Analysis
- max time kernel
68s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 19:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe
- Size 208KB
- Sample261002-ybtbjsyamd
- SHA256 5873de3e375fd7c81a67058cb201e4302ae7df52a3538d0b80d1aa33a74baefa
- MD5 13a630dc8780ea7d6fd7dc8fb51cf93b
- SHA1 7876c66fd5a55f353fefa2d817831e4adf72da4a
- SHA512 94557ade9a4057264cf1586a9fddecb68802422a2417df1a5022a3c0368e5cd65da9d43786f291e34a7bf3c91e5a503228ed801b8a7a24c4e98adc10d17dabe9
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFliKL+LOfM4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFliS+LOUkEj1
- TLSH T1AE247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3232 JEJHI.exe 2796 UURO.exe 4160 APQXEJ.exe 4200 KNI.exe 1720 ZDJBBY.exe 1408 FDROKS.exe 4972 JLYWWL.exe 4424 NWWK.exe 1048 GPLUFFY.exe 1012 INRPVN.exe 5384 QSDVFL.exe 4800 GIEV.exe 5568 KYLVQZN.exe 1836 UOZP.exe 2852 EMEK.exe 5260 LCFBUET.exe 3784 VALVB.exe 4072 KDCAMZD.exe 1732 QQUIR.exe 2696 POND.exe 4360 YOPQP.exe 2364 HWRWTK.exe 2920 KKW.exe 2736 HPGU.exe 4940 WFHMAAL.exe 3108 PILP.exe 1984 SQZPSJ.exe 3928 IGAPQ.exe 2568 MWHPDWL.exe 5768 BRQBW.exe 2436 SSSGZH.exe 2756 NFX.exe 4900 WNZV.exe 5316 NBKNDIA.exe 3208 GWNQ.exe 720 HZR.exe 3668 QHTR.exe 3408 FCDEKGO.exe 4064 ENFUTM.exe 6112 TDGLR.exe 4296 CQRDH.exe 4944 KWRSJS.exe 1860 HBX.exe 4560 LJDPC.exe 4828 LPEDLZ.exe 2740 TCIKO.exe 2220 XKP.exe 976 MNYWTC.exe 4672 MTZLVP.exe 4636 XMC.exe 3936 OZMVL.exe 708 JMRFVTW.exe 3092 JSJ.exe 4664 VIQTJ.exe 5044 QVUDTYB.exe 2040 IQGG.exe 5976 DLDQJO.exe 5780 JML.exe 1404 FJQBZ.exe 4756 GMUWMQE.exe 2368 GSULOVZ.exe 5560 EQGOBA.exe 5420 SNOZ.exe 5600 WEUA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\LJDPC.exe HBX.exe File opened for modification C:\windows\SysWOW64\TCIKO.exe LPEDLZ.exe File opened for modification C:\windows\SysWOW64\GSULOVZ.exe GMUWMQE.exe File created C:\windows\SysWOW64\GPLUFFY.exe.bat NWWK.exe File created C:\windows\SysWOW64\PILP.exe WFHMAAL.exe File created C:\windows\SysWOW64\PILP.exe.bat WFHMAAL.exe File created C:\windows\SysWOW64\LJDPC.exe HBX.exe File created C:\windows\SysWOW64\GSULOVZ.exe GMUWMQE.exe File opened for modification C:\windows\SysWOW64\WEUA.exe SNOZ.exe File created C:\windows\SysWOW64\QSDVFL.exe INRPVN.exe File opened for modification C:\windows\SysWOW64\NFX.exe SSSGZH.exe File created C:\windows\SysWOW64\LPEDLZ.exe.bat LJDPC.exe File opened for modification C:\windows\SysWOW64\NEWFA.exe WEUA.exe File created C:\windows\SysWOW64\JEJHI.exe 2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe File created C:\windows\SysWOW64\MTZLVP.exe.bat MNYWTC.exe File created C:\windows\SysWOW64\ZDJBBY.exe.bat KNI.exe File opened for modification C:\windows\SysWOW64\UOZP.exe KYLVQZN.exe File opened for modification C:\windows\SysWOW64\PILP.exe WFHMAAL.exe File created C:\windows\SysWOW64\FCDEKGO.exe QHTR.exe File created C:\windows\SysWOW64\ENFUTM.exe FCDEKGO.exe File created C:\windows\SysWOW64\ELUZ.exe.bat RFUOX.exe File created C:\windows\SysWOW64\JEJHI.exe.bat 2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe File created C:\windows\SysWOW64\FDROKS.exe.bat ZDJBBY.exe File opened for modification C:\windows\SysWOW64\GPLUFFY.exe NWWK.exe File created C:\windows\SysWOW64\MWHPDWL.exe IGAPQ.exe File created C:\windows\SysWOW64\NFX.exe.bat SSSGZH.exe File created C:\windows\SysWOW64\VIQTJ.exe.bat JSJ.exe File opened for modification C:\windows\SysWOW64\JEJHI.exe 2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe File created C:\windows\SysWOW64\ZDJBBY.exe