Analysis
- max time kernel
95s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 17:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_75f6325547dd8da2ce0ac7778cd55422_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-07_75f6325547dd8da2ce0ac7778cd55422_elex_emotet_stop.exe
- Size 208KB
- Sample260807-vx5pxss1ex
- SHA256 af93e571047d4dec556d480873d2bc2e6beadaa4dfdcf9d50b280ec444232694
- MD5 75f6325547dd8da2ce0ac7778cd55422
- SHA1 c6ad5068ba6c508d34facadc57f630b85eaa0bf6
- SHA512 ed4ab53d0a61837194b4b0f8441a231068ff969ad2e8f604472dd9f95bae523fec56613299d3ab9aa9933607057b674219838a740cb63663918d69209402000a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfN4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOlQEj1
- TLSH T1AB247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3856 WFKV.exe 1776 ZOGKGRM.exe 2120 VTY.exe 1292 WWCVB.exe 768 FWEAFH.exe 3652 THMZTK.exe 5692 VUR.exe 4544 FDTN.exe 5140 ODVAKN.exe 4112 FQF.exe 4264 UGGKH.exe 3352 NJKN.exe 2460 IMTEAGG.exe 4668 KKGYIO.exe 5344 AAH.exe 2828 XBJA.exe 4308 ROOKC.exe 5908 WTGZ.exe 5716 FCIEWGY.exe 432 ENLU.exe 4836 YAQDPM.exe 5084 CQWLB.exe 3868 DLAHHUG.exe 3960 SGRLA.exe 5776 BOLYDMR.exe 1896 HOTM.exe 3404 ASXISW.exe 2688 CFCRCWJ.exe 3068 OXFK.exe 5336 XYHPO.exe 1400 UDNMVTC.exe 3016 MGQQIJ.exe 5236 IRZH.exe 5128 RRBMA.exe 4552 XSIZJTC.exe 976 RFNR.exe 5536 RLNXV.exe 6108 HOXKGTV.exe 4764 SGSC.exe 1376 MTXMY.exe 828 YMAFYHO.exe 2848 SZE.exe 3348 YAMC.exe 4812 KQT.exe 1104 FDYLO.exe 3936 HBDGWCQ.exe 572 PGD.exe 5268 JUIDH.exe 4088 CXMH.exe 6120 IXUV.exe 4856 CKYEOH.exe 4292 XYD.exe 1440 IQGG.exe 1100 FWEEGY.exe 240 QOHOOFU.exe 3920 FJQBZ.exe 1868 FXRPI.exe 2972 WCBHQB.exe 2020 CXAI.exe 2044 QIJHJPW.exe 4956 ZJL.exe 3272 FJSZE.exe 3668 WRUEHMC.exe 1156 URCS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\LRRT.exe QEMKUWM.exe File created C:\windows\SysWOW64\YAQDPM.exe ENLU.exe File created C:\windows\SysWOW64\SZE.exe YMAFYHO.exe File opened for modification C:\windows\SysWOW64\LRRT.exe QEMKUWM.exe File opened for modification C:\windows\SysWOW64\CZTYH.exe LRRT.exe File created C:\windows\SysWOW64\IXUV.exe CXMH.exe File created C:\windows\SysWOW64\FJSZE.exe.bat ZJL.exe File created C:\windows\SysWOW64\VEWGHZ.exe TGQMSRU.exe File created C:\windows\SysWOW64\HUDX.exe DMWPRA.exe File created C:\windows\SysWOW64\LRRT.exe.bat QEMKUWM.exe File created C:\windows\SysWOW64\GVANV.exe.bat XNYHSTR.exe File created C:\windows\SysWOW64\WFKV.exe 2026-08-07_75f6325547dd8da2ce0ac7778cd55422_elex_emotet_stop.exe File created C:\windows\SysWOW64\IMTEAGG.exe NJKN.exe File created C:\windows\SysWOW64\OXFK.exe.bat CFCRCWJ.exe File opened for modification C:\windows\SysWOW64\HBDGWCQ.exe FDYLO.exe File created C:\windows\SysWOW64\FWEEGY.exe IQGG.exe File created C:\windows\SysWOW64\URGXOH.exe.bat EBFYIMO.exe File created C:\windows\SysWOW64\DINKVS.exe.bat ZFP.exe File created C:\windows\SysWOW64\GNHLIN.exe LSDU.exe File created C:\windows\SysWOW64\XYD.exe CKYEOH.exe File created C:\windows\SysWOW64\CQWLB.exe YAQDPM.exe File opened for modification C:\windows\SysWOW64\WRODE.exe VOK.exe File opened for modification C:\windows\SysWOW64\VEWGHZ.exe TGQMSRU.exe File opened for modification C:\windows\SysWOW64\GVANV.exe XNYHSTR.exe File created C:\windows\SysWOW64\AAH.exe KKGYIO.exe File opened for modification C:\windows\SysWOW64\YAQDPM.exe ENLU.exe File created C:\windows\SysWOW64\CQWLB.exe.bat YAQDPM.exe File opened for modification C:\windows\SysWOW64\RRBMA.exe IRZH.exe File created C:\windows\SysWOW64\RRBMA.exe.bat IRZH.