Analysis
- max time kernel
82s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 18:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_6c82bae7a14424ef0d89341214956e33_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-02_6c82bae7a14424ef0d89341214956e33_elex_emotet_stop.exe
- Size 208KB
- Sample260802-ws2cdadg89
- SHA256 2239d3bd2c88f7918c19da7c898ce86987b0e9a46bab15718ea9fc8c2db7567e
- MD5 6c82bae7a14424ef0d89341214956e33
- SHA1 fceb47213e04817d1153ebb6a0d8fecba0d74eb9
- SHA512 1af4634f9e067c6154c7a6762488cc2228cdd1d795772fa193771961bbc75efe7db69a0a90f52ff97f6a7068039464289e8535adf812e4ddb144f5594c29d805
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOff4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LO3kEj1
- TLSH T1C4247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1708 LFGDCRQ.exe 4964 CSFCW.exe 2652 TNPMF.exe 3008 KWRSJS.exe 3264 YGZQXU.exe 6036 EUZRCXB.exe 4616 IKFR.exe 3188 XFXDZCX.exe 5560 GNZ.exe 4280 HIDEQYB.exe 3588 LYJMU.exe 1416 PGQMGIL.exe 2560 GPS.exe 1044 IMX.exe 5220 ZNZR.exe 5804 DDGZPE.exe 3964 NDIES.exe 5408 SDQSBEY.exe 3468 KMS.exe 4560 CHVAS.exe 4960 MEBVA.exe 4344 QUQVMAY.exe 716 AVK.exe 3012 ELYICP.exe 2932 GYD.exe 5916 BLAB.exe 5264 HMIOFJB.exe 5028 SEL.exe 2748 MSPRY.exe 4432 SSXEHTG.exe 420 SFX.exe 5132 NTCC.exe 3208 COLGDSY.exe 5944 NGG.exe 5556 RWVHYS.exe 4872 JXPMBXM.exe 6088 BABIHN.exe 596 QVKUSAO.exe 5496 AVMZD.exe 4408 GVU.exe 1396 GYYJ.exe 1544 BMDSCP.exe 4144 HHCBHSF.exe 4632 CUZL.exe 2564 RXQPCFC.exe 4868 JSUTID.exe 2344 ZIVK.exe 2408 OEEWZ.exe 848 SULW.exe 612 VCU.exe 1572 TNWBBEH.exe 2924 VKKVJMQ.exe 3888 ZARD.exe 4876 PQS.exe 4644 ZOXPJ.exe 6072 VUQEZV.exe 5920 UFSUI.exe 4600 VIWQNZC.exe 5936 XFKKDI.exe 2480 XAO.exe 1880 QDRKO.exe 1000 RGVO.exe 1692 LUAXDD.exe 4256 RUI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IKFR.exe EUZRCXB.exe File created C:\windows\SysWOW64\GPS.exe.bat PGQMGIL.exe File opened for modification C:\windows\SysWOW64\SDQSBEY.exe NDIES.exe File created C:\windows\SysWOW64\VUQEZV.exe ZOXPJ.exe File opened for modification C:\windows\SysWOW64\VUQEZV.exe ZOXPJ.exe File created C:\windows\SysWOW64\IUBP.exe.bat PRPUS.exe File created C:\windows\SysWOW64\CSFCW.exe.bat LFGDCRQ.exe File opened for modification C:\windows\SysWOW64\GPS.exe PGQMGIL.exe File opened for modification C:\windows\SysWOW64\BLAB.exe GYD.exe File created C:\windows\SysWOW64\UFSUI.exe VUQEZV.exe File opened for modification C:\windows\SysWOW64\SVFFC.exe SQER.exe File created C:\windows\SysWOW64\SVFFC.exe.bat SQER.exe File created C:\windows\SysWOW64\IUBP.exe PRPUS.exe File created C:\windows\SysWOW64\ZNZR.exe.bat IMX.exe File created C:\windows\SysWOW64\HHCBHSF.exe.bat BMDSCP.exe File opened for modification C:\windows\SysWOW64\OQSQD.exe IUBP.exe File created C:\windows\SysWOW64\OQSQD.exe.bat IUBP.exe File created C:\windows\SysWOW64\PGQMGIL.exe.bat LYJMU.exe File created C:\windows\SysWOW64\GPS.exe PGQMGIL.exe File created C:\windows\SysWOW64\VUQEZV.exe.bat ZOXPJ.exe File opened for modification C:\windows\SysWOW64\TNPMF.exe CSFCW.exe File created C:\windows\SysWOW64\ZNZR.exe IMX.exe File opened for modification C:\windows\SysWOW64\UOQR.exe TKEOVWO.exe File created C:\windows\SysWOW64\YEHAZ.exe.bat NLMI.exe File created C:\windows\SysWOW64\TNPMF.exe.bat CSFCW.exe File opened for modification C:\windows\SysWOW64\SULW.exe OEEWZ.exe File created C:\windows\SysWOW64\YYSOVFY.exe ZNH.exe File created C:\windows\SysWOW64\XYABWI.exe NQYO.exe File opened for modification C:\windows\SysWOW64\TKEOVWO.exe AHA.exe File created