KNI.exe File opened for modification C:\windows\SysWOW64\HPGU.exe KKW.exe File created C:\windows\SysWOW64\ENFUTM.exe.bat FCDEKGO.exe File created C:\windows\SysWOW64\XKP.exe.bat TCIKO.exe File created C:\windows\SysWOW64\MNYWTC.exe.bat XKP.exe File created C:\windows\SysWOW64\QVUDTYB.exe VIQTJ.exe File created C:\windows\SysWOW64\OIRMK.exe UNMD.exe File created C:\windows\SysWOW64\KNI.exe APQXEJ.exe File created C:\windows\SysWOW64\WEUA.exe SNOZ.exe File opened for modification C:\windows\SysWOW64\UGDEKTR.exe ELUZ.exe File opened for modification C:\windows\SysWOW64\WOLBIXQ.exe URYGSOI.exe File opened for modification C:\windows\SysWOW64\UURO.exe JEJHI.exe File created C:\windows\SysWOW64\WNZV.exe NFX.exe File opened for modification C:\windows\SysWOW64\WNZV.exe NFX.exe File created C:\windows\SysWOW64\MNYWTC.exe XKP.exe File created C:\windows\SysWOW64\VIQTJ.exe JSJ.exe File created C:\windows\SysWOW64\OIRMK.exe.bat UNMD.exe File opened for modification C:\windows\SysWOW64\GIEV.exe QSDVFL.exe File created C:\windows\SysWOW64\WNZV.exe.bat NFX.exe File created C:\windows\SysWOW64\HBX.exe.bat KWRSJS.exe File opened for modification C:\windows\SysWOW64\PDJH.exe LUDZJGN.exe File created C:\windows\SysWOW64\UOZP.exe KYLVQZN.exe File created C:\windows\SysWOW64\HWRWTK.exe YOPQP.exe File created C:\windows\SysWOW64\HWRWTK.exe.bat YOPQP.exe File opened for modification C:\windows\SysWOW64\ENFUTM.exe FCDEKGO.exe File created C:\windows\SysWOW64\GJSDR.exe.bat XBQQ.exe File created C:\windows\SysWOW64\ELUZ.exe RFUOX.exe File opened for modification C:\windows\SysWOW64\ZDJBBY.exe KNI.exe File created C:\windows\SysWOW64\NFX.exe SSSGZH.exe File created C:\windows\SysWOW64\LPEDLZ.exe LJDPC.exe File created C:\windows\SysWOW64\OZMVL.exe XMC.exe File opened for modification C:\windows\SysWOW64\OZMVL.exe XMC.exe File created C:\windows\SysWOW64\GSULOVZ.exe.bat GMUWMQE.exe File opened for modification C:\windows\SysWOW64\OIRMK.exe UNMD.exe File created C:\windows\SysWOW64\WOLBIXQ.exe URYGSOI.exe File created C:\windows\SysWOW64\MWHPDWL.exe.bat IGAPQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\CQRDH.exe TDGLR.exe File opened for modification C:\windows\XMC.exe MTZLVP.exe File created C:\windows\XMC.exe.bat MTZLVP.exe File created C:\windows\system\SNOZ.exe EQGOBA.exe File created C:\windows\UNMD.exe AUFS.exe File created C:\windows\system\YGFGR.exe OIRMK.exe File created C:\windows\system\LUDZJGN.exe.bat QHYPZ.exe File created C:\windows\system\WFHMAAL.exe.bat HPGU.exe File opened for modification C:\windows\NBKNDIA.exe WNZV.exe File created C:\windows\system\JMRFVTW.exe OZMVL.exe File created C:\windows\FJQBZ.exe JML.exe File created C:\windows\system\RUDNFTD.exe NEWFA.exe File opened for modification C:\windows\XBQQ.exe RBJCFYM.exe File opened for modification C:\windows\system\YBKSY.exe OTIN.exe File created C:\windows\system\YBKSY.exe.bat OTIN.exe File created C:\windows\system\SQZPSJ.exe PILP.exe File created C:\windows\XBQQ.exe RBJCFYM.exe File opened for modification C:\windows\system\JMRFVTW.exe OZMVL.exe File created C:\windows\system\SNOZ.exe.bat EQGOBA.exe File opened for modification C:\windows\system\RBJCFYM.exe YGFGR.exe File created C:\windows\system\SSSGZH.exe BRQBW.exe File opened for modification C:\windows\system\TWUKN.exe ETKYCMY.exe File created C:\windows\system\WRPE.exe WOLBIXQ.exe File created C:\windows\system\KWRSJS.exe CQRDH.exe File opened for modification C:\windows\system\INRPVN.exe GPLUFFY.exe File created