Analysis
- max time kernel
86s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 22:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-24_cab1d508fd980262c091d9d186aced16_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-24_cab1d508fd980262c091d9d186aced16_elex_emotet_stop.exe
- Size 208KB
- Sample260924-2gpgbsyscv
- SHA256 e17167378260516481d35a5d1a02e320c1acb7e5e8c5034eda18f0ad3aa9ed35
- MD5 cab1d508fd980262c091d9d186aced16
- SHA1 c809207798a43163a3699b10cb89b38c83e44349
- SHA512 3a875eec1a180eaf364d02a52aa7fe1bb9a947932ce75b9c042b5ae2a9e81f2697aa9c9d0ae063e57f69147e4a9370d858f0083688c047708951b58daf64a95f
- SSDEEP 3072:7tLQaL9tbLkRIgd1Lye9yjE2hWAN5XbslcdL+LOfJ4pLthEjQT6j:7NlZtbLWIgd1LZ9oECZbslc5+LOhkEj1
- TLSH T1E8247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4280 FBAV.exe 204 MSH.exe 1052 BNZFDJ.exe 2672 SVBKHOD.exe 6004 WDHS.exe 4488 LTI.exe 3444 PJPSM.exe 5712 FZQJ.exe 3452 JHXRXS.exe 5708 NXD.exe 4188 QFSZVD.exe 4444 ADXMD.exe 1108 AJYAEY.exe 5852 MZE.exe 528 WZGNU.exe 4324 QUDXEN.exe 2576 WVLK.exe 5928 CVSYEK.exe 4844 XIX.exe 3808 PLBLU.exe 4100 QGNH.exe 5980 KUJQK.exe 6140 HZPNR.exe 1424 HFQCSM.exe 3472 CAU.exe 3880 IACZM.exe 1408 NBKNDIA.exe 3008 IOOW.exe 5732 ITHLO.exe 1592 UJNTTGG.exe 4780 YSCT.exe 6032 UXAQMI.exe 4112 UDAEVVZ.exe 2084 GVD.exe 4460 MWKLN.exe 860 RWK.exe 2812 PRJ.exe 2668 UXCP.exe 3792 NSFKWN.exe 4556 NVJ.exe 4860 XDLTFI.exe 944 RQQ.exe 868 VYXKC.exe 3844 BZE.exe 1512 ARHO.exe 976 JSJ.exe 1376 YNAYQT.exe 5468 EISYMW.exe 4640 TDJL.exe 5696 SOM.exe 1976 CWOGS.exe 3364 RRX.exe 5480 ZXX.exe 2688 DNEZQM.exe 5564 XAJQAMC.exe 3428 MVSUM.exe 2848 TRS.exe 4916 PWCKGFV.exe 3084 TZAGG.exe 2356 SXT.exe 5388 SCTP.exe 2464 MQQYFQ.exe 5940 PDVQPPL.exe 5548 TTKQCAZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\HZPNR.exe KUJQK.exe File created C:\windows\SysWOW64\ZXX.exe RRX.exe File created C:\windows\SysWOW64\JPE.exe.bat DCEWOQM.exe File created C:\windows\SysWOW64\ZZB.exe.bat UYUULT.exe File created C:\windows\SysWOW64\SVBKHOD.exe BNZFDJ.exe File created C:\windows\SysWOW64\RWK.exe MWKLN.exe File opened for modification C:\windows\SysWOW64\XDLTFI.exe NVJ.exe File created C:\windows\SysWOW64\PDVQPPL.exe MQQYFQ.exe File created C:\windows\SysWOW64\ESZ.exe KEVFHDL.exe File created C:\windows\SysWOW64\HTZ.exe NFUDHQ.exe File created C:\windows\SysWOW64\GXRFOHC.exe.bat UHKXB.exe File created C:\windows\SysWOW64\WDHS.exe.bat SVBKHOD.exe File opened for modification C:\windows\SysWOW64\CAU.exe HFQCSM.exe File opened for modification C:\windows\SysWOW64\PRJ.exe RWK.exe File created C:\windows\SysWOW64\ARHO.exe BZE.exe File created C:\windows\SysWOW64\MVSUM.exe XAJQAMC.exe File opened for modification C:\windows\SysWOW64\PWCKGFV.exe TRS.exe File opened for modification C:\windows\SysWOW64\ZTJELCA.exe TTKQCAZ.exe File created C:\windows\SysWOW64\SDOPJQ.exe.bat JPE.exe File opened for modification C:\windows\SysWOW64\WDHS.exe SVBKHOD.exe File opened for modification C:\windows\SysWOW64\MZE.exe AJYAEY.exe File opened for modification C:\windows\SysWOW64\KUJQK.exe QGNH.exe File created C:\windows\SysWOW64\ARHO.exe.bat BZE.exe File created C:\windows\SysWOW64\ZXX.exe.bat RRX.exe File created C:\windows\SysWOW64\ZTJELCA.exe.bat TTKQCAZ.exe File created C:\windows\SysWOW64\LHYTW.exe WMPHDTJ.exe File created C:\windows\SysWOW64\HTZ.exe.bat NFUDHQ.exe File created C:\windows\SysWOW64\CAU.exe.bat HFQCSM.exe File opened for modification C:\windows\SysWOW64\NVJ.exe NSFKWN.exe File opened for