C:\windows\SysWOW64\UOQR.exe TKEOVWO.exe File opened for modification C:\windows\SysWOW64\XYABWI.exe NQYO.exe File opened for modification C:\windows\SysWOW64\GUVJFY.exe HJSSWSC.exe File created C:\windows\SysWOW64\UOQR.exe.bat TKEOVWO.exe File created C:\windows\SysWOW64\SDQSBEY.exe NDIES.exe File created C:\windows\SysWOW64\SDQSBEY.exe.bat NDIES.exe File created C:\windows\SysWOW64\SULW.exe.bat OEEWZ.exe File created C:\windows\SysWOW64\TKEOVWO.exe.bat AHA.exe File created C:\windows\SysWOW64\MEBVA.exe.bat CHVAS.exe File created C:\windows\SysWOW64\CSFCW.exe LFGDCRQ.exe File opened for modification C:\windows\SysWOW64\CSFCW.exe LFGDCRQ.exe File opened for modification C:\windows\SysWOW64\HHCBHSF.exe BMDSCP.exe File created C:\windows\SysWOW64\UHMO.exe.bat FEDBFC.exe File created C:\windows\SysWOW64\XYABWI.exe.bat NQYO.exe File created C:\windows\SysWOW64\HHCBHSF.exe BMDSCP.exe File opened for modification C:\windows\SysWOW64\UFSUI.exe VUQEZV.exe File opened for modification C:\windows\SysWOW64\IUBP.exe PRPUS.exe File created C:\windows\SysWOW64\IKFR.exe.bat EUZRCXB.exe File opened for modification C:\windows\SysWOW64\PGQMGIL.exe LYJMU.exe File created C:\windows\SysWOW64\UFSUI.exe.bat VUQEZV.exe File created C:\windows\SysWOW64\PGQMGIL.exe LYJMU.exe File created C:\windows\SysWOW64\BLAB.exe.bat GYD.exe File opened for modification C:\windows\SysWOW64\YYSOVFY.exe ZNH.exe File opened for modification C:\windows\SysWOW64\NQYO.exe UXJD.exe File created C:\windows\SysWOW64\GUVJFY.exe.bat HJSSWSC.exe File opened for modification C:\windows\SysWOW64\MEBVA.exe CHVAS.exe File opened for modification C:\windows\SysWOW64\IKFR.exe EUZRCXB.exe File created C:\windows\SysWOW64\NQYO.exe UXJD.exe File created C:\windows\SysWOW64\NQYO.exe.bat UXJD.exe File created C:\windows\SysWOW64\TNPMF.exe CSFCW.exe File opened for modification C:\windows\SysWOW64\ZNZR.exe IMX.exe File created C:\windows\SysWOW64\SULW.exe OEEWZ.exe File created C:\windows\SysWOW64\SVFFC.exe SQER.exe File created C:\windows\SysWOW64\AHA.exe GUVJFY.exe File created C:\windows\SysWOW64\YEHAZ.exe NLMI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\IMX.exe GPS.exe File created C:\windows\system\ZIVK.exe.bat JSUTID.exe File opened for modification C:\windows\TNWBBEH.exe VCU.exe File created C:\windows\system\SQER.exe OIYJOTR.exe File created C:\windows\ZNH.exe.bat QFFSJUZ.exe File created C:\windows\system\DJC.exe.bat CGZW.exe File created C:\windows\XFXDZCX.exe.bat IKFR.exe File created C:\windows\system\SEL.exe.bat HMIOFJB.exe File created C:\windows\system\QVKUSAO.exe BABIHN.exe File created C:\windows\RPU.exe RMQU.exe File created C:\windows\system\COLGDSY.exe.bat NTCC.exe File created C:\windows\system\GVU.exe.bat AVMZD.exe File created C:\windows\BMDSCP.exe GYYJ.exe File created C:\windows\VCU.exe SULW.exe File created C:\windows\QFFSJUZ.exe RPU.exe File opened for modification C:\windows\QFFSJUZ.exe RPU.exe File created C:\windows\system\VIWQNZC.exe.bat UFSUI.exe File created C:\windows\BABIHN.exe.bat JXPMBXM.exe File created C:\windows\HYYIOPL.exe.bat UOQR.exe File opened for modification C:\windows\VCU.exe SULW.exe File opened for modification C:\windows\RAIZ.exe RUI.exe File created C:\windows\system\FYDNDX.exe QDT.exe File created C:\windows\system\SQER.exe.bat OIYJOTR.exe File created C:\windows\system\SYHYPBK.exe.bat OQSQD.exe File opened for modification C:\windows\GYYJ.exe GVU.exe File opened for modification C:\windows\XAO.exe XFKKDI.exe File created C:\windows\system\QDT.exe MNNJY.exe File