Analysis
- max time kernel
98s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 17:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe
- Size 208KB
- Sample261003-vy6zdaed86
- SHA256 079d7d45922d0c1dcac71e00e6e821b47ae4fd45c74537a09e76eb8ef778ba24
- MD5 0f80ab359b00154bd500c66ef4551764
- SHA1 664e2dd82f88c5adba348c24d3730772b8b702a8
- SHA512 ce5cd7bd249da44f0ee6929ad1a98d722355f612f352f023b1afe5eedc147f2c73f0de5202aceabf55169a467f5c4aaf9921b61c77eb66111a4d3104b2b927a3
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOfm4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LOekEj1
- TLSH T1C1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4320 CJMVYF.exe 3544 GJJXLV.exe 1708 OXNEV.exe 4276 ESX.exe 1280 NSZN.exe 1980 INEXUL.exe 2708 NOL.exe 4856 FONYP.exe 4532 XRRTUJP.exe 3024 DRZH.exe 4984 THAHKZN.exe 5492 VFNBZ.exe 260 BFNPIBP.exe 6052 QVWGP.exe 1400 ATB.exe 2096 LMET.exe 4560 EHI.exe 4868 RSRNYN.exe 3952 DIX.exe 5512 BVXWPA.exe 1252 QYGB.exe 5584 YDGPC.exe 3296 CMNPOSK.exe 2148 RHWBZ.exe 5992 MCBLJNZ.exe 3396 XUE.exe 4732 BCLEW.exe 4968 WQPNGNR.exe 1496 ABOIO.exe 4208 GBVWXAD.exe 1308 QZBQE.exe 4644 WZJENKN.exe 2844 FZLJ.exe 1248 PXY.exe 3608 PDQS.exe 5000 JQVBS.exe 3708 ELALCDW.exe 4488 MRNRNBS.exe 5348 SRUF.exe 2908 BAOKZ.exe 2840 NID.exe 4436 ASLJAW.exe 2360 SLWP.exe 5784 BMYUVL.exe 5852 HMX.exe 6076 BZCZO.exe 1296 RPD.exe 4264 VFSZH.exe 2468 EGUEKRI.exe 2368 KGUS.exe 2724 STUGV.exe 5312 HOD.exe 2584 SHGD.exe 2208 CHIIZ.exe 2224 WDNSCXT.exe 1096 RQSB.exe 4548 PGDEHCQ.exe 4820 BYG.exe 3188 JEYL.exe 3016 HEGZAZ.exe 5016 JZL.exe 2364 NHZJOJ.exe 4092 IVWSZJB.exe 3400 EACP.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\LMET.exe ATB.exe File created C:\windows\SysWOW64\ABOIO.exe.bat WQPNGNR.exe File created C:\windows\SysWOW64\GBVWXAD.exe.bat ABOIO.exe File created C:\windows\SysWOW64\TTKQCAZ.exe.bat LBBOO.exe File opened for modification C:\windows\SysWOW64\IULJW.exe EMF.exe File created C:\windows\SysWOW64\BRFX.exe.bat GEA.exe File created C:\windows\SysWOW64\QXJDQ.exe VKE.exe File created C:\windows\SysWOW64\GJJXLV.exe CJMVYF.exe File created C:\windows\SysWOW64\QZBQE.exe.bat GBVWXAD.exe File created C:\windows\SysWOW64\JQVBS.exe PDQS.exe File created C:\windows\SysWOW64\OIO.exe.bat KSHDAX.exe File created C:\windows\SysWOW64\UVNLRS.exe.bat OIO.exe File opened for modification C:\windows\SysWOW64\QXJDQ.exe VKE.exe File created C:\windows\SysWOW64\PCPGEP.exe PPPSCC.exe File created C:\windows\SysWOW64\SHGD.exe HOD.exe File created C:\windows\SysWOW64\OPVL.exe JPNXWFM.exe File created C:\windows\SysWOW64\AOLA.exe FBH.exe File created C:\windows\SysWOW64\XURXAX.exe.bat AOLA.exe File opened for modification C:\windows\SysWOW64\YDGPC.exe QYGB.exe File created C:\windows\SysWOW64\IULJW.exe EMF.exe File opened for modification C:\windows\SysWOW64\OVGIA.exe IVYUR.exe File created C:\windows\SysWOW64\FVBU.exe ZAKL.exe File created C:\windows\SysWOW64\KSHDAX.exe.bat BRFX.exe File created C:\windows\SysWOW64\BFNPIBP.exe VFNBZ.exe File created C:\windows\SysWOW64\PXY.exe.bat FZLJ.exe File created C:\windows\SysWOW64\CHIIZ.exe.bat SHGD.exe File opened for modification C:\windows\SysWOW64\HEGZAZ.exe JEYL.exe File created C:\windows\SysWOW64\EMF.exe.bat TTKQCAZ.exe File created C:\windows\SysWOW64\OVGIA.exe IVYUR.exe File created C:\windows\SysWOW64\XURXAX.exe AOLA.exe File