modification C:\windows\SysWOW64\TDJL.exe EISYMW.exe File opened for modification C:\windows\SysWOW64\RWK.exe MWKLN.exe File created C:\windows\SysWOW64\RWK.exe.bat MWKLN.exe File created C:\windows\SysWOW64\PRJ.exe.bat RWK.exe File created C:\windows\SysWOW64\XDLTFI.exe NVJ.exe File created C:\windows\SysWOW64\BZE.exe.bat VYXKC.exe File created C:\windows\SysWOW64\CWOGS.exe SOM.exe File opened for modification C:\windows\SysWOW64\KEVFHDL.exe PRQWF.exe File opened for modification C:\windows\SysWOW64\BKNHTS.exe GWJX.exe File created C:\windows\SysWOW64\KUJQK.exe QGNH.exe File created C:\windows\SysWOW64\NSFKWN.exe UXCP.exe File created C:\windows\SysWOW64\CWOGS.exe.bat SOM.exe File created C:\windows\SysWOW64\PWCKGFV.exe TRS.exe File created C:\windows\SysWOW64\TTKQCAZ.exe.bat PDVQPPL.exe File created C:\windows\SysWOW64\VXS.exe.bat BKNHTS.exe File created C:\windows\SysWOW64\GXRFOHC.exe UHKXB.exe File created C:\windows\SysWOW64\TDJL.exe.bat EISYMW.exe File created C:\windows\SysWOW64\TTKQCAZ.exe PDVQPPL.exe File opened for modification C:\windows\SysWOW64\VXS.exe BKNHTS.exe File opened for modification C:\windows\SysWOW64\ZZB.exe UYUULT.exe File created C:\windows\SysWOW64\NVJ.exe NSFKWN.exe File created C:\windows\SysWOW64\NVJ.exe.bat NSFKWN.exe File created C:\windows\SysWOW64\RQQ.exe XDLTFI.exe File created C:\windows\SysWOW64\KEVFHDL.exe.bat PRQWF.exe File created C:\windows\SysWOW64\ESZ.exe.bat KEVFHDL.exe File opened for modification C:\windows\SysWOW64\HTZ.exe NFUDHQ.exe File opened for modification C:\windows\SysWOW64\LBGMV.exe HTZ.exe File created C:\windows\SysWOW64\SVBKHOD.exe.bat BNZFDJ.exe File opened for modification C:\windows\SysWOW64\LTI.exe WDHS.exe File created C:\windows\SysWOW64\UDAEVVZ.exe UXAQMI.exe File created C:\windows\SysWOW64\BZE.exe VYXKC.exe File opened for modification C:\windows\SysWOW64\ARHO.exe BZE.exe File created C:\windows\SysWOW64\PWCKGFV.exe.bat TRS.exe File created C:\windows\SysWOW64\DCEWOQM.exe IHANM.exe File created C:\windows\SysWOW64\ZZB.exe UYUULT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SQATTZ.exe UPS.exe File created C:\windows\system\GWJX.exe CGCXXAR.exe File created C:\windows\GWLWGIS.exe.bat LBGMV.exe File created C:\windows\system\IACZM.exe CAU.exe File opened for modification C:\windows\BNZFDJ.exe MSH.exe File created C:\windows\system\PLBLU.exe.bat XIX.exe File created C:\windows\system\MWKLN.exe.bat GVD.exe File created C:\windows\MQQYFQ.exe.bat SCTP.exe File created C:\windows\system\QFSZVD.exe NXD.exe File created C:\windows\system\UXAQMI.exe YSCT.exe File opened for modification C:\windows\system\GROA.exe GWLWGIS.exe File created C:\windows\system\QCH.exe ZUS.exe File created C:\windows\system\MSH.exe FBAV.exe File created C:\windows\system\UJNTTGG.exe.bat ITHLO.exe File created C:\windows\system\MWKLN.exe GVD.exe File opened for modification C:\windows\system\DNEZQM.exe ZXX.exe File opened for modification C:\windows\system\CGCXXAR.exe ROZEOT.exe File opened for modification C:\windows\system\QCH.exe ZUS.exe File created C:\windows\system\EISYMW.exe.bat YNAYQT.exe File created C:\windows\AJYAEY.exe ADXMD.exe File opened for modification C:\windows\system\MSH.exe FBAV.exe File opened for modification C:\windows\NBKNDIA.exe IACZM.exe File created C:\windows\system\JHXRXS.exe FZQJ.exe File opened for modification C:\windows\IOOW.exe NBKNDIA.exe File created C:\windows\system\DNEZQM.exe ZXX.exe File created C:\windows\BYKXB.exe.bat ZARD.exe