C:\windows\POND.exe.bat QQUIR.exe File opened for modification C:\windows\system\IGAPQ.exe SQZPSJ.exe File opened for modification C:\windows\system\SSSGZH.exe BRQBW.exe File opened for modification C:\windows\JML.exe DLDQJO.exe File opened for modification C:\windows\system\SNOZ.exe EQGOBA.exe File created C:\windows\system\LUDZJGN.exe QHYPZ.exe File opened for modification C:\windows\system\KYLVQZN.exe GIEV.exe File created C:\windows\EMEK.exe UOZP.exe File opened for modification C:\windows\system\WFHMAAL.exe HPGU.exe File created C:\windows\GWNQ.exe NBKNDIA.exe File opened for modification C:\windows\CQRDH.exe TDGLR.exe File created C:\windows\system\RBJCFYM.exe YGFGR.exe File created C:\windows\system\KYLVQZN.exe.bat GIEV.exe File created C:\windows\system\YOPQP.exe.bat POND.exe File created C:\windows\system\IGAPQ.exe SQZPSJ.exe File created C:\windows\NBKNDIA.exe WNZV.exe File created C:\windows\NBKNDIA.exe.bat WNZV.exe File opened for modification C:\windows\system\TDGLR.exe ENFUTM.exe File created C:\windows\URYGSOI.exe TWUKN.exe File created C:\windows\NWWK.exe.bat JLYWWL.exe File created C:\windows\system\KYLVQZN.exe GIEV.exe File opened for modification C:\windows\system\LCFBUET.exe EMEK.exe File created C:\windows\system\YOPQP.exe POND.exe File created C:\windows\XMC.exe MTZLVP.exe File opened for modification C:\windows\URYGSOI.exe TWUKN.exe File created C:\windows\EMEK.exe.bat UOZP.exe File opened for modification C:\windows\system\YOPQP.exe POND.exe File opened for modification C:\windows\system\KWRSJS.exe CQRDH.exe File opened for modification C:\windows\AUFS.exe RUDNFTD.exe File created C:\windows\system\JLYWWL.exe.bat FDROKS.exe File opened for modification C:\windows\system\QHTR.exe HZR.exe File created C:\windows\system\JLYWWL.exe FDROKS.exe File created C:\windows\VALVB.exe.bat LCFBUET.exe File created C:\windows\KDCAMZD.exe.bat VALVB.exe File opened for modification C:\windows\QQUIR.exe KDCAMZD.exe File created C:\windows\system\TDGLR.exe ENFUTM.exe File created C:\windows\system\JMRFVTW.exe.bat OZMVL.exe File opened for modification C:\windows\system\RUDNFTD.exe NEWFA.exe File created C:\windows\HZR.exe GWNQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1948 cmd.exe 5184 cmd.exe 4076 cmd.exe 1156 cmd.exe 5580 cmd.exe 960 cmd.exe 5200 cmd.exe 4292 cmd.exe 2780 cmd.exe 2944 cmd.exe 2104 cmd.exe 3388 cmd.exe 3624 cmd.exe 3156 cmd.exe 5520 cmd.exe 5220 cmd.exe 1912 cmd.exe 4720 cmd.exe 4108 cmd.exe 3520 cmd.exe 1520 cmd.exe 964 cmd.exe 4624 cmd.exe 3720 cmd.exe 4952 cmd.exe 4136 cmd.exe 4996 cmd.exe 2768 cmd.exe 4796 cmd.exe 2540 cmd.exe 1572 cmd.exe 4516 cmd.exe 2984 cmd.exe 3620 cmd.exe 3460 cmd.exe 5496 cmd.exe 4832 cmd.exe 4784 cmd.exe 264 cmd.exe 2608 cmd.exe 6128 cmd.exe 4112 cmd.exe 5588 cmd.exe 1068 cmd.exe 4228 cmd.exe 4172 cmd.exe 5832 cmd.exe 3492 cmd.exe 4156 cmd.exe 3220 cmd.exe 1548 cmd.exe 2972 cmd.exe 3960 cmd.exe 2472 cmd.exe 1884 cmd.exe 824 cmd.exe 4700 cmd.exe 1196 cmd.exe 4776 cmd.exe 4420 cmd.exe 3088 cmd.exe 1668 cmd.exe 2184 cmd.exe 4216 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5884 1852 WerFault.exe 87 4612 3232 WerFault.exe 93 4420 2796 WerFault.exe 99 3824 4160 WerFault.exe 104 3056 4200 WerFault.exe 109 600 1720 WerFault.exe 114 1704 1408 WerFault.exe 119 3160 4972 WerFault.exe 124 2296 4424 WerFault.exe 129 5420 1048 WerFault.exe 134 3580 1012 WerFault.exe 139 5592 5384 WerFault.exe 144 3628 4800 WerFault.exe 149 3276 5568 WerFault.exe 154 5948 1836 WerFault.exe 159 4672 2852 WerFault.exe 