Analysis
- max time kernel
85s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 17:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_8ef477ed0d6e9e0e85179b56941aa086_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-31_8ef477ed0d6e9e0e85179b56941aa086_elex_emotet_stop.exe
- Size 208KB
- Sample260731-v44ffaxdkh
- SHA256 5095afcdf016af8a67f1a89ffe9f6cee1d309f12912df311566a3717cd094dba
- MD5 8ef477ed0d6e9e0e85179b56941aa086
- SHA1 8a669ca012b6cb283d3027f9d13317e912ea0996
- SHA512 4fbd59483ddfd21cec57cd98a2aa07dbd2f6f023206cd3c092bab3571931f07d0103de4638a40d93e07320ed6816365a31815c4607b66e8417d3b11547ea54ad
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf94pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOVkEj1
- TLSH T10E247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4432 FKX.exe 5756 MYQ.exe 1144 MTUDW.exe 1036 AEKCK.exe 3324 YONK.exe 2616 XHQABD.exe 2756 BPWIGW.exe 576 FFL.exe 2460 WGNN.exe 2420 YDTH.exe 3544 GJTW.exe 4280 KZZWYRF.exe 6076 XCIUN.exe 3352 HKK.exe 2932 TSQHC.exe 4912 BGDON.exe 1280 KGFTRV.exe 2792 XRNS.exe 2504 PRP.exe 2788 CCYWWG.exe 6052 CFCRCWJ.exe 4604 BABAH.exe 4468 ZQUV.exe 3484 OGVUAAV.exe 4076 UGDIJCW.exe 3504 UMVXL.exe 1612 VPHSYXJ.exe 5176 KKQXJ.exe 796 FXVOTSY.exe 4972 OGP.exe 5080 UGXHG.exe 4188 DGZMRPD.exe 5460 SJQQ.exe 3040 ECLJLR.exe 5000 VCNOOOE.exe 5832 QPSG.exe 3048 UFZGDG.exe 1508 UICBQ.exe 200 YQJJCPE.exe 3584 TEOT.exe 812 IUP.exe 3044 OUW.exe 4536 ZNZR.exe 3180 SQD.exe 4436 FAUTWM.exe 5732 GWXPK.exe 2440 KMEXOVS.exe 3476 ZCFO.exe 1984 YMI.exe 4940 WCBHQB.exe 2760 MSCZX.exe 2868 EVGCCN.exe 2580 ILNCPF.exe 1576 JGQ.exe 3020 ECVP.exe 5520 YPAZPV.exe 5156 CXHZ.exe 5880 NQKSJ.exe 2124 ZGQSNNK.exe 2000 QQTIWT.exe 2412 JJITNT.exe 1588 BRK.exe 2228 FZRGD.exe 1696 UPS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\WGNN.exe FFL.exe File opened for modification C:\windows\SysWOW64\PRP.exe XRNS.exe File opened for modification C:\windows\SysWOW64\UMVXL.exe UGDIJCW.exe File created C:\windows\SysWOW64\SQD.exe ZNZR.exe File created C:\windows\SysWOW64\AEKCK.exe MTUDW.exe File opened for modification C:\windows\SysWOW64\CFCRCWJ.exe CCYWWG.exe File created C:\windows\SysWOW64\KGS.exe AYQVJVA.exe File opened for modification C:\windows\SysWOW64\OSKMRI.exe ZXAH.exe File created C:\windows\SysWOW64\MXOMVY.exe.bat RMGVHN.exe File created C:\windows\SysWOW64\VPHSYXJ.exe.bat UMVXL.exe File opened for modification C:\windows\SysWOW64\SJQQ.exe DGZMRPD.exe File created C:\windows\SysWOW64\OUW.exe IUP.exe File created C:\windows\SysWOW64\CXPGGCW.exe.bat SAJMQTN.exe File created C:\windows\SysWOW64\YPWP.exe JJRAKIE.exe File created C:\windows\SysWOW64\YJCS.exe.bat PJANYAK.exe File created C:\windows\SysWOW64\KIC.exe NCWKDN.exe File opened for modification C:\windows\SysWOW64\MBGQR.exe OQVAID.exe File opened for modification C:\windows\SysWOW64\DGZMRPD.exe UGXHG.exe File opened for modification C:\windows\SysWOW64\SQD.exe ZNZR.exe File created C:\windows\SysWOW64\KGS.exe.bat AYQVJVA.exe File opened for modification C:\windows\SysWOW64\VJGTCQ.exe XOH.exe File created C:\windows\SysWOW64\CFCRCWJ.exe CCYWWG.exe File created C:\windows\SysWOW64\CCYWWG.exe PRP.exe File created C:\windows\SysWOW64\CCYWWG.exe.bat PRP.exe File created C:\windows\SysWOW64\UMVXL.exe.bat UGDIJCW.exe File created C:\windows\SysWOW64\SJQQ.exe DGZMRPD.exe File created C:\windows\SysWOW64\ZNZR.exe OUW.exe File created C:\windows\SysWOW64\GWXPK.exe FAUTWM.exe File created C:\windows\SysWOW64\YJCS.exe PJANYAK.exe