Analysis
- max time kernel
88s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 20:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe
- Size 208KB
- Sample260913-zchf4sdp21
- SHA256 d4a0ba7f9191435b9fd074f4d52fab0208afab5fb93565d74d062ac288238a8a
- MD5 e054857e1d5cc2a3b2dc646a4669170c
- SHA1 c9f63bce4ebd9e4c6ab2e6999cdc992311c858e9
- SHA512 f33960508bf1c16a93e3aec08a972de9e6e1a9e06126746a044f9536b252a58d674131d7467f1cc863fd592a08e791901f48d2a07d96cbb6ea559496a8eb36d8
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOf04pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOckEj1
- TLSH T1AE247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4184 YBXKZ.exe 4336 YWQVI.exe 6036 PEESV.exe 620 QHIW.exe 5340 UPPWMC.exe 4072 MSS.exe 2876 LDVPBYM.exe 5912 PTKP.exe 3632 KWSO.exe 6000 AMTFIP.exe 3748 ECANM.exe 2956 GAN.exe 5312 VQOZAD.exe 204 WLS.exe 4904 LOCHYO.exe 5368 SEDZ.exe 4324 HZMLQWL.exe 6012 VUYEEKC.exe 4408 FUAJH.exe 1084 ZIFASQT.exe 4604 JFKN.exe 2972 NWRVLIP.exe 4876 GZDQRG.exe 1400 FJFGZ.exe 4484 PHLBHVW.exe 4648 HCPXUK.exe 4540 TVSPV.exe 564 XAKFLV.exe 2352 MQLE.exe 3668 WZNJV.exe 5448 LUX.exe 5344 GHBXQ.exe 3536 GNULAO.exe 756 LNB.exe 5200 GIGQT.exe 4776 MIOECKQ.exe 1308 SWN.exe 4204 QTGAUS.exe 1924 AUA.exe 2584 IHNUIWL.exe 4920 ZIPZLT.exe 4132 SLSCZJO.exe 4276 YLAQI.exe 3764 ELIERGZ.exe 3952 TBJ.exe 3400 VZO.exe 5892 QMTZP.exe 4716 VNBNYEN.exe 796 QAGW.exe 2028 LVKGTD.exe 1496 JGNWB.exe 2856 KJZZHH.exe 5868 MZFUOQ.exe 1292 NCI.exe 3884 QSPPO.exe 1192 GIQP.exe 1464 COIEDPM.exe 1756 XBNN.exe 1664 FGFCP.exe 5548 UBX.exe 4080 PXCQ.exe 2128 HSF.exe 2904 IVJPD.exe 5668 BYNT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\PKOCLXX.exe PPK.exe File opened for modification C:\windows\SysWOW64\PKOCLXX.exe PPK.exe File created C:\windows\SysWOW64\VUYEEKC.exe.bat HZMLQWL.exe File opened for modification C:\windows\SysWOW64\VQOZAD.exe GAN.exe File opened for modification C:\windows\SysWOW64\GNULAO.exe GHBXQ.exe File created C:\windows\SysWOW64\QHIW.exe.bat PEESV.exe File created C:\windows\SysWOW64\HCPXUK.exe.bat PHLBHVW.exe File opened for modification C:\windows\SysWOW64\IHNUIWL.exe AUA.exe File created C:\windows\SysWOW64\KJZZHH.exe JGNWB.exe File opened for modification C:\windows\SysWOW64\MZFUOQ.exe KJZZHH.exe File created C:\windows\SysWOW64\JGDDYG.exe.bat QOOSP.exe File opened for modification C:\windows\SysWOW64\VSIY.exe TUUEX.exe File opened for modification C:\windows\SysWOW64\LOCHYO.exe WLS.exe File created C:\windows\SysWOW64\LOCHYO.exe.bat WLS.exe File opened for modification C:\windows\SysWOW64\TVSPV.exe HCPXUK.exe File created C:\windows\SysWOW64\TVSPV.exe.bat HCPXUK.exe File created C:\windows\SysWOW64\XAKFLV.exe.bat TVSPV.exe File opened for modification C:\windows\SysWOW64\WZNJV.exe MQLE.exe File created C:\windows\SysWOW64\WZNJV.exe.bat MQLE.exe File created C:\windows\SysWOW64\VNBNYEN.exe QMTZP.exe File created C:\windows\SysWOW64\YBXKZ.exe.bat 2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe File created C:\windows\SysWOW64\QHIW.exe PEESV.exe File created C:\windows\SysWOW64\MZFUOQ.exe KJZZHH.exe File created C:\windows\SysWOW64\MZFUOQ.exe.bat KJZZHH.exe File created C:\windows\SysWOW64\FGFCP.exe XBNN.exe File created C:\windows\SysWOW64\IVJPD.exe.bat HSF.exe File created C:\windows\SysWOW64\XMQXAHG.exe NOK.exe File created C:\windows\SysWOW64\UWDSYM.exe.bat URLDW.exe File created C:\windows\SysWOW64\ZIFASQT.exe FUAJH.exe File created C:\windows\SysWOW64\YBXKZ.exe 