Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 11:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe
- Size 208KB
- Sample261003-nzfegsda39
- SHA256 81db20942a6d282a0f32f8e820af0c97c99ea4b11371b29a9dc0da0f6a608309
- MD5 5d93fb5603412c4d50e3177d856cdf8a
- SHA1 e4f2f9984a21f2d3a5d36ed636e165e5da931cec
- SHA512 0b3fad3eae4574de3e23b92c8355ccf5d9954c2f92fd7ab8dff5c998f37cf07b3460ae3dd6ff63e67db70037abc41114c21c272310d21fa1c8de3900a9e12db1
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUtL+LOfh4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUp+LO5kEj1
- TLSH T171247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4604 NGZSC.exe 3500 OETUN.exe 5060 SUACAQP.exe 1908 YUHP.exe 2080 CXFKQDT.exe 1736 XKKU.exe 4236 MFUYMYQ.exe 1216 DOW.exe 2964 WRZHV.exe 3512 LMR.exe 2556 RHIMKB.exe 2848 GCAY.exe 2524 QCUDH.exe 6092 MIZBO.exe 3948 YACLWK.exe 3440 NVMY.exe 4592 WEODLCP.exe 2932 ZRTM.exe 2528 TEXWFC.exe 4960 OSCFPCH.exe 3884 XAES.exe 3816 BILSFS.exe 4988 MBGLFZV.exe 1160 EOQ.exe 960 YBVMF.exe 4688 YPVBHI.exe 1872 BCAKRIP.exe 5852 GFW.exe 1796 XSHB.exe 2580 XYHPO.exe 1768 UDNMVTC.exe 2576 AEUA.exe 1572 OJSX.exe 3256 JWXHD.exe 4548 LUYBBU.exe 5724 NID.exe 5452 LIKGV.exe 2956 TNDUWB.exe 1864 ZOK.exe 2728 DERIZ.exe 3504 METNDTN.exe 1912 NHXRII.exe 3348 BNDGP.exe 1408 RIM.exe 3060 ZNMH.exe 1240 WOUUTM.exe 3184 ZBZ.exe 5620 UWDNN.exe 5024 FPYGOB.exe 4528 LPG.exe 876 NFHODSF.exe 3828 LFPC.exe 4124 WYKUU.exe 1464 IOY.exe 6116 CBVMR.exe 4972 IMZKWD.exe 1868 KCSM.exe 3708 EXXWEA.exe 3192 KXF.exe 4140 QYNXEW.exe 6136 BQQQNEQ.exe 5036 YOVNUO.exe 996 JGQ.exe 6128 LEESJDQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\CXFKQDT.exe YUHP.exe File created C:\windows\SysWOW64\XSHB.exe GFW.exe File created C:\windows\SysWOW64\LEESJDQ.exe JGQ.exe File opened for modification C:\windows\SysWOW64\IXYTL.exe EPSLZBG.exe File created C:\windows\SysWOW64\YAB.exe.bat SZTKSX.exe File opened for modification C:\windows\SysWOW64\VUYEEKC.exe ZPSPPBA.exe File created C:\windows\SysWOW64\WEODLCP.exe.bat NVMY.exe File created C:\windows\SysWOW64\HMJR.exe.bat WTG.exe File created C:\windows\SysWOW64\KVZNS.exe.bat IXYTL.exe File created C:\windows\SysWOW64\HKMWSR.exe.bat BJEAJ.exe File created C:\windows\SysWOW64\VUYEEKC.exe ZPSPPBA.exe File created C:\windows\SysWOW64\NGZSC.exe 2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe File created C:\windows\SysWOW64\SUACAQP.exe OETUN.exe File created C:\windows\SysWOW64\NVMY.exe.bat YACLWK.exe File created C:\windows\SysWOW64\UWDNN.exe.bat ZBZ.exe File created C:\windows\SysWOW64\KXF.exe.bat EXXWEA.exe File created C:\windows\SysWOW64\GITBPK.exe.bat MUOS.exe File created C:\windows\SysWOW64\LUYBBU.exe.bat JWXHD.exe File opened for modification C:\windows\SysWOW64\URGXOH.exe QBZ.exe File opened for modification C:\windows\SysWOW64\YAB.exe SZTKSX.exe File created C:\windows\SysWOW64\NEREG.exe HMJR.exe File opened for modification C:\windows\SysWOW64\KSE.exe VUYEEKC.exe File created C:\windows\SysWOW64\KSE.exe.bat VUYEEKC.exe File created C:\windows\SysWOW64\WMTFL.exe.bat ZGWQEV.exe File created C:\windows\SysWOW64\GCAY.exe RHIMKB.exe File created C:\windows\SysWOW64\NID.exe LUYBBU.exe File created C:\windows\SysWOW64\PCKYN.exe NEREG.exe File opened for modification C:\windows\SysWOW64\IOWT.exe XWTAP.exe File opened for modification C:\windows\SysWOW64\WMTFL.exe ZGWQEV.exe File opened for modification