File opened for modification C:\windows\SysWOW64\ZQUV.exe BABAH.exe File created C:\windows\SysWOW64\DGZMRPD.exe.bat UGXHG.exe File opened for modification C:\windows\SysWOW64\CXPGGCW.exe SAJMQTN.exe File created C:\windows\SysWOW64\GNDG.exe.bat CXPGGCW.exe File opened for modification C:\windows\SysWOW64\KIC.exe NCWKDN.exe File created C:\windows\SysWOW64\KZZWYRF.exe GJTW.exe File created C:\windows\SysWOW64\ZNZR.exe.bat OUW.exe File created C:\windows\SysWOW64\WCBHQB.exe YMI.exe File opened for modification C:\windows\SysWOW64\PJANYAK.exe MWVDOA.exe File created C:\windows\SysWOW64\HQT.exe.bat WYQRZVL.exe File opened for modification C:\windows\SysWOW64\KGFTRV.exe BGDON.exe File opened for modification C:\windows\SysWOW64\CCYWWG.exe PRP.exe File created C:\windows\SysWOW64\OSKMRI.exe.bat ZXAH.exe File created C:\windows\SysWOW64\MXOMVY.exe RMGVHN.exe File created C:\windows\SysWOW64\HQT.exe WYQRZVL.exe File created C:\windows\SysWOW64\ZQUV.exe.bat BABAH.exe File opened for modification C:\windows\SysWOW64\HQT.exe WYQRZVL.exe File created C:\windows\SysWOW64\ZPYI.exe VJGTCQ.exe File created C:\windows\SysWOW64\UCDZCL.exe.bat ZPYI.exe File opened for modification C:\windows\SysWOW64\XCIUN.exe KZZWYRF.exe File created C:\windows\SysWOW64\FZRGD.exe BRK.exe File created C:\windows\SysWOW64\PJANYAK.exe.bat MWVDOA.exe File opened for modification C:\windows\SysWOW64\FZRGD.exe BRK.exe File opened for modification C:\windows\SysWOW64\EJJMBGC.exe ULDSUYU.exe File created C:\windows\SysWOW64\VJGTCQ.exe.bat XOH.exe File opened for modification C:\windows\SysWOW64\WKG.exe BMGBE.exe File created C:\windows\SysWOW64\PRP.exe XRNS.exe File created C:\windows\SysWOW64\SQD.exe.bat ZNZR.exe File created C:\windows\SysWOW64\CVF.exe.bat UPS.exe File created C:\windows\SysWOW64\WKG.exe BMGBE.exe File opened for modification C:\windows\SysWOW64\ZNZR.exe OUW.exe File created C:\windows\SysWOW64\WCBHQB.exe.bat YMI.exe File created C:\windows\SysWOW64\ZPYI.exe.bat VJGTCQ.exe File opened for modification C:\windows\SysWOW64\UCDZCL.exe ZPYI.exe File opened for modification C:\windows\SysWOW64\VPHSYXJ.exe UMVXL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\YDTH.exe WGNN.exe File created C:\windows\system\HKK.exe XCIUN.exe File created C:\windows\system\ECLJLR.exe SJQQ.exe File created C:\windows\QPSG.exe.bat VCNOOOE.exe File created C:\windows\system\ZCFO.exe.bat KMEXOVS.exe File created C:\windows\system\FFL.exe BPWIGW.exe File opened for modification C:\windows\system\FFL.exe BPWIGW.exe File opened for modification C:\windows\system\FXVOTSY.exe KKQXJ.exe File created C:\windows\system\FXVOTSY.exe.bat KKQXJ.exe File created C:\windows\system\TEOT.exe YQJJCPE.exe File created C:\windows\EVGCCN.exe.bat MSCZX.exe File created C:\windows\BRK.exe JJITNT.exe File created C:\windows\LGAST.exe.bat HQT.exe File created C:\windows\system\ILNCPF.exe.bat EVGCCN.exe File created C:\windows\NQKSJ.exe CXHZ.exe File created C:\windows\BRK.exe.bat JJITNT.exe File created C:\windows\system\ULDSUYU.exe GNDG.exe File created C:\windows\system\ULDSUYU.exe.bat GNDG.exe File created C:\windows\system\WYQRZVL.exe.bat MXOMVY.exe File opened for modification C:\windows\GZB.exe AZTELPL.exe File opened for modification C:\windows\system\NCWKDN.exe TPSB.exe File opened for modification C:\windows\XHQABD.exe YONK.exe File created C:\windows\XHQABD.exe.bat YONK.exe File opened for modification C:\windows\EVGCCN.exe MSCZX.exe File opened for modification C:\windows\system\WYQRZVL.exe