2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\YBXKZ.exe 2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe File created C:\windows\SysWOW64\KWSO.exe.bat PTKP.exe File created C:\windows\SysWOW64\HZMLQWL.exe.bat SEDZ.exe File created C:\windows\SysWOW64\VUYEEKC.exe HZMLQWL.exe File created C:\windows\SysWOW64\HCPXUK.exe PHLBHVW.exe File created C:\windows\SysWOW64\QOOSP.exe.bat BYNT.exe File created C:\windows\SysWOW64\GNULAO.exe GHBXQ.exe File created C:\windows\SysWOW64\YLAQI.exe SLSCZJO.exe File opened for modification C:\windows\SysWOW64\KJZZHH.exe JGNWB.exe File created C:\windows\SysWOW64\FGFCP.exe.bat XBNN.exe File opened for modification C:\windows\SysWOW64\IVJPD.exe HSF.exe File opened for modification C:\windows\SysWOW64\BTUX.exe ETMK.exe File created C:\windows\SysWOW64\WIS.exe SALX.exe File created C:\windows\SysWOW64\PBOT.exe GTMON.exe File created C:\windows\SysWOW64\IHNUIWL.exe.bat AUA.exe File created C:\windows\SysWOW64\ZIPZLT.exe IHNUIWL.exe File created C:\windows\SysWOW64\ZIPZLT.exe.bat IHNUIWL.exe File opened for modification C:\windows\SysWOW64\YLAQI.exe SLSCZJO.exe File created C:\windows\SysWOW64\UWDSYM.exe URLDW.exe File created C:\windows\SysWOW64\VSIY.exe TUUEX.exe File created C:\windows\SysWOW64\VSIY.exe.bat TUUEX.exe File created C:\windows\SysWOW64\PBOT.exe.bat GTMON.exe File opened for modification C:\windows\SysWOW64\LDVPBYM.exe MSS.exe File opened for modification C:\windows\SysWOW64\VUYEEKC.exe HZMLQWL.exe File opened for modification C:\windows\SysWOW64\GIQP.exe QSPPO.exe File opened for modification C:\windows\SysWOW64\FGFCP.exe XBNN.exe File created C:\windows\SysWOW64\HSF.exe PXCQ.exe File created C:\windows\SysWOW64\XMQXAHG.exe.bat NOK.exe File created C:\windows\SysWOW64\LDVPBYM.exe MSS.exe File created C:\windows\SysWOW64\TVSPV.exe HCPXUK.exe File created C:\windows\SysWOW64\MIOECKQ.exe.bat GIGQT.exe File created C:\windows\SysWOW64\QOOSP.exe BYNT.exe File created C:\windows\SysWOW64\PKOCLXX.exe.bat PPK.exe File created C:\windows\SysWOW64\BTUX.exe ETMK.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\GIGQT.exe.bat LNB.exe File created C:\windows\system\NCI.exe MZFUOQ.exe File created C:\windows\system\BYNT.exe.bat IVJPD.exe File opened for modification C:\windows\system\WXANBN.exe XMQXAHG.exe File created C:\windows\system\RSPFOE.exe.bat NCAF.exe File created C:\windows\system\QSPPO.exe.bat NCI.exe File created C:\windows\WJEJCG.exe.bat COZA.exe File created C:\windows\BZTU.exe.bat TLPNG.exe File created C:\windows\FIWU.exe QNMHOS.exe File opened for modification C:\windows\system\BXUPEBY.exe TJUBDO.exe File opened for modification C:\windows\system\NOK.exe JGDDYG.exe File created C:\windows\SLSCZJO.exe ZIPZLT.exe File created C:\windows\system\QSPPO.exe NCI.exe File opened for modification C:\windows\YVGA.exe WXANBN.exe File opened for modification C:\windows\VZO.exe TBJ.exe File created C:\windows\system\UCFXWH.exe.bat BZTU.exe File created C:\windows\system\SALX.exe.bat MFM.exe File opened for modification C:\windows\system\ECANM.exe AMTFIP.exe File opened for modification C:\windows\GAN.exe ECANM.exe File created C:\windows\GZDQRG.exe.bat NWRVLIP.exe File created C:\windows\system\FJHVBEX.exe JDCGUUD.exe File created C:\windows\system\PHLBHVW.exe FJFGZ.exe File created C:\windows\SWN.exe MIOECKQ.exe File created C:\windows\COIEDPM.exe.bat GIQP.exe File created C:\windows\system\NOK.exe.bat JGDDYG.exe File created C:\windows\system\NHDD.exe.bat PJJAF.exe File