File created C:\windows\RWVHYS.exe ZTJELCA.exe File created C:\windows\system\STE.exe.bat SQATTZ.exe File created C:\windows\WMPHDTJ.exe.bat BYKXB.exe File created C:\windows\system\SPKR.exe.bat IHI.exe File created C:\windows\system\QCH.exe.bat ZUS.exe File opened for modification C:\windows\system\MWKLN.exe GVD.exe File opened for modification C:\windows\YNAYQT.exe JSJ.exe File created C:\windows\PRQWF.exe.bat EYND.exe File created C:\windows\FNM.exe ZNEYC.exe File created C:\windows\system\WZGNU.exe.bat MZE.exe File opened for modification C:\windows\system\PJPSM.exe LTI.exe File created C:\windows\NXD.exe JHXRXS.exe File created C:\windows\YNAYQT.exe JSJ.exe File created C:\windows\RWVHYS.exe.bat ZTJELCA.exe File created C:\windows\TRS.exe MVSUM.exe File created C:\windows\FZQJ.exe.bat PJPSM.exe File created C:\windows\system\ROZEOT.exe BYYN.exe File created C:\windows\system\TZAGG.exe PWCKGFV.exe File created C:\windows\FBAV.exe.bat 2026-09-24_cab1d508fd980262c091d9d186aced16_elex_emotet_stop.exe File created C:\windows\CVSYEK.exe.bat WVLK.exe File opened for modification C:\windows\system\XAJQAMC.exe DNEZQM.exe File created C:\windows\SQATTZ.exe.bat UPS.exe File created C:\windows\QGNH.exe.bat PLBLU.exe File created C:\windows\system\SOM.exe.bat TDJL.exe File created C:\windows\system\IHANM.exe NUV.exe File created C:\windows\system\BYYN.exe OVQO.exe File opened for modification C:\windows\system\IACZM.exe CAU.exe File created C:\windows\system\SPKR.exe IHI.exe File created C:\windows\QGNH.exe PLBLU.exe File created C:\windows\VYXKC.exe.bat RQQ.exe File created C:\windows\system\JSJ.exe.bat ARHO.exe File created C:\windows\system\CTGU.exe.bat STE.exe File opened for modification C:\windows\system\IHI.exe TMYIY.exe File created C:\windows\system\IHI.exe.bat TMYIY.exe File opened for modification C:\windows\UYUULT.exe EITVF.exe File created C:\windows\system\UHKXB.exe ZZB.exe File created C:\windows\SCTP.exe.bat SXT.exe File created C:\windows\MKA.exe RWVHYS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4424 cmd.exe 2492 cmd.exe 3064 cmd.exe 3516 cmd.exe 3564 cmd.exe 5332 cmd.exe 3076 cmd.exe 3060 cmd.exe 2592 cmd.exe 5124 cmd.exe 560 cmd.exe 4984 cmd.exe 3056 cmd.exe 5060 cmd.exe 2680 cmd.exe 5652 cmd.exe 5136 cmd.exe 5704 cmd.exe 756 cmd.exe 248 cmd.exe 5724 cmd.exe 5008 cmd.exe 3892 cmd.exe 200 cmd.exe 3356 cmd.exe 2480 cmd.exe 2736 cmd.exe 1340 cmd.exe 1144 cmd.exe 2676 cmd.exe 720 cmd.exe 4464 cmd.exe 3336 cmd.exe 3536 cmd.exe 2780 cmd.exe 5764 cmd.exe 5276 cmd.exe 4896 cmd.exe 3620 cmd.exe 2456 cmd.exe 5132 cmd.exe 2360 cmd.exe 4208 cmd.exe 5640 cmd.exe 3156 cmd.exe 5216 cmd.exe 4940 cmd.exe 4332 cmd.exe 4248 cmd.exe 2140 cmd.exe 1544 cmd.exe 1332 cmd.exe 4104 cmd.exe 5648 cmd.exe 5984 cmd.exe 1548 cmd.exe 4116 cmd.exe 3140 cmd.exe 5788 cmd.exe 852 cmd.exe 4200 cmd.exe 4304 cmd.exe 1832 cmd.exe 5068 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2924 4372 WerFault.exe 87 4984 4280 WerFault.exe 93 5056 204 WerFault.exe 99 2460 1052 WerFault.exe 104 4656 2672 WerFault.exe 109 1524 6004 WerFault.exe 114 5548 4488 WerFault.exe 119 5732 3444 WerFault.exe 124 4800 5712 WerFault.exe 129 4624 3452 WerFault.exe 134 2372 5708 WerFault.exe 139 5124 4188 WerFault.exe 144 5232 4444 WerFault.exe 149 3060 1108 WerFault.exe 154 5900 5852 WerFault.exe 159 4200 528 WerFault.exe 164 3268 4324 WerFault.exe 169 1992 2576 WerFault.exe 174 4152 5928 WerFault.exe 179 2652 4844 WerFault.exe 184 2392 3808 WerFault.exe 