Analysis
- max time kernel
90s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 19:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-16_902353b791b0668976f9799b51493acd_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-16_902353b791b0668976f9799b51493acd_elex_emotet_stop.exe
- Size 208KB
- Sample260916-x2y42seq9w
- SHA256 6bfe66ed30a74b768e9d3787976d3ee313104568c04410c50b3706957d33b463
- MD5 902353b791b0668976f9799b51493acd
- SHA1 fb55816d95fa88242ac572302ebee18af7f8e220
- SHA512 89a7bc91647c1e76db149407f674c227d6f40b6691063fffc0390a8eadd2bfce12dc3977d10587fa86b21e1280d4ba666de00504fb7d68e6e89ffd820d181bd6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOfd4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOVkEj1
- TLSH T1DD247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6084 KVGJK.exe 4284 NLTYA.exe 4056 TLBMJRF.exe 5912 CMD.exe 2588 IMKFVR.exe 3088 MXJA.exe 5172 AAZQRNG.exe 1644 CNE.exe 1100 MVYNF.exe 2004 BQP.exe 2748 HMGSV.exe 4072 WHY.exe 1924 RUDOQ.exe 4604 RIVCSH.exe 3460 BFI.exe 5760 ENPWLI.exe 4600 IVWWY.exe 1364 DRAGISV.exe 1964 MRC.exe 1056 PEHCV.exe 4484 JAMMYXB.exe 3256 ENJ.exe 2480 TIAABK.exe 3756 DQU.exe 4880 GYJNR.exe 248 YHL.exe 1672 EHLF.exe 1360 YUPPN.exe 5464 OKYO.exe 5672 GFCKAK.exe 1308 CLP.exe 1888 UOSSQFQ.exe 4776 AOAF.exe 4992 BREBNQ.exe 4884 HSM.exe 4896 OINOC.exe 4276 PDQS.exe 5804 RBEEXM.exe 4904 GWNQ.exe 4700 JRSASY.exe 2564 JXKO.exe 1012 DKPYE.exe 4064 HAW.exe 4448 ESGAUZN.exe 1784 ZDOZI.exe 5532 FDWMREK.exe 3616 DZVVW.exe 5040 JZCJF.exe 5568 NHJJR.exe 2256 TCIKO.exe 4412 GNZ.exe 4852 QLE.exe 2044 GBFUQE.exe 4724 JJMC.exe 2212 TJOHO.exe 4640 IMX.exe 3320 XCYLGK.exe 5100 NXIP.exe 2560 HLNZBW.exe 5728 HQNNDJL.exe 4752 ITR.exe 4248 XOAVBM.exe 4068 GXC.exe 2520 KFJIRCL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\BZXGA.exe.bat DEXFEOI.exe File opened for modification C:\windows\SysWOW64\NFUNJ.exe YKLBQQH.exe File created C:\windows\SysWOW64\DEXFEOI.exe RORFR.exe File created C:\windows\SysWOW64\RGI.exe NQBYQ.exe File opened for modification C:\windows\SysWOW64\BQP.exe MVYNF.exe File created C:\windows\SysWOW64\GYJNR.exe DQU.exe File opened for modification C:\windows\SysWOW64\YUPPN.exe EHLF.exe File opened for modification C:\windows\SysWOW64\ITR.exe HQNNDJL.exe File created C:\windows\SysWOW64\HJEON.exe IYBYFW.exe File created C:\windows\SysWOW64\CNE.exe AAZQRNG.exe File created C:\windows\SysWOW64\IVWWY.exe ENPWLI.exe File created C:\windows\SysWOW64\GYJNR.exe.bat DQU.exe File created C:\windows\SysWOW64\DZVVW.exe FDWMREK.exe File opened for modification C:\windows\SysWOW64\DZVVW.exe FDWMREK.exe File created C:\windows\SysWOW64\VEBG.exe PDTTKXM.exe File opened for modification C:\windows\SysWOW64\CYDRXYU.exe NICR.exe File created C:\windows\SysWOW64\AOAF.exe UOSSQFQ.exe File created C:\windows\SysWOW64\ZCPUWUK.exe TGQMSRU.exe File created C:\windows\SysWOW64\ZCPUWUK.exe.bat TGQMSRU.exe File opened for modification C:\windows\SysWOW64\BREBNQ.exe AOAF.exe File created C:\windows\SysWOW64\JXKO.exe JRSASY.exe File created C:\windows\SysWOW64\QLE.exe.bat GNZ.exe File created C:\windows\SysWOW64\XOAVBM.exe.bat ITR.exe File created C:\windows\SysWOW64\NFUNJ.exe YKLBQQH.exe File created C:\windows\SysWOW64\PEHCV.exe MRC.exe File created C:\windows\SysWOW64\BREBNQ.exe.bat AOAF.exe File created C:\windows\SysWOW64\VNJXYY.exe AAEN.exe File opened for modification C:\windows\SysWOW64\OKYO.exe YUPPN.exe File created C:\windows\SysWOW64\HLNZBW.exe.bat NXIP.exe File