opened for modification C:\windows\system\FEDBFC.exe FYDNDX.exe File created C:\windows\RPU.exe.bat RMQU.exe File opened for modification C:\windows\ELYICP.exe AVK.exe File opened for modification C:\windows\NTCC.exe SFX.exe File created C:\windows\system\MTK.exe XYABWI.exe File opened for modification C:\windows\QZAVS.exe HYYIOPL.exe File created C:\windows\system\NGG.exe.bat COLGDSY.exe File created C:\windows\RUI.exe LUAXDD.exe File opened for modification C:\windows\system\UXJD.exe VMGVS.exe File created C:\windows\system\VIWQNZC.exe UFSUI.exe File opened for modification C:\windows\system\DJC.exe CGZW.exe File opened for modification C:\windows\HJSSWSC.exe MWOJM.exe File created C:\windows\GYD.exe ELYICP.exe File created C:\windows\system\MNNJY.exe RAIZ.exe File opened for modification C:\windows\OIYJOTR.exe KSRJC.exe File created C:\windows\VCU.exe.bat SULW.exe File created C:\windows\TNWBBEH.exe.bat VCU.exe File opened for modification C:\windows\system\MNNJY.exe RAIZ.exe File opened for modification C:\windows\system\CPHVEMJ.exe QZAVS.exe File created C:\windows\system\PRPUS.exe CPHVEMJ.exe File opened for modification C:\windows\BABIHN.exe JXPMBXM.exe File created C:\windows\system\RGVO.exe QDRKO.exe File opened for modification C:\windows\system\XOIUQL.exe SVFFC.exe File opened for modification C:\windows\system\VMGVS.exe DJC.exe File created C:\windows\NLMI.exe SYHYPBK.exe File opened for modification C:\windows\QUQVMAY.exe MEBVA.exe File created C:\windows\BABIHN.exe JXPMBXM.exe File opened for modification C:\windows\ZNH.exe QFFSJUZ.exe File created C:\windows\system\KWRSJS.exe TNPMF.exe File opened for modification C:\windows\system\GVU.exe AVMZD.exe File created C:\windows\system\VKKVJMQ.exe.bat TNWBBEH.exe File created C:\windows\system\PQS.exe ZARD.exe File created C:\windows\RUI.exe.bat LUAXDD.exe File opened for modification C:\windows\JSUTID.exe RXQPCFC.exe File created C:\windows\system\LUAXDD.exe RGVO.exe File created C:\windows\OIYJOTR.exe.bat KSRJC.exe File created C:\windows\system\MTK.exe.bat XYABWI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1864 cmd.exe 4160 cmd.exe 3112 cmd.exe 4692 cmd.exe 2972 cmd.exe 1844 cmd.exe 2140 cmd.exe 4780 cmd.exe 3900 cmd.exe 2752 cmd.exe 3272 cmd.exe 2272 cmd.exe 4516 cmd.exe 3292 cmd.exe 5552 cmd.exe 4268 cmd.exe 4784 cmd.exe 2744 cmd.exe 1108 cmd.exe 5768 cmd.exe 5824 cmd.exe 4896 cmd.exe 4696 cmd.exe 5060 cmd.exe 4524 cmd.exe 3484 cmd.exe 4608 cmd.exe 4132 cmd.exe 5960 cmd.exe 6004 cmd.exe 2628 cmd.exe 2852 cmd.exe 2204 cmd.exe 2788 cmd.exe 3700 cmd.exe 1856 cmd.exe 2756 cmd.exe 3444 cmd.exe 3924 cmd.exe 2132 cmd.exe 1312 cmd.exe 5820 cmd.exe 3432 cmd.exe 700 cmd.exe 4768 cmd.exe 1308 cmd.exe 3268 cmd.exe 2092 cmd.exe 3564 cmd.exe 2668 cmd.exe 360 cmd.exe 2872 cmd.exe 912 cmd.exe 4596 cmd.exe 760 cmd.exe 4980 cmd.exe 5616 cmd.exe 5176 cmd.exe 4936 cmd.exe 3332 cmd.exe 4712 cmd.exe 1280 cmd.exe 2500 cmd.exe 5080 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3152 4760 WerFault.exe 87 1572 1708 WerFault.exe 93 6028 4964 WerFault.exe 99 932 2652 WerFault.exe 104 2756 3008 WerFault.exe 109 4128 3264 WerFault.exe 114 1304 6036 WerFault.exe 119 3836 4616 WerFault.exe 124 848 3188 WerFault.exe 129 3820 5560 WerFault.exe 134 4208 4280 WerFault.exe 139 1224 3588 WerFault.exe 144 2300 1416 WerFault.exe 149 2740 2560 WerFault.exe 154 1992 1044 WerFault.exe 159 3388 5220 WerFault.exe 164 700 5804 WerFault.exe 169 2844 3964 WerFault.exe 174 5616 5408 WerFault.exe 179 1352 3468 WerFault.exe 184 1060 4560 