189 4512 4100 WerFault.exe 194 4112 5980 WerFault.exe 199 1932 6140 WerFault.exe 204 4724 1424 WerFault.exe 209 3164 3472 WerFault.exe 214 2812 3880 WerFault.exe 219 3648 1408 WerFault.exe 224 6048 3008 WerFault.exe 229 1892 5732 WerFault.exe 234 4564 1592 WerFault.exe 239 4744 4780 WerFault.exe 244 2616 6032 WerFault.exe 249 5724 4112 WerFault.exe 254 2688 2084 WerFault.exe 259 2780 4460 WerFault.exe 264 4728 860 WerFault.exe 269 3052 2812 WerFault.exe 274 2628 2668 WerFault.exe 279 5860 3792 WerFault.exe 285 4184 4556 WerFault.exe 290 4204 4860 WerFault.exe 295 2108 944 WerFault.exe 300 2156 868 WerFault.exe 305 3532 3844 WerFault.exe 310 2868 1512 WerFault.exe 315 1992 976 WerFault.exe 320 5252 1376 WerFault.exe 325 1604 5468 WerFault.exe 330 2316 4640 WerFault.exe 335 4668 5696 WerFault.exe 340 5124 1976 WerFault.exe 345 2664 3364 WerFault.exe 350 4988 5480 WerFault.exe 355 5440 2688 WerFault.exe 360 5160 5564 WerFault.exe 365 5368 3428 WerFault.exe 370 2628 2848 WerFault.exe 375 5276 4916 WerFault.exe 380 5428 3084 WerFault.exe 385 4520 2356 WerFault.exe 390 2892 5388 WerFault.exe 395 4412 2464 WerFault.exe 400 5796 5940 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJYAEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VYXKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTGU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MNPZRP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBKNDIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EISYMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBGMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLQUMWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSFKWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHYTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVBKHOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVSUM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XIX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNAYQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CWOGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EITVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GHZYUMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNEZQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGCXXAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFQCSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4372 2026-09-24_cab1d508fd980262c091d9d186aced16_elex_emotet_stop.exe 4372 2026-09-24_cab1d508fd980262c091d9d186aced16_elex_emotet_stop.exe 4280 FBAV.exe 4280 FBAV.exe 204 MSH.exe 204 MSH.exe 1052 BNZFDJ.exe 1052 BNZFDJ.exe 2672 SVBKHOD.exe 2672 SVBKHOD.exe 6004 WDHS.exe 6004 WDHS.exe 4488 LTI.exe 4488 LTI.exe 3444 PJPSM.exe 3444 PJPSM.exe 5712 FZQJ.exe 5712 FZQJ.exe 3452 JHXRXS.exe 3452 JHXRXS.exe 5708 NXD.exe 5708 NXD.exe 4188 QFSZVD.exe 4188 QFSZVD.exe 4444 ADXMD.exe 4444 ADXMD.exe 1108 AJYAEY.exe 1108 AJYAEY.exe 5852 MZE.exe 5852 MZE.exe 528 WZGNU.exe 528 WZGNU.exe 4324 QUDXEN.exe 4324 QUDXEN.exe 2576 WVLK.exe 2576 WVLK.exe 5928 CVSYEK.exe 5928 CVSYEK.exe 4844 XIX.exe 4844 XIX.exe 3808 PLBLU.exe 3808 PLBLU.exe 4100 QGNH.exe 4100 QGNH.exe 5980 KUJQK.exe 5980 KUJQK.exe 6140 HZPNR.exe 6140 HZPNR.exe 1424 HFQCSM.exe 1424 HFQCSM.exe 3472 CAU.exe 3472 CAU.exe 3880 IACZM.exe 3880 IACZM.exe 1408 NBKNDIA.exe 1408 NBKNDIA.exe 3008 IOOW.exe 3008 IOOW.exe 5732 ITHLO.exe 5732 ITHLO.exe 1592 UJNTTGG.exe 1592 UJNTTGG.exe 4780 YSCT.exe 4780 YSCT.