opened for modification C:\windows\SysWOW64\FVRNGZ.exe WVXI.exe File created C:\windows\SysWOW64\KFZ.exe HXKIBG.exe File created C:\windows\SysWOW64\BZXGA.exe DEXFEOI.exe File created C:\windows\SysWOW64\XSQGTZ.exe.bat JIIQEO.exe File created C:\windows\SysWOW64\JXKO.exe.bat JRSASY.exe File opened for modification C:\windows\SysWOW64\TCIKO.exe NHJJR.exe File created C:\windows\SysWOW64\TCIKO.exe.bat NHJJR.exe File opened for modification C:\windows\SysWOW64\XOAVBM.exe ITR.exe File created C:\windows\SysWOW64\RGI.exe.bat NQBYQ.exe File opened for modification C:\windows\SysWOW64\IVWWY.exe ENPWLI.exe File created C:\windows\SysWOW64\IVWWY.exe.bat ENPWLI.exe File opened for modification C:\windows\SysWOW64\JRSASY.exe GWNQ.exe File created C:\windows\SysWOW64\DIDEBOK.exe KFZ.exe File opened for modification C:\windows\SysWOW64\DIDEBOK.exe KFZ.exe File created C:\windows\SysWOW64\CYDRXYU.exe NICR.exe File opened for modification C:\windows\SysWOW64\BKNHTS.exe XCHG.exe File created C:\windows\SysWOW64\OKYO.exe.bat YUPPN.exe File created C:\windows\SysWOW64\OINOC.exe.bat HSM.exe File opened for modification C:\windows\SysWOW64\VEBG.exe PDTTKXM.exe File created C:\windows\SysWOW64\PDQS.exe OINOC.exe File created C:\windows\SysWOW64\NICR.exe UFQWLMW.exe File created C:\windows\SysWOW64\ENPWLI.exe BFI.exe File created C:\windows\SysWOW64\FVRNGZ.exe.bat WVXI.exe File created C:\windows\SysWOW64\DRAGISV.exe.bat IVWWY.exe File created C:\windows\SysWOW64\OKYO.exe YUPPN.exe File created C:\windows\SysWOW64\VEBG.exe.bat PDTTKXM.exe File created C:\windows\SysWOW64\BREBNQ.exe AOAF.exe File created C:\windows\SysWOW64\DEXFEOI.exe.bat RORFR.exe File created C:\windows\SysWOW64\PEHCV.exe.bat MRC.exe File opened for modification C:\windows\SysWOW64\GYJNR.exe DQU.exe File opened for modification C:\windows\SysWOW64\KFZ.exe HXKIBG.exe File created C:\windows\SysWOW64\AAZQRNG.exe MXJA.exe File created C:\windows\SysWOW64\OINOC.exe HSM.exe File created C:\windows\SysWOW64\XSQGTZ.exe JIIQEO.exe File created C:\windows\SysWOW64\BQP.exe.bat MVYNF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\QGRFHCI.exe VEBG.exe File created C:\windows\system\TJOHO.exe.bat JJMC.exe File opened for modification C:\windows\WCF.exe BZXGA.exe File created C:\windows\UFQWLMW.exe.bat FKHJ.exe File opened for modification C:\windows\NQBYQ.exe VQN.exe File created C:\windows\MVYNF.exe CNE.exe File created C:\windows\RUDOQ.exe.bat WHY.exe File opened for modification C:\windows\system\UOSSQFQ.exe CLP.exe File created C:\windows\system\ZNBNVVE.exe NFUNJ.exe File opened for modification C:\windows\BFI.exe RIVCSH.exe File created C:\windows\system\NXIP.exe XCYLGK.exe File created C:\windows\system\GXC.exe XOAVBM.exe File created C:\windows\system\TGQMSRU.exe.bat ELHH.exe File created C:\windows\SFFZT.exe GXZZH.exe File opened for modification C:\windows\system\JIIQEO.exe BKNHTS.exe File created C:\windows\VJTLDS.exe XOU.exe File created C:\windows\GWNQ.exe.bat RBEEXM.exe File created C:\windows\system\DKPYE.exe.bat JXKO.exe File opened for modification C:\windows\system\FDWMREK.exe ZDOZI.exe File opened for modification C:\windows\system\TLBMJRF.exe NLTYA.exe File created C:\windows\BFI.exe RIVCSH.exe File created C:\windows\system\RBEEXM.exe PDQS.exe File created C:\windows\HAW.exe DKPYE.exe File created C:\windows\system\JJMC.exe GBFUQE.exe File created C:\windows\system\VQN.exe.bat VNJXYY.exe File created C:\windows\KVGJK.exe 