Analysis
- max time kernel
78s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 06:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe
- Size 208KB
- Sample260930-hpsdeawemb
- SHA256 f411555ca6b562eca05bcaa9e1eb3a860c3785ad079c6f90eb7588c241fc4f8d
- MD5 ec27fc959d3deff9862921af27d79092
- SHA1 523a5b7f9778c2abe10e3e719ce68f1cf3394880
- SHA512 0f7c22ff8a75fafe2d0ba43d397e5cae15f4a5f11a4aa28dd3187e9e9e3c89043eff121b69fedf33f65d89e5e0c4da3a9c9694059fa8d3d04a4cdbe06493cc6f
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfH4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LO/kEj1
- TLSH T1FA247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5628 QVMINTJ.exe 5552 JZP.exe 4416 TWV.exe 956 XZT.exe 2432 UFLZ.exe 5452 USMNI.exe 1608 VOPJWEX.exe 5268 AOXW.exe 2088 YOFKOI.exe 1836 IMKFVR.exe 1688 MXJA.exe 5500 UCV.exe 4776 CIA.exe 5472 UQO.exe 300 NJEVUZ.exe 2800 RZKDH.exe 2876 QKNT.exe 5660 INRPVN.exe 808 ANT.exe 5248 PICGJ.exe 5604 PWCVTK.exe 4444 VWK.exe 2148 XMDD.exe 4832 KWUBOMR.exe 3920 YSFUCAH.exe 2176 YXKJNH.exe 4620 ZAOFS.exe 5788 BVFGEI.exe 3412 WJK.exe 892 VUNGXWE.exe 2468 MCBLJNZ.exe 676 ZAJXL.exe 2164 ADNSYPK.exe 1244 RLTX.exe 4492 FOKORII.exe 5864 LJJ.exe 5404 HOTM.exe 4468 XFUETCH.exe 2080 IXKPC.exe 3284 OSJ.exe 3708 BDROVJ.exe 5840 NLY.exe 4148 CRELO.exe 5600 CMHPUBA.exe 3048 QSP.exe 4604 DCYZKP.exe 252 PKE.exe 3988 INIVC.exe 3764 BBPBH.exe 5244 DZVVW.exe 1476 HHBVAAN.exe 5324 IKFR.exe 4204 ANR.exe 952 MVYVG.exe 2952 ZGG.exe 3956 JGIYX.exe 3664 TEOT.exe 4528 THSOSE.exe 1416 MKDSY.exe 4764 HXICIUS.exe 2816 DYKEMY.exe 5980 GLP.exe 5156 FBAQJD.exe 4640 QTDJRLN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\DZVVW.exe BBPBH.exe File created C:\windows\SysWOW64\DZVVW.exe.bat BBPBH.exe File created C:\windows\SysWOW64\CUOEP.exe.bat YMI.exe File created C:\windows\SysWOW64\WRUEHMC.exe FJSZE.exe File created C:\windows\SysWOW64\NLY.exe.bat BDROVJ.exe File created C:\windows\SysWOW64\THSOSE.exe.bat TEOT.exe File opened for modification C:\windows\SysWOW64\FBAQJD.exe GLP.exe File created C:\windows\SysWOW64\NDQDXY.exe MAMI.exe File opened for modification C:\windows\SysWOW64\CYIQ.exe NDQDXY.exe File created C:\windows\SysWOW64\IUBQTO.exe.bat JJRAKIE.exe File created C:\windows\SysWOW64\XFUETCH.exe.bat HOTM.exe File opened for modification C:\windows\SysWOW64\BDROVJ.exe OSJ.exe File opened for modification C:\windows\SysWOW64\THSOSE.exe TEOT.exe File created C:\windows\SysWOW64\FJSZE.exe.bat BBM.exe File opened for modification C:\windows\SysWOW64\NDQDXY.exe MAMI.exe File created C:\windows\SysWOW64\SCVVW.exe.bat IUBQTO.exe File created C:\windows\SysWOW64\YOFKOI.exe AOXW.exe File created C:\windows\SysWOW64\YOFKOI.exe.bat AOXW.exe File created C:\windows\SysWOW64\UQO.exe CIA.exe File created C:\windows\SysWOW64\VWK.exe PWCVTK.exe File opened for modification C:\windows\SysWOW64\YXKJNH.exe YSFUCAH.exe File created C:\windows\SysWOW64\IUBQTO.exe JJRAKIE.exe File created C:\windows\SysWOW64\BVFGEI.exe ZAOFS.exe File created C:\windows\SysWOW64\MVYVG.exe.bat ANR.exe File created C:\windows\SysWOW64\CYIQ.exe NDQDXY.exe File created C:\windows\SysWOW64\IWDD.exe VLVF.exe File opened for modification C:\windows\SysWOW64\CXPGGCW.exe HVGIRRB.exe File created C:\windows\SysWOW64\QVMINTJ.exe.bat 2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe File created C:\windows\SysWOW64\UCV.exe MXJA.exe File created C:\windows\SysWOW64\PICGJ.exe.bat ANT.exe File created C:\windows\SysWOW64\PKE.exe