created C:\windows\URLDW.exe FWBZLNC.exe File created C:\windows\PJJAF.exe FJHVBEX.exe File created C:\windows\system\QNMHOS.exe VSIY.exe File created C:\windows\system\PXCQ.exe.bat UBX.exe File opened for modification C:\windows\PKI.exe UWDSYM.exe File created C:\windows\system\TUUEX.exe.bat NHDD.exe File opened for modification C:\windows\MSS.exe UPPWMC.exe File created C:\windows\QAGW.exe VNBNYEN.exe File created C:\windows\system\JGNWB.exe.bat LVKGTD.exe File opened for modification C:\windows\system\BYNT.exe IVJPD.exe File opened for modification C:\windows\URLDW.exe FWBZLNC.exe File created C:\windows\system\TNBG.exe.bat PFUGBOS.exe File created C:\windows\system\FUAJH.exe.bat VUYEEKC.exe File created C:\windows\ITM.exe YVGA.exe File created C:\windows\MSS.exe UPPWMC.exe File created C:\windows\GIGQT.exe LNB.exe File opened for modification C:\windows\ELIERGZ.exe YLAQI.exe File created C:\windows\UBX.exe.bat FGFCP.exe File opened for modification C:\windows\PEESV.exe YWQVI.exe File opened for modification C:\windows\system\NCI.exe MZFUOQ.exe File created C:\windows\INSG.exe PKOCLXX.exe File created C:\windows\system\GXSTY.exe PKI.exe File opened for modification C:\windows\HVWB.exe SANWSW.exe File opened for modification C:\windows\AMTFIP.exe KWSO.exe File opened for modification C:\windows\GIGQT.exe LNB.exe File created C:\windows\system\LVKGTD.exe.bat QAGW.exe File created C:\windows\system\XIBKKAH.exe INSG.exe File opened for modification C:\windows\QAGW.exe VNBNYEN.exe File created C:\windows\system\BYNT.exe IVJPD.exe File created C:\windows\HVWB.exe SANWSW.exe File created C:\windows\MQLE.exe.bat XAKFLV.exe File created C:\windows\system\LNB.exe.bat GNULAO.exe File opened for modification C:\windows\system\AUA.exe QTGAUS.exe File created C:\windows\UPPWMC.exe QHIW.exe File opened for modification C:\windows\UBX.exe FGFCP.exe File opened for modification C:\windows\system\PXCQ.exe UBX.exe File created C:\windows\system\TUUEX.exe NHDD.exe File created C:\windows\system\SANWSW.exe.bat ARLJO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4744 cmd.exe 3296 cmd.exe 3020 cmd.exe 2324 cmd.exe 3396 cmd.exe 5180 cmd.exe 2284 cmd.exe 5604 cmd.exe 5744 cmd.exe 3552 cmd.exe 1596 cmd.exe 5776 cmd.exe 4420 cmd.exe 2732 cmd.exe 5980 cmd.exe 3220 cmd.exe 124 cmd.exe 2400 cmd.exe 2132 cmd.exe 4076 cmd.exe 4140 cmd.exe 1916 cmd.exe 932 cmd.exe 1576 cmd.exe 3012 cmd.exe 5864 cmd.exe 4556 cmd.exe 4248 cmd.exe 3568 cmd.exe 4124 cmd.exe 2336 cmd.exe 1328 cmd.exe 5160 cmd.exe 4404 cmd.exe 3364 cmd.exe 1808 cmd.exe 5072 cmd.exe 5900 cmd.exe 4012 cmd.exe 5348 cmd.exe 6040 cmd.exe 5952 cmd.exe 2892 cmd.exe 3896 cmd.exe 4908 cmd.exe 5336 cmd.exe 4328 cmd.exe 1344 cmd.exe 1912 cmd.exe 4116 cmd.exe 3528 cmd.exe 3544 cmd.exe 3416 cmd.exe 3540 cmd.exe 4372 cmd.exe 1864 cmd.exe 3096 cmd.exe 4508 cmd.exe 5364 cmd.exe 1412 cmd.exe 4568 cmd.exe 1268 cmd.exe 4272 cmd.exe 2596 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5128 5512 WerFault.exe 85 4720 4184 WerFault.exe 90 5564 4336 WerFault.exe 96 5432 6036 WerFault.exe 101 4964 620 WerFault.exe 106 4948 5340 WerFault.exe 111 3044 4072 WerFault.exe 116 3528 2876 WerFault.exe 121 2608 5912 WerFault.exe 126 792 3632 WerFault.exe 131 772 6000 WerFault.exe 136 4580 3748 WerFault.exe 141 4668 2956 WerFault.exe 146 2428 5312 WerFault.exe 151 5628 204 WerFault.exe 156 5004 4904 WerFault.exe 161 2896 5368 WerFault.exe 166 2640 4324 WerFault.exe 171 5256 6012 WerFault.exe 176 2336 4408 