164 3156 5260 WerFault.exe 169 4832 3784 WerFault.exe 174 2468 4072 WerFault.exe 179 2328 1732 WerFault.exe 184 5032 2696 WerFault.exe 189 5480 4360 WerFault.exe 194 4484 2364 WerFault.exe 199 2472 2920 WerFault.exe 204 5788 2736 WerFault.exe 209 2348 4940 WerFault.exe 214 5052 3108 WerFault.exe 219 1368 1984 WerFault.exe 224 5036 3928 WerFault.exe 229 3404 2568 WerFault.exe 234 2292 5768 WerFault.exe 239 972 2436 WerFault.exe 244 3476 2756 WerFault.exe 249 796 4900 WerFault.exe 254 4484 5316 WerFault.exe 259 3316 3208 WerFault.exe 264 240 720 WerFault.exe 269 5976 3668 WerFault.exe 274 5552 3408 WerFault.exe 279 5776 4064 WerFault.exe 284 5028 6112 WerFault.exe 289 1704 4296 WerFault.exe 294 1800 4944 WerFault.exe 299 2628 1860 WerFault.exe 304 4144 4560 WerFault.exe 309 3276 4828 WerFault.exe 314 1136 2740 WerFault.exe 319 1232 2220 WerFault.exe 324 1656 976 WerFault.exe 329 1104 4672 WerFault.exe 334 6020 4636 WerFault.exe 339 6064 3936 WerFault.exe 344 2296 708 WerFault.exe 349 580 3092 WerFault.exe 354 1140 4664 WerFault.exe 359 5612 5044 WerFault.exe 364 2524 2040 WerFault.exe 369 2068 5976 WerFault.exe 374 3008 5780 WerFault.exe 379 1616 1404 WerFault.exe 384 3096 4756 WerFault.exe 389 4312 2368 WerFault.exe 394 5732 5560 WerFault.exe 399 3372 5420 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSDVFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWRWTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDGLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELUZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UURO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSSGZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBJCFYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCFBUET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZMVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJSDR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLDQJO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URYGSOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYLVQZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KDCAMZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQUIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVUDTYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AUFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APQXEJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDROKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGFGR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWUKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UOZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWHPDWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIRMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INRPVN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1852 2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe 1852 2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe 3232 JEJHI.exe 3232 JEJHI.exe 2796 UURO.exe 2796 UURO.exe 4160 APQXEJ.exe 4160 APQXEJ.exe 4200 KNI.exe 4200 KNI.exe 1720 ZDJBBY.exe 1720 ZDJBBY.exe 1408 FDROKS.exe 1408 FDROKS.exe 4972 JLYWWL.exe 4972 JLYWWL.exe 4424 NWWK.exe 4424 NWWK.exe 1048 GPLUFFY.exe 1048 GPLUFFY.exe 1012 INRPVN.exe 1012 INRPVN.exe 5384 QSDVFL.exe 5384 QSDVFL.exe 4800 GIEV.exe 4800 GIEV.exe 5568 KYLVQZN.exe 5568 KYLVQZN.exe 1836 UOZP.exe 1836 UOZP.exe 2852 EMEK.exe 2852 EMEK.exe 5260 LCFBUET.exe 5260 LCFBUET.exe 3784 VALVB.exe 3784 VALVB.exe 4072 KDCAMZD.exe 4072 KDCAMZD.exe 1732 QQUIR.exe 1732 QQUIR.exe 2696 POND.exe 2696 POND.exe 4360 YOPQP.exe 4360 YOPQP.exe 2364 HWRWTK.exe 2364 HWRWTK.exe 2920 KKW.exe 2920 KKW.exe 2736 HPGU.exe 2736 HPGU.exe 4940 WFHMAAL.exe 4940 WFHMAAL.exe 3108 PILP.exe 3108 PILP.exe 1984 SQZPSJ.exe 1984 SQZPSJ.exe 3928 IGAPQ.exe 3928 IGAPQ.exe 2568 MWHPDWL.exe 2568 MWHPDWL.exe 5768 BRQBW.exe 5768 BRQBW.exe 2436 SSSGZH.exe 2436 SSSGZH.