT.exe 5556 OQQSJ.exe 5180 JMVCTUV.exe 5820 BHZGZK.exe 3152 HHGTIM.exe 5864 CCL.exe 1916 KIL.exe 4880 ZDVVNL.exe 2916 ZIVK.exe 2284 FJCY.exe 5796 ZWHHIS.exe 4260 JEJU.exe 3192 YZTZE.exe 3612 CPZZI.exe 4808 IDYHN.exe 5184 ODG.exe 5544 XLIA.exe 564 MGSESSJ.exe 5188 XZV.exe 4304 JSQQ.exe 1660 PSXESJP.exe 4444 PXXSTOK.exe 4920 UYF.exe 5320 AYNUM.exe 5504 SGPZXQ.exe 4400 BHJE.exe 1216 WUNNLN.exe 2040 LXFA.exe 3860 WQA.exe 252 CQIGNK.exe 1564 VLLC.exe 3416 VOPGGY.exe 2004 QBU.exe 2700 ZKWU.exe 444 UXBDWV.exe 1884 GNHLIN.exe 4540 UKNBP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JJW.exe FTPAXH.exe File opened for modification C:\windows\SysWOW64\OXEP.exe DFB.exe File created C:\windows\SysWOW64\XGBPURQ.exe UFZGDG.exe File created C:\windows\SysWOW64\IDYHN.exe.bat CPZZI.exe File created C:\windows\SysWOW64\ZJYTQKM.exe.bat PBWOFN.exe File created C:\windows\SysWOW64\XGBPURQ.exe.bat UFZGDG.exe File created C:\windows\SysWOW64\PWCKGFV.exe LOVK.exe File opened for modification C:\windows\SysWOW64\JEJU.exe ZWHHIS.exe File created C:\windows\SysWOW64\IDYHN.exe CPZZI.exe File opened for modification C:\windows\SysWOW64\ZKWU.exe QBU.exe File created C:\windows\SysWOW64\OXEP.exe DFB.exe File opened for modification C:\windows\SysWOW64\LFWFN.exe QSR.exe File opened for modification C:\windows\SysWOW64\LOVK.exe QDNMGB.exe File opened for modification C:\windows\SysWOW64\BHJE.exe SGPZXQ.exe File created C:\windows\SysWOW64\IURKRKX.exe OHNBPL.exe File created C:\windows\SysWOW64\MGSESSJ.exe.bat XLIA.exe File created C:\windows\SysWOW64\IJGCPUZ.exe.bat QAEXMP.exe File opened for modification C:\windows\SysWOW64\PHWNOAD.exe FJQBZ.exe File created C:\windows\SysWOW64\QAEXMP.exe WNHO.exe File opened for modification C:\windows\SysWOW64\BYUF.exe FAUTWM.exe File created C:\windows\SysWOW64\JEJU.exe ZWHHIS.exe File opened for modification C:\windows\SysWOW64\JSQQ.exe XZV.exe File created C:\windows\SysWOW64\PBWOFN.exe.bat VNRE.exe File opened for modification C:\windows\SysWOW64\OPMG.exe XPK.exe File created C:\windows\SysWOW64\WXK.exe.bat QWDSNW.exe File created C:\windows\SysWOW64\BHJE.exe.bat SGPZXQ.exe File created C:\windows\SysWOW64\ZKWU.exe.bat QBU.exe File created C:\windows\SysWOW64\OXEP.exe.bat DFB.exe File opened for modification C:\windows\SysWOW64\XGBPURQ.exe UFZGDG.exe File opened for modification C:\windows\SysWOW64\QDNMGB.exe XAJQAMC.exe File created C:\windows\SysWOW64\QNLJNMJ.exe.bat QKHGH.exe File opened for modification C:\windows\SysWOW64\BXVOFA.exe IURKRKX.exe File opened for modification C:\windows\SysWOW64\ODG.exe IDYHN.exe File opened for modification C:\windows\SysWOW64\ZJYTQKM.exe PBWOFN.exe File created C:\windows\SysWOW64\NDMVQS.exe.bat FXLHO.exe File created C:\windows\SysWOW64\PSXESJP.exe.bat JSQQ.exe File created C:\windows\SysWOW64\GNHLIN.exe.bat UXBDWV.exe File opened for modification C:\windows\SysWOW64\VNRE.exe UKNBP.exe File created C:\windows\SysWOW64\PBWOFN.exe VNRE.exe File opened for modification C:\windows\SysWOW64\NDMVQS.exe FXLHO.exe File created C:\windows\SysWOW64\WUNNLN.exe.bat BHJE.exe File created C:\windows\SysWOW64\WNHO.exe QNZASUG.exe File created C:\windows\SysWOW64\NCDPI.exe.bat YHUDXTN.exe File created C:\windows\SysWOW64\PWCKGFV.exe.bat LOVK.exe File opened for modification C:\windows\SysWOW64\IURKRKX.exe OHNBPL.exe File created C:\windows\SysWOW64\ZKWU.exe QBU.exe File created C:\windows\SysWOW64\QNLJNMJ.exe QKHGH.exe File created C:\windows\SysWOW64\MGSESSJ.exe XLIA.exe File opened for modification C:\windows\SysWOW64\JJW.exe FTPAXH.exe File created C:\windows\SysWOW64\BYUF.exe.bat FAUTWM.exe File created C:\windows\SysWOW64\NDMVQS.exe FXLHO.exe File created C:\windows\SysWOW64\ODG.exe.bat IDYHN.exe File created C:\windows\SysWOW64\HPNZE.exe WXK.exe File created C:\windows\SysWOW64\LOVK.exe.bat QDNMGB.exe File created