WerFault.exe 189 3720 4960 WerFault.exe 194 3336 4344 WerFault.exe 199 6016 716 WerFault.exe 204 684 3012 WerFault.exe 209 2960 2932 WerFault.exe 214 3236 5916 WerFault.exe 219 1280 5264 WerFault.exe 224 4472 5028 WerFault.exe 229 5376 2748 WerFault.exe 234 1260 4432 WerFault.exe 239 3520 420 WerFault.exe 244 1412 5132 WerFault.exe 249 5004 3208 WerFault.exe 254 1768 5944 WerFault.exe 259 5108 5556 WerFault.exe 264 552 4872 WerFault.exe 269 3088 6088 WerFault.exe 274 2828 596 WerFault.exe 279 4780 5496 WerFault.exe 283 5116 4408 WerFault.exe 289 2432 1396 WerFault.exe 294 3328 1544 WerFault.exe 299 6060 4144 WerFault.exe 304 1856 4632 WerFault.exe 309 1380 2564 WerFault.exe 314 5564 4868 WerFault.exe 319 5176 2344 WerFault.exe 324 1432 2408 WerFault.exe 329 3956 848 WerFault.exe 334 2584 612 WerFault.exe 339 5508 1572 WerFault.exe 344 932 2924 WerFault.exe 349 2852 3888 WerFault.exe 354 3448 4876 WerFault.exe 359 1244 4644 WerFault.exe 364 2764 6072 WerFault.exe 369 5924 5920 WerFault.exe 374 2984 4600 WerFault.exe 379 1236 5936 WerFault.exe 384 4332 2480 WerFault.exe 389 2132 1880 WerFault.exe 394 448 1000 WerFault.exe 399 3176 1692 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRPUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWRSJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BABIHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFSUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEDBFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFFSJUZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSXEHTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGQMGIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MEBVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLMI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELYICP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMIOFJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWOJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXPMBXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUAXDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZIVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNWBBEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGZQXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFXDZCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDGZPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJSSWSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNPMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUQVMAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCU.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4760 2026-08-02_6c82bae7a14424ef0d89341214956e33_elex_emotet_stop.exe 4760 2026-08-02_6c82bae7a14424ef0d89341214956e33_elex_emotet_stop.exe 1708 LFGDCRQ.exe 1708 LFGDCRQ.exe 4964 CSFCW.exe 4964 CSFCW.exe 2652 TNPMF.exe 2652 TNPMF.exe 3008 KWRSJS.exe 3008 KWRSJS.exe 3264 YGZQXU.exe 3264 YGZQXU.exe 6036 EUZRCXB.exe 6036 EUZRCXB.exe 4616 IKFR.exe 4616 IKFR.exe 3188 XFXDZCX.exe 3188 XFXDZCX.exe 5560 GNZ.exe 5560 GNZ.exe 4280 HIDEQYB.exe 4280 HIDEQYB.exe 3588 LYJMU.exe 3588 LYJMU.exe 1416 PGQMGIL.exe 1416 PGQMGIL.exe 2560 GPS.exe 2560 GPS.exe 1044 IMX.exe 1044 IMX.exe 5220 ZNZR.exe 5220 ZNZR.exe 5804 DDGZPE.exe 5804 DDGZPE.exe 3964 NDIES.exe 3964 NDIES.exe 5408 SDQSBEY.exe 5408 SDQSBEY.exe 3468 KMS.exe 3468 KMS.exe 4560 CHVAS.exe 4560 CHVAS.exe 4960 MEBVA.exe 4960 MEBVA.exe 4344 QUQVMAY.exe 4344 QUQVMAY.exe 716 AVK.exe 716 AVK.exe 3012 ELYICP.exe 3012 ELYICP.exe 2932 GYD.exe 2932 GYD.exe 5916 BLAB.exe 5916 BLAB.exe 5264 HMIOFJB.exe 5264 HMIOFJB.exe 5028 