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4372 2026-09-24_cab1d508fd980262c091d9d186aced16_elex_emotet_stop.exe 4372 2026-09-24_cab1d508fd980262c091d9d186aced16_elex_emotet_stop.exe 4280 FBAV.exe 4280 FBAV.exe 204 MSH.exe 204 MSH.exe 1052 BNZFDJ.exe 1052 BNZFDJ.exe 2672 SVBKHOD.exe 2672 SVBKHOD.exe 6004 WDHS.exe 6004 WDHS.exe 4488 LTI.exe 4488 LTI.exe 3444 PJPSM.exe 3444 PJPSM.exe 5712 FZQJ.exe 5712 FZQJ.exe 3452 JHXRXS.exe 3452 JHXRXS.exe 5708 NXD.exe 5708 NXD.exe 4188 QFSZVD.exe 4188 QFSZVD.exe 4444 ADXMD.exe 4444 ADXMD.exe 1108 AJYAEY.exe 1108 AJYAEY.exe 5852 MZE.exe 5852 MZE.exe 528 WZGNU.exe 528 WZGNU.exe 4324 QUDXEN.exe 4324 QUDXEN.exe 2576 WVLK.exe 2576 WVLK.exe 5928 CVSYEK.exe 5928 CVSYEK.exe 4844 XIX.exe 4844 XIX.exe 3808 PLBLU.exe 3808 PLBLU.exe 4100 QGNH.exe 4100 QGNH.exe 5980 KUJQK.exe 5980 KUJQK.exe 6140 HZPNR.exe 6140 HZPNR.exe 1424 HFQCSM.exe 1424 HFQCSM.exe 3472 CAU.exe 3472 CAU.exe 3880 IACZM.exe 3880 IACZM.exe 1408 NBKNDIA.exe 1408 NBKNDIA.exe 3008 IOOW.exe 3008 IOOW.exe 5732 ITHLO.exe 5732 ITHLO.exe 1592 UJNTTGG.exe 1592 UJNTTGG.exe 4780 YSCT.exe 4780 YSCT.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 2836 4372 2026-09-24_cab1d508fd980262c091d9d186aced16_elex_emotet_stop.exe 89 PID 2836 wrote to memory of 4280 2836 cmd.exe 93 PID 4280 wrote to memory of 1348 4280 FBAV.exe 95 PID 1348 wrote to memory of 204 1348 cmd.exe 99 PID 204 wrote to memory of 4684 204 MSH.exe 100 PID 4684 wrote to memory of 1052 4684 cmd.exe 104 PID 1052 wrote to memory of 624 1052 BNZFDJ.exe 105 PID 624 wrote to memory of 2672 624 cmd.exe 109 PID 2672 wrote to memory of 4580 2672 SVBKHOD.exe 110 PID 4580 wrote to memory of 6004 4580 cmd.exe 114 PID 6004 wrote to memory of 5060 6004 WDHS.exe 115 PID 5060 wrote to memory of 4488 5060 cmd.exe 119 PID 4488 wrote to memory of 4896 4488 LTI.exe 120 PID 4896 wrote to memory of 3444 4896 cmd.exe 124 PID 3444 wrote to memory of 2612 3444 PJPSM.exe 125 PID 2612 wrote to memory of 5712 2612 cmd.exe 129 PID 5712 wrote to memory of 5840 5712 FZQJ.exe 130 PID 5840 wrote to memory of 3452 5840 cmd.exe 134 PID 3452 wrote to memory of 5748 3452 JHXRXS.exe 135 PID 5748 wrote to memory of 5708 5748 cmd.exe 139 PID 5708 wrote to memory of 1776 5708 NXD.exe 140 PID 1776 wrote to memory of 4188 1776 cmd.exe 144 PID 4188 wrote to memory of 4464 4188 QFSZVD.exe 145 PID 4464 wrote to memory of 4444 4464 cmd.exe 149 PID 4444 wrote to memory of 248 4444 ADXMD.exe 150 PID 248 wrote to memory of 1108 248 cmd.exe 154 PID 1108 wrote to memory of 2476 1108 AJYAEY.exe 155 PID 2476 wrote to memory of 5852 2476 cmd.exe 159 PID 5852 wrote to memory of 2460 5852 MZE.exe 160 PID 2460 wrote to memory of 528 2460 cmd.exe 164 PID 528 wrote to memory of 4816 528 WZGNU.exe 165 PID 4816 wrote to memory of 4324 4816 cmd.exe 169 PID 4324 wrote to memory of 4484 4324 QUDXEN.exe 170 PID 4484 wrote to memory of 2576 4484 cmd.exe 174 PID 2576 wrote to memory of 2320 2576 WVLK.exe 175 PID 2320 wrote to memory of 5928 2320 cmd.exe 179 PID 5928 wrote to memory of 3380 5928 CVSYEK.exe 180 PID 3380 wrote to memory of 4844 3380 cmd.exe 184 PID 4844 wrote to memory of 6060 4844 XIX.exe 185 PID 6060 wrote to memory of 3808 6060 cmd.exe 189 PID 3808 wrote to memory of 5424 3808 PLBLU.exe 190 PID 5424 wrote to memory of 4100 5424 cmd.exe 194 PID 4100 wrote to memory of 244 4100 QGNH.exe 195 PID 244 wrote to memory of 5980 244 cmd.exe 199 PID 5980 wrote to memory of 4500 5980 KUJQK.exe 200 PID 4500 wrote to memory of 6140 4500 cmd.exe 204 PID 6140 wrote to memory of 1508 6140 HZPNR.exe 