DCYZKP.exe File created C:\windows\SysWOW64\PKE.exe.bat DCYZKP.exe File created C:\windows\SysWOW64\HXICIUS.exe.bat MKDSY.exe File opened for modification C:\windows\SysWOW64\FJSZE.exe BBM.exe File created C:\windows\SysWOW64\ZAJXL.exe MCBLJNZ.exe File opened for modification C:\windows\SysWOW64\NLY.exe BDROVJ.exe File created C:\windows\SysWOW64\CUOEP.exe YMI.exe File opened for modification C:\windows\SysWOW64\WRUEHMC.exe FJSZE.exe File opened for modification C:\windows\SysWOW64\HVGIRRB.exe DJINKY.exe File created C:\windows\SysWOW64\RZKDH.exe NJEVUZ.exe File created C:\windows\SysWOW64\PICGJ.exe ANT.exe File created C:\windows\SysWOW64\ZAOFS.exe YXKJNH.exe File opened for modification C:\windows\SysWOW64\MVYVG.exe ANR.exe File opened for modification C:\windows\SysWOW64\CUOEP.exe YMI.exe File created C:\windows\SysWOW64\NDQDXY.exe.bat MAMI.exe File created C:\windows\SysWOW64\SCVVW.exe IUBQTO.exe File created C:\windows\SysWOW64\TWV.exe.bat JZP.exe File created C:\windows\SysWOW64\UCV.exe.bat MXJA.exe File created C:\windows\SysWOW64\VWK.exe.bat PWCVTK.exe File created C:\windows\SysWOW64\BDROVJ.exe.bat OSJ.exe File opened for modification C:\windows\SysWOW64\PKE.exe DCYZKP.exe File created C:\windows\SysWOW64\DZVVW.exe BBPBH.exe File created C:\windows\SysWOW64\HXICIUS.exe MKDSY.exe File opened for modification C:\windows\SysWOW64\HXICIUS.exe MKDSY.exe File created C:\windows\SysWOW64\QVMINTJ.exe 2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\PICGJ.exe ANT.exe File opened for modification C:\windows\SysWOW64\VWK.exe PWCVTK.exe File created C:\windows\SysWOW64\LJJ.exe.bat FOKORII.exe File opened for modification C:\windows\SysWOW64\SCVVW.exe IUBQTO.exe File opened for modification C:\windows\SysWOW64\QVMINTJ.exe 2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\TWV.exe JZP.exe File created C:\windows\SysWOW64\LJJ.exe FOKORII.exe File created C:\windows\SysWOW64\BDROVJ.exe OSJ.exe File created C:\windows\SysWOW64\WRUEHMC.exe.bat FJSZE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\XMDD.exe.bat VWK.exe File created C:\windows\system\HOTM.exe LJJ.exe File opened for modification C:\windows\MKDSY.exe THSOSE.exe File created C:\windows\DMEJS.exe WRUEHMC.exe File created C:\windows\system\XKLIL.exe GZJSCZ.exe File created C:\windows\UFLZ.exe.bat XZT.exe File opened for modification C:\windows\system\CIA.exe UCV.exe File created C:\windows\system\QKNT.exe RZKDH.exe File opened for modification C:\windows\system\RLTX.exe ADNSYPK.exe File opened for modification C:\windows\system\IXKPC.exe XFUETCH.exe File opened for modification C:\windows\QSP.exe CMHPUBA.exe File created C:\windows\system\ANR.exe.bat IKFR.exe File created C:\windows\system\JGIYX.exe ZGG.exe File created C:\windows\system\AOXW.exe VOPJWEX.exe File created C:\windows\BBPBH.exe INIVC.exe File created C:\windows\system\HHBVAAN.exe.bat DZVVW.exe File created C:\windows\system\ZGG.exe MVYVG.exe File created C:\windows\system\XLFRFE.exe.bat PFFDE.exe File opened for modification C:\windows\BBM.exe XLFRFE.exe File created C:\windows\system\MAMI.exe.bat XKLIL.exe File created C:\windows\VLVF.exe CQRJGFN.exe File created C:\windows\system\QKNT.exe.bat RZKDH.exe File created C:\windows\PWCVTK.exe PICGJ.exe File created C:\windows\system\MCBLJNZ.exe.bat VUNGXWE.exe File created C:\windows\system\HOTM.exe.bat LJJ.exe File created C:\windows\GZJSCZ.exe DMEJS.exe File created C:\windows\system\VAB.exe CXPGGCW.exe File