2026-09-16_902353b791b0668976f9799b51493acd_elex_emotet_stop.exe File created C:\windows\system\FDWMREK.exe ZDOZI.exe File opened for modification C:\windows\system\TJOHO.exe JJMC.exe File created C:\windows\system\XLIA.exe CYDRXYU.exe File opened for modification C:\windows\VJTLDS.exe XOU.exe File created C:\windows\EHLF.exe.bat YHL.exe File created C:\windows\UFQWLMW.exe FKHJ.exe File created C:\windows\GWNQ.exe RBEEXM.exe File created C:\windows\SFFZT.exe.bat GXZZH.exe File opened for modification C:\windows\CLP.exe GFCKAK.exe File created C:\windows\system\TLBMJRF.exe NLTYA.exe File opened for modification C:\windows\HMGSV.exe BQP.exe File opened for modification C:\windows\JAMMYXB.exe PEHCV.exe File created C:\windows\system\GXZZH.exe.bat ZCPUWUK.exe File created C:\windows\system\VQN.exe VNJXYY.exe File opened for modification C:\windows\system\CMD.exe TLBMJRF.exe File opened for modification C:\windows\system\QGRFHCI.exe VEBG.exe File created C:\windows\QVXCZYR.exe MNIU.exe File created C:\windows\system\MXJA.exe.bat IMKFVR.exe File opened for modification C:\windows\RUDOQ.exe WHY.exe File opened for modification C:\windows\system\MXJA.exe IMKFVR.exe File created C:\windows\system\NHJJR.exe JZCJF.exe File opened for modification C:\windows\system\GBFUQE.exe QLE.exe File created C:\windows\JAMMYXB.exe.bat PEHCV.exe File created C:\windows\system\DQU.exe TIAABK.exe File opened for modification C:\windows\system\JJMC.exe GBFUQE.exe File created C:\windows\system\XCYLGK.exe IMX.exe File created C:\windows\system\UOSSQFQ.exe.bat CLP.exe File created C:\windows\system\HSM.exe.bat BREBNQ.exe File created C:\windows\system\OCRGM.exe.bat QGRFHCI.exe File created C:\windows\system\MNIU.exe RDAEZD.exe File opened for modification C:\windows\system\RRC.exe NJVIYI.exe File opened for modification C:\windows\system\IMKFVR.exe CMD.exe File created C:\windows\IMX.exe TJOHO.exe File opened for modification C:\windows\IMX.exe TJOHO.exe File opened for modification C:\windows\IYBYFW.exe QVXCZYR.exe File opened for modification C:\windows\system\YKLBQQH.exe HZA.exe File created C:\windows\system\TJOHO.exe JJMC.exe File created C:\windows\system\ESGAUZN.exe.bat HAW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1688 cmd.exe 3008 cmd.exe 2540 cmd.exe 5792 cmd.exe 6060 cmd.exe 5704 cmd.exe 4264 cmd.exe 5444 cmd.exe 3416 cmd.exe 1900 cmd.exe 1968 cmd.exe 3064 cmd.exe 4660 cmd.exe 1640 cmd.exe 4580 cmd.exe 3868 cmd.exe 2240 cmd.exe 916 cmd.exe 4228 cmd.exe 2020 cmd.exe 1412 cmd.exe 4756 cmd.exe 3100 cmd.exe 3476 cmd.exe 4948 cmd.exe 4348 cmd.exe 6116 cmd.exe 3252 cmd.exe 256 cmd.exe 3948 cmd.exe 2772 cmd.exe 1284 cmd.exe 3884 cmd.exe 4748 cmd.exe 4568 cmd.exe 4648 cmd.exe 4876 cmd.exe 2768 cmd.exe 2284 cmd.exe 2720 cmd.exe 2864 cmd.exe 5020 cmd.exe 3624 cmd.exe 4512 cmd.exe 5980 cmd.exe 5496 cmd.exe 896 cmd.exe 2884 cmd.exe 5056 cmd.exe 1872 cmd.exe 5856 cmd.exe 1424 cmd.exe 4060 cmd.exe 4652 cmd.exe 1084 cmd.exe 2816 cmd.exe 2596 cmd.exe 484 cmd.exe 4676 cmd.exe 5060 cmd.exe 6096 cmd.exe 3384 cmd.exe 4592 cmd.exe 1920 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4728 5204 WerFault.exe 87 3952 6084 WerFault.exe 92 2268 4284 WerFault.exe 98 560 4056 WerFault.exe 103 3368 5912 WerFault.exe 108 2000 2588 WerFault.exe 113 1552 3088 WerFault.exe 118 1960 5172 WerFault.exe 123 2976 1644 WerFault.exe 128 1152 1100 WerFault.exe 133 4208 2004 WerFault.exe 138 3232 2748 WerFault.exe 143 2512 4072 WerFault.exe 148 2704 1924 WerFault.exe 152 5260 4604 