205 PID 1508 wrote to memory of 1424 1508 cmd.exe 209 PID 1424 wrote to memory of 5216 1424 HFQCSM.exe 210 PID 5216 wrote to memory of 3472 5216 cmd.exe 214 PID 3472 wrote to memory of 4348 3472 CAU.exe 215 PID 4348 wrote to memory of 3880 4348 cmd.exe 219 PID 3880 wrote to memory of 300 3880 IACZM.exe 220 PID 300 wrote to memory of 1408 300 cmd.exe 224 PID 1408 wrote to memory of 5100 1408 NBKNDIA.exe 225 PID 5100 wrote to memory of 3008 5100 cmd.exe 229 PID 3008 wrote to memory of 1384 3008 IOOW.exe 230 PID 1384 wrote to memory of 5732 1384 cmd.exe 234 PID 5732 wrote to memory of 2044 5732 ITHLO.exe 235 PID 2044 wrote to memory of 1592 2044 cmd.exe 239 PID 1592 wrote to memory of 2152 1592 UJNTTGG.exe 240 PID 2152 wrote to memory of 4780 2152 cmd.exe 244 PID 4780 wrote to memory of 3620 4780 YSCT.exe 245 PID 3620 wrote to memory of 6032 3620 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_cab1d508fd980262c091d9d186aced16_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_cab1d508fd980262c091d9d186aced16_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBAV.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\windows\FBAV.exeC:\windows\FBAV.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MSH.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\windows\system\MSH.exeC:\windows\system\MSH.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNZFDJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\BNZFDJ.exeC:\windows\BNZFDJ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVBKHOD.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624 -
C:\windows\SysWOW64\SVBKHOD.exeC:\windows\system32\SVBKHOD.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDHS.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\windows\SysWOW64\WDHS.exeC:\windows\system32\WDHS.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LTI.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\windows\SysWOW64\LTI.exeC:\windows\system32\LTI.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJPSM.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\system\PJPSM.exeC:\windows\system\PJPSM.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZQJ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\windows\FZQJ.exeC:\windows\FZQJ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JHXRXS.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\windows\system\JHXRXS.exeC:\windows\system\JHXRXS.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXD.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\NXD.exeC:\windows\NXD.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFSZVD.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\windows\system\QFSZVD.exeC:\windows\system\QFSZVD.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADXMD.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\windows\ADXMD.exeC:\windows\ADXMD.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AJYAEY.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\AJYAEY.exeC:\windows\AJYAEY.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZE.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\windows\SysWOW64\MZE.exeC:\windows\system32\MZE.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZGNU.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\windows\system\WZGNU.exeC:\windows\system\WZGNU.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUDXEN.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\system\QUDXEN.exeC:\windows\system\QUDXEN.