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe FXRPI.exe File created C:\windows\SysWOW64\MUY.exe CWTEZ.exe File opened for modification C:\windows\SysWOW64\DINKVS.exe ZFP.exe File opened for modification C:\windows\SysWOW64\OGGPMOD.exe UTCGC.exe File created C:\windows\SysWOW64\THMZTK.exe FWEAFH.exe File created C:\windows\SysWOW64\AAH.exe.bat KKGYIO.exe File created C:\windows\SysWOW64\RRBMA.exe IRZH.exe File opened for modification C:\windows\SysWOW64\SZE.exe YMAFYHO.exe File opened for modification C:\windows\SysWOW64\FWEEGY.exe IQGG.exe File created C:\windows\SysWOW64\WCBHQB.exe.bat FXRPI.exe File created C:\windows\SysWOW64\FJSZE.exe ZJL.exe File created C:\windows\SysWOW64\WRODE.exe.bat VOK.exe File created C:\windows\SysWOW64\VEWGHZ.exe.bat TGQMSRU.exe File created C:\windows\SysWOW64\EBFYIMO.exe.bat CDZEA.exe File created C:\windows\SysWOW64\DINKVS.exe ZFP.exe File created C:\windows\SysWOW64\WWCVB.exe.bat VTY.exe File opened for modification C:\windows\SysWOW64\CQWLB.exe YAQDPM.exe File created C:\windows\SysWOW64\DLAHHUG.exe.bat CQWLB.exe File created C:\windows\SysWOW64\CFCRCWJ.exe.bat ASXISW.exe File opened for modification C:\windows\SysWOW64\OXFK.exe CFCRCWJ.exe File opened for modification C:\windows\SysWOW64\MUY.exe CWTEZ.exe File opened for modification C:\windows\SysWOW64\GNHLIN.exe LSDU.exe File opened for modification C:\windows\SysWOW64\WTGZ.exe ROOKC.exe File opened for modification C:\windows\SysWOW64\XYD.exe CKYEOH.exe File created C:\windows\SysWOW64\XYD.exe.bat CKYEOH.exe File created C:\windows\SysWOW64\FWEEGY.exe.bat IQGG.exe File created C:\windows\SysWOW64\CZTYH.exe.bat LRRT.exe File opened for modification C:\windows\SysWOW64\CFCRCWJ.exe ASXISW.exe File opened for modification C:\windows\SysWOW64\FJSZE.exe ZJL.exe File created C:\windows\SysWOW64\MUY.exe.bat CWTEZ.exe File created C:\windows\SysWOW64\GVANV.exe XNYHSTR.exe File created C:\windows\SysWOW64\IXUV.exe.bat CXMH.exe File created C:\windows\SysWOW64\WWCVB.exe VTY.exe File opened for modification C:\windows\SysWOW64\WWCVB.exe VTY.exe File opened for modification C:\windows\SysWOW64\AAH.exe KKGYIO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\CDZEA.exe BAWINO.exe File created C:\windows\QEMKUWM.exe OGGPMOD.exe File created C:\windows\system\YRTPBJM.exe JOJLQX.exe File opened for modification C:\windows\FWEAFH.exe WWCVB.exe File opened for modification C:\windows\system\UDNMVTC.exe XYHPO.exe File opened for modification C:\windows\system\VOK.exe MNIU.exe File opened for modification C:\windows\ACINFF.exe ZZESA.exe File created C:\windows\MTNHEF.exe.bat EOVSV.exe File created C:\windows\system\TNBJ.exe.bat VRCIVJ.exe File created C:\windows\system\CXAI.exe WCBHQB.exe File created C:\windows\JFHNOBO.exe.bat KUF.exe File created C:\windows\system\YMAFYHO.exe MTXMY.exe File created C:\windows\system\PGD.exe HBDGWCQ.exe File opened for modification C:\windows\IQGG.exe XYD.exe File created C:\windows\FYG.exe VAB.exe File created C:\windows\system\PBYXL.exe.bat LTS.exe File opened for modification C:\windows\system\NGS.exe DINKVS.exe File created C:\windows\VRCIVJ.exe EESQG.exe File opened for modification C:\windows\FQF.exe ODVAKN.exe File created C:\windows\FQF.exe.bat ODVAKN.exe File created C:\windows\system\XSIZJTC.exe.bat RRBMA.exe File created C:\windows\system\CXAI.exe.bat WCBHQB.exe File created