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1852 2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe 1852 2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe 3232 JEJHI.exe 3232 JEJHI.exe 2796 UURO.exe 2796 UURO.exe 4160 APQXEJ.exe 4160 APQXEJ.exe 4200 KNI.exe 4200 KNI.exe 1720 ZDJBBY.exe 1720 ZDJBBY.exe 1408 FDROKS.exe 1408 FDROKS.exe 4972 JLYWWL.exe 4972 JLYWWL.exe 4424 NWWK.exe 4424 NWWK.exe 1048 GPLUFFY.exe 1048 GPLUFFY.exe 1012 INRPVN.exe 1012 INRPVN.exe 5384 QSDVFL.exe 5384 QSDVFL.exe 4800 GIEV.exe 4800 GIEV.exe 5568 KYLVQZN.exe 5568 KYLVQZN.exe 1836 UOZP.exe 1836 UOZP.exe 2852 EMEK.exe 2852 EMEK.exe 5260 LCFBUET.exe 5260 LCFBUET.exe 3784 VALVB.exe 3784 VALVB.exe 4072 KDCAMZD.exe 4072 KDCAMZD.exe 1732 QQUIR.exe 1732 QQUIR.exe 2696 POND.exe 2696 POND.exe 4360 YOPQP.exe 4360 YOPQP.exe 2364 HWRWTK.exe 2364 HWRWTK.exe 2920 KKW.exe 2920 KKW.exe 2736 HPGU.exe 2736 HPGU.exe 4940 WFHMAAL.exe 4940 WFHMAAL.exe 3108 PILP.exe 3108 PILP.exe 1984 SQZPSJ.exe 1984 SQZPSJ.exe 3928 IGAPQ.exe 3928 IGAPQ.exe 2568 MWHPDWL.exe 2568 MWHPDWL.exe 5768 BRQBW.exe 5768 BRQBW.exe 2436 SSSGZH.exe 2436 SSSGZH.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1852 wrote to memory of 5184 1852 2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe 89 PID 5184 wrote to memory of 3232 5184 cmd.exe 93 PID 3232 wrote to memory of 5284 3232 JEJHI.exe 95 PID 5284 wrote to memory of 2796 5284 cmd.exe 99 PID 2796 wrote to memory of 4136 2796 UURO.exe 100 PID 4136 wrote to memory of 4160 4136 cmd.exe 104 PID 4160 wrote to memory of 1480 4160 APQXEJ.exe 105 PID 1480 wrote to memory of 4200 1480 cmd.exe 109 PID 4200 wrote to memory of 1576 4200 KNI.exe 110 PID 1576 wrote to memory of 1720 1576 cmd.exe 114 PID 1720 wrote to memory of 3364 1720 ZDJBBY.exe 115 PID 3364 wrote to memory of 1408 3364 cmd.exe 119 PID 1408 wrote to memory of 4904 1408 FDROKS.exe 120 PID 4904 wrote to memory of 4972 4904 cmd.exe 124 PID 4972 wrote to memory of 4588 4972 JLYWWL.exe 125 PID 4588 wrote to memory of 4424 4588 cmd.exe 129 PID 4424 wrote to memory of 3460 4424 NWWK.exe 130 PID 3460 wrote to memory of 1048 3460 cmd.exe 134 PID 1048 wrote to memory of 6088 1048 GPLUFFY.exe 135 PID 6088 wrote to memory of 1012 6088 cmd.exe 139 PID 1012 wrote to memory of 4720 1012 INRPVN.exe 140 PID 4720 wrote to memory of 5384 4720 cmd.exe 144 PID 5384 wrote to memory of 4536 5384 QSDVFL.exe 145 PID 4536 wrote to memory of 4800 4536 cmd.exe 149 PID 4800 wrote to memory of 1436 4800 GIEV.exe 150 PID 1436 wrote to memory of 5568 1436 cmd.exe 154 PID 5568 wrote to memory of 3348 5568 KYLVQZN.exe 155 PID 3348 wrote to memory of 1836 3348 cmd.exe 159 PID 1836 wrote to memory of 1192 1836 UOZP.exe 160 PID 1192 wrote to memory of 2852 1192 cmd.exe 164 PID 2852 wrote to memory of 264 2852 EMEK.exe 165 PID 264 wrote to memory of 5260 264 cmd.exe 169 PID 5260 wrote to memory of 2904 5260 LCFBUET.exe 170 PID 2904 wrote to memory of 3784 2904 cmd.exe 174 PID 3784 wrote to memory of 4892 3784 VALVB.exe 175 PID 4892 wrote to memory of 4072 4892 cmd.exe 179 PID 4072 wrote to memory of 4824 4072 KDCAMZD.exe 180 PID 4824 wrote to memory of 1732 4824 cmd.exe 184 PID 1732 wrote to memory of 1628 1732 