WerFault.exe 158 5988 3460 WerFault.exe 163 5304 5760 WerFault.exe 168 5860 4600 WerFault.exe 173 1968 1364 WerFault.exe 178 6052 1964 WerFault.exe 183 3420 1056 WerFault.exe 188 3640 4484 WerFault.exe 193 4448 3256 WerFault.exe 198 3140 2480 WerFault.exe 203 8 3756 WerFault.exe 208 1216 4880 WerFault.exe 213 5776 248 WerFault.exe 218 4612 1672 WerFault.exe 223 4268 1360 WerFault.exe 228 2700 5464 WerFault.exe 233 5056 5672 WerFault.exe 238 1840 1308 WerFault.exe 243 2008 1888 WerFault.exe 248 1092 4776 WerFault.exe 253 2884 4992 WerFault.exe 258 8 4884 WerFault.exe 263 5444 4896 WerFault.exe 268 2544 4276 WerFault.exe 273 5520 5804 WerFault.exe 278 1660 4904 WerFault.exe 283 5480 4700 WerFault.exe 288 2336 2564 WerFault.exe 293 4316 1012 WerFault.exe 298 2516 4064 WerFault.exe 303 5012 4448 WerFault.exe 308 3272 1784 WerFault.exe 313 3948 5532 WerFault.exe 318 256 3616 WerFault.exe 323 5304 5040 WerFault.exe 328 6068 5568 WerFault.exe 333 2828 2256 WerFault.exe 338 5584 4412 WerFault.exe 343 1328 4852 WerFault.exe 348 5548 2044 WerFault.exe 353 4628 4724 WerFault.exe 358 3272 2212 WerFault.exe 363 4520 4640 WerFault.exe 368 4152 3320 WerFault.exe 373 2880 5100 WerFault.exe 378 3592 2560 WerFault.exe 383 3908 5728 WerFault.exe 388 1968 4752 WerFault.exe 393 744 4248 WerFault.exe 398 4848 4068 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLBMJRF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMKFVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HQNNDJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJVIYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJTLDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRSASY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJEON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFFZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TJOHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDTTKXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDWMREK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAZQRNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEHCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESGAUZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZXGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BREBNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDOZI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLTYA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXZZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAMMYXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKLBQQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DIDEBOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RORFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVYNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIVCSH.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5204 2026-09-16_902353b791b0668976f9799b51493acd_elex_emotet_stop.exe 5204 2026-09-16_902353b791b0668976f9799b51493acd_elex_emotet_stop.exe 6084 KVGJK.exe 6084 KVGJK.exe 4284 NLTYA.exe 4284 NLTYA.exe 4056 TLBMJRF.exe 4056 TLBMJRF.exe 5912 CMD.exe 5912 CMD.exe 2588 IMKFVR.exe 2588 IMKFVR.exe 3088 MXJA.exe 3088 MXJA.exe 5172 AAZQRNG.exe 5172 AAZQRNG.exe 1644 CNE.exe 1644 CNE.exe 1100 MVYNF.exe 1100 MVYNF.exe 2004 BQP.exe 2004 BQP.exe 2748 HMGSV.exe 2748 HMGSV.exe 4072 WHY.exe 4072 WHY.exe 1924 RUDOQ.exe 1924 RUDOQ.exe 4604 RIVCSH.exe 4604 RIVCSH.exe 3460 BFI.exe 3460 BFI.exe 5760 ENPWLI.exe 5760 ENPWLI.exe 4600 IVWWY.exe 4600 IVWWY.exe 1364 DRAGISV.exe 1364 DRAGISV.exe 