MXOMVY.exe File opened for modification C:\windows\BMGBE.exe GZB.exe File opened for modification C:\windows\system\YONK.exe AEKCK.exe File opened for modification C:\windows\system\GJTW.exe YDTH.exe File opened for modification C:\windows\system\OGVUAAV.exe ZQUV.exe File opened for modification C:\windows\UFZGDG.exe QPSG.exe File created C:\windows\FAUTWM.exe SQD.exe File opened for modification C:\windows\FAUTWM.exe SQD.exe File created C:\windows\system\ILNCPF.exe EVGCCN.exe File created C:\windows\CXHZ.exe YPAZPV.exe File created C:\windows\TSQHC.exe HKK.exe File created C:\windows\system\YMI.exe ZCFO.exe File opened for modification C:\windows\SAJMQTN.exe UPG.exe File created C:\windows\PVO.exe.bat OSKMRI.exe File opened for modification C:\windows\MWVDOA.exe PVO.exe File created C:\windows\DYMQU.exe WDMQXKU.exe File created C:\windows\system\OQVAID.exe KAOA.exe File opened for modification C:\windows\TSQHC.exe HKK.exe File created C:\windows\system\UICBQ.exe.bat UFZGDG.exe File created C:\windows\system\YQJJCPE.exe.bat UICBQ.exe File opened for modification C:\windows\system\AYQVJVA.exe LIPECA.exe File opened for modification C:\windows\JJRAKIE.exe EJJMBGC.exe File opened for modification C:\windows\ZXAH.exe PPYCD.exe File created C:\windows\system\KAOA.exe RFKWQ.exe File created C:\windows\XRNS.exe.bat KGFTRV.exe File opened for modification C:\windows\system\UICBQ.exe UFZGDG.exe File created C:\windows\system\ZCFO.exe KMEXOVS.exe File opened for modification C:\windows\system\ZCFO.exe KMEXOVS.exe File created C:\windows\system\QQTIWT.exe.bat ZGQSNNK.exe File created C:\windows\RMGVHN.exe.bat YJCS.exe File opened for modification C:\windows\LGAST.exe HQT.exe File opened for modification C:\windows\system\JSER.exe UCDZCL.exe File opened for modification C:\windows\system\ECLJLR.exe SJQQ.exe File created C:\windows\ECVP.exe JGQ.exe File created C:\windows\CXHZ.exe.bat YPAZPV.exe File created C:\windows\UPS.exe FZRGD.exe File created C:\windows\JJRAKIE.exe EJJMBGC.exe File opened for modification C:\windows\system\WDMQXKU.exe JSER.exe File created C:\windows\AZTELPL.exe.bat DYMQU.exe File created C:\windows\system\DPQIHN.exe MBGQR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5752 cmd.exe 3220 cmd.exe 2688 cmd.exe 1364 cmd.exe 2740 cmd.exe 5372 cmd.exe 2924 cmd.exe 3408 cmd.exe 3000 cmd.exe 5376 cmd.exe 3552 cmd.exe 1692 cmd.exe 3236 cmd.exe 2548 cmd.exe 3728 cmd.exe 1096 cmd.exe 3332 cmd.exe 5164 cmd.exe 4320 cmd.exe 2956 cmd.exe 4664 cmd.exe 3604 cmd.exe 4632 cmd.exe 4692 cmd.exe 6032 cmd.exe 1800 cmd.exe 4112 cmd.exe 556 cmd.exe 6108 cmd.exe 3964 cmd.exe 1000 cmd.exe 5928 cmd.exe 3900 cmd.exe 5736 cmd.exe 5484 cmd.exe 2452 cmd.exe 4552 cmd.exe 3644 cmd.exe 5604 cmd.exe 3028 cmd.exe 1100 cmd.exe 436 cmd.exe 1556 cmd.exe 1216 cmd.exe 5680 cmd.exe 5748 cmd.exe 2520 cmd.exe 4880 cmd.exe 4140 cmd.exe 4660 cmd.exe 5936 cmd.exe 4336 cmd.exe 1948 cmd.exe 3224 cmd.exe 4956 cmd.exe 2444 cmd.exe 5676 cmd.exe 996 cmd.exe 2184 cmd.exe 1796 cmd.exe 4424 cmd.exe 2676 cmd.exe 5320 cmd.exe 4748 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1196 936 WerFault.exe 87 6040 4432 WerFault.exe 93 2520 5756 WerFault.exe 99 3624 1144 WerFault.exe 104 1532 1036 WerFault.exe 109 2820 3324 WerFault.exe 114 2924 2616 WerFault.exe 119 1824 2756 WerFault.exe 124 5268 576 WerFault.exe 129 5108 2460 WerFault.exe 134 4228 2420 WerFault.exe 139 5472 3544 WerFault.exe 144 3220 4280 WerFault.exe 149 4412 6076 WerFault.exe 154 2580 3352 