QQUIR.exe 185 PID 1628 wrote to memory of 2696 1628 cmd.exe 189 PID 2696 wrote to memory of 5540 2696 POND.exe 190 PID 5540 wrote to memory of 4360 5540 cmd.exe 194 PID 4360 wrote to memory of 4732 4360 YOPQP.exe 195 PID 4732 wrote to memory of 2364 4732 cmd.exe 199 PID 2364 wrote to memory of 2480 2364 HWRWTK.exe 200 PID 2480 wrote to memory of 2920 2480 cmd.exe 204 PID 2920 wrote to memory of 4108 2920 KKW.exe 205 PID 4108 wrote to memory of 2736 4108 cmd.exe 209 PID 2736 wrote to memory of 4816 2736 HPGU.exe 210 PID 4816 wrote to memory of 4940 4816 cmd.exe 214 PID 4940 wrote to memory of 4216 4940 WFHMAAL.exe 215 PID 4216 wrote to memory of 3108 4216 cmd.exe 219 PID 3108 wrote to memory of 124 3108 PILP.exe 220 PID 124 wrote to memory of 1984 124 cmd.exe 224 PID 1984 wrote to memory of 2860 1984 SQZPSJ.exe 225 PID 2860 wrote to memory of 3928 2860 cmd.exe 229 PID 3928 wrote to memory of 900 3928 IGAPQ.exe 230 PID 900 wrote to memory of 2568 900 cmd.exe 234 PID 2568 wrote to memory of 5544 2568 MWHPDWL.exe 235 PID 5544 wrote to memory of 5768 5544 cmd.exe 239 PID 5768 wrote to memory of 3244 5768 BRQBW.exe 240 PID 3244 wrote to memory of 2436 3244 cmd.exe 244 PID 2436 wrote to memory of 3840 2436 SSSGZH.exe 245 PID 3840 wrote to memory of 2756 3840 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_13a630dc8780ea7d6fd7dc8fb51cf93b_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEJHI.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\windows\SysWOW64\JEJHI.exeC:\windows\system32\JEJHI.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UURO.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\windows\SysWOW64\UURO.exeC:\windows\system32\UURO.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\APQXEJ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\SysWOW64\APQXEJ.exeC:\windows\system32\APQXEJ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNI.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\windows\SysWOW64\KNI.exeC:\windows\system32\KNI.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDJBBY.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\windows\SysWOW64\ZDJBBY.exeC:\windows\system32\ZDJBBY.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FDROKS.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\SysWOW64\FDROKS.exeC:\windows\system32\FDROKS.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLYWWL.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\windows\system\JLYWWL.exeC:\windows\system\JLYWWL.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NWWK.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\NWWK.exeC:\windows\NWWK.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPLUFFY.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\windows\SysWOW64\GPLUFFY.exeC:\windows\system32\GPLUFFY.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INRPVN.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\windows\system\INRPVN.exeC:\windows\system\INRPVN.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QSDVFL.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\windows\SysWOW64\QSDVFL.exeC:\windows\system32\QSDVFL.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GIEV.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\SysWOW64\GIEV.exeC:\windows\system32\GIEV.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYLVQZN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\windows\system\KYLVQZN.exeC:\windows\system\KYLVQZN.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UOZP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\SysWOW64\UOZP.exeC:\windows\system32\UOZP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EMEK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\windows\EMEK.exeC:\windows\EMEK.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LCFBUET.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:264 -