C:\windows\SysWOW64\NGZSC.exe 2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\SUACAQP.exe OETUN.exe File opened for modification C:\windows\SysWOW64\HMJR.exe WTG.exe File opened for modification C:\windows\SysWOW64\EPSLZBG.exe HKMWSR.exe File created C:\windows\SysWOW64\JMXC.exe.bat URGXOH.exe File opened for modification C:\windows\SysWOW64\QHW.exe VTRDWLJ.exe File opened for modification C:\windows\SysWOW64\EXXWEA.exe KCSM.exe File created C:\windows\SysWOW64\SUACAQP.exe.bat OETUN.exe File created C:\windows\SysWOW64\NID.exe.bat LUYBBU.exe File created C:\windows\SysWOW64\URGXOH.exe QBZ.exe File created C:\windows\SysWOW64\SZTKSX.exe YMOB.exe File created C:\windows\SysWOW64\GCAY.exe.bat RHIMKB.exe File created C:\windows\SysWOW64\GITBPK.exe MUOS.exe File created C:\windows\SysWOW64\NGZSC.exe.bat 2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe File created C:\windows\SysWOW64\CXFKQDT.exe.bat YUHP.exe File opened for modification C:\windows\SysWOW64\GCAY.exe RHIMKB.exe File created C:\windows\SysWOW64\UWDNN.exe ZBZ.exe File opened for modification C:\windows\SysWOW64\JMXC.exe URGXOH.exe File created C:\windows\SysWOW64\RQYYQ.exe DFUZLH.exe File opened for modification C:\windows\SysWOW64\MSCYTWS.exe QNXAMMQ.exe File created C:\windows\SysWOW64\MSCYTWS.exe.bat QNXAMMQ.exe File created C:\windows\SysWOW64\NFHODSF.exe LPG.exe File created C:\windows\SysWOW64\CBVMR.exe IOY.exe File created C:\windows\SysWOW64\KVZNS.exe IXYTL.exe File opened for modification C:\windows\SysWOW64\RQYYQ.exe DFUZLH.exe File created C:\windows\SysWOW64\IOWT.exe XWTAP.exe File created C:\windows\SysWOW64\WMTFL.exe ZGWQEV.exe File created C:\windows\SysWOW64\CXRERQL.exe.bat GRTHK.exe File opened for modification C:\windows\SysWOW64\LUYBBU.exe JWXHD.exe File opened for modification C:\windows\SysWOW64\VDOY.exe ONNHNF.exe File created C:\windows\SysWOW64\VDOY.exe.bat ONNHNF.exe File created C:\windows\SysWOW64\EPSLZBG.exe.bat HKMWSR.exe File opened for modification C:\windows\SysWOW64\KVZNS.exe IXYTL.exe File created C:\windows\SysWOW64\JSQQ.exe JMXC.exe File created C:\windows\SysWOW64\WAJMK.exe.bat YAB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\QYNXEW.exe KXF.exe File created C:\windows\QEFFP.exe.bat WRBV.exe File opened for modification C:\windows\QBZ.exe CYDRXYU.exe File created C:\windows\system\VLZKRO.exe WAJMK.exe File opened for modification C:\windows\system\MBGLFZV.exe BILSFS.exe File created C:\windows\system\METNDTN.exe DERIZ.exe File created C:\windows\EXZLSL.exe LEESJDQ.exe File opened for modification C:\windows\system\TOKTG.exe YBO.exe File opened for modification C:\windows\system\CHDH.exe IUYYSFQ.exe File opened for modification C:\windows\TNDUWB.exe LIKGV.exe File opened for modification C:\windows\system\LPG.exe FPYGOB.exe File created C:\windows\QEFFP.exe WRBV.exe File created C:\windows\system\IMHSBSY.exe QEFFP.exe File created C:\windows\system\VTRDWLJ.exe PTKP.exe File opened for modification C:\windows\GTKR.exe YNS.exe File created C:\windows\DOW.exe.bat MFUYMYQ.exe File opened for modification C:\windows\TEXWFC.exe ZRTM.exe File created C:\windows\XYHPO.exe.bat XSHB.exe File created C:\windows\YOVNUO.exe BQQQNEQ.exe File opened for modification C:\windows\ZGWQEV.exe ZBVBC.exe File created C:\windows\MFUYMYQ.exe.bat XKKU.exe File created C:\windows\system\LMR.exe.bat WRZHV.exe File created C:\windows\MIZBO.exe.bat