WerFault.exe 159 3552 2932 WerFault.exe 164 4336 4912 WerFault.exe 169 2712 1280 WerFault.exe 174 5268 2792 WerFault.exe 179 5776 2504 WerFault.exe 184 4504 2788 WerFault.exe 189 2740 6052 WerFault.exe 194 1488 4604 WerFault.exe 199 2668 4468 WerFault.exe 204 1060 3484 WerFault.exe 209 3964 4076 WerFault.exe 214 4336 3504 WerFault.exe 219 3560 1612 WerFault.exe 224 5880 5176 WerFault.exe 229 2392 796 WerFault.exe 234 2572 4972 WerFault.exe 239 2112 5080 WerFault.exe 244 5560 4188 WerFault.exe 249 1588 5460 WerFault.exe 254 1808 3040 WerFault.exe 259 5196 5000 WerFault.exe 264 4336 5832 WerFault.exe 269 4496 3048 WerFault.exe 274 4500 1508 WerFault.exe 280 5464 200 WerFault.exe 285 1152 3584 WerFault.exe 290 3760 812 WerFault.exe 295 824 3044 WerFault.exe 300 1160 4536 WerFault.exe 305 3140 3180 WerFault.exe 310 2344 4436 WerFault.exe 315 4996 5732 WerFault.exe 320 5516 2440 WerFault.exe 325 5776 3476 WerFault.exe 330 5228 1984 WerFault.exe 335 1988 4940 WerFault.exe 340 4660 2760 WerFault.exe 345 4800 2868 WerFault.exe 350 3568 2580 WerFault.exe 355 4200 1576 WerFault.exe 360 4564 3020 WerFault.exe 365 3256 5520 WerFault.exe 370 1548 5156 WerFault.exe 375 2576 5880 WerFault.exe 380 2552 2124 WerFault.exe 385 3420 2000 WerFault.exe 390 3448 2412 WerFault.exe 395 3396 1588 WerFault.exe 400 4312 2228 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDMQXKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMGBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBGQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGZMRPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSKMRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJANYAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGFTRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGQSNNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQVAID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPWIGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJJMBGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPHSYXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYQVJVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUIWISJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPYCD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWVDOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXOMVY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFCRCWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TSQHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RMGVHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZRGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCIUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 936 2026-07-31_8ef477ed0d6e9e0e85179b56941aa086_elex_emotet_stop.exe 936 2026-07-31_8ef477ed0d6e9e0e85179b56941aa086_elex_emotet_stop.exe 4432 FKX.exe 4432 FKX.exe 5756 MYQ.exe 5756 MYQ.exe 1144 MTUDW.exe 1144 MTUDW.exe 1036 AEKCK.exe 1036 AEKCK.exe 3324 YONK.exe 3324 YONK.exe 2616 XHQABD.exe 2616 XHQABD.exe 2756 BPWIGW.exe 2756 BPWIGW.exe 576 FFL.exe 576 FFL.exe 2460 WGNN.exe 2460 WGNN.exe 2420 YDTH.exe 2420 YDTH.exe 3544 GJTW.exe 3544 GJTW.exe 4280 KZZWYRF.exe 4280 KZZWYRF.exe 6076 XCIUN.exe 6076 XCIUN.exe 3352 HKK.exe 3352 HKK.exe 2932 TSQHC.exe 2932 TSQHC.exe 4912 BGDON.exe 4912 BGDON.exe 1280 KGFTRV.exe 1280 KGFTRV.exe 2792 XRNS.exe 2792 XRNS.exe 2504 PRP.exe 2504 PRP.exe 2788 CCYWWG.exe 2788 CCYWWG.exe 6052 CFCRCWJ.exe 6052 CFCRCWJ.exe 4604 BABAH.exe 4604 BABAH.exe 4468 ZQUV.exe 4468 ZQUV.exe 3484 OGVUAAV.exe 3484 OGVUAAV.exe 4076 