C:\windows\SysWOW64\ZDVVNL.exe KIL.exe File created C:\windows\SysWOW64\BXVOFA.exe.bat IURKRKX.exe File created C:\windows\SysWOW64\ZJYTQKM.exe PBWOFN.exe File opened for modification C:\windows\SysWOW64\UYF.exe PXXSTOK.exe File opened for modification C:\windows\SysWOW64\DWUR.exe EMRBL.exe File created C:\windows\SysWOW64\DWUR.exe.bat EMRBL.exe File created C:\windows\SysWOW64\PHWNOAD.exe FJQBZ.exe File created C:\windows\SysWOW64\BHJE.exe SGPZXQ.exe File created C:\windows\SysWOW64\OPMG.exe XPK.exe File created C:\windows\SysWOW64\QAEXMP.exe.bat WNHO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\SGPZXQ.exe.bat AYNUM.exe File created C:\windows\KXIFCTS.exe EXART.exe File created C:\windows\DANTJKI.exe.bat OXEP.exe File created C:\windows\system\HWBNJ.exe.bat SBRJYMT.exe File created C:\windows\SOFFOVO.exe SJFQNQ.exe File created C:\windows\system\DDGZPE.exe TFAE.exe File created C:\windows\system\CHF.exe.bat DWUR.exe File opened for modification C:\windows\FJCY.exe ZIVK.exe File created C:\windows\system\YLYJLXT.exe XIUOG.exe File created C:\windows\XPK.exe.bat TZDB.exe File opened for modification C:\windows\QWDSNW.exe HWBNJ.exe File opened for modification C:\windows\system\QSR.exe HJPJZ.exe File created C:\windows\UFZGDG.exe.bat 2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe File created C:\windows\system\HHGTIM.exe.bat BHZGZK.exe File created C:\windows\ZWHHIS.exe.bat FJCY.exe File created C:\windows\system\PXXSTOK.exe PSXESJP.exe File created C:\windows\OAETG.exe.bat DIJ.exe File opened for modification C:\windows\system\QKHGH.exe KXIFCTS.exe File created C:\windows\XPK.exe TZDB.exe File created C:\windows\system\MRMKBEV.exe IJGCPUZ.exe File opened for modification C:\windows\TDT.exe NDMVQS.exe File opened for modification C:\windows\system\XZV.exe MGSESSJ.exe File created C:\windows\system\PXXSTOK.exe.bat PSXESJP.exe File created C:\windows\XIUOG.exe QNLJNMJ.exe File opened for modification C:\windows\system\MRMKBEV.exe IJGCPUZ.exe File opened for modification C:\windows\SJFQNQ.exe GTZQ.exe File created C:\windows\ZYIFZ.exe.bat DBKIS.exe File opened for modification C:\windows\system\VLLC.exe CQIGNK.exe File opened for modification C:\windows\XPK.exe TZDB.exe File opened for modification C:\windows\UFZGDG.exe 2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe File opened for modification C:\windows\system\AZT.exe LEBBD.exe File created C:\windows\system\FXLHO.exe CHF.exe File created C:\windows\system\CCL.exe.bat HHGTIM.exe File opened for modification C:\windows\system\CPZZI.exe YZTZE.exe File created C:\windows\AMO.exe.bat LRETD.exe File created C:\windows\system\UBMHX.exe.bat OAETG.exe File created C:\windows\system\QKHGH.exe KXIFCTS.exe File created C:\windows\system\LEBBD.exe.bat XGBPURQ.exe File created C:\windows\system\QBU.exe VOPGGY.exe File created C:\windows\UXBDWV.exe.bat ZKWU.exe File created C:\windows\system\UKNBP.exe GNHLIN.exe File created C:\windows\system\QKHGH.exe.bat KXIFCTS.exe File created C:\windows\QWDSNW.exe HWBNJ.exe File created C:\windows\GTZQ.exe.bat NQVMVIW.exe File created C:\windows\system\QSR.exe HJPJZ.exe File created C:\windows\system\AZT.exe LEBBD.exe File created C:\windows\system\AZT.exe.bat LEBBD.exe File created C:\windows\TDT.exe.bat NDMVQS.exe File created C:\windows\system\QBU.exe.bat VOPGGY.exe File created C:\windows\system\EXART.exe.bat JJW.exe File opened for modification C:\windows\EVRX.exe DANTJKI.exe File opened for modification C:\windows\SOFFOVO.exe SJFQNQ.exe File created C:\windows\HJPJZ.exe SOFFOVO.exe File created C:\windows\MPZFBI.exe AZT.exe File created C:\windows\system\TFAE.exe MPZFBI.exe File opened for modification C:\windows\system\DDGZPE.exe TFAE.exe File created C:\windows\system\ZIVK.exe ZDVVNL.exe File created C:\windows\system\CPZZI.exe YZTZE.exe File created C:\windows\system\XZV.exe.bat