QCUDH.exe File opened for modification C:\windows\ZNMH.exe RIM.exe File opened for modification C:\windows\SBCVYRJ.exe MBVHPPA.exe File opened for modification C:\windows\system\SQER.exe JDUZ.exe File created C:\windows\XWTAP.exe SQER.exe File created C:\windows\ZBVBC.exe.bat AIN.exe File opened for modification C:\windows\OJSX.exe AEUA.exe File created C:\windows\WYKUU.exe.bat LFPC.exe File created C:\windows\system\KYA.exe GITBPK.exe File created C:\windows\system\HFHHEW.exe MSCYTWS.exe File created C:\windows\SCVLNRN.exe CHDH.exe File opened for modification C:\windows\CXEMYOO.exe FSGPR.exe File created C:\windows\GTKR.exe YNS.exe File created C:\windows\DOW.exe MFUYMYQ.exe File created C:\windows\system\EOQ.exe MBGLFZV.exe File created C:\windows\system\CYCOFA.exe KYA.exe File created C:\windows\QBZ.exe CYDRXYU.exe File created C:\windows\IXZS.exe.bat CXRERQL.exe File created C:\windows\system\OETUN.exe.bat NGZSC.exe File created C:\windows\system\LFPC.exe.bat NFHODSF.exe File created C:\windows\ZGWQEV.exe ZBVBC.exe File opened for modification C:\windows\system\OHIZS.exe ZMYNZXI.exe File created C:\windows\GTKR.exe.bat YNS.exe File opened for modification C:\windows\IXZS.exe CXRERQL.exe File opened for modification C:\windows\BNESG.exe RQYYQ.exe File created C:\windows\JDUZ.exe KSE.exe File opened for modification C:\windows\system\YACLWK.exe MIZBO.exe File created C:\windows\system\HLDGYLG.exe.bat VDOY.exe File created C:\windows\system\BJEAJ.exe.bat SBCVYRJ.exe File created C:\windows\system\ZMYNZXI.exe FRTEW.exe File created C:\windows\system\FSGPR.exe OHIZS.exe File created C:\windows\system\BNDGP.exe.bat NHXRII.exe File opened for modification C:\windows\WOUUTM.exe ZNMH.exe File created C:\windows\system\FPYGOB.exe.bat UWDNN.exe File created C:\windows\PTKP.exe BNESG.exe File created C:\windows\RHIMKB.exe.bat LMR.exe File created C:\windows\QCUDH.exe.bat GCAY.exe File created C:\windows\LIKGV.exe.bat NID.exe File created C:\windows\ZOK.exe TNDUWB.exe File opened for modification C:\windows\IMZKWD.exe CBVMR.exe File opened for modification C:\windows\KCSM.exe IMZKWD.exe File created C:\windows\system\CYCOFA.exe.bat KYA.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5104 cmd.exe 2636 cmd.exe 4628 cmd.exe 4596 cmd.exe 1596 cmd.exe 6068 cmd.exe 4148 cmd.exe 2768 cmd.exe 4532 cmd.exe 5904 cmd.exe 5708 cmd.exe 1876 cmd.exe 2656 cmd.exe 4324 cmd.exe 4452 cmd.exe 2148 cmd.exe 2824 cmd.exe 6020 cmd.exe 5164 cmd.exe 5416 cmd.exe 1916 cmd.exe 1220 cmd.exe 4344 cmd.exe 5660 cmd.exe 1208 cmd.exe 2844 cmd.exe 3368 cmd.exe 3696 cmd.exe 5324 cmd.exe 5012 cmd.exe 4380 cmd.exe 1120 cmd.exe 1660 cmd.exe 3088 cmd.exe 2388 cmd.exe 4804 cmd.exe 5900 cmd.exe 5956 cmd.exe 2544 cmd.exe 3080 cmd.exe 4700 cmd.exe 4320 cmd.exe 5264 cmd.exe 3980 cmd.exe 1520 cmd.exe 2400 cmd.exe 5476 cmd.exe 264 cmd.exe 1920 cmd.exe 4584 cmd.exe 1860 cmd.exe 3476 cmd.exe 5872 cmd.exe 3396 cmd.exe 5924 cmd.exe 5604 cmd.exe 3336 cmd.exe 5308 cmd.exe 4616 cmd.exe 3140 cmd.exe 2596 cmd.exe 5332 cmd.exe 4440 cmd.exe 4356 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4356 1260 WerFault.exe 87 6116 4604 WerFault.exe 93 5012 3500 WerFault.exe 99 3720 5060 WerFault.exe 104 3136 1908 WerFault.exe 109 2360 2080 WerFault.exe 114 876 1736 WerFault.exe 119 4796 4236 WerFault.exe 124 2032 1216 WerFault.exe 129 1764 2964 WerFault.exe 134 632 3512 WerFault.exe 139 2540 