created C:\windows\JJRAKIE.exe.bat JGNWF.exe File created C:\windows\system\WJK.exe.bat BVFGEI.exe File created C:\windows\system\VUNGXWE.exe WJK.exe File created C:\windows\OSJ.exe.bat IXKPC.exe File opened for modification C:\windows\system\INIVC.exe PKE.exe File created C:\windows\system\ZGG.exe.bat MVYVG.exe File opened for modification C:\windows\system\TEOT.exe JGIYX.exe File created C:\windows\system\QTDJRLN.exe FBAQJD.exe File created C:\windows\DMEJS.exe.bat WRUEHMC.exe File opened for modification C:\windows\YSFUCAH.exe KWUBOMR.exe File created C:\windows\system\MCBLJNZ.exe VUNGXWE.exe File created C:\windows\system\FOKORII.exe.bat RLTX.exe File created C:\windows\BBPBH.exe.bat INIVC.exe File opened for modification C:\windows\system\DYKEMY.exe HXICIUS.exe File opened for modification C:\windows\system\PEIBKWW.exe CYIQ.exe File created C:\windows\system\PEIBKWW.exe.bat CYIQ.exe File created C:\windows\system\PDXPM.exe OIT.exe File opened for modification C:\windows\BBPBH.exe INIVC.exe File opened for modification C:\windows\system\ZGG.exe MVYVG.exe File created C:\windows\system\PFFDE.exe CUOEP.exe File opened for modification C:\windows\system\STE.exe PDXPM.exe File opened for modification C:\windows\system\VAB.exe CXPGGCW.exe File opened for modification C:\windows\JVTUX.exe FNM.exe File opened for modification C:\windows\system\MCBLJNZ.exe VUNGXWE.exe File created C:\windows\system\IXKPC.exe.bat XFUETCH.exe File opened for modification C:\windows\system\XLFRFE.exe PFFDE.exe File created C:\windows\system\MAMI.exe XKLIL.exe File created C:\windows\JGNWF.exe.bat HIHCXK.exe File opened for modification C:\windows\JJRAKIE.exe JGNWF.exe File created C:\windows\JVTUX.exe.bat FNM.exe File created C:\windows\VOPJWEX.exe.bat USMNI.exe File opened for modification C:\windows\system\AOXW.exe VOPJWEX.exe File created C:\windows\system\CMHPUBA.exe CRELO.exe File created C:\windows\YSFUCAH.exe.bat KWUBOMR.exe File created C:\windows\system\OIT.exe KSML.exe File created C:\windows\system\AOXW.exe.bat VOPJWEX.exe File created C:\windows\system\IMKFVR.exe YOFKOI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 804 cmd.exe 1808 cmd.exe 2684 cmd.exe 4272 cmd.exe 1380 cmd.exe 3324 cmd.exe 476 cmd.exe 3312 cmd.exe 4788 cmd.exe 3232 cmd.exe 4180 cmd.exe 4276 cmd.exe 2440 cmd.exe 976 cmd.exe 3892 cmd.exe 4824 cmd.exe 1220 cmd.exe 3996 cmd.exe 4372 cmd.exe 1956 cmd.exe 3688 cmd.exe 240 cmd.exe 4160 cmd.exe 5468 cmd.exe 4552 cmd.exe 5592 cmd.exe 5732 cmd.exe 4968 cmd.exe 2964 cmd.exe 4648 cmd.exe 2772 cmd.exe 1284 cmd.exe 2180 cmd.exe 4348 cmd.exe 2824 cmd.exe 2912 cmd.exe 1932 cmd.exe 3084 cmd.exe 4744 cmd.exe 1320 cmd.exe 1892 cmd.exe 2256 cmd.exe 5288 cmd.exe 4812 cmd.exe 4560 cmd.exe 2972 cmd.exe 2112 cmd.exe 2792 cmd.exe 2424 cmd.exe 4340 cmd.exe 4176 cmd.exe 1644 cmd.exe 3228 cmd.exe 4944 cmd.exe 3916 cmd.exe 3476 cmd.exe 4908 cmd.exe 4980 cmd.exe 2056 cmd.exe 1964 cmd.exe 3036 cmd.exe 4360 cmd.exe 3136 cmd.exe 1848 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5876 1448 WerFault.exe 87 3536 5628 WerFault.exe 93 4828 5552 WerFault.exe 99 4652 4416 WerFault.exe 104 476 956 WerFault.exe 109 4436 2432 WerFault.exe 113 3928 5452 WerFault.exe 119 2672 1608 WerFault.exe 124 5432 5268 WerFault.exe 129 5840 2088 WerFault.exe 134 924 1836 WerFault.exe 139 5856 1688 WerFault.exe 144 5632 5500 WerFault.exe 149 4992 4776 WerFault.exe 154 4652 5472 WerFault.exe 159 1272 300 WerFault.exe 164 1712 2800 