MGSESSJ.exe File opened for modification C:\windows\VOPGGY.exe VLLC.exe File opened for modification C:\windows\DBKIS.exe LSIDGPE.exe File created C:\windows\FAUTWM.exe.bat DDGZPE.exe File created C:\windows\NTCC.exe.bat HXDBODI.exe File created C:\windows\AEKBHIT.exe.bat NTCC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1744 cmd.exe 2996 cmd.exe 5444 cmd.exe 2784 cmd.exe 1956 cmd.exe 2992 cmd.exe 4900 cmd.exe 2524 cmd.exe 3468 cmd.exe 2908 cmd.exe 1252 cmd.exe 4916 cmd.exe 3716 cmd.exe 3428 cmd.exe 2584 cmd.exe 2384 cmd.exe 4892 cmd.exe 2984 cmd.exe 5220 cmd.exe 1432 cmd.exe 1500 cmd.exe 2724 cmd.exe 5040 cmd.exe 3432 cmd.exe 5880 cmd.exe 708 cmd.exe 1712 cmd.exe 1104 cmd.exe 2736 cmd.exe 4368 cmd.exe 3536 cmd.exe 2620 cmd.exe 1372 cmd.exe 2164 cmd.exe 468 cmd.exe 6136 cmd.exe 5228 cmd.exe 5528 cmd.exe 4572 cmd.exe 5940 cmd.exe 4972 cmd.exe 2608 cmd.exe 4128 cmd.exe 5720 cmd.exe 1412 cmd.exe 5436 cmd.exe 940 cmd.exe 5512 cmd.exe 4780 cmd.exe 3148 cmd.exe 1176 cmd.exe 4344 cmd.exe 4624 cmd.exe 4196 cmd.exe 4468 cmd.exe 1732 cmd.exe 5644 cmd.exe 3292 cmd.exe 2544 cmd.exe 1516 cmd.exe 4848 cmd.exe 5836 cmd.exe 2376 cmd.exe 6092 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4140 5824 WerFault.exe 87 488 4596 WerFault.exe 92 3548 260 WerFault.exe 98 1732 5368 WerFault.exe 102 2768 4676 WerFault.exe 107 3748 1904 WerFault.exe 113 5244 4224 WerFault.exe 118 3720 3992 WerFault.exe 123 3400 4604 WerFault.exe 128 1556 1452 WerFault.exe 133 6128 4820 WerFault.exe 138 4908 5100 WerFault.exe 143 2452 4300 WerFault.exe 148 5088 1004 WerFault.exe 153 1096 2312 WerFault.exe 158 2192 1648 WerFault.exe 163 3128 6124 WerFault.exe 168 4652 3144 WerFault.exe 173 5060 5400 WerFault.exe 178 2376 4172 WerFault.exe 183 5552 3248 WerFault.exe 188 5540 4116 WerFault.exe 193 3292 4228 WerFault.exe 198 2616 2452 WerFault.exe 203 2664 3068 WerFault.exe 208 1008 1232 WerFault.exe 213 2184 2108 WerFault.exe 218 1512 6028 WerFault.exe 223 3056 4912 WerFault.exe 228 3028 3452 WerFault.exe 233 4368 5556 WerFault.exe 238 2552 5180 WerFault.exe 243 4876 5820 WerFault.exe 248 3372 3152 WerFault.exe 253 5784 5864 WerFault.exe 258 3964 1916 WerFault.exe 263 4760 4880 WerFault.exe 268 1512 2916 WerFault.exe 274 4652 2284 WerFault.exe 279 6024 5796 WerFault.exe 284 2104 4260 WerFault.exe 289 2668 3192 WerFault.exe 294 3124 3612 WerFault.exe 299 2944 4808 WerFault.exe 304 4556 5184 WerFault.exe 309 1656 5544 WerFault.exe 314 5284 564 WerFault.exe 319 3172 5188 WerFault.exe 324 1208 4304 WerFault.exe 329 4212 1660 WerFault.exe 334 2644 4444 WerFault.exe 339 2852 4920 WerFault.exe 344 5872 5320 WerFault.exe 349 4568 5504 WerFault.exe 354 1364 4400 WerFault.exe 359 4888 1216 WerFault.exe 364 2400 2040 WerFault.exe 369 2408 3860 WerFault.exe 374 5420 252 WerFault.exe 379 1556 1564 WerFault.exe 384 3548 3416 WerFault.exe 389 4804 2004 WerFault.exe 394 3744 2700 WerFault.exe 399 5928 444 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRMKBEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHNBPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXXSTOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJYTQKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFWFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJPJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXDBODI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDNMGB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAUTWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BHZGZK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDVVNL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZIVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDGZPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JEJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBMHX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGBPURQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SOFFOVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKIRUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHGTIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IDYHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUNNLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5824 