WerFault.exe 181 4120 1084 WerFault.exe 186 2892 4604 WerFault.exe 191 1392 2972 WerFault.exe 196 5056 4876 WerFault.exe 201 932 1400 WerFault.exe 206 3396 4484 WerFault.exe 211 464 4648 WerFault.exe 216 5084 4540 WerFault.exe 221 1260 564 WerFault.exe 226 2684 2352 WerFault.exe 231 5868 3668 WerFault.exe 236 3804 5448 WerFault.exe 241 4784 5344 WerFault.exe 246 4628 3536 WerFault.exe 251 3388 756 WerFault.exe 256 932 5200 WerFault.exe 261 3396 4776 WerFault.exe 266 4772 1308 WerFault.exe 272 1368 4204 WerFault.exe 277 3296 1924 WerFault.exe 282 3528 2584 WerFault.exe 287 3304 4920 WerFault.exe 292 4100 4132 WerFault.exe 297 6108 4276 WerFault.exe 302 1188 3764 WerFault.exe 307 4844 3952 WerFault.exe 312 4060 3400 WerFault.exe 317 3716 5892 WerFault.exe 322 4664 4716 WerFault.exe 327 5084 796 WerFault.exe 332 1260 2028 WerFault.exe 337 4548 1496 WerFault.exe 342 2800 2856 WerFault.exe 347 1416 5868 WerFault.exe 352 4456 1292 WerFault.exe 357 1216 3884 WerFault.exe 362 4532 1192 WerFault.exe 367 4292 1464 WerFault.exe 372 2232 1756 WerFault.exe 377 5296 1664 WerFault.exe 382 4040 5548 WerFault.exe 387 1368 4080 WerFault.exe 392 2316 2128 WerFault.exe 397 3528 2904 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RSPFOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SALX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNULAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLPNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJJAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LNB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWWHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZMLQWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKOCLXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XIBKKAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URLDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQOZAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUYEEKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVJPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJFGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLAQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELIERGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPPWMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GHBXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XAKFLV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5512 2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe 5512 2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe 4184 YBXKZ.exe 4184 YBXKZ.exe 4336 YWQVI.exe 4336 YWQVI.exe 6036 PEESV.exe 6036 PEESV.exe 620 QHIW.exe 620 QHIW.exe 5340 UPPWMC.exe 5340 UPPWMC.exe 4072 MSS.exe 4072 MSS.exe 2876 LDVPBYM.exe 2876 LDVPBYM.exe 5912 PTKP.exe 5912 PTKP.exe 3632 KWSO.exe 3632 KWSO.exe 6000 AMTFIP.exe 6000 AMTFIP.exe 3748 ECANM.exe 3748 ECANM.exe 2956 GAN.exe 2956 GAN.exe 5312 VQOZAD.exe 5312 VQOZAD.exe 204 WLS.exe 204 WLS.exe 4904 LOCHYO.exe 4904 LOCHYO.exe 5368 SEDZ.exe 5368 SEDZ.exe 4324 HZMLQWL.exe 4324 HZMLQWL.exe 6012 VUYEEKC.exe 6012 VUYEEKC.exe 4408 FUAJH.exe 4408 FUAJH.exe 1084 ZIFASQT.exe 1084 ZIFASQT.exe 4604 JFKN.exe 4604 JFKN.exe 2972 NWRVLIP.exe 2972 NWRVLIP.exe 4876 GZDQRG.exe 4876 GZDQRG.exe 1400 FJFGZ.exe 1400 FJFGZ.exe 4484 PHLBHVW.exe 4484 PHLBHVW.exe 4648 HCPXUK.exe 4648 HCPXUK.exe 4540 TVSPV.exe 4540 TVSPV.exe 564 XAKFLV.exe 564 XAKFLV.exe 2352 MQLE.exe 2352 MQLE.exe 3668 WZNJV.exe 3668 WZNJV.exe 5448 LUX.exe 5448 LUX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5512 