C:\windows\system\UTCGC.exe.bat TQYC.exe File opened for modification C:\windows\system\HOTM.exe BOLYDMR.exe File created C:\windows\system\ZJL.exe.bat QIJHJPW.exe File opened for modification C:\windows\system\YRTPBJM.exe JOJLQX.exe File created C:\windows\EESQG.exe.bat YRTPBJM.exe File opened for modification C:\windows\HOXKGTV.exe RLNXV.exe File created C:\windows\CKYEOH.exe IXUV.exe File created C:\windows\system\KYA.exe.bat IAUPUU.exe File created C:\windows\system\LAKC.exe GVANV.exe File created C:\windows\VTY.exe.bat ZOGKGRM.exe File opened for modification C:\windows\system\UGGKH.exe FQF.exe File created C:\windows\system\SGSC.exe.bat HOXKGTV.exe File created C:\windows\system\UGGKH.exe.bat FQF.exe File created C:\windows\ENLU.exe FCIEWGY.exe File created C:\windows\IQGG.exe XYD.exe File created C:\windows\TMNZE.exe.bat PEY.exe File created C:\windows\system\DMWPRA.exe TPQUJRT.exe File created C:\windows\system\XNYHSTR.exe CZTYH.exe File created C:\windows\VRCIVJ.exe.bat EESQG.exe File created C:\windows\system\KKGYIO.exe.bat IMTEAGG.exe File opened for modification C:\windows\system\YAMC.exe SZE.exe File created C:\windows\FJQBZ.exe QOHOOFU.exe File created C:\windows\system\LRY.exe LMGIPWP.exe File created C:\windows\system\EOVSV.exe HIDD.exe File created C:\windows\system\FCIEWGY.exe.bat WTGZ.exe File created C:\windows\system\QBU.exe MTNHEF.exe File created C:\windows\LSDU.exe.bat URJPUQ.exe File created C:\windows\system\KQT.exe.bat YAMC.exe File opened for modification C:\windows\CKYEOH.exe IXUV.exe File opened for modification C:\windows\system\LAKC.exe GVANV.exe File opened for modification C:\windows\system\SGRLA.exe DLAHHUG.exe File created C:\windows\system\RLNXV.exe RFNR.exe File opened for modification C:\windows\system\SGSC.exe HOXKGTV.exe File created C:\windows\NPL.exe.bat LRY.exe File created C:\windows\system\CWTEZ.exe.bat URGXOH.exe File created C:\windows\system\PEY.exe.bat NGS.exe File opened for modification C:\windows\system\ZOGKGRM.exe WFKV.exe File created C:\windows\system\JUIDH.exe PGD.exe File opened for modification C:\windows\ZFP.exe MUY.exe File created C:\windows\ODVAKN.exe FDTN.exe File created C:\windows\system\SGSC.exe HOXKGTV.exe File opened for modification C:\windows\system\CXAI.exe WCBHQB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5020 cmd.exe 1624 cmd.exe 5420 cmd.exe 4320 cmd.exe 3724 cmd.exe 5500 cmd.exe 2816 cmd.exe 5768 cmd.exe 5852 cmd.exe 1256 cmd.exe 3448 cmd.exe 2900 cmd.exe 2824 cmd.exe 4976 cmd.exe 4212 cmd.exe 3900 cmd.exe 5248 cmd.exe 5964 cmd.exe 4748 cmd.exe 4248 cmd.exe 3308 cmd.exe 5164 cmd.exe 5684 cmd.exe 1556 cmd.exe 1780 cmd.exe 5788 cmd.exe 1600 cmd.exe 2472 cmd.exe 4124 cmd.exe 5492 cmd.exe 1760 cmd.exe 5740 cmd.exe 5240 cmd.exe 2404 cmd.exe 4460 cmd.exe 2264 cmd.exe 2364 cmd.exe 248 cmd.exe 940 cmd.exe 2576 cmd.exe 3380 cmd.exe 2016 cmd.exe 3004 cmd.exe 4888 cmd.exe 3940 cmd.exe 5856 cmd.exe 2552 cmd.exe 2032 cmd.exe 4480 cmd.exe 5132 cmd.exe 4092 cmd.exe 1768 cmd.exe 5080 cmd.exe 3340 cmd.exe 5484 cmd.exe 4188 cmd.exe 528 cmd.exe 1568 cmd.exe 4872 cmd.exe 3152 cmd.exe 2536 cmd.exe 5224 cmd.exe 2516 cmd.exe 4072 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5088 1812 WerFault.exe 87 1556 3856 WerFault.exe 93 2236 1776 WerFault.exe 99 3404 2120 WerFault.exe 104 2756 1292 WerFault.exe 109 5396 768 WerFault.exe 114 5624 3652 WerFault.exe 119 2980 5692 WerFault.exe 124 3300 4544 WerFault.exe 129 4160 5140 WerFault.exe 