1964 MRC.exe 1964 MRC.exe 1056 PEHCV.exe 1056 PEHCV.exe 4484 JAMMYXB.exe 4484 JAMMYXB.exe 3256 ENJ.exe 3256 ENJ.exe 2480 TIAABK.exe 2480 TIAABK.exe 3756 DQU.exe 3756 DQU.exe 4880 GYJNR.exe 4880 GYJNR.exe 248 YHL.exe 248 YHL.exe 1672 EHLF.exe 1672 EHLF.exe 1360 YUPPN.exe 1360 YUPPN.exe 5464 OKYO.exe 5464 OKYO.exe 5672 GFCKAK.exe 5672 GFCKAK.exe 1308 CLP.exe 1308 CLP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5204 2026-09-16_902353b791b0668976f9799b51493acd_elex_emotet_stop.exe 5204 2026-09-16_902353b791b0668976f9799b51493acd_elex_emotet_stop.exe 6084 KVGJK.exe 6084 KVGJK.exe 4284 NLTYA.exe 4284 NLTYA.exe 4056 TLBMJRF.exe 4056 TLBMJRF.exe 5912 CMD.exe 5912 CMD.exe 2588 IMKFVR.exe 2588 IMKFVR.exe 3088 MXJA.exe 3088 MXJA.exe 5172 AAZQRNG.exe 5172 AAZQRNG.exe 1644 CNE.exe 1644 CNE.exe 1100 MVYNF.exe 1100 MVYNF.exe 2004 BQP.exe 2004 BQP.exe 2748 HMGSV.exe 2748 HMGSV.exe 4072 WHY.exe 4072 WHY.exe 1924 RUDOQ.exe 1924 RUDOQ.exe 4604 RIVCSH.exe 4604 RIVCSH.exe 3460 BFI.exe 3460 BFI.exe 5760 ENPWLI.exe 5760 ENPWLI.exe 4600 IVWWY.exe 4600 IVWWY.exe 1364 DRAGISV.exe 1364 DRAGISV.exe 1964 MRC.exe 1964 MRC.exe 1056 PEHCV.exe 1056 PEHCV.exe 4484 JAMMYXB.exe 4484 JAMMYXB.exe 3256 ENJ.exe 3256 ENJ.exe 2480 TIAABK.exe 2480 TIAABK.exe 3756 DQU.exe 3756 DQU.exe 4880 GYJNR.exe 4880 GYJNR.exe 248 YHL.exe 248 YHL.exe 1672 EHLF.exe 1672 EHLF.exe 1360 YUPPN.exe 1360 YUPPN.exe 5464 OKYO.exe 5464 OKYO.exe 5672 GFCKAK.exe 5672 GFCKAK.exe 1308 CLP.exe 1308 CLP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5204 wrote to memory of 1920 5204 2026-09-16_902353b791b0668976f9799b51493acd_elex_emotet_stop.exe 88 PID 1920 wrote to memory of 6084 1920 cmd.exe 92 PID 6084 wrote to memory of 4512 6084 KVGJK.exe 94 PID 4512 wrote to memory of 4284 4512 cmd.exe 98 PID 4284 wrote to memory of 5980 4284 NLTYA.exe 99 PID 5980 wrote to memory of 4056 5980 cmd.exe 103 PID 4056 wrote to memory of 4956 4056 TLBMJRF.exe 104 PID 4956 wrote to memory of 5912 4956 cmd.exe 108 PID 5912 wrote to memory of 3476 5912 CMD.exe 109 PID 3476 wrote to memory of 2588 3476 cmd.exe 113 PID 2588 wrote to memory of 4108 2588 IMKFVR.exe 114 PID 4108 wrote to memory of 3088 4108 cmd.exe 118 PID 3088 wrote to memory of 464 3088 MXJA.exe 119 PID 464 wrote to memory of 5172 464 cmd.exe 123 PID 5172 wrote to memory of 4060 5172 AAZQRNG.exe 124 PID 4060 wrote to memory of 1644 4060 cmd.exe 128 PID 1644 wrote to memory of 2772 1644 CNE.exe 129 PID 2772 wrote to memory of 1100 2772 cmd.exe 133 PID 1100 wrote to memory of 4736 1100 MVYNF.exe 134 PID 4736 wrote to memory of 2004 4736 cmd.exe 138 PID 2004 wrote to memory of 4184 2004 BQP.exe 139 PID 4184 wrote to memory of 2748 4184 cmd.exe 143 PID 2748 wrote to memory of 5436 2748 HMGSV.exe 144 PID 5436 wrote to memory of 4072 5436 cmd.exe 148 PID 4072 wrote to memory of 4144 4072 WHY.exe 149 PID 4144 wrote to memory of 1924 4144 cmd.exe 152 PID 1924 wrote to memory of 5060 1924 RUDOQ.exe 154 PID 5060 wrote to memory of 4604 5060 cmd.exe 158 PID 4604 wrote to memory of 4948 4604 RIVCSH.exe 159 PID 4948 wrote to memory of 3460 4948 cmd.exe 163 PID 3460 wrote to memory of 2084 3460 BFI.exe 164 PID 2084 wrote to memory of 5760 2084 cmd.exe 168 PID 5760 wrote to memory of 3632 5760 ENPWLI.exe 169 PID 3632 wrote to memory of 4600 3632 cmd.exe 173 PID 4600 wrote to memory of 5992 4600 IVWWY.exe 174 PID 5992 wrote to memory of 1364 5992 cmd.exe 178 PID 1364 wrote to memory of 1424 1364 DRAGISV.exe 179 PID 1424 wrote to memory of 