2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe 5512 2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe 4184 YBXKZ.exe 4184 YBXKZ.exe 4336 YWQVI.exe 4336 YWQVI.exe 6036 PEESV.exe 6036 PEESV.exe 620 QHIW.exe 620 QHIW.exe 5340 UPPWMC.exe 5340 UPPWMC.exe 4072 MSS.exe 4072 MSS.exe 2876 LDVPBYM.exe 2876 LDVPBYM.exe 5912 PTKP.exe 5912 PTKP.exe 3632 KWSO.exe 3632 KWSO.exe 6000 AMTFIP.exe 6000 AMTFIP.exe 3748 ECANM.exe 3748 ECANM.exe 2956 GAN.exe 2956 GAN.exe 5312 VQOZAD.exe 5312 VQOZAD.exe 204 WLS.exe 204 WLS.exe 4904 LOCHYO.exe 4904 LOCHYO.exe 5368 SEDZ.exe 5368 SEDZ.exe 4324 HZMLQWL.exe 4324 HZMLQWL.exe 6012 VUYEEKC.exe 6012 VUYEEKC.exe 4408 FUAJH.exe 4408 FUAJH.exe 1084 ZIFASQT.exe 1084 ZIFASQT.exe 4604 JFKN.exe 4604 JFKN.exe 2972 NWRVLIP.exe 2972 NWRVLIP.exe 4876 GZDQRG.exe 4876 GZDQRG.exe 1400 FJFGZ.exe 1400 FJFGZ.exe 4484 PHLBHVW.exe 4484 PHLBHVW.exe 4648 HCPXUK.exe 4648 HCPXUK.exe 4540 TVSPV.exe 4540 TVSPV.exe 564 XAKFLV.exe 564 XAKFLV.exe 2352 MQLE.exe 2352 MQLE.exe 3668 WZNJV.exe 3668 WZNJV.exe 5448 LUX.exe 5448 LUX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5512 wrote to memory of 5812 5512 2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe 86 PID 5812 wrote to memory of 4184 5812 cmd.exe 90 PID 4184 wrote to memory of 5336 4184 YBXKZ.exe 92 PID 5336 wrote to memory of 4336 5336 cmd.exe 96 PID 4336 wrote to memory of 3980 4336 YWQVI.exe 97 PID 3980 wrote to memory of 6036 3980 cmd.exe 101 PID 6036 wrote to memory of 1556 6036 PEESV.exe 102 PID 1556 wrote to memory of 620 1556 cmd.exe 106 PID 620 wrote to memory of 2484 620 QHIW.exe 107 PID 2484 wrote to memory of 5340 2484 cmd.exe 111 PID 5340 wrote to memory of 1524 5340 UPPWMC.exe 112 PID 1524 wrote to memory of 4072 1524 cmd.exe 116 PID 4072 wrote to memory of 5160 4072 MSS.exe 117 PID 5160 wrote to memory of 2876 5160 cmd.exe 121 PID 2876 wrote to memory of 4428 2876 LDVPBYM.exe 122 PID 4428 wrote to memory of 5912 4428 cmd.exe 126 PID 5912 wrote to memory of 4508 5912 PTKP.exe 127 PID 4508 wrote to memory of 3632 4508 cmd.exe 131 PID 3632 wrote to memory of 5772 3632 KWSO.exe 132 PID 5772 wrote to memory of 6000 5772 cmd.exe 136 PID 6000 wrote to memory of 124 6000 AMTFIP.exe 137 PID 124 wrote to memory of 3748 124 cmd.exe 141 PID 3748 wrote to memory of 5828 3748 ECANM.exe 142 PID 5828 wrote to memory of 2956 5828 cmd.exe 146 PID 2956 wrote to memory of 3064 2956 GAN.exe 147 PID 3064 wrote to memory of 5312 3064 cmd.exe 151 PID 5312 wrote to memory of 2284 5312 VQOZAD.exe 152 PID 2284 wrote to memory of 204 2284 cmd.exe 156 PID 204 wrote to memory of 2696 204 WLS.exe 157 PID 2696 wrote to memory of 4904 2696 cmd.exe 161 PID 4904 wrote to memory of 3140 4904 LOCHYO.exe 162 PID 3140 wrote to memory of 5368 3140 cmd.exe 166 PID 5368 wrote to memory of 2872 5368 SEDZ.exe 167 PID 2872 wrote to memory of 4324 2872 cmd.exe 171 PID 4324 wrote to memory of 2916 4324 HZMLQWL.exe 172 PID 2916 wrote to memory of 6012 2916 cmd.exe 176 PID 6012 wrote to memory of 3380 6012 VUYEEKC.exe 177 PID 3380 wrote to memory of 4408 3380 cmd.exe 181 PID 4408 wrote to memory of 5100 4408 FUAJH.exe 182 PID 5100 wrote to memory of 1084 5100 cmd.exe 186 PID 1084 wrote to memory of 2796 1084 ZIFASQT.exe 187 PID 2796 wrote to memory of 4604 2796 cmd.exe 191 PID 4604 wrote to memory of 6024 4604 JFKN.exe 192 PID 6024 wrote to memory of 2972 6024 cmd.exe 196 PID 2972 wrote to memory of 5364 2972 NWRVLIP.exe 197 PID 5364 wrote to memory of 4876 5364 