2556 WerFault.exe 144 3208 2848 WerFault.exe 149 3260 2524 WerFault.exe 154 1836 6092 WerFault.exe 159 1100 3948 WerFault.exe 164 4824 3440 WerFault.exe 169 5068 4592 WerFault.exe 174 5056 2932 WerFault.exe 179 3600 2528 WerFault.exe 184 5540 4960 WerFault.exe 189 2656 3884 WerFault.exe 194 5656 3816 WerFault.exe 199 4548 4988 WerFault.exe 204 264 1160 WerFault.exe 209 912 960 WerFault.exe 214 1744 4688 WerFault.exe 219 5260 1872 WerFault.exe 224 3328 5852 WerFault.exe 229 1344 1796 WerFault.exe 234 3116 2580 WerFault.exe 239 2628 1768 WerFault.exe 244 2808 2576 WerFault.exe 249 996 1572 WerFault.exe 254 4356 3256 WerFault.exe 259 5672 4548 WerFault.exe 264 3668 5724 WerFault.exe 269 1084 5452 WerFault.exe 274 2988 2956 WerFault.exe 279 600 1864 WerFault.exe 284 2372 2728 WerFault.exe 289 3756 3504 WerFault.exe 294 5288 1912 WerFault.exe 299 996 3348 WerFault.exe 304 6060 1408 WerFault.exe 309 2984 3060 WerFault.exe 314 124 1240 WerFault.exe 319 3812 3184 WerFault.exe 324 5628 5620 WerFault.exe 329 600 5024 WerFault.exe 334 2328 4528 WerFault.exe 339 3756 876 WerFault.exe 344 1764 3828 WerFault.exe 349 4680 4124 WerFault.exe 354 4480 1464 WerFault.exe 359 3432 6116 WerFault.exe 364 3944 4972 WerFault.exe 369 4308 1868 WerFault.exe 374 5956 3708 WerFault.exe 379 4596 3192 WerFault.exe 384 4172 4140 WerFault.exe 389 2424 6136 WerFault.exe 394 4736 5036 WerFault.exe 399 2412 996 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRZHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBVMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEODLCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUYYSFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUACAQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MIZBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYNXEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCVLNRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQYYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URGXOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XAES.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCAKRIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBVMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOVNUO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIYJDKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXEMYOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRTEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWXHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YVKJFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHXRII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBGLFZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBVHPPA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1260 2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe 1260 2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe 4604 NGZSC.exe 4604 NGZSC.exe 3500 OETUN.exe 3500 OETUN.exe 5060 SUACAQP.exe 5060 SUACAQP.exe 1908 YUHP.exe 1908 YUHP.exe 2080 CXFKQDT.exe 2080 CXFKQDT.exe 1736 XKKU.exe 1736 XKKU.exe 4236 MFUYMYQ.exe 4236 MFUYMYQ.exe 1216 DOW.exe 1216 DOW.exe 2964 WRZHV.exe 2964 WRZHV.exe 3512 LMR.exe 3512 LMR.exe 2556 RHIMKB.exe 2556 RHIMKB.exe 2848 GCAY.exe 2848 GCAY.exe 2524 QCUDH.exe 2524 QCUDH.exe 6092 MIZBO.exe 6092 MIZBO.exe 3948 YACLWK.exe 3948 YACLWK.exe 3440 NVMY.exe 3440 NVMY.exe 4592 WEODLCP.exe 4592 WEODLCP.exe 2932 ZRTM.exe 2932 ZRTM.exe 2528 TEXWFC.exe 