1964 1424 cmd.exe 183 PID 1964 wrote to memory of 1284 1964 MRC.exe 184 PID 1284 wrote to memory of 1056 1284 cmd.exe 188 PID 1056 wrote to memory of 1264 1056 PEHCV.exe 189 PID 1264 wrote to memory of 4484 1264 cmd.exe 193 PID 4484 wrote to memory of 700 4484 JAMMYXB.exe 194 PID 700 wrote to memory of 3256 700 cmd.exe 198 PID 3256 wrote to memory of 4528 3256 ENJ.exe 199 PID 4528 wrote to memory of 2480 4528 cmd.exe 203 PID 2480 wrote to memory of 5496 2480 TIAABK.exe 204 PID 5496 wrote to memory of 3756 5496 cmd.exe 208 PID 3756 wrote to memory of 4728 3756 DQU.exe 209 PID 4728 wrote to memory of 4880 4728 cmd.exe 213 PID 4880 wrote to memory of 1640 4880 GYJNR.exe 214 PID 1640 wrote to memory of 248 1640 cmd.exe 218 PID 248 wrote to memory of 6096 248 YHL.exe 219 PID 6096 wrote to memory of 1672 6096 cmd.exe 223 PID 1672 wrote to memory of 896 1672 EHLF.exe 224 PID 896 wrote to memory of 1360 896 cmd.exe 228 PID 1360 wrote to memory of 3368 1360 YUPPN.exe 229 PID 3368 wrote to memory of 5464 3368 cmd.exe 233 PID 5464 wrote to memory of 5964 5464 OKYO.exe 234 PID 5964 wrote to memory of 5672 5964 cmd.exe 238 PID 5672 wrote to memory of 1188 5672 GFCKAK.exe 239 PID 1188 wrote to memory of 1308 1188 cmd.exe 243 PID 1308 wrote to memory of 5704 1308 CLP.exe 244 PID 5704 wrote to memory of 1888 5704 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_902353b791b0668976f9799b51493acd_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_902353b791b0668976f9799b51493acd_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVGJK.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\windows\KVGJK.exeC:\windows\KVGJK.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLTYA.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\system\NLTYA.exeC:\windows\system\NLTYA.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TLBMJRF.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\windows\system\TLBMJRF.exeC:\windows\system\TLBMJRF.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMD.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\system\CMD.exeC:\windows\system\CMD.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMKFVR.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\system\IMKFVR.exeC:\windows\system\IMKFVR.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXJA.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\system\MXJA.exeC:\windows\system\MXJA.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZQRNG.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\windows\SysWOW64\AAZQRNG.exeC:\windows\system32\AAZQRNG.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CNE.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\windows\SysWOW64\CNE.exeC:\windows\system32\CNE.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MVYNF.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\MVYNF.exeC:\windows\MVYNF.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQP.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\SysWOW64\BQP.exeC:\windows\system32\BQP.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMGSV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\windows\HMGSV.exeC:\windows\HMGSV.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WHY.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\system\WHY.exeC:\windows\system\WHY.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RUDOQ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\windows\RUDOQ.exeC:\windows\RUDOQ.