WerFault.exe 169 5292 2876 WerFault.exe 174 3960 5660 WerFault.exe 179 5388 808 WerFault.exe 184 5780 5248 WerFault.exe 189 5072 5604 WerFault.exe 194 3948 4444 WerFault.exe 199 5760 2148 WerFault.exe 204 368 4832 WerFault.exe 209 1160 3920 WerFault.exe 214 1316 2176 WerFault.exe 219 1344 4620 WerFault.exe 224 1812 5788 WerFault.exe 229 5884 3412 WerFault.exe 234 4924 892 WerFault.exe 239 5512 2468 WerFault.exe 244 4248 676 WerFault.exe 249 1164 2164 WerFault.exe 254 940 1244 WerFault.exe 259 3416 4492 WerFault.exe 264 1556 5864 WerFault.exe 270 3036 5404 WerFault.exe 275 3500 4468 WerFault.exe 280 4796 2080 WerFault.exe 285 1476 3284 WerFault.exe 290 912 3708 WerFault.exe 295 4836 5840 WerFault.exe 300 8 4148 WerFault.exe 305 4352 5600 WerFault.exe 310 4476 3048 WerFault.exe 315 4844 4604 WerFault.exe 320 712 252 WerFault.exe 325 3424 3988 WerFault.exe 330 1812 3764 WerFault.exe 335 5732 5244 WerFault.exe 340 5728 1476 WerFault.exe 345 2464 5324 WerFault.exe 350 5012 4204 WerFault.exe 355 940 952 WerFault.exe 360 4780 2952 WerFault.exe 365 4652 3956 WerFault.exe 370 1432 3664 WerFault.exe 375 724 4528 WerFault.exe 380 3960 1416 WerFault.exe 385 2656 4764 WerFault.exe 390 4836 2816 WerFault.exe 395 2240 5980 WerFault.exe 400 5676 5156 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWUBOMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRELO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHBVAAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDQDXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGNWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBPBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVGIRRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCVVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZJSCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USMNI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMKFVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMHPUBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMEJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDROVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGIYX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THSOSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBAQJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKLIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDXPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOFKOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSFUCAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOKORII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1448 2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe 1448 2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe 5628 QVMINTJ.exe 5628 QVMINTJ.exe 5552 JZP.exe 5552 JZP.exe 4416 TWV.exe 4416 TWV.exe 956 XZT.exe 956 XZT.exe 2432 UFLZ.exe 2432 UFLZ.exe 5452 USMNI.exe 5452 USMNI.exe 1608 VOPJWEX.exe 1608 VOPJWEX.exe 5268 AOXW.exe 5268 AOXW.exe 2088 YOFKOI.exe 2088 YOFKOI.exe 1836 IMKFVR.exe 1836 IMKFVR.exe 1688 MXJA.exe 1688 MXJA.exe 5500 UCV.exe 5500 UCV.exe 4776 CIA.exe 4776 CIA.exe 5472 UQO.exe 5472 UQO.exe 300 NJEVUZ.exe 300 NJEVUZ.exe 2800 RZKDH.exe 2800 RZKDH.exe 2876 QKNT.exe 2876 QKNT.exe 5660 INRPVN.exe 5660 INRPVN.exe 808 ANT.exe 808 ANT.exe 5248 PICGJ.exe 5248 PICGJ.exe 5604 PWCVTK.exe 5604 PWCVTK.exe 4444 VWK.exe 4444 VWK.exe 2148 XMDD.exe 2148 XMDD.exe 4832 KWUBOMR.exe 4832 KWUBOMR.exe 3920 YSFUCAH.exe 3920 YSFUCAH.exe 2176 YXKJNH.exe 2176 YXKJNH.exe 4620 