SEL.exe 5028 SEL.exe 2748 MSPRY.exe 2748 MSPRY.exe 4432 SSXEHTG.exe 4432 SSXEHTG.exe 420 SFX.exe 420 SFX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4760 2026-08-02_6c82bae7a14424ef0d89341214956e33_elex_emotet_stop.exe 4760 2026-08-02_6c82bae7a14424ef0d89341214956e33_elex_emotet_stop.exe 1708 LFGDCRQ.exe 1708 LFGDCRQ.exe 4964 CSFCW.exe 4964 CSFCW.exe 2652 TNPMF.exe 2652 TNPMF.exe 3008 KWRSJS.exe 3008 KWRSJS.exe 3264 YGZQXU.exe 3264 YGZQXU.exe 6036 EUZRCXB.exe 6036 EUZRCXB.exe 4616 IKFR.exe 4616 IKFR.exe 3188 XFXDZCX.exe 3188 XFXDZCX.exe 5560 GNZ.exe 5560 GNZ.exe 4280 HIDEQYB.exe 4280 HIDEQYB.exe 3588 LYJMU.exe 3588 LYJMU.exe 1416 PGQMGIL.exe 1416 PGQMGIL.exe 2560 GPS.exe 2560 GPS.exe 1044 IMX.exe 1044 IMX.exe 5220 ZNZR.exe 5220 ZNZR.exe 5804 DDGZPE.exe 5804 DDGZPE.exe 3964 NDIES.exe 3964 NDIES.exe 5408 SDQSBEY.exe 5408 SDQSBEY.exe 3468 KMS.exe 3468 KMS.exe 4560 CHVAS.exe 4560 CHVAS.exe 4960 MEBVA.exe 4960 MEBVA.exe 4344 QUQVMAY.exe 4344 QUQVMAY.exe 716 AVK.exe 716 AVK.exe 3012 ELYICP.exe 3012 ELYICP.exe 2932 GYD.exe 2932 GYD.exe 5916 BLAB.exe 5916 BLAB.exe 5264 HMIOFJB.exe 5264 HMIOFJB.exe 5028 SEL.exe 5028 SEL.exe 2748 MSPRY.exe 2748 MSPRY.exe 4432 SSXEHTG.exe 4432 SSXEHTG.exe 420 SFX.exe 420 SFX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4760 wrote to memory of 4268 4760 2026-08-02_6c82bae7a14424ef0d89341214956e33_elex_emotet_stop.exe 89 PID 4268 wrote to memory of 1708 4268 cmd.exe 93 PID 1708 wrote to memory of 5384 1708 LFGDCRQ.exe 95 PID 5384 wrote to memory of 4964 5384 cmd.exe 99 PID 4964 wrote to memory of 1864 4964 CSFCW.exe 100 PID 1864 wrote to memory of 2652 1864 cmd.exe 104 PID 2652 wrote to memory of 3900 2652 TNPMF.exe 105 PID 3900 wrote to memory of 3008 3900 cmd.exe 109 PID 3008 wrote to memory of 3584 3008 KWRSJS.exe 110 PID 3584 wrote to memory of 3264 3584 cmd.exe 114 PID 3264 wrote to memory of 6020 3264 YGZQXU.exe 115 PID 6020 wrote to memory of 6036 6020 cmd.exe 119 PID 6036 wrote to memory of 5820 6036 EUZRCXB.exe 120 PID 5820 wrote to memory of 4616 5820 cmd.exe 124 PID 4616 wrote to memory of 2296 4616 IKFR.exe 125 PID 2296 wrote to memory of 3188 2296 cmd.exe 129 PID 3188 wrote to memory of 5252 3188 XFXDZCX.exe 130 PID 5252 wrote to memory of 5560 5252 cmd.exe 134 PID 5560 wrote to memory of 1820 5560 GNZ.exe 135 PID 1820 wrote to memory of 4280 1820 cmd.exe 139 PID 4280 wrote to memory of 1332 4280 HIDEQYB.exe 140 PID 1332 wrote to memory of 3588 1332 cmd.exe 144 PID 3588 wrote to memory of 2644 3588 LYJMU.exe 145 PID 2644 wrote to memory of 1416 2644 cmd.exe 149 PID 1416 wrote to memory of 2440 1416 PGQMGIL.exe 150 PID 2440 wrote to memory of 2560 2440 cmd.exe 154 PID 2560 wrote to memory of 904 2560 GPS.exe 155 PID 904 wrote to memory of 1044 904 cmd.exe 159 PID 1044 wrote to memory of 3432 1044 IMX.exe 160 PID 3432 wrote to memory of 5220 3432 cmd.exe 164 PID 5220 wrote to memory of 2032 5220 ZNZR.exe 165 PID 2032 wrote to memory of 5804 2032 cmd.exe 169 PID 5804 wrote to memory of 2788 5804 DDGZPE.exe 170 PID 2788 wrote to memory of 3964 2788 cmd.exe 174 PID 3964 wrote to memory of 3564 3964 NDIES.exe 175 PID 3564 wrote to memory of 5408 3564 cmd.exe 179 PID 5408 wrote to memory of 4540 5408 SDQSBEY.exe 180 PID 4540 wrote to memory of 3468 4540 cmd.exe 184 PID 3468 wrote to memory of 2712 3468 KMS.exe 185 PID 2712 wrote to memory of 4560 2712 cmd.exe 189 PID 4560 wrote to memory of 4596 4560 CHVAS.exe 190 PID 4596 wrote to memory of 4960 4596 cmd.exe 194 PID 4960 wrote to memory of 3700 4960 MEBVA.exe 195 PID 3700 