cmd.exe 201 PID 4876 wrote to memory of 3992 4876 GZDQRG.exe 202 PID 3992 wrote to memory of 1400 3992 cmd.exe 206 PID 1400 wrote to memory of 2084 1400 FJFGZ.exe 207 PID 2084 wrote to memory of 4484 2084 cmd.exe 211 PID 4484 wrote to memory of 1580 4484 PHLBHVW.exe 212 PID 1580 wrote to memory of 4648 1580 cmd.exe 216 PID 4648 wrote to memory of 3552 4648 HCPXUK.exe 217 PID 3552 wrote to memory of 4540 3552 cmd.exe 221 PID 4540 wrote to memory of 3012 4540 TVSPV.exe 222 PID 3012 wrote to memory of 564 3012 cmd.exe 226 PID 564 wrote to memory of 1412 564 XAKFLV.exe 227 PID 1412 wrote to memory of 2352 1412 cmd.exe 231 PID 2352 wrote to memory of 6040 2352 MQLE.exe 232 PID 6040 wrote to memory of 3668 6040 cmd.exe 236 PID 3668 wrote to memory of 4792 3668 WZNJV.exe 237 PID 4792 wrote to memory of 5448 4792 cmd.exe 241 PID 5448 wrote to memory of 3544 5448 LUX.exe 242 PID 3544 wrote to memory of 5344 3544 cmd.exe 246
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_e054857e1d5cc2a3b2dc646a4669170c_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBXKZ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\windows\SysWOW64\YBXKZ.exeC:\windows\system32\YBXKZ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YWQVI.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\windows\YWQVI.exeC:\windows\YWQVI.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PEESV.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\windows\PEESV.exeC:\windows\PEESV.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QHIW.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\windows\SysWOW64\QHIW.exeC:\windows\system32\QHIW.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPPWMC.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\UPPWMC.exeC:\windows\UPPWMC.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MSS.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\windows\MSS.exeC:\windows\MSS.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LDVPBYM.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\windows\SysWOW64\LDVPBYM.exeC:\windows\system32\LDVPBYM.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTKP.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\windows\PTKP.exeC:\windows\PTKP.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWSO.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\windows\SysWOW64\KWSO.exeC:\windows\system32\KWSO.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AMTFIP.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\windows\AMTFIP.exeC:\windows\AMTFIP.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ECANM.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:124 -
C:\windows\system\ECANM.exeC:\windows\system\ECANM.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAN.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\windows\GAN.exeC:\windows\GAN.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQOZAD.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\SysWOW64\VQOZAD.exeC:\windows\system32\VQOZAD.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WLS.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\windows\WLS.exeC:\windows\WLS.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LOCHYO.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\windows\SysWOW64\LOCHYO.exeC:\windows\system32\LOCHYO.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEDZ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\windows\SysWOW64\SEDZ.exeC:\windows\system32\SEDZ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HZMLQWL.