134 2124 4112 WerFault.exe 139 1808 4264 WerFault.exe 144 2612 3352 WerFault.exe 149 4644 2460 WerFault.exe 154 2984 4668 WerFault.exe 159 3036 5344 WerFault.exe 164 1228 2828 WerFault.exe 169 5156 4308 WerFault.exe 174 5052 5908 WerFault.exe 179 4792 5716 WerFault.exe 184 4888 432 WerFault.exe 189 3976 4836 WerFault.exe 194 2856 5084 WerFault.exe 199 3184 3868 WerFault.exe 204 268 3960 WerFault.exe 209 976 5776 WerFault.exe 214 3936 1896 WerFault.exe 219 1276 3404 WerFault.exe 224 2576 2688 WerFault.exe 229 4892 3068 WerFault.exe 234 5424 5336 WerFault.exe 239 6116 1400 WerFault.exe 244 2088 3016 WerFault.exe 249 2572 5236 WerFault.exe 254 4644 5128 WerFault.exe 259 936 4552 WerFault.exe 264 2580 976 WerFault.exe 269 6072 5536 WerFault.exe 274 4604 6108 WerFault.exe 280 2012 4764 WerFault.exe 285 2044 1376 WerFault.exe 290 3752 828 WerFault.exe 295 3132 2848 WerFault.exe 300 5944 3348 WerFault.exe 305 2476 4812 WerFault.exe 310 2872 1104 WerFault.exe 315 5676 3936 WerFault.exe 320 4896 572 WerFault.exe 325 4592 5268 WerFault.exe 330 1924 4088 WerFault.exe 335 5880 6120 WerFault.exe 340 2860 4856 WerFault.exe 345 4616 4292 WerFault.exe 350 2844 1440 WerFault.exe 355 4976 1100 WerFault.exe 360 5316 240 WerFault.exe 365 5832 3920 WerFault.exe 370 2216 1868 WerFault.exe 375 5540 2972 WerFault.exe 380 4328 2020 WerFault.exe 385 4160 2044 WerFault.exe 390 4720 4956 WerFault.exe 395 2612 3272 WerFault.exe 400 3520 3668 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EESQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRCIVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRODE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAWINO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNHLIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGGPMOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDNMVTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKGYIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTCGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZESA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMWPRA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOXKGTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRUEHMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFCRCWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFHNOBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CWTEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASXISW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMGIPWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWEAFH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1812 2026-08-07_75f6325547dd8da2ce0ac7778cd55422_elex_emotet_stop.exe 1812 2026-08-07_75f6325547dd8da2ce0ac7778cd55422_elex_emotet_stop.exe 3856 WFKV.exe 3856 WFKV.exe 1776 ZOGKGRM.exe 1776 ZOGKGRM.exe 2120 VTY.exe 2120 VTY.exe 1292 WWCVB.exe 1292 WWCVB.exe 768 FWEAFH.exe 768 FWEAFH.exe 3652 THMZTK.exe 3652 THMZTK.exe 5692 VUR.exe 5692 VUR.exe 4544 FDTN.exe 4544 FDTN.exe 5140 ODVAKN.exe 5140 ODVAKN.exe 4112 FQF.exe 4112 FQF.exe 4264 UGGKH.exe 4264 UGGKH.exe 3352 NJKN.exe 3352 NJKN.exe 2460 IMTEAGG.exe 2460 IMTEAGG.exe 4668 KKGYIO.exe 4668 KKGYIO.exe 5344 AAH.exe 5344 AAH.exe 2828 XBJA.exe 2828 XBJA.exe 4308 ROOKC.exe 4308 ROOKC.exe 5908 WTGZ.exe 5908 WTGZ.exe 5716 FCIEWGY.exe 5716 FCIEWGY.exe 432 ENLU.exe 432 ENLU.exe 4836 YAQDPM.exe 4836 YAQDPM.exe 5084 CQWLB.exe 5084 CQWLB.exe 3868 DLAHHUG.exe 3868 DLAHHUG.exe 3960 SGRLA.exe 3960 SGRLA.exe 5776 