wrote to memory of 4344 3700 cmd.exe 199 PID 4344 wrote to memory of 1580 4344 QUQVMAY.exe 200 PID 1580 wrote to memory of 716 1580 cmd.exe 204 PID 716 wrote to memory of 5696 716 AVK.exe 205 PID 5696 wrote to memory of 3012 5696 cmd.exe 209 PID 3012 wrote to memory of 4784 3012 ELYICP.exe 210 PID 4784 wrote to memory of 2932 4784 cmd.exe 214 PID 2932 wrote to memory of 4820 2932 GYD.exe 215 PID 4820 wrote to memory of 5916 4820 cmd.exe 219 PID 5916 wrote to memory of 6108 5916 BLAB.exe 220 PID 6108 wrote to memory of 5264 6108 cmd.exe 224 PID 5264 wrote to memory of 5156 5264 HMIOFJB.exe 225 PID 5156 wrote to memory of 5028 5156 cmd.exe 229 PID 5028 wrote to memory of 3044 5028 SEL.exe 230 PID 3044 wrote to memory of 2748 3044 cmd.exe 234 PID 2748 wrote to memory of 4160 2748 MSPRY.exe 235 PID 4160 wrote to memory of 4432 4160 cmd.exe 239 PID 4432 wrote to memory of 3820 4432 SSXEHTG.exe 240 PID 3820 wrote to memory of 420 3820 cmd.exe 244 PID 420 wrote to memory of 1104 420 SFX.exe 245 PID 1104 wrote to memory of 5132 1104 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_6c82bae7a14424ef0d89341214956e33_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_6c82bae7a14424ef0d89341214956e33_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSFCW.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\windows\SysWOW64\CSFCW.exeC:\windows\system32\CSFCW.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNPMF.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\windows\SysWOW64\TNPMF.exeC:\windows\system32\TNPMF.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWRSJS.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\windows\system\KWRSJS.exeC:\windows\system\KWRSJS.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGZQXU.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\windows\YGZQXU.exeC:\windows\YGZQXU.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUZRCXB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\windows\EUZRCXB.exeC:\windows\EUZRCXB.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKFR.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\windows\SysWOW64\IKFR.exeC:\windows\system32\IKFR.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFXDZCX.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\windows\XFXDZCX.exeC:\windows\XFXDZCX.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GNZ.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\windows\system\GNZ.exeC:\windows\system\GNZ.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HIDEQYB.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\windows\HIDEQYB.exeC:\windows\HIDEQYB.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYJMU.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\windows\system\LYJMU.exeC:\windows\system\LYJMU.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PGQMGIL.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\SysWOW64\PGQMGIL.exeC:\windows\system32\PGQMGIL.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPS.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\windows\SysWOW64\GPS.exeC:\windows\system32\GPS.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMX.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:904 -