2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe 5824 2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe 4596 UFZGDG.exe 4596 UFZGDG.exe 260 XGBPURQ.exe 260 XGBPURQ.exe 5368 LEBBD.exe 5368 LEBBD.exe 4676 AZT.exe 4676 AZT.exe 1904 MPZFBI.exe 1904 MPZFBI.exe 4224 TFAE.exe 4224 TFAE.exe 3992 DDGZPE.exe 3992 DDGZPE.exe 4604 FAUTWM.exe 4604 FAUTWM.exe 4820 DWZR.exe 4820 DWZR.exe 5100 FJQBZ.exe 5100 FJQBZ.exe 4300 PHWNOAD.exe 4300 PHWNOAD.exe 1004 IKIRUY.exe 1004 IKIRUY.exe 2312 XAJQAMC.exe 2312 XAJQAMC.exe 1648 QDNMGB.exe 1648 QDNMGB.exe 6124 LOVK.exe 6124 LOVK.exe 3144 PWCKGFV.exe 3144 PWCKGFV.exe 5400 OHNBPL.exe 5400 OHNBPL.exe 4172 IURKRKX.exe 4172 IURKRKX.exe 3248 BXVOFA.exe 3248 BXVOFA.exe 4116 HXDBODI.exe 4116 HXDBODI.exe 4228 NTCC.exe 4228 NTCC.exe 2452 AEKBHIT.exe 2452 AEKBHIT.exe 3068 EMRBL.exe 3068 EMRBL.exe 1232 DWUR.exe 1232 DWUR.exe 2108 CHF.exe 2108 CHF.exe 6028 FXLHO.exe 6028 FXLHO.exe 4912 NDMVQS.exe 4912 NDMVQS.exe 3452 TDT.exe 3452 TDT.exe 5556 OQQSJ.exe 5556 OQQSJ.exe 5180 JMVCTUV.exe 5180 JMVCTUV.exe 5820 BHZGZK.exe 5820 BHZGZK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5824 2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe 5824 2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe 4596 UFZGDG.exe 4596 UFZGDG.exe 260 XGBPURQ.exe 260 XGBPURQ.exe 5368 LEBBD.exe 5368 LEBBD.exe 4676 AZT.exe 4676 AZT.exe 1904 MPZFBI.exe 1904 MPZFBI.exe 4224 TFAE.exe 4224 TFAE.exe 3992 DDGZPE.exe 3992 DDGZPE.exe 4604 FAUTWM.exe 4604 FAUTWM.exe 4820 DWZR.exe 4820 DWZR.exe 5100 FJQBZ.exe 5100 FJQBZ.exe 4300 PHWNOAD.exe 4300 PHWNOAD.exe 1004 IKIRUY.exe 1004 IKIRUY.exe 2312 XAJQAMC.exe 2312 XAJQAMC.exe 1648 QDNMGB.exe 1648 QDNMGB.exe 6124 LOVK.exe 6124 LOVK.exe 3144 PWCKGFV.exe 3144 PWCKGFV.exe 5400 OHNBPL.exe 5400 OHNBPL.exe 4172 IURKRKX.exe 4172 IURKRKX.exe 3248 BXVOFA.exe 3248 BXVOFA.exe 4116 HXDBODI.exe 4116 HXDBODI.exe 4228 NTCC.exe 4228 NTCC.exe 2452 AEKBHIT.exe 2452 AEKBHIT.exe 3068 EMRBL.exe 3068 EMRBL.exe 1232 DWUR.exe 1232 DWUR.exe 2108 CHF.exe 2108 CHF.exe 6028 FXLHO.exe 6028 FXLHO.exe 4912 NDMVQS.exe 4912 NDMVQS.exe 3452 TDT.exe 3452 TDT.exe 5556 OQQSJ.exe 5556 OQQSJ.exe 5180 JMVCTUV.exe 5180 JMVCTUV.exe 5820 BHZGZK.exe 5820 BHZGZK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5824 wrote to memory of 2632 5824 2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe 88 PID 2632 wrote to memory of 4596 2632 cmd.exe 92 PID 4596 wrote to memory of 5276 4596 UFZGDG.exe 94 PID 5276 wrote to memory of 260 5276 cmd.exe 98 PID 260 wrote to memory of 4972 260 XGBPURQ.exe 99 PID 4972 wrote to memory of 5368 4972 cmd.exe 102 PID 5368 wrote to memory of 3232 5368 LEBBD.exe 104 PID 3232 wrote to memory of 4676 3232 cmd.exe 107 PID 4676 wrote to memory of 3436 4676 AZT.exe 109 PID 3436 wrote to memory of 1904 3436 cmd.exe 113 PID 1904 wrote to memory of 2620 1904 MPZFBI.exe 114 PID 2620 wrote to memory of 4224 2620 cmd.exe 118 PID 4224 wrote to memory of 1744 4224 TFAE.exe 119 PID 1744 wrote to memory of 3992 1744 cmd.exe 123 PID 3992 wrote to memory of 3064 3992 DDGZPE.exe 124 PID 3064 wrote to memory of 4604 3064 cmd.exe 128 PID 4604 wrote to memory of 868 4604 FAUTWM.exe 129 PID 868 wrote to memory of 1452 868 cmd.exe 133 PID 2996 wrote to memory of 4820 2996 cmd.exe 138 PID 4820 wrote to memory of 4944 4820 DWZR.exe 139 PID 4944 wrote to memory of 5100 4944 cmd.exe 143 PID 5100 wrote to memory of 3460 5100 FJQBZ.exe 144 PID 3460 wrote to memory of 4300 3460 cmd.exe 148 PID 4300 wrote to memory of 840 