BOLYDMR.exe 5776 BOLYDMR.exe 1896 HOTM.exe 1896 HOTM.exe 3404 ASXISW.exe 3404 ASXISW.exe 2688 CFCRCWJ.exe 2688 CFCRCWJ.exe 3068 OXFK.exe 3068 OXFK.exe 5336 XYHPO.exe 5336 XYHPO.exe 1400 UDNMVTC.exe 1400 UDNMVTC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1812 2026-08-07_75f6325547dd8da2ce0ac7778cd55422_elex_emotet_stop.exe 1812 2026-08-07_75f6325547dd8da2ce0ac7778cd55422_elex_emotet_stop.exe 3856 WFKV.exe 3856 WFKV.exe 1776 ZOGKGRM.exe 1776 ZOGKGRM.exe 2120 VTY.exe 2120 VTY.exe 1292 WWCVB.exe 1292 WWCVB.exe 768 FWEAFH.exe 768 FWEAFH.exe 3652 THMZTK.exe 3652 THMZTK.exe 5692 VUR.exe 5692 VUR.exe 4544 FDTN.exe 4544 FDTN.exe 5140 ODVAKN.exe 5140 ODVAKN.exe 4112 FQF.exe 4112 FQF.exe 4264 UGGKH.exe 4264 UGGKH.exe 3352 NJKN.exe 3352 NJKN.exe 2460 IMTEAGG.exe 2460 IMTEAGG.exe 4668 KKGYIO.exe 4668 KKGYIO.exe 5344 AAH.exe 5344 AAH.exe 2828 XBJA.exe 2828 XBJA.exe 4308 ROOKC.exe 4308 ROOKC.exe 5908 WTGZ.exe 5908 WTGZ.exe 5716 FCIEWGY.exe 5716 FCIEWGY.exe 432 ENLU.exe 432 ENLU.exe 4836 YAQDPM.exe 4836 YAQDPM.exe 5084 CQWLB.exe 5084 CQWLB.exe 3868 DLAHHUG.exe 3868 DLAHHUG.exe 3960 SGRLA.exe 3960 SGRLA.exe 5776 BOLYDMR.exe 5776 BOLYDMR.exe 1896 HOTM.exe 1896 HOTM.exe 3404 ASXISW.exe 3404 ASXISW.exe 2688 CFCRCWJ.exe 2688 CFCRCWJ.exe 3068 OXFK.exe 3068 OXFK.exe 5336 XYHPO.exe 5336 XYHPO.exe 1400 UDNMVTC.exe 1400 UDNMVTC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 5980 1812 2026-08-07_75f6325547dd8da2ce0ac7778cd55422_elex_emotet_stop.exe 89 PID 5980 wrote to memory of 3856 5980 cmd.exe 93 PID 3856 wrote to memory of 1468 3856 WFKV.exe 95 PID 1468 wrote to memory of 1776 1468 cmd.exe 99 PID 1776 wrote to memory of 1140 1776 ZOGKGRM.exe 100 PID 1140 wrote to memory of 2120 1140 cmd.exe 104 PID 2120 wrote to memory of 704 2120 VTY.exe 105 PID 704 wrote to memory of 1292 704 cmd.exe 109 PID 1292 wrote to memory of 2404 1292 WWCVB.exe 110 PID 2404 wrote to memory of 768 2404 cmd.exe 114 PID 768 wrote to memory of 5684 768 FWEAFH.exe 115 PID 5684 wrote to memory of 3652 5684 cmd.exe 119 PID 3652 wrote to memory of 4188 3652 THMZTK.exe 120 PID 4188 wrote to memory of 5692 4188 cmd.exe 124 PID 5692 wrote to memory of 4092 5692 VUR.exe 125 PID 4092 wrote to memory of 4544 4092 cmd.exe 129 PID 4544 wrote to memory of 5340 4544 FDTN.exe 130 PID 5340 wrote to memory of 5140 5340 cmd.exe 134 PID 5140 wrote to memory of 2816 5140 ODVAKN.exe 135 PID 2816 wrote to memory of 4112 2816 cmd.exe 139 PID 4112 wrote to memory of 3580 4112 FQF.exe 140 PID 3580 wrote to memory of 4264 3580 cmd.exe 144 PID 4264 wrote to memory of 3064 4264 UGGKH.exe 145 PID 3064 wrote to memory of 3352 3064 cmd.exe 149 PID 3352 wrote to memory of 5224 3352 NJKN.exe 150 PID 5224 wrote to memory of 2460 5224 cmd.exe 154 PID 2460 wrote to memory of 1556 2460 IMTEAGG.exe 155 PID 1556 wrote to memory of 4668 1556 cmd.exe 159 PID 4668 wrote to memory of 940 4668 KKGYIO.exe 160 PID 940 wrote to memory of 5344 940 cmd.exe 164 PID 5344 wrote to memory of 1108 5344 AAH.exe 165 PID 1108 wrote to memory of 2828 1108 cmd.exe 169 PID 2828 wrote to memory of 1144 2828 XBJA.exe 170 PID 1144 wrote to memory of 4308 1144 cmd.exe 174 PID 4308 wrote to memory of 2412 4308 ROOKC.exe 175 PID 2412 wrote to memory of 5908 2412 cmd.exe 179 PID 5908 wrote to memory of 1768 5908 WTGZ.exe 180 PID 1768 wrote to memory of 5716 1768 cmd.exe 184 PID 5716 wrote to memory of 6040 5716 FCIEWGY.exe 185 PID 6040 wrote to memory of 432 6040 cmd.exe 189 PID 432 wrote to