UGDIJCW.exe 4076 UGDIJCW.exe 3504 UMVXL.exe 3504 UMVXL.exe 1612 VPHSYXJ.exe 1612 VPHSYXJ.exe 5176 KKQXJ.exe 5176 KKQXJ.exe 796 FXVOTSY.exe 796 FXVOTSY.exe 4972 OGP.exe 4972 OGP.exe 5080 UGXHG.exe 5080 UGXHG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 936 2026-07-31_8ef477ed0d6e9e0e85179b56941aa086_elex_emotet_stop.exe 936 2026-07-31_8ef477ed0d6e9e0e85179b56941aa086_elex_emotet_stop.exe 4432 FKX.exe 4432 FKX.exe 5756 MYQ.exe 5756 MYQ.exe 1144 MTUDW.exe 1144 MTUDW.exe 1036 AEKCK.exe 1036 AEKCK.exe 3324 YONK.exe 3324 YONK.exe 2616 XHQABD.exe 2616 XHQABD.exe 2756 BPWIGW.exe 2756 BPWIGW.exe 576 FFL.exe 576 FFL.exe 2460 WGNN.exe 2460 WGNN.exe 2420 YDTH.exe 2420 YDTH.exe 3544 GJTW.exe 3544 GJTW.exe 4280 KZZWYRF.exe 4280 KZZWYRF.exe 6076 XCIUN.exe 6076 XCIUN.exe 3352 HKK.exe 3352 HKK.exe 2932 TSQHC.exe 2932 TSQHC.exe 4912 BGDON.exe 4912 BGDON.exe 1280 KGFTRV.exe 1280 KGFTRV.exe 2792 XRNS.exe 2792 XRNS.exe 2504 PRP.exe 2504 PRP.exe 2788 CCYWWG.exe 2788 CCYWWG.exe 6052 CFCRCWJ.exe 6052 CFCRCWJ.exe 4604 BABAH.exe 4604 BABAH.exe 4468 ZQUV.exe 4468 ZQUV.exe 3484 OGVUAAV.exe 3484 OGVUAAV.exe 4076 UGDIJCW.exe 4076 UGDIJCW.exe 3504 UMVXL.exe 3504 UMVXL.exe 1612 VPHSYXJ.exe 1612 VPHSYXJ.exe 5176 KKQXJ.exe 5176 KKQXJ.exe 796 FXVOTSY.exe 796 FXVOTSY.exe 4972 OGP.exe 4972 OGP.exe 5080 UGXHG.exe 5080 UGXHG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 936 wrote to memory of 3116 936 2026-07-31_8ef477ed0d6e9e0e85179b56941aa086_elex_emotet_stop.exe 89 PID 3116 wrote to memory of 4432 3116 cmd.exe 93 PID 4432 wrote to memory of 5356 4432 FKX.exe 95 PID 5356 wrote to memory of 5756 5356 cmd.exe 99 PID 5756 wrote to memory of 5940 5756 MYQ.exe 100 PID 5940 wrote to memory of 1144 5940 cmd.exe 104 PID 1144 wrote to memory of 5220 1144 MTUDW.exe 105 PID 5220 wrote to memory of 1036 5220 cmd.exe 109 PID 1036 wrote to memory of 436 1036 AEKCK.exe 110 PID 436 wrote to memory of 3324 436 cmd.exe 114 PID 3324 wrote to memory of 3728 3324 YONK.exe 115 PID 3728 wrote to memory of 2616 3728 cmd.exe 119 PID 2616 wrote to memory of 1556 2616 XHQABD.exe 120 PID 1556 wrote to memory of 2756 1556 cmd.exe 124 PID 2756 wrote to memory of 1216 2756 BPWIGW.exe 125 PID 1216 wrote to memory of 576 1216 cmd.exe 129 PID 576 wrote to memory of 4908 576 FFL.exe 130 PID 4908 wrote to memory of 2460 4908 cmd.exe 134 PID 2460 wrote to memory of 4988 2460 WGNN.exe 135 PID 4988 wrote to memory of 2420 4988 cmd.exe 139 PID 2420 wrote to memory of 5752 2420 YDTH.exe 140 PID 5752 wrote to memory of 3544 5752 cmd.exe 144 PID 3544 wrote to memory of 2620 3544 GJTW.exe 145 PID 2620 wrote to memory of 4280 2620 cmd.exe 149 PID 4280 wrote to memory of 5552 4280 KZZWYRF.exe 150 PID 5552 wrote to memory of 6076 5552 cmd.exe 154 PID 6076 wrote to memory of 5532 6076 XCIUN.exe 155 PID 5532 wrote to memory of 3352 5532 cmd.exe 159 PID 3352 wrote to memory of 5948 3352 HKK.exe 160 PID 5948 wrote to memory of 2932 5948 cmd.exe 164 PID 2932 wrote to memory of 1948 2932 TSQHC.exe 165 PID 1948 wrote to memory of 4912 1948 cmd.exe 169 PID 4912 wrote to memory of 1288 4912 BGDON.exe 170 PID 1288 wrote to memory of 1280 1288 cmd.exe 174 PID 1280 wrote to memory of 5644 1280 KGFTRV.exe 175 PID 5644 wrote to memory of 2792 5644 cmd.exe 179 PID 2792 wrote to memory of 908 2792 XRNS.exe 180 PID 908 wrote to memory of 2504 908 cmd.exe 184 PID 2504 wrote to memory of 2608 2504 PRP.exe 185 PID 2608 wrote to memory of 2788 2608 cmd.exe 189 PID 2788 wrote to memory of 364 2788 CCYWWG.exe 190 PID 364 