4300 PHWNOAD.exe 149 PID 840 wrote to memory of 1004 840 cmd.exe 153 PID 1004 wrote to memory of 4440 1004 IKIRUY.exe 154 PID 4440 wrote to memory of 2312 4440 cmd.exe 158 PID 2312 wrote to memory of 5724 2312 XAJQAMC.exe 159 PID 5724 wrote to memory of 1648 5724 cmd.exe 163 PID 1648 wrote to memory of 1948 1648 QDNMGB.exe 164 PID 1948 wrote to memory of 6124 1948 cmd.exe 168 PID 6124 wrote to memory of 3444 6124 LOVK.exe 169 PID 3444 wrote to memory of 3144 3444 cmd.exe 173 PID 3144 wrote to memory of 4624 3144 PWCKGFV.exe 174 PID 4624 wrote to memory of 5400 4624 cmd.exe 178 PID 5400 wrote to memory of 3616 5400 OHNBPL.exe 179 PID 3616 wrote to memory of 4172 3616 cmd.exe 183 PID 4172 wrote to memory of 1520 4172 IURKRKX.exe 184 PID 1520 wrote to memory of 3248 1520 cmd.exe 188 PID 3248 wrote to memory of 5228 3248 BXVOFA.exe 189 PID 5228 wrote to memory of 4116 5228 cmd.exe 193 PID 4116 wrote to memory of 4684 4116 HXDBODI.exe 194 PID 4684 wrote to memory of 4228 4684 cmd.exe 198 PID 4228 wrote to memory of 4532 4228 NTCC.exe 199 PID 4532 wrote to memory of 2452 4532 cmd.exe 203 PID 2452 wrote to memory of 4360 2452 AEKBHIT.exe 204 PID 4360 wrote to memory of 3068 4360 cmd.exe 208 PID 3068 wrote to memory of 2720 3068 EMRBL.exe 209 PID 2720 wrote to memory of 1232 2720 cmd.exe 213 PID 1232 wrote to memory of 2524 1232 DWUR.exe 214 PID 2524 wrote to memory of 2108 2524 cmd.exe 218 PID 2108 wrote to memory of 3468 2108 CHF.exe 219 PID 3468 wrote to memory of 6028 3468 cmd.exe 223 PID 6028 wrote to memory of 3492 6028 FXLHO.exe 224 PID 3492 wrote to memory of 4912 3492 cmd.exe 228 PID 4912 wrote to memory of 5340 4912 NDMVQS.exe 229 PID 5340 wrote to memory of 3452 5340 cmd.exe 233 PID 3452 wrote to memory of 2068 3452 TDT.exe 234 PID 2068 wrote to memory of 5556 2068 cmd.exe 238 PID 5556 wrote to memory of 1412 5556 OQQSJ.exe 239 PID 1412 wrote to memory of 5180 1412 cmd.exe 243 PID 5180 wrote to memory of 204 5180 JMVCTUV.exe 244 PID 204 wrote to memory of 5820 204 cmd.exe 248 PID 5820 wrote to memory of 236 5820 BHZGZK.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a87887d416a819883f666a6280a4fedb_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFZGDG.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\UFZGDG.exeC:\windows\UFZGDG.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XGBPURQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\windows\SysWOW64\XGBPURQ.exeC:\windows\system32\XGBPURQ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LEBBD.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\system\LEBBD.exeC:\windows\system\LEBBD.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZT.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\windows\system\AZT.exeC:\windows\system\AZT.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MPZFBI.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\MPZFBI.exeC:\windows\MPZFBI.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDGZPE.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\windows\system\DDGZPE.exeC:\windows\system\DDGZPE.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYUF.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868 -
C:\windows\SysWOW64\BYUF.exeC:\windows\system32\BYUF.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWZR.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\SysWOW64\DWZR.exeC:\windows\system32\DWZR.exe21⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJQBZ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\windows\FJQBZ.exeC:\windows\FJQBZ.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PHWNOAD.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\windows\SysWOW64\PHWNOAD.exeC:\windows\system32\PHWNOAD.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IKIRUY.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\windows\system\IKIRUY.exeC:\windows\system\IKIRUY.