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\windows\SysWOW64\HZMLQWL.exeC:\windows\system32\HZMLQWL.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VUYEEKC.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\windows\SysWOW64\VUYEEKC.exeC:\windows\system32\VUYEEKC.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUAJH.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\windows\system\FUAJH.exeC:\windows\system\FUAJH.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZIFASQT.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\windows\SysWOW64\ZIFASQT.exeC:\windows\system32\ZIFASQT.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JFKN.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\windows\system\JFKN.exeC:\windows\system\JFKN.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NWRVLIP.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\NWRVLIP.exeC:\windows\NWRVLIP.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZDQRG.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\GZDQRG.exeC:\windows\GZDQRG.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FJFGZ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\windows\SysWOW64\FJFGZ.exeC:\windows\system32\FJFGZ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHLBHVW.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\windows\system\PHLBHVW.exeC:\windows\system\PHLBHVW.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HCPXUK.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\windows\SysWOW64\HCPXUK.exeC:\windows\system32\HCPXUK.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TVSPV.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\windows\SysWOW64\TVSPV.exeC:\windows\system32\TVSPV.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAKFLV.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\windows\SysWOW64\XAKFLV.exeC:\windows\system32\XAKFLV.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MQLE.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\windows\MQLE.exeC:\windows\MQLE.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZNJV.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\windows\SysWOW64\WZNJV.exeC:\windows\system32\WZNJV.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LUX.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\windows\system\LUX.exeC:\windows\system\LUX.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GHBXQ.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\windows\system\GHBXQ.exeC:\windows\system\GHBXQ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GNULAO.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1076 -
C:\windows\SysWOW64\GNULAO.exeC:\windows\system32\GNULAO.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LNB.exe.bat" "68⤵PID:2024
-
C:\windows\system\LNB.exeC:\windows\system\LNB.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIGQT.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4328 -
C:\windows\GIGQT.exeC:\windows\GIGQT.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIOECKQ.exe.bat" "72⤵
- Executes a command shell one-liner
PID:1596 -
C:\windows\SysWOW64\MIOECKQ.exeC:\windows\system32\MIOECKQ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SWN.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5776 -
C:\windows\SWN.exeC:\windows\SWN.exe75⤵
- Executes dropped EXE
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTGAUS.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2844 -