C:\windows\system\LCFBUET.exeC:\windows\system\LCFBUET.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VALVB.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\VALVB.exeC:\windows\VALVB.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KDCAMZD.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\windows\KDCAMZD.exeC:\windows\KDCAMZD.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QQUIR.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\QQUIR.exeC:\windows\QQUIR.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\POND.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\windows\POND.exeC:\windows\POND.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOPQP.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\system\YOPQP.exeC:\windows\system\YOPQP.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWRWTK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\windows\SysWOW64\HWRWTK.exeC:\windows\system32\HWRWTK.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKW.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\windows\SysWOW64\KKW.exeC:\windows\system32\KKW.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPGU.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\SysWOW64\HPGU.exeC:\windows\system32\HPGU.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFHMAAL.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\system\WFHMAAL.exeC:\windows\system\WFHMAAL.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PILP.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\SysWOW64\PILP.exeC:\windows\system32\PILP.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQZPSJ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:124 -
C:\windows\system\SQZPSJ.exeC:\windows\system\SQZPSJ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MWHPDWL.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\windows\SysWOW64\MWHPDWL.exeC:\windows\system32\MWHPDWL.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRQBW.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\SysWOW64\BRQBW.exeC:\windows\system32\BRQBW.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSSGZH.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\windows\system\SSSGZH.exeC:\windows\system\SSSGZH.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFX.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\windows\SysWOW64\NFX.exeC:\windows\system32\NFX.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WNZV.exe.bat" "66⤵PID:2456
-
C:\windows\SysWOW64\WNZV.exeC:\windows\system32\WNZV.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBKNDIA.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2944 -
C:\windows\NBKNDIA.exeC:\windows\NBKNDIA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWNQ.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2104 -
C:\windows\GWNQ.exeC:\windows\GWNQ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZR.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:6032 -
C:\windows\HZR.exeC:\windows\HZR.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTR.exe.bat" "74⤵
- Executes a command shell one-liner
PID:4076 -