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XAJQAMC.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\windows\system\XAJQAMC.exeC:\windows\system\XAJQAMC.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QDNMGB.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\SysWOW64\QDNMGB.exeC:\windows\system32\QDNMGB.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LOVK.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\windows\SysWOW64\LOVK.exeC:\windows\system32\LOVK.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PWCKGFV.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\SysWOW64\PWCKGFV.exeC:\windows\system32\PWCKGFV.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHNBPL.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\OHNBPL.exeC:\windows\OHNBPL.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IURKRKX.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\windows\SysWOW64\IURKRKX.exeC:\windows\system32\IURKRKX.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BXVOFA.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\windows\SysWOW64\BXVOFA.exeC:\windows\system32\BXVOFA.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HXDBODI.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\windows\HXDBODI.exeC:\windows\HXDBODI.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTCC.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\NTCC.exeC:\windows\NTCC.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AEKBHIT.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\AEKBHIT.exeC:\windows\AEKBHIT.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EMRBL.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\system\EMRBL.exeC:\windows\system\EMRBL.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWUR.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\windows\SysWOW64\DWUR.exeC:\windows\system32\DWUR.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHF.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\windows\system\CHF.exeC:\windows\system\CHF.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXLHO.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\system\FXLHO.exeC:\windows\system\FXLHO.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NDMVQS.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\SysWOW64\NDMVQS.exeC:\windows\system32\NDMVQS.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TDT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\windows\TDT.exeC:\windows\TDT.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQQSJ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\windows\OQQSJ.exeC:\windows\OQQSJ.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMVCTUV.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\SysWOW64\JMVCTUV.exeC:\windows\system32\JMVCTUV.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BHZGZK.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:204 -
C:\windows\BHZGZK.exeC:\windows\BHZGZK.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HHGTIM.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:236 -
C:\windows\system\HHGTIM.exeC:\windows\system\HHGTIM.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CCL.exe.bat" "68⤵PID:1088
-
C:\windows\system\CCL.exeC:\windows\system\CCL.exe69⤵
- Executes dropped EXE
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KIL.exe.bat" "70⤵PID:1800
-
C:\windows\system\KIL.exeC:\windows\system\KIL.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDVVNL.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3508 -
C:\windows\SysWOW64\ZDVVNL.exeC:\windows\system32\ZDVVNL.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIVK.exe.bat" "74⤵
- Executes a command shell one-liner
PID:5436 -
C:\windows\system\ZIVK.exeC:\windows\system\ZIVK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJCY.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4848 -