memory of 5020 432 ENLU.exe 190 PID 5020 wrote to memory of 4836 5020 cmd.exe 194 PID 4836 wrote to memory of 4460 4836 YAQDPM.exe 195 PID 4460 wrote to memory of 5084 4460 cmd.exe 199 PID 5084 wrote to memory of 3900 5084 CQWLB.exe 200 PID 3900 wrote to memory of 3868 3900 cmd.exe 204 PID 3868 wrote to memory of 1784 3868 DLAHHUG.exe 205 PID 1784 wrote to memory of 3960 1784 cmd.exe 209 PID 3960 wrote to memory of 2264 3960 SGRLA.exe 210 PID 2264 wrote to memory of 5776 2264 cmd.exe 214 PID 5776 wrote to memory of 4212 5776 BOLYDMR.exe 215 PID 4212 wrote to memory of 1896 4212 cmd.exe 219 PID 1896 wrote to memory of 5484 1896 HOTM.exe 220 PID 5484 wrote to memory of 3404 5484 cmd.exe 224 PID 3404 wrote to memory of 1624 3404 ASXISW.exe 225 PID 1624 wrote to memory of 2688 1624 cmd.exe 229 PID 2688 wrote to memory of 5068 2688 CFCRCWJ.exe 230 PID 5068 wrote to memory of 3068 5068 cmd.exe 234 PID 3068 wrote to memory of 5768 3068 OXFK.exe 235 PID 5768 wrote to memory of 5336 5768 cmd.exe 239 PID 5336 wrote to memory of 5852 5336 XYHPO.exe 240 PID 5852 wrote to memory of 1400 5852 cmd.exe 244 PID 1400 wrote to memory of 476 1400 UDNMVTC.exe 245 PID 476 wrote to memory of 3016 476 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_75f6325547dd8da2ce0ac7778cd55422_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_75f6325547dd8da2ce0ac7778cd55422_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFKV.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\windows\SysWOW64\WFKV.exeC:\windows\system32\WFKV.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOGKGRM.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\windows\system\ZOGKGRM.exeC:\windows\system\ZOGKGRM.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\windows\VTY.exeC:\windows\VTY.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWCVB.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:704 -
C:\windows\SysWOW64\WWCVB.exeC:\windows\system32\WWCVB.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWEAFH.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\FWEAFH.exeC:\windows\FWEAFH.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THMZTK.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\windows\SysWOW64\THMZTK.exeC:\windows\system32\THMZTK.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUR.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\system\VUR.exeC:\windows\system\VUR.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDTN.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\system\FDTN.exeC:\windows\system\FDTN.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQF.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\FQF.exeC:\windows\FQF.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGGKH.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\windows\system\UGGKH.exeC:\windows\system\UGGKH.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJKN.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\NJKN.exeC:\windows\NJKN.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMTEAGG.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\windows\SysWOW64\IMTEAGG.exeC:\windows\system32\IMTEAGG.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKGYIO.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\windows\system\KKGYIO.exeC:\windows\system\KKGYIO.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAH.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\SysWOW64\AAH.exeC:\windows\system32\AAH.