2528 TEXWFC.exe 4960 OSCFPCH.exe 4960 OSCFPCH.exe 3884 XAES.exe 3884 XAES.exe 3816 BILSFS.exe 3816 BILSFS.exe 4988 MBGLFZV.exe 4988 MBGLFZV.exe 1160 EOQ.exe 1160 EOQ.exe 960 YBVMF.exe 960 YBVMF.exe 4688 YPVBHI.exe 4688 YPVBHI.exe 1872 BCAKRIP.exe 1872 BCAKRIP.exe 5852 GFW.exe 5852 GFW.exe 1796 XSHB.exe 1796 XSHB.exe 2580 XYHPO.exe 2580 XYHPO.exe 1768 UDNMVTC.exe 1768 UDNMVTC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1260 2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe 1260 2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe 4604 NGZSC.exe 4604 NGZSC.exe 3500 OETUN.exe 3500 OETUN.exe 5060 SUACAQP.exe 5060 SUACAQP.exe 1908 YUHP.exe 1908 YUHP.exe 2080 CXFKQDT.exe 2080 CXFKQDT.exe 1736 XKKU.exe 1736 XKKU.exe 4236 MFUYMYQ.exe 4236 MFUYMYQ.exe 1216 DOW.exe 1216 DOW.exe 2964 WRZHV.exe 2964 WRZHV.exe 3512 LMR.exe 3512 LMR.exe 2556 RHIMKB.exe 2556 RHIMKB.exe 2848 GCAY.exe 2848 GCAY.exe 2524 QCUDH.exe 2524 QCUDH.exe 6092 MIZBO.exe 6092 MIZBO.exe 3948 YACLWK.exe 3948 YACLWK.exe 3440 NVMY.exe 3440 NVMY.exe 4592 WEODLCP.exe 4592 WEODLCP.exe 2932 ZRTM.exe 2932 ZRTM.exe 2528 TEXWFC.exe 2528 TEXWFC.exe 4960 OSCFPCH.exe 4960 OSCFPCH.exe 3884 XAES.exe 3884 XAES.exe 3816 BILSFS.exe 3816 BILSFS.exe 4988 MBGLFZV.exe 4988 MBGLFZV.exe 1160 EOQ.exe 1160 EOQ.exe 960 YBVMF.exe 960 YBVMF.exe 4688 YPVBHI.exe 4688 YPVBHI.exe 1872 BCAKRIP.exe 1872 BCAKRIP.exe 5852 GFW.exe 5852 GFW.exe 1796 XSHB.exe 1796 XSHB.exe 2580 XYHPO.exe 2580 XYHPO.exe 1768 UDNMVTC.exe 1768 UDNMVTC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1260 wrote to memory of 2716 1260 2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe 89 PID 2716 wrote to memory of 4604 2716 cmd.exe 93 PID 4604 wrote to memory of 2304 4604 NGZSC.exe 95 PID 2304 wrote to memory of 3500 2304 cmd.exe 99 PID 3500 wrote to memory of 6096 3500 OETUN.exe 100 PID 6096 wrote to memory of 5060 6096 cmd.exe 104 PID 5060 wrote to memory of 2636 5060 SUACAQP.exe 105 PID 2636 wrote to memory of 1908 2636 cmd.exe 109 PID 1908 wrote to memory of 2768 1908 YUHP.exe 110 PID 2768 wrote to memory of 2080 2768 cmd.exe 114 PID 2080 wrote to memory of 4212 2080 CXFKQDT.exe 115 PID 4212 wrote to memory of 1736 4212 cmd.exe 119 PID 1736 wrote to memory of 1828 1736 XKKU.exe 120 PID 1828 wrote to memory of 4236 1828 cmd.exe 124 PID 4236 wrote to memory of 2604 4236 MFUYMYQ.exe 125 PID 2604 wrote to memory of 1216 2604 cmd.exe 129 PID 1216 wrote to memory of 2732 1216 DOW.exe 130 PID 2732 wrote to memory of 2964 2732 cmd.exe 134 PID 2964 wrote to memory of 4628 2964 WRZHV.exe 135 PID 4628 wrote to memory of 3512 4628 cmd.exe 139 PID 3512 wrote to memory of 4456 3512 LMR.exe 140 PID 4456 wrote to memory of 2556 4456 cmd.exe 144 PID 2556 wrote to memory of 4128 2556 RHIMKB.exe 145 PID 4128 wrote to memory of 2848 4128 cmd.exe 149 PID 2848 wrote to memory of 2144 2848 GCAY.exe 150 PID 2144 wrote to memory of 2524 2144 cmd.exe 154 PID 2524 wrote to memory of 1056 2524 QCUDH.exe 155 PID 1056 wrote to memory of 6092 1056 cmd.exe 159 PID 6092 wrote to memory of 4564 6092 MIZBO.exe 160 PID 4564 wrote to memory of 3948 4564 cmd.exe 164 PID 3948 wrote to memory of 2508 3948 YACLWK.exe 165 PID 2508 wrote to memory of 3440 2508 cmd.exe 169 PID 3440 wrote to memory of 2028 3440 NVMY.exe 170 PID 2028 wrote to memory of 4592 2028 cmd.exe 174 PID 4592 wrote to memory of 3556 4592 WEODLCP.exe 175 PID 3556 wrote to memory