ZAOFS.exe 4620 ZAOFS.exe 5788 BVFGEI.exe 5788 BVFGEI.exe 3412 WJK.exe 3412 WJK.exe 892 VUNGXWE.exe 892 VUNGXWE.exe 2468 MCBLJNZ.exe 2468 MCBLJNZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1448 2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe 1448 2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe 5628 QVMINTJ.exe 5628 QVMINTJ.exe 5552 JZP.exe 5552 JZP.exe 4416 TWV.exe 4416 TWV.exe 956 XZT.exe 956 XZT.exe 2432 UFLZ.exe 2432 UFLZ.exe 5452 USMNI.exe 5452 USMNI.exe 1608 VOPJWEX.exe 1608 VOPJWEX.exe 5268 AOXW.exe 5268 AOXW.exe 2088 YOFKOI.exe 2088 YOFKOI.exe 1836 IMKFVR.exe 1836 IMKFVR.exe 1688 MXJA.exe 1688 MXJA.exe 5500 UCV.exe 5500 UCV.exe 4776 CIA.exe 4776 CIA.exe 5472 UQO.exe 5472 UQO.exe 300 NJEVUZ.exe 300 NJEVUZ.exe 2800 RZKDH.exe 2800 RZKDH.exe 2876 QKNT.exe 2876 QKNT.exe 5660 INRPVN.exe 5660 INRPVN.exe 808 ANT.exe 808 ANT.exe 5248 PICGJ.exe 5248 PICGJ.exe 5604 PWCVTK.exe 5604 PWCVTK.exe 4444 VWK.exe 4444 VWK.exe 2148 XMDD.exe 2148 XMDD.exe 4832 KWUBOMR.exe 4832 KWUBOMR.exe 3920 YSFUCAH.exe 3920 YSFUCAH.exe 2176 YXKJNH.exe 2176 YXKJNH.exe 4620 ZAOFS.exe 4620 ZAOFS.exe 5788 BVFGEI.exe 5788 BVFGEI.exe 3412 WJK.exe 3412 WJK.exe 892 VUNGXWE.exe 892 VUNGXWE.exe 2468 MCBLJNZ.exe 2468 MCBLJNZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1448 wrote to memory of 4896 1448 2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe 89 PID 4896 wrote to memory of 5628 4896 cmd.exe 93 PID 5628 wrote to memory of 4676 5628 QVMINTJ.exe 95 PID 4676 wrote to memory of 5552 4676 cmd.exe 99 PID 5552 wrote to memory of 1452 5552 JZP.exe 100 PID 1452 wrote to memory of 4416 1452 cmd.exe 104 PID 4416 wrote to memory of 2248 4416 TWV.exe 105 PID 2248 wrote to memory of 956 2248 cmd.exe 109 PID 956 wrote to memory of 2452 956 XZT.exe 110 PID 2452 wrote to memory of 2432 2452 cmd.exe 113 PID 2432 wrote to memory of 3280 2432 UFLZ.exe 115 PID 3280 wrote to memory of 5452 3280 cmd.exe 119 PID 5452 wrote to memory of 5724 5452 USMNI.exe 120 PID 5724 wrote to memory of 1608 5724 cmd.exe 124 PID 1608 wrote to memory of 688 1608 VOPJWEX.exe 125 PID 688 wrote to memory of 5268 688 cmd.exe 129 PID 5268 wrote to memory of 2596 5268 AOXW.exe 130 PID 2596 wrote to memory of 2088 2596 cmd.exe 134 PID 2088 wrote to memory of 3276 2088 YOFKOI.exe 135 PID 3276 wrote to memory of 1836 3276 cmd.exe 139 PID 1836 wrote to memory of 1220 1836 IMKFVR.exe 140 PID 1220 wrote to memory of 1688 1220 cmd.exe 144 PID 1688 wrote to memory of 2280 1688 MXJA.exe 145 PID 2280 wrote to memory of 5500 2280 cmd.exe 149 PID 5500 wrote to memory of 1976 5500 UCV.exe 150 PID 1976 wrote to memory of 4776 1976 cmd.exe 154 PID 4776 wrote to memory of 2780 4776 CIA.exe 155 PID 2780 wrote to memory of 5472 2780 cmd.exe 159 PID 5472 wrote to memory of 2416 5472 UQO.exe 160 PID 2416 wrote to memory of 300 2416 cmd.exe 164 PID 300 wrote to memory of 1644 300 NJEVUZ.exe 165 PID 1644 wrote to memory of 2800 1644 cmd.exe 169 PID 2800 wrote to memory of 3996 2800 RZKDH.exe 170 PID 3996 wrote to memory of 2876 3996 cmd.exe 174 PID 2876 wrote to memory of 4272 2876 QKNT.exe 175 PID 4272 wrote to memory of 5660 4272 cmd.exe 179 PID 5660 wrote to memory of 3676 5660 INRPVN.exe 180 PID 3676 wrote to memory of 808 3676 cmd.exe 184 PID 808 wrote to memory of 1284 808 ANT.exe 185 PID 1284 wrote to memory of 5248 1284 cmd.exe 189 PID 5248 wrote to memory of 2420 5248 PICGJ.exe 190 PID 2420 wrote to memory of 5604 2420 cmd.exe 194 PID 5604 wrote to memory