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBJA.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\windows\XBJA.exeC:\windows\XBJA.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROOKC.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\windows\ROOKC.exeC:\windows\ROOKC.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WTGZ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\SysWOW64\WTGZ.exeC:\windows\system32\WTGZ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCIEWGY.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\windows\system\FCIEWGY.exeC:\windows\system\FCIEWGY.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENLU.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\ENLU.exeC:\windows\ENLU.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAQDPM.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\SysWOW64\YAQDPM.exeC:\windows\system32\YAQDPM.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQWLB.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\windows\SysWOW64\CQWLB.exeC:\windows\system32\CQWLB.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLAHHUG.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\windows\SysWOW64\DLAHHUG.exeC:\windows\system32\DLAHHUG.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGRLA.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\windows\system\SGRLA.exeC:\windows\system\SGRLA.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOLYDMR.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\system\BOLYDMR.exeC:\windows\system\BOLYDMR.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOTM.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\system\HOTM.exeC:\windows\system\HOTM.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASXISW.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\ASXISW.exeC:\windows\ASXISW.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CFCRCWJ.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\windows\SysWOW64\CFCRCWJ.exeC:\windows\system32\CFCRCWJ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXFK.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\windows\SysWOW64\OXFK.exeC:\windows\system32\OXFK.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDNMVTC.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\windows\system\UDNMVTC.exeC:\windows\system\UDNMVTC.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MGQQIJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:476 -
C:\windows\SysWOW64\MGQQIJ.exeC:\windows\system32\MGQQIJ.exe65⤵
- Executes dropped EXE
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRZH.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2516 -
C:\windows\system\IRZH.exeC:\windows\system\IRZH.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRBMA.exe.bat" "68⤵PID:4580
-
C:\windows\SysWOW64\RRBMA.exeC:\windows\system32\RRBMA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSIZJTC.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2552 -
C:\windows\system\XSIZJTC.exeC:\windows\system\XSIZJTC.exe71⤵
- Executes dropped EXE
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFNR.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5420 -
C:\windows\RFNR.exeC:\windows\RFNR.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLNXV.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1816 -
C:\windows\system\RLNXV.exeC:\windows\system\RLNXV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOXKGTV.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:6052 -