of 2932 3556 cmd.exe 179 PID 2932 wrote to memory of 2068 2932 ZRTM.exe 180 PID 2068 wrote to memory of 2528 2068 cmd.exe 184 PID 2528 wrote to memory of 5924 2528 TEXWFC.exe 185 PID 5924 wrote to memory of 4960 5924 cmd.exe 189 PID 4960 wrote to memory of 3548 4960 OSCFPCH.exe 190 PID 3548 wrote to memory of 3884 3548 cmd.exe 194 PID 3884 wrote to memory of 5824 3884 XAES.exe 195 PID 5824 wrote to memory of 3816 5824 cmd.exe 199 PID 3816 wrote to memory of 5424 3816 BILSFS.exe 200 PID 5424 wrote to memory of 4988 5424 cmd.exe 204 PID 4988 wrote to memory of 3396 4988 MBGLFZV.exe 205 PID 3396 wrote to memory of 1160 3396 cmd.exe 209 PID 1160 wrote to memory of 4904 1160 EOQ.exe 210 PID 4904 wrote to memory of 960 4904 cmd.exe 214 PID 960 wrote to memory of 300 960 YBVMF.exe 215 PID 300 wrote to memory of 4688 300 cmd.exe 219 PID 4688 wrote to memory of 4160 4688 YPVBHI.exe 220 PID 4160 wrote to memory of 1872 4160 cmd.exe 224 PID 1872 wrote to memory of 4532 1872 BCAKRIP.exe 225 PID 4532 wrote to memory of 5852 4532 cmd.exe 229 PID 5852 wrote to memory of 4804 5852 GFW.exe 230 PID 4804 wrote to memory of 1796 4804 cmd.exe 234 PID 1796 wrote to memory of 556 1796 XSHB.exe 235 PID 556 wrote to memory of 2580 556 cmd.exe 239 PID 2580 wrote to memory of 6084 2580 XYHPO.exe 240 PID 6084 wrote to memory of 1768 6084 cmd.exe 244 PID 1768 wrote to memory of 2884 1768 UDNMVTC.exe 245 PID 2884 wrote to memory of 2576 2884 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_5d93fb5603412c4d50e3177d856cdf8a_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGZSC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\windows\SysWOW64\NGZSC.exeC:\windows\system32\NGZSC.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OETUN.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\windows\system\OETUN.exeC:\windows\system\OETUN.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUACAQP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\SysWOW64\SUACAQP.exeC:\windows\system32\SUACAQP.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUHP.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\YUHP.exeC:\windows\YUHP.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CXFKQDT.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\windows\SysWOW64\CXFKQDT.exeC:\windows\system32\CXFKQDT.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XKKU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\windows\system\XKKU.exeC:\windows\system\XKKU.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFUYMYQ.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\windows\MFUYMYQ.exeC:\windows\MFUYMYQ.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DOW.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\windows\DOW.exeC:\windows\DOW.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRZHV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\system\WRZHV.exeC:\windows\system\WRZHV.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHIMKB.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\RHIMKB.exeC:\windows\RHIMKB.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCAY.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\windows\SysWOW64\GCAY.exeC:\windows\system32\GCAY.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCUDH.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\windows\QCUDH.exeC:\windows\QCUDH.