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVLK.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\windows\system\WVLK.exeC:\windows\system\WVLK.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CVSYEK.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\windows\CVSYEK.exeC:\windows\CVSYEK.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XIX.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\windows\system\XIX.exeC:\windows\system\XIX.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PLBLU.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\windows\system\PLBLU.exeC:\windows\system\PLBLU.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGNH.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\QGNH.exeC:\windows\QGNH.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUJQK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\SysWOW64\KUJQK.exeC:\windows\system32\KUJQK.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HZPNR.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\windows\SysWOW64\HZPNR.exeC:\windows\system32\HZPNR.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HFQCSM.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\HFQCSM.exeC:\windows\HFQCSM.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CAU.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\windows\SysWOW64\CAU.exeC:\windows\system32\CAU.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IACZM.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\system\IACZM.exeC:\windows\system\IACZM.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBKNDIA.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:300 -
C:\windows\NBKNDIA.exeC:\windows\NBKNDIA.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOOW.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\windows\IOOW.exeC:\windows\IOOW.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ITHLO.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\windows\system\ITHLO.exeC:\windows\system\ITHLO.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJNTTGG.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\windows\system\UJNTTGG.exeC:\windows\system\UJNTTGG.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSCT.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\windows\system\YSCT.exeC:\windows\system\YSCT.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXAQMI.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\windows\system\UXAQMI.exeC:\windows\system\UXAQMI.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UDAEVVZ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1656 -
C:\windows\SysWOW64\UDAEVVZ.exeC:\windows\system32\UDAEVVZ.exe67⤵
- Executes dropped EXE
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVD.exe.bat" "68⤵PID:4508
-
C:\windows\GVD.exeC:\windows\GVD.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWKLN.exe.bat" "70⤵PID:4064
-
C:\windows\system\MWKLN.exeC:\windows\system\MWKLN.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWK.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2736 -
C:\windows\SysWOW64\RWK.exeC:\windows\system32\RWK.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJ.exe.bat" "74⤵PID:52
-
C:\windows\SysWOW64\PRJ.exeC:\windows\system32\PRJ.exe75⤵
- Executes dropped EXE
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UXCP.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5332 -
C:\windows\UXCP.exeC:\windows\UXCP.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NSFKWN.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2240 -