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIVCSH.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\windows\system\RIVCSH.exeC:\windows\system\RIVCSH.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BFI.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\windows\BFI.exeC:\windows\BFI.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENPWLI.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\windows\SysWOW64\ENPWLI.exeC:\windows\system32\ENPWLI.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVWWY.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\windows\SysWOW64\IVWWY.exeC:\windows\system32\IVWWY.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DRAGISV.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\windows\SysWOW64\DRAGISV.exeC:\windows\system32\DRAGISV.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRC.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\windows\system\MRC.exeC:\windows\system\MRC.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PEHCV.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\SysWOW64\PEHCV.exeC:\windows\system32\PEHCV.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAMMYXB.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\windows\JAMMYXB.exeC:\windows\JAMMYXB.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENJ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:700 -
C:\windows\ENJ.exeC:\windows\ENJ.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TIAABK.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\TIAABK.exeC:\windows\TIAABK.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQU.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\windows\system\DQU.exeC:\windows\system\DQU.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYJNR.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\windows\SysWOW64\GYJNR.exeC:\windows\system32\GYJNR.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHL.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\windows\YHL.exeC:\windows\YHL.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHLF.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\EHLF.exeC:\windows\EHLF.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YUPPN.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:896 -
C:\windows\SysWOW64\YUPPN.exeC:\windows\system32\YUPPN.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OKYO.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\windows\SysWOW64\OKYO.exeC:\windows\system32\OKYO.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFCKAK.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\system\GFCKAK.exeC:\windows\system\GFCKAK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CLP.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\windows\CLP.exeC:\windows\CLP.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOSSQFQ.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\windows\system\UOSSQFQ.exeC:\windows\system\UOSSQFQ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOAF.exe.bat" "66⤵PID:2488
-
C:\windows\SysWOW64\AOAF.exeC:\windows\system32\AOAF.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BREBNQ.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4876 -
C:\windows\SysWOW64\BREBNQ.exeC:\windows\system32\BREBNQ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HSM.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4348 -
C:\windows\system\HSM.exeC:\windows\system\HSM.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OINOC.exe.bat" "72⤵PID:4900