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MIZBO.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\MIZBO.exeC:\windows\MIZBO.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YACLWK.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\system\YACLWK.exeC:\windows\system\YACLWK.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVMY.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\SysWOW64\NVMY.exeC:\windows\system32\NVMY.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEODLCP.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\windows\SysWOW64\WEODLCP.exeC:\windows\system32\WEODLCP.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRTM.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\windows\system\ZRTM.exeC:\windows\system\ZRTM.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEXWFC.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\windows\TEXWFC.exeC:\windows\TEXWFC.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSCFPCH.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\windows\OSCFPCH.exeC:\windows\OSCFPCH.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XAES.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\windows\SysWOW64\XAES.exeC:\windows\system32\XAES.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BILSFS.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\BILSFS.exeC:\windows\BILSFS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBGLFZV.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\system\MBGLFZV.exeC:\windows\system\MBGLFZV.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EOQ.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\system\EOQ.exeC:\windows\system\EOQ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBVMF.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\windows\system\YBVMF.exeC:\windows\system\YBVMF.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPVBHI.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:300 -
C:\windows\system\YPVBHI.exeC:\windows\system\YPVBHI.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCAKRIP.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\BCAKRIP.exeC:\windows\BCAKRIP.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFW.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\SysWOW64\GFW.exeC:\windows\system32\GFW.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:556 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDNMVTC.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\windows\system\UDNMVTC.exeC:\windows\system\UDNMVTC.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AEUA.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\windows\system\AEUA.exeC:\windows\system\AEUA.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJSX.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4452 -
C:\windows\OJSX.exeC:\windows\OJSX.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWXHD.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5440 -
C:\windows\system\JWXHD.exeC:\windows\system\JWXHD.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LUYBBU.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2148 -
C:\windows\SysWOW64\LUYBBU.exeC:\windows\system32\LUYBBU.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NID.exe.bat" "72⤵PID:1832
-
C:\windows\SysWOW64\NID.exeC:\windows\system32\NID.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LIKGV.exe.bat" "74⤵PID:1196
-