wrote to memory of 6052 364 cmd.exe 194 PID 6052 wrote to memory of 2908 6052 CFCRCWJ.exe 195 PID 2908 wrote to memory of 4604 2908 cmd.exe 199 PID 4604 wrote to memory of 3220 4604 BABAH.exe 200 PID 3220 wrote to memory of 4468 3220 cmd.exe 204 PID 4468 wrote to memory of 4828 4468 ZQUV.exe 205 PID 4828 wrote to memory of 3484 4828 cmd.exe 209 PID 3484 wrote to memory of 2688 3484 OGVUAAV.exe 210 PID 2688 wrote to memory of 4076 2688 cmd.exe 214 PID 4076 wrote to memory of 2292 4076 UGDIJCW.exe 215 PID 2292 wrote to memory of 3504 2292 cmd.exe 219 PID 3504 wrote to memory of 4424 3504 UMVXL.exe 220 PID 4424 wrote to memory of 1612 4424 cmd.exe 224 PID 1612 wrote to memory of 5536 1612 VPHSYXJ.exe 225 PID 5536 wrote to memory of 5176 5536 cmd.exe 229 PID 5176 wrote to memory of 3764 5176 KKQXJ.exe 230 PID 3764 wrote to memory of 796 3764 cmd.exe 234 PID 796 wrote to memory of 3232 796 FXVOTSY.exe 235 PID 3232 wrote to memory of 4972 3232 cmd.exe 239 PID 4972 wrote to memory of 2692 4972 OGP.exe 240 PID 2692 wrote to memory of 5080 2692 cmd.exe 244 PID 5080 wrote to memory of 5472 5080 UGXHG.exe 245 PID 5472 wrote to memory of 4188 5472 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_8ef477ed0d6e9e0e85179b56941aa086_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_8ef477ed0d6e9e0e85179b56941aa086_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKX.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\windows\system\FKX.exeC:\windows\system\FKX.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\MYQ.exeC:\windows\MYQ.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTUDW.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\MTUDW.exeC:\windows\MTUDW.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AEKCK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\SysWOW64\AEKCK.exeC:\windows\system32\AEKCK.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YONK.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:436 -
C:\windows\system\YONK.exeC:\windows\system\YONK.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHQABD.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\windows\XHQABD.exeC:\windows\XHQABD.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPWIGW.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\windows\system\BPWIGW.exeC:\windows\system\BPWIGW.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFL.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\windows\system\FFL.exeC:\windows\system\FFL.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WGNN.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\SysWOW64\WGNN.exeC:\windows\system32\WGNN.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\YDTH.exeC:\windows\YDTH.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GJTW.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\system\GJTW.exeC:\windows\system\GJTW.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZZWYRF.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\SysWOW64\KZZWYRF.exeC:\windows\system32\KZZWYRF.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XCIUN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\SysWOW64\XCIUN.exeC:\windows\system32\XCIUN.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKK.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\system\HKK.exeC:\windows\system\HKK.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSQHC.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\TSQHC.exeC:\windows\TSQHC.