-
C:\windows\SysWOW64\OINOC.exeC:\windows\system32\OINOC.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDQS.exe.bat" "74⤵PID:364
-
C:\windows\SysWOW64\PDQS.exeC:\windows\system32\PDQS.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBEEXM.exe.bat" "76⤵PID:2356
-
C:\windows\system\RBEEXM.exeC:\windows\system\RBEEXM.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWNQ.exe.bat" "78⤵PID:976
-
C:\windows\GWNQ.exeC:\windows\GWNQ.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JRSASY.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4228 -
C:\windows\SysWOW64\JRSASY.exeC:\windows\system32\JRSASY.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXKO.exe.bat" "82⤵PID:1260
-
C:\windows\SysWOW64\JXKO.exeC:\windows\system32\JXKO.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKPYE.exe.bat" "84⤵PID:3700
-
C:\windows\system\DKPYE.exeC:\windows\system\DKPYE.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAW.exe.bat" "86⤵PID:4576
-
C:\windows\HAW.exeC:\windows\HAW.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESGAUZN.exe.bat" "88⤵PID:1200
-
C:\windows\system\ESGAUZN.exeC:\windows\system\ESGAUZN.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDOZI.exe.bat" "90⤵PID:1448
-
C:\windows\ZDOZI.exeC:\windows\ZDOZI.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FDWMREK.exe.bat" "92⤵PID:5044
-
C:\windows\system\FDWMREK.exeC:\windows\system\FDWMREK.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DZVVW.exe.bat" "94⤵PID:3612
-
C:\windows\SysWOW64\DZVVW.exeC:\windows\system32\DZVVW.exe95⤵
- Executes dropped EXE
PID:3616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZCJF.exe.bat" "96⤵PID:2892
-
C:\windows\JZCJF.exeC:\windows\JZCJF.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHJJR.exe.bat" "98⤵
- Executes a command shell one-liner
PID:6116 -
C:\windows\system\NHJJR.exeC:\windows\system\NHJJR.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCIKO.exe.bat" "100⤵PID:3292
-
C:\windows\SysWOW64\TCIKO.exeC:\windows\system32\TCIKO.exe101⤵
- Executes dropped EXE
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GNZ.exe.bat" "102⤵PID:5384
-
C:\windows\system\GNZ.exeC:\windows\system\GNZ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QLE.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2476 -
C:\windows\SysWOW64\QLE.exeC:\windows\system32\QLE.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBFUQE.exe.bat" "106⤵PID:2500
-
C:\windows\system\GBFUQE.exeC:\windows\system\GBFUQE.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "108⤵PID:844
-
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2816 -
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMX.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:3020 -
C:\windows\IMX.exeC:\windows\IMX.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCYLGK.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1216 -
C:\windows\system\XCYLGK.exeC:\windows\system\XCYLGK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXIP.exe.bat" "116⤵PID:2556
-
C:\windows\system\NXIP.exeC:\windows\system\NXIP.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HLNZBW.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:620 -
C:\windows\SysWOW64\HLNZBW.exeC:\windows\system32\HLNZBW.exe119⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HQNNDJL.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1688 -
C:\windows\system\HQNNDJL.exeC:\windows\system\HQNNDJL.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-