C:\windows\LIKGV.exeC:\windows\LIKGV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNDUWB.exe.bat" "76⤵PID:5336
-
C:\windows\TNDUWB.exeC:\windows\TNDUWB.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOK.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4344 -
C:\windows\ZOK.exeC:\windows\ZOK.exe79⤵
- Executes dropped EXE
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DERIZ.exe.bat" "80⤵PID:6040
-
C:\windows\system\DERIZ.exeC:\windows\system\DERIZ.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\METNDTN.exe.bat" "82⤵PID:4796
-
C:\windows\system\METNDTN.exeC:\windows\system\METNDTN.exe83⤵
- Executes dropped EXE
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHXRII.exe.bat" "84⤵PID:2308
-
C:\windows\system\NHXRII.exeC:\windows\system\NHXRII.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNDGP.exe.bat" "86⤵PID:704
-
C:\windows\system\BNDGP.exeC:\windows\system\BNDGP.exe87⤵
- Executes dropped EXE
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RIM.exe.bat" "88⤵PID:2700
-
C:\windows\RIM.exeC:\windows\RIM.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNMH.exe.bat" "90⤵
- Executes a command shell one-liner
PID:1920 -
C:\windows\ZNMH.exeC:\windows\ZNMH.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUUTM.exe.bat" "92⤵PID:5612
-
C:\windows\WOUUTM.exeC:\windows\WOUUTM.exe93⤵
- Executes dropped EXE
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZBZ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5660 -
C:\windows\ZBZ.exeC:\windows\ZBZ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UWDNN.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3140 -
C:\windows\SysWOW64\UWDNN.exeC:\windows\system32\UWDNN.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPYGOB.exe.bat" "98⤵
- Executes a command shell one-liner
PID:2824 -
C:\windows\system\FPYGOB.exeC:\windows\system\FPYGOB.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPG.exe.bat" "100⤵PID:2660
-
C:\windows\system\LPG.exeC:\windows\system\LPG.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFHODSF.exe.bat" "102⤵PID:3232
-
C:\windows\SysWOW64\NFHODSF.exeC:\windows\system32\NFHODSF.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFPC.exe.bat" "104⤵PID:3472
-
C:\windows\system\LFPC.exeC:\windows\system\LFPC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WYKUU.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5900 -
C:\windows\WYKUU.exeC:\windows\WYKUU.exe107⤵
- Executes dropped EXE
PID:4124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOY.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4476 -
C:\windows\IOY.exeC:\windows\IOY.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBVMR.exe.bat" "110⤵PID:932
-
C:\windows\SysWOW64\CBVMR.exeC:\windows\system32\CBVMR.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMZKWD.exe.bat" "112⤵PID:3460
-
C:\windows\IMZKWD.exeC:\windows\IMZKWD.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCSM.exe.bat" "114⤵PID:5536
-
C:\windows\KCSM.exeC:\windows\KCSM.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXXWEA.exe.bat" "116⤵PID:4220
-
C:\windows\SysWOW64\EXXWEA.exeC:\windows\system32\EXXWEA.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXF.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4824 -
C:\windows\SysWOW64\KXF.exeC:\windows\system32\KXF.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "120⤵PID:2960
-
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-