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BGDON.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\windows\system\BGDON.exeC:\windows\system\BGDON.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGFTRV.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\SysWOW64\KGFTRV.exeC:\windows\system32\KGFTRV.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRNS.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\XRNS.exeC:\windows\XRNS.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRP.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:908 -
C:\windows\SysWOW64\PRP.exeC:\windows\system32\PRP.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CCYWWG.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\SysWOW64\CCYWWG.exeC:\windows\system32\CCYWWG.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CFCRCWJ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:364 -
C:\windows\SysWOW64\CFCRCWJ.exeC:\windows\system32\CFCRCWJ.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BABAH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\windows\BABAH.exeC:\windows\BABAH.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQUV.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\SysWOW64\ZQUV.exeC:\windows\system32\ZQUV.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGVUAAV.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\system\OGVUAAV.exeC:\windows\system\OGVUAAV.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGDIJCW.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\system\UGDIJCW.exeC:\windows\system\UGDIJCW.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMVXL.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\windows\SysWOW64\UMVXL.exeC:\windows\system32\UMVXL.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPHSYXJ.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\windows\SysWOW64\VPHSYXJ.exeC:\windows\system32\VPHSYXJ.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKQXJ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\windows\SysWOW64\KKQXJ.exeC:\windows\system32\KKQXJ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXVOTSY.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\system\FXVOTSY.exeC:\windows\system\FXVOTSY.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\windows\OGP.exeC:\windows\OGP.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGXHG.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\windows\UGXHG.exeC:\windows\UGXHG.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DGZMRPD.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\windows\SysWOW64\DGZMRPD.exeC:\windows\system32\DGZMRPD.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJQQ.exe.bat" "66⤵PID:5468
-
C:\windows\SysWOW64\SJQQ.exeC:\windows\system32\SJQQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECLJLR.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3052 -
C:\windows\system\ECLJLR.exeC:\windows\system\ECLJLR.exe69⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCNOOOE.exe.bat" "70⤵
- Executes a command shell one-liner
PID:1800 -
C:\windows\VCNOOOE.exeC:\windows\VCNOOOE.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPSG.exe.bat" "72⤵PID:3252
-
C:\windows\QPSG.exeC:\windows\QPSG.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFZGDG.exe.bat" "74⤵PID:5540
-
C:\windows\UFZGDG.exeC:\windows\UFZGDG.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UICBQ.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2924 -