C:\windows\HOXKGTV.exeC:\windows\HOXKGTV.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGSC.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2576 -
C:\windows\system\SGSC.exeC:\windows\system\SGSC.exe79⤵
- Executes dropped EXE
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTXMY.exe.bat" "80⤵PID:4472
-
C:\windows\MTXMY.exeC:\windows\MTXMY.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YMAFYHO.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1256 -
C:\windows\system\YMAFYHO.exeC:\windows\system\YMAFYHO.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZE.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4124 -
C:\windows\SysWOW64\SZE.exeC:\windows\system32\SZE.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAMC.exe.bat" "86⤵PID:3976
-
C:\windows\system\YAMC.exeC:\windows\system\YAMC.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "88⤵PID:3420
-
C:\windows\system\KQT.exeC:\windows\system\KQT.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDYLO.exe.bat" "90⤵PID:3592
-
C:\windows\system\FDYLO.exeC:\windows\system\FDYLO.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBDGWCQ.exe.bat" "92⤵
- Executes a command shell one-liner
PID:3448 -
C:\windows\SysWOW64\HBDGWCQ.exeC:\windows\system32\HBDGWCQ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGD.exe.bat" "94⤵PID:1484
-
C:\windows\system\PGD.exeC:\windows\system\PGD.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JUIDH.exe.bat" "96⤵PID:6004
-
C:\windows\system\JUIDH.exeC:\windows\system\JUIDH.exe97⤵
- Executes dropped EXE
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXMH.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2168 -
C:\windows\CXMH.exeC:\windows\CXMH.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXUV.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2328 -
C:\windows\SysWOW64\IXUV.exeC:\windows\system32\IXUV.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKYEOH.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5056 -
C:\windows\CKYEOH.exeC:\windows\CKYEOH.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYD.exe.bat" "104⤵PID:5060
-
C:\windows\SysWOW64\XYD.exeC:\windows\system32\XYD.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQGG.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5248 -
C:\windows\IQGG.exeC:\windows\IQGG.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FWEEGY.exe.bat" "108⤵
- Executes a command shell one-liner
PID:3380 -
C:\windows\SysWOW64\FWEEGY.exeC:\windows\system32\FWEEGY.exe109⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QOHOOFU.exe.bat" "110⤵PID:1352
-
C:\windows\system\QOHOOFU.exeC:\windows\system\QOHOOFU.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJQBZ.exe.bat" "112⤵PID:2644
-
C:\windows\FJQBZ.exeC:\windows\FJQBZ.exe113⤵
- Executes dropped EXE
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXRPI.exe.bat" "114⤵PID:4240
-
C:\windows\system\FXRPI.exeC:\windows\system\FXRPI.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCBHQB.exe.bat" "116⤵PID:2176
-
C:\windows\SysWOW64\WCBHQB.exeC:\windows\system32\WCBHQB.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXAI.exe.bat" "118⤵PID:2636
-
C:\windows\system\CXAI.exeC:\windows\system\CXAI.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIJHJPW.exe.bat" "120⤵PID:1504
-
C:\windows\system\QIJHJPW.exeC:\windows\system\QIJHJPW.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-