C:\windows\IMX.exeC:\windows\IMX.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNZR.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\SysWOW64\ZNZR.exeC:\windows\system32\ZNZR.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDGZPE.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\system\DDGZPE.exeC:\windows\system\DDGZPE.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDIES.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\windows\NDIES.exeC:\windows\NDIES.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDQSBEY.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\windows\SysWOW64\SDQSBEY.exeC:\windows\system32\SDQSBEY.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMS.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\windows\KMS.exeC:\windows\KMS.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CHVAS.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\windows\CHVAS.exeC:\windows\CHVAS.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MEBVA.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\SysWOW64\MEBVA.exeC:\windows\system32\MEBVA.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUQVMAY.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\windows\QUQVMAY.exeC:\windows\QUQVMAY.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AVK.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\windows\AVK.exeC:\windows\AVK.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELYICP.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\windows\ELYICP.exeC:\windows\ELYICP.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYD.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\windows\GYD.exeC:\windows\GYD.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLAB.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\windows\SysWOW64\BLAB.exeC:\windows\system32\BLAB.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMIOFJB.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\windows\system\HMIOFJB.exeC:\windows\system\HMIOFJB.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEL.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\windows\system\SEL.exeC:\windows\system\SEL.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MSPRY.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\windows\system\MSPRY.exeC:\windows\system\MSPRY.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSXEHTG.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\SSXEHTG.exeC:\windows\SSXEHTG.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFX.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\windows\system\SFX.exeC:\windows\system\SFX.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTCC.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\windows\NTCC.exeC:\windows\NTCC.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COLGDSY.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2744 -
C:\windows\system\COLGDSY.exeC:\windows\system\COLGDSY.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NGG.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5504 -
C:\windows\system\NGG.exeC:\windows\system\NGG.exe69⤵
- Executes dropped EXE
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RWVHYS.exe.bat" "70⤵PID:1408
-
C:\windows\RWVHYS.exeC:\windows\RWVHYS.exe71⤵
- Executes dropped EXE
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXPMBXM.exe.bat" "72⤵PID:3788
-
C:\windows\JXPMBXM.exeC:\windows\JXPMBXM.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BABIHN.exe.bat" "74⤵
- Executes a command shell one-liner
PID:760 -
C:\windows\BABIHN.exeC:\windows\BABIHN.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QVKUSAO.exe.bat" "76⤵
- Executes a command shell one-liner
PID:700 -
C:\windows\system\QVKUSAO.exeC:\windows\system\QVKUSAO.exe77⤵
- Executes dropped EXE
PID:596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AVMZD.exe.bat" "78⤵PID:5288