of 4452 5604 PWCVTK.exe 195 PID 4452 wrote to memory of 4444 4452 cmd.exe 199 PID 4444 wrote to memory of 4496 4444 VWK.exe 200 PID 4496 wrote to memory of 2148 4496 cmd.exe 204 PID 2148 wrote to memory of 5632 2148 XMDD.exe 205 PID 5632 wrote to memory of 4832 5632 cmd.exe 209 PID 4832 wrote to memory of 5308 4832 KWUBOMR.exe 210 PID 5308 wrote to memory of 3920 5308 cmd.exe 214 PID 3920 wrote to memory of 5180 3920 YSFUCAH.exe 215 PID 5180 wrote to memory of 2176 5180 cmd.exe 219 PID 2176 wrote to memory of 4280 2176 YXKJNH.exe 220 PID 4280 wrote to memory of 4620 4280 cmd.exe 224 PID 4620 wrote to memory of 4372 4620 ZAOFS.exe 225 PID 4372 wrote to memory of 5788 4372 cmd.exe 229 PID 5788 wrote to memory of 1848 5788 BVFGEI.exe 230 PID 1848 wrote to memory of 3412 1848 cmd.exe 234 PID 3412 wrote to memory of 1932 3412 WJK.exe 235 PID 1932 wrote to memory of 892 1932 cmd.exe 239 PID 892 wrote to memory of 3212 892 VUNGXWE.exe 240 PID 3212 wrote to memory of 2468 3212 cmd.exe 244 PID 2468 wrote to memory of 1896 2468 MCBLJNZ.exe 245 PID 1896 wrote to memory of 676 1896 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_ec27fc959d3deff9862921af27d79092_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVMINTJ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\SysWOW64\QVMINTJ.exeC:\windows\system32\QVMINTJ.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZP.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\JZP.exeC:\windows\JZP.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWV.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\windows\SysWOW64\TWV.exeC:\windows\system32\TWV.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XZT.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\windows\system\XZT.exeC:\windows\system\XZT.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFLZ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\UFLZ.exeC:\windows\UFLZ.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\USMNI.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\windows\system\USMNI.exeC:\windows\system\USMNI.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VOPJWEX.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\VOPJWEX.exeC:\windows\VOPJWEX.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOXW.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\windows\system\AOXW.exeC:\windows\system\AOXW.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YOFKOI.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\SysWOW64\YOFKOI.exeC:\windows\system32\YOFKOI.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMKFVR.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\windows\system\IMKFVR.exeC:\windows\system\IMKFVR.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXJA.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\windows\system\MXJA.exeC:\windows\system\MXJA.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCV.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\windows\SysWOW64\UCV.exeC:\windows\system32\UCV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIA.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\windows\system\CIA.exeC:\windows\system\CIA.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQO.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\windows\SysWOW64\UQO.exeC:\windows\system32\UQO.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJEVUZ.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\windows\NJEVUZ.exeC:\windows\NJEVUZ.