C:\windows\system\QTGAUS.exeC:\windows\system\QTGAUS.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AUA.exe.bat" "78⤵PID:3344
-
C:\windows\system\AUA.exeC:\windows\system\AUA.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHNUIWL.exe.bat" "80⤵PID:1968
-
C:\windows\SysWOW64\IHNUIWL.exeC:\windows\system32\IHNUIWL.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZIPZLT.exe.bat" "82⤵PID:5256
-
C:\windows\SysWOW64\ZIPZLT.exeC:\windows\system32\ZIPZLT.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLSCZJO.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5952 -
C:\windows\SLSCZJO.exeC:\windows\SLSCZJO.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YLAQI.exe.bat" "86⤵PID:3016
-
C:\windows\SysWOW64\YLAQI.exeC:\windows\system32\YLAQI.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ELIERGZ.exe.bat" "88⤵PID:3196
-
C:\windows\ELIERGZ.exeC:\windows\ELIERGZ.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBJ.exe.bat" "90⤵PID:2988
-
C:\windows\SysWOW64\TBJ.exeC:\windows\system32\TBJ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VZO.exe.bat" "92⤵PID:1672
-
C:\windows\VZO.exeC:\windows\VZO.exe93⤵
- Executes dropped EXE
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMTZP.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\windows\system\QMTZP.exeC:\windows\system\QMTZP.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VNBNYEN.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4568 -
C:\windows\SysWOW64\VNBNYEN.exeC:\windows\system32\VNBNYEN.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QAGW.exe.bat" "98⤵PID:3784
-
C:\windows\QAGW.exeC:\windows\QAGW.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVKGTD.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4420 -
C:\windows\system\LVKGTD.exeC:\windows\system\LVKGTD.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGNWB.exe.bat" "102⤵PID:3432
-
C:\windows\system\JGNWB.exeC:\windows\system\JGNWB.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJZZHH.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4744 -
C:\windows\SysWOW64\KJZZHH.exeC:\windows\system32\KJZZHH.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZFUOQ.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5864 -
C:\windows\SysWOW64\MZFUOQ.exeC:\windows\system32\MZFUOQ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NCI.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2400 -
C:\windows\system\NCI.exeC:\windows\system\NCI.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QSPPO.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2868 -
C:\windows\system\QSPPO.exeC:\windows\system\QSPPO.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GIQP.exe.bat" "112⤵
- Executes a command shell one-liner
PID:4556 -
C:\windows\SysWOW64\GIQP.exeC:\windows\system32\GIQP.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\COIEDPM.exe.bat" "114⤵PID:860
-
C:\windows\COIEDPM.exeC:\windows\COIEDPM.exe115⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBNN.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2132 -
C:\windows\XBNN.exeC:\windows\XBNN.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGFCP.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3416 -
C:\windows\SysWOW64\FGFCP.exeC:\windows\system32\FGFCP.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UBX.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2580 -
C:\windows\UBX.exeC:\windows\UBX.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-