-
C:\windows\SysWOW64\AVMZD.exeC:\windows\system32\AVMZD.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GVU.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4980 -
C:\windows\system\GVU.exeC:\windows\system\GVU.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYYJ.exe.bat" "82⤵PID:2516
-
C:\windows\GYYJ.exeC:\windows\GYYJ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMDSCP.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2668 -
C:\windows\BMDSCP.exeC:\windows\BMDSCP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HHCBHSF.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3292 -
C:\windows\SysWOW64\HHCBHSF.exeC:\windows\system32\HHCBHSF.exe87⤵
- Executes dropped EXE
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CUZL.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:360 -
C:\windows\system\CUZL.exeC:\windows\system\CUZL.exe89⤵
- Executes dropped EXE
PID:4632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RXQPCFC.exe.bat" "90⤵PID:2604
-
C:\windows\system\RXQPCFC.exeC:\windows\system\RXQPCFC.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JSUTID.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4856 -
C:\windows\JSUTID.exeC:\windows\JSUTID.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIVK.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:5456 -
C:\windows\system\ZIVK.exeC:\windows\system\ZIVK.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEEWZ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:3460 -
C:\windows\OEEWZ.exeC:\windows\OEEWZ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SULW.exe.bat" "98⤵PID:2036
-
C:\windows\SysWOW64\SULW.exeC:\windows\system32\SULW.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VCU.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5616 -
C:\windows\VCU.exeC:\windows\VCU.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNWBBEH.exe.bat" "102⤵PID:828
-
C:\windows\TNWBBEH.exeC:\windows\TNWBBEH.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VKKVJMQ.exe.bat" "104⤵PID:2472
-
C:\windows\system\VKKVJMQ.exeC:\windows\system\VKKVJMQ.exe105⤵
- Executes dropped EXE
PID:2924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZARD.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5060 -
C:\windows\ZARD.exeC:\windows\ZARD.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQS.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\windows\system\PQS.exeC:\windows\system\PQS.exe109⤵
- Executes dropped EXE
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOXPJ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5960 -
C:\windows\ZOXPJ.exeC:\windows\ZOXPJ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VUQEZV.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4524 -
C:\windows\SysWOW64\VUQEZV.exeC:\windows\system32\VUQEZV.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFSUI.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:5648 -
C:\windows\SysWOW64\UFSUI.exeC:\windows\system32\UFSUI.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VIWQNZC.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5552 -
C:\windows\system\VIWQNZC.exeC:\windows\system\VIWQNZC.exe117⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFKKDI.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2828 -
C:\windows\XFKKDI.exeC:\windows\XFKKDI.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XAO.exe.bat" "120⤵PID:1292
-
C:\windows\XAO.exeC:\windows\XAO.exe121⤵
- Executes dropped EXE
PID:2480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-