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RZKDH.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\windows\SysWOW64\RZKDH.exeC:\windows\system32\RZKDH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QKNT.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\windows\system\QKNT.exeC:\windows\system\QKNT.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INRPVN.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\windows\system\INRPVN.exeC:\windows\system\INRPVN.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANT.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\windows\system\ANT.exeC:\windows\system\ANT.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PICGJ.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\SysWOW64\PICGJ.exeC:\windows\system32\PICGJ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWCVTK.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\windows\PWCVTK.exeC:\windows\PWCVTK.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\SysWOW64\VWK.exeC:\windows\system32\VWK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMDD.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\windows\XMDD.exeC:\windows\XMDD.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWUBOMR.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\system\KWUBOMR.exeC:\windows\system\KWUBOMR.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YSFUCAH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\windows\YSFUCAH.exeC:\windows\YSFUCAH.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXKJNH.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\windows\SysWOW64\YXKJNH.exeC:\windows\system32\YXKJNH.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAOFS.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\windows\SysWOW64\ZAOFS.exeC:\windows\system32\ZAOFS.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVFGEI.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\windows\SysWOW64\BVFGEI.exeC:\windows\system32\BVFGEI.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WJK.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\windows\system\WJK.exeC:\windows\system\WJK.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VUNGXWE.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\windows\system\VUNGXWE.exeC:\windows\system\VUNGXWE.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCBLJNZ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\system\MCBLJNZ.exeC:\windows\system\MCBLJNZ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAJXL.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\windows\SysWOW64\ZAJXL.exeC:\windows\system32\ZAJXL.exe65⤵
- Executes dropped EXE
PID:676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ADNSYPK.exe.bat" "66⤵PID:5588
-
C:\windows\system\ADNSYPK.exeC:\windows\system\ADNSYPK.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3228 -
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOKORII.exe.bat" "70⤵PID:3508
-
C:\windows\system\FOKORII.exeC:\windows\system\FOKORII.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJJ.exe.bat" "72⤵PID:4504
-
C:\windows\SysWOW64\LJJ.exeC:\windows\system32\LJJ.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOTM.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3528 -
C:\windows\system\HOTM.exeC:\windows\system\HOTM.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFUETCH.exe.bat" "76⤵PID:6140
-