C:\windows\system\UICBQ.exeC:\windows\system\UICBQ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQJJCPE.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5868 -
C:\windows\system\YQJJCPE.exeC:\windows\system\YQJJCPE.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEOT.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5164 -
C:\windows\system\TEOT.exeC:\windows\system\TEOT.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IUP.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5276 -
C:\windows\IUP.exeC:\windows\IUP.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUW.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4712 -
C:\windows\SysWOW64\OUW.exeC:\windows\system32\OUW.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNZR.exe.bat" "86⤵PID:980
-
C:\windows\SysWOW64\ZNZR.exeC:\windows\system32\ZNZR.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SQD.exe.bat" "88⤵
- Executes a command shell one-liner
PID:3224 -
C:\windows\SysWOW64\SQD.exeC:\windows\system32\SQD.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4112 -
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWXPK.exe.bat" "92⤵PID:5260
-
C:\windows\SysWOW64\GWXPK.exeC:\windows\system32\GWXPK.exe93⤵
- Executes dropped EXE
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMEXOVS.exe.bat" "94⤵PID:1252
-
C:\windows\SysWOW64\KMEXOVS.exeC:\windows\system32\KMEXOVS.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCFO.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2384 -
C:\windows\system\ZCFO.exeC:\windows\system\ZCFO.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMI.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1812 -
C:\windows\system\YMI.exeC:\windows\system\YMI.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCBHQB.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:4304 -
C:\windows\SysWOW64\WCBHQB.exeC:\windows\system32\WCBHQB.exe101⤵
- Executes dropped EXE
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSCZX.exe.bat" "102⤵
- Executes a command shell one-liner
PID:2676 -
C:\windows\MSCZX.exeC:\windows\MSCZX.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EVGCCN.exe.bat" "104⤵PID:3488
-
C:\windows\EVGCCN.exeC:\windows\EVGCCN.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILNCPF.exe.bat" "106⤵PID:2812
-
C:\windows\system\ILNCPF.exeC:\windows\system\ILNCPF.exe107⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JGQ.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1096 -
C:\windows\JGQ.exeC:\windows\JGQ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECVP.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3408 -
C:\windows\ECVP.exeC:\windows\ECVP.exe111⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPAZPV.exe.bat" "112⤵PID:1824
-
C:\windows\system\YPAZPV.exeC:\windows\system\YPAZPV.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXHZ.exe.bat" "114⤵
- Executes a command shell one-liner
PID:4320 -
C:\windows\CXHZ.exeC:\windows\CXHZ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NQKSJ.exe.bat" "116⤵PID:5200
-
C:\windows\NQKSJ.exeC:\windows\NQKSJ.exe117⤵
- Executes dropped EXE
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGQSNNK.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2416 -
C:\windows\system\ZGQSNNK.exeC:\windows\system\ZGQSNNK.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QQTIWT.exe.bat" "120⤵
- Executes a command shell one-liner
PID:5736 -
C:\windows\system\QQTIWT.exeC:\windows\system\QQTIWT.exe121⤵
- Executes dropped EXE
PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-