C:\windows\system\QHTR.exeC:\windows\system\QHTR.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCDEKGO.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\windows\SysWOW64\FCDEKGO.exeC:\windows\system32\FCDEKGO.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENFUTM.exe.bat" "78⤵PID:4912
-
C:\windows\SysWOW64\ENFUTM.exeC:\windows\system32\ENFUTM.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDGLR.exe.bat" "80⤵PID:3652
-
C:\windows\system\TDGLR.exeC:\windows\system\TDGLR.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQRDH.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3388 -
C:\windows\CQRDH.exeC:\windows\CQRDH.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWRSJS.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3624 -
C:\windows\system\KWRSJS.exeC:\windows\system\KWRSJS.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBX.exe.bat" "86⤵PID:2612
-
C:\windows\SysWOW64\HBX.exeC:\windows\system32\HBX.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJDPC.exe.bat" "88⤵PID:3892
-
C:\windows\SysWOW64\LJDPC.exeC:\windows\system32\LJDPC.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LPEDLZ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1636 -
C:\windows\SysWOW64\LPEDLZ.exeC:\windows\system32\LPEDLZ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCIKO.exe.bat" "92⤵
- Executes a command shell one-liner
PID:4996 -
C:\windows\SysWOW64\TCIKO.exeC:\windows\system32\TCIKO.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XKP.exe.bat" "94⤵PID:5592
-
C:\windows\SysWOW64\XKP.exeC:\windows\system32\XKP.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MNYWTC.exe.bat" "96⤵PID:5936
-
C:\windows\SysWOW64\MNYWTC.exeC:\windows\system32\MNYWTC.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTZLVP.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4284 -
C:\windows\SysWOW64\MTZLVP.exeC:\windows\system32\MTZLVP.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMC.exe.bat" "100⤵
- Executes a command shell one-liner
PID:3156 -
C:\windows\XMC.exeC:\windows\XMC.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "102⤵PID:1528
-
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JMRFVTW.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4240 -
C:\windows\system\JMRFVTW.exeC:\windows\system\JMRFVTW.exe105⤵
- Executes dropped EXE
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JSJ.exe.bat" "106⤵PID:5032
-
C:\windows\system\JSJ.exeC:\windows\system\JSJ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VIQTJ.exe.bat" "108⤵PID:4572
-
C:\windows\SysWOW64\VIQTJ.exeC:\windows\system32\VIQTJ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVUDTYB.exe.bat" "110⤵PID:2016
-
C:\windows\SysWOW64\QVUDTYB.exeC:\windows\system32\QVUDTYB.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQGG.exe.bat" "112⤵PID:2476
-
C:\windows\IQGG.exeC:\windows\IQGG.exe113⤵
- Executes dropped EXE
PID:2040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDQJO.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2768 -
C:\windows\system\DLDQJO.exeC:\windows\system\DLDQJO.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JML.exe.bat" "116⤵PID:940
-
C:\windows\JML.exeC:\windows\JML.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJQBZ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3680 -
C:\windows\FJQBZ.exeC:\windows\FJQBZ.exe119⤵
- Executes dropped EXE
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMUWMQE.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2716 -
C:\windows\GMUWMQE.exeC:\windows\GMUWMQE.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-