C:\windows\SysWOW64\XFUETCH.exeC:\windows\system32\XFUETCH.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXKPC.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:980 -
C:\windows\system\IXKPC.exeC:\windows\system\IXKPC.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSJ.exe.bat" "80⤵PID:5440
-
C:\windows\OSJ.exeC:\windows\OSJ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDROVJ.exe.bat" "82⤵PID:3456
-
C:\windows\SysWOW64\BDROVJ.exeC:\windows\system32\BDROVJ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NLY.exe.bat" "84⤵PID:3208
-
C:\windows\SysWOW64\NLY.exeC:\windows\system32\NLY.exe85⤵
- Executes dropped EXE
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRELO.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4888 -
C:\windows\CRELO.exeC:\windows\CRELO.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMHPUBA.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5460 -
C:\windows\system\CMHPUBA.exeC:\windows\system\CMHPUBA.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSP.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3232 -
C:\windows\QSP.exeC:\windows\QSP.exe91⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DCYZKP.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5760 -
C:\windows\system\DCYZKP.exeC:\windows\system\DCYZKP.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PKE.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4180 -
C:\windows\SysWOW64\PKE.exeC:\windows\system32\PKE.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INIVC.exe.bat" "96⤵PID:1556
-
C:\windows\system\INIVC.exeC:\windows\system\INIVC.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBPBH.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3364 -
C:\windows\BBPBH.exeC:\windows\BBPBH.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DZVVW.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1380 -
C:\windows\SysWOW64\DZVVW.exeC:\windows\system32\DZVVW.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HHBVAAN.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:1548 -
C:\windows\system\HHBVAAN.exeC:\windows\system\HHBVAAN.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKFR.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4924 -
C:\windows\SysWOW64\IKFR.exeC:\windows\system32\IKFR.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ANR.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4644 -
C:\windows\system\ANR.exeC:\windows\system\ANR.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVYVG.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4748 -
C:\windows\SysWOW64\MVYVG.exeC:\windows\system32\MVYVG.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGG.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4908 -
C:\windows\system\ZGG.exeC:\windows\system\ZGG.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JGIYX.exe.bat" "112⤵PID:1748
-
C:\windows\system\JGIYX.exeC:\windows\system\JGIYX.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEOT.exe.bat" "114⤵
- Executes a command shell one-liner
PID:3084 -
C:\windows\system\TEOT.exeC:\windows\system\TEOT.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THSOSE.exe.bat" "116⤵PID:3632
-
C:\windows\SysWOW64\THSOSE.exeC:\windows\system32\THSOSE.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKDSY.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3324 -
C:\windows\MKDSY.exeC:\windows\MKDSY.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "120⤵PID:5292
-
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-