C:\windows\FJCY.exeC:\windows\FJCY.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWHHIS.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2584 -
C:\windows\ZWHHIS.exeC:\windows\ZWHHIS.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEJU.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4364 -
C:\windows\SysWOW64\JEJU.exeC:\windows\system32\JEJU.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YZTZE.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\windows\YZTZE.exeC:\windows\YZTZE.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPZZI.exe.bat" "84⤵PID:3916
-
C:\windows\system\CPZZI.exeC:\windows\system\CPZZI.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IDYHN.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4196 -
C:\windows\SysWOW64\IDYHN.exeC:\windows\system32\IDYHN.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ODG.exe.bat" "88⤵
- Executes a command shell one-liner
PID:940 -
C:\windows\SysWOW64\ODG.exeC:\windows\system32\ODG.exe89⤵
- Executes dropped EXE
PID:5184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XLIA.exe.bat" "90⤵
- Executes a command shell one-liner
PID:708 -
C:\windows\system\XLIA.exeC:\windows\system\XLIA.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MGSESSJ.exe.bat" "92⤵PID:4728
-
C:\windows\SysWOW64\MGSESSJ.exeC:\windows\system32\MGSESSJ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XZV.exe.bat" "94⤵PID:4760
-
C:\windows\system\XZV.exeC:\windows\system\XZV.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSQQ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:6096 -
C:\windows\SysWOW64\JSQQ.exeC:\windows\system32\JSQQ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSXESJP.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2736 -
C:\windows\SysWOW64\PSXESJP.exeC:\windows\system32\PSXESJP.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PXXSTOK.exe.bat" "100⤵PID:5440
-
C:\windows\system\PXXSTOK.exeC:\windows\system\PXXSTOK.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UYF.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1888 -
C:\windows\SysWOW64\UYF.exeC:\windows\system32\UYF.exe103⤵
- Executes dropped EXE
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYNUM.exe.bat" "104⤵PID:5416
-
C:\windows\system\AYNUM.exeC:\windows\system\AYNUM.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGPZXQ.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5836 -
C:\windows\system\SGPZXQ.exeC:\windows\system\SGPZXQ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BHJE.exe.bat" "108⤵PID:2944
-
C:\windows\SysWOW64\BHJE.exeC:\windows\system32\BHJE.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUNNLN.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4556 -
C:\windows\SysWOW64\WUNNLN.exeC:\windows\system32\WUNNLN.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXFA.exe.bat" "112⤵
- Executes a command shell one-liner
PID:5512 -
C:\windows\LXFA.exeC:\windows\LXFA.exe113⤵
- Executes dropped EXE
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQA.exe.bat" "114⤵
- Executes a command shell one-liner
PID:2384 -
C:\windows\system\WQA.exeC:\windows\system\WQA.exe115⤵
- Executes dropped EXE
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQIGNK.exe.bat" "116⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4468 -
C:\windows\CQIGNK.exeC:\windows\CQIGNK.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VLLC.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4892 -
C:\windows\system\VLLC.exeC:\windows\system\VLLC.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VOPGGY.exe.bat" "120⤵
- Executes a command shell one-liner
PID:4368 -
C:\windows\VOPGGY.exeC:\windows\VOPGGY.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3416
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-