C:\windows\SysWOW64\NSFKWN.exeC:\windows\system32\NSFKWN.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVJ.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5788 -
C:\windows\SysWOW64\NVJ.exeC:\windows\system32\NVJ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XDLTFI.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2680 -
C:\windows\SysWOW64\XDLTFI.exeC:\windows\system32\XDLTFI.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQQ.exe.bat" "84⤵PID:5500
-
C:\windows\SysWOW64\RQQ.exeC:\windows\system32\RQQ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VYXKC.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4940 -
C:\windows\VYXKC.exeC:\windows\VYXKC.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BZE.exe.bat" "88⤵
- Executes a command shell one-liner
PID:5724 -
C:\windows\SysWOW64\BZE.exeC:\windows\system32\BZE.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARHO.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5080 -
C:\windows\SysWOW64\ARHO.exeC:\windows\system32\ARHO.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JSJ.exe.bat" "92⤵PID:3488
-
C:\windows\system\JSJ.exeC:\windows\system\JSJ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YNAYQT.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4332 -
C:\windows\YNAYQT.exeC:\windows\YNAYQT.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EISYMW.exe.bat" "96⤵PID:3476
-
C:\windows\system\EISYMW.exeC:\windows\system\EISYMW.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDJL.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3076 -
C:\windows\SysWOW64\TDJL.exeC:\windows\system32\TDJL.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SOM.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5172 -
C:\windows\system\SOM.exeC:\windows\system\SOM.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWOGS.exe.bat" "102⤵PID:2944
-
C:\windows\SysWOW64\CWOGS.exeC:\windows\system32\CWOGS.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRX.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:1264 -
C:\windows\RRX.exeC:\windows\RRX.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXX.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5008 -
C:\windows\SysWOW64\ZXX.exeC:\windows\system32\ZXX.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNEZQM.exe.bat" "108⤵
- Executes a command shell one-liner
PID:756 -
C:\windows\system\DNEZQM.exeC:\windows\system\DNEZQM.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XAJQAMC.exe.bat" "110⤵PID:5084
-
C:\windows\system\XAJQAMC.exeC:\windows\system\XAJQAMC.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVSUM.exe.bat" "112⤵PID:4560
-
C:\windows\SysWOW64\MVSUM.exeC:\windows\system32\MVSUM.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRS.exe.bat" "114⤵PID:692
-
C:\windows\TRS.exeC:\windows\TRS.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PWCKGFV.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3336 -
C:\windows\SysWOW64\PWCKGFV.exeC:\windows\system32\PWCKGFV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TZAGG.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5648 -
C:\windows\system\TZAGG.exeC:\windows\system\TZAGG.exe119⤵
- Executes dropped EXE
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXT.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4564 -
C:\windows\system\SXT.exeC:\windows\system\SXT.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-