created C:\windows\SysWOW64\ISM.exe.bat XAJMCCW.exe File created C:\windows\SysWOW64\FONYP.exe.bat NOL.exe File created C:\windows\SysWOW64\YDGPC.exe QYGB.exe File created C:\windows\SysWOW64\WQPNGNR.exe.bat BCLEW.exe File opened for modification C:\windows\SysWOW64\BRFX.exe GEA.exe File created C:\windows\SysWOW64\KSHDAX.exe BRFX.exe File created C:\windows\SysWOW64\FACOCS.exe EXYS.exe File opened for modification C:\windows\SysWOW64\VFNBZ.exe THAHKZN.exe File created C:\windows\SysWOW64\QVWGP.exe.bat BFNPIBP.exe File created C:\windows\SysWOW64\ASLJAW.exe NID.exe File opened for modification C:\windows\SysWOW64\JEYL.exe BYG.exe File created C:\windows\SysWOW64\OIO.exe KSHDAX.exe File opened for modification C:\windows\SysWOW64\NSG.exe CZLY.exe File created C:\windows\SysWOW64\VFNBZ.exe THAHKZN.exe File created C:\windows\SysWOW64\TTKQCAZ.exe LBBOO.exe File opened for modification C:\windows\SysWOW64\GEA.exe AETAE.exe File created C:\windows\SysWOW64\UVNLRS.exe OIO.exe File created C:\windows\SysWOW64\QXJDQ.exe.bat VKE.exe File opened for modification C:\windows\SysWOW64\FBH.exe LOCHYO.exe File opened for modification C:\windows\SysWOW64\AOLA.exe FBH.exe File opened for modification C:\windows\SysWOW64\FONYP.exe NOL.exe File opened for modification C:\windows\SysWOW64\ABOIO.exe WQPNGNR.exe File created C:\windows\SysWOW64\UARPJ.exe IIOW.exe File opened for modification C:\windows\SysWOW64\INEXUL.exe NSZN.exe File created C:\windows\SysWOW64\NOL.exe.bat INEXUL.exe File opened for modification C:\windows\SysWOW64\PDQS.exe PXY.exe File opened for modification C:\windows\SysWOW64\JQVBS.exe PDQS.exe File created C:\windows\SysWOW64\ASLJAW.exe.bat NID.exe File created C:\windows\SysWOW64\JEYL.exe.bat BYG.exe File opened for modification C:\windows\SysWOW64\AIGDKD.exe FVBU.exe File opened for modification C:\windows\SysWOW64\GJJXLV.exe CJMVYF.exe File opened for modification C:\windows\SysWOW64\XRRTUJP.exe FONYP.exe File created C:\windows\SysWOW64\SRUF.exe MRNRNBS.exe File created C:\windows\SysWOW64\IWJETYU.exe.bat PTFIO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\EACP.exe IVWSZJB.exe File created C:\windows\EWPJ.exe JIKRKJL.exe File created C:\windows\system\PQS.exe.bat UVNLRS.exe File created C:\windows\OSUST.exe.bat ISM.exe File opened for modification C:\windows\EHI.exe LMET.exe File opened for modification C:\windows\system\RHWBZ.exe CMNPOSK.exe File opened for modification C:\windows\system\XUE.exe MCBLJNZ.exe File created C:\windows\system\ABUVGTR.exe.bat DVOGZ.exe File created C:\windows\system\WMAG.exe.bat QMSSFOV.exe File opened for modification C:\windows\system\AETAE.exe VEL.exe File opened for modification C:\windows\system\IIOW.exe XPT.exe File created C:\windows\system\SLWP.exe AYLX.exe File opened for modification C:\windows\system\SLWP.exe AYLX.exe File created C:\windows\system\IVWSZJB.exe.bat NHZJOJ.exe File created C:\windows\LBBOO.exe LVBA.exe File created C:\windows\system\OIT.exe TMOBWP.exe File created C:\windows\AHNMDF.exe POKUV.exe File created C:\windows\CMNPOSK.exe.bat YDGPC.exe File opened for modification C:\windows\system\ELALCDW.exe JQVBS.exe File created C:\windows\system\EGUEKRI.exe VFSZH.exe File created C:\windows\JIKRKJL.exe OVGIA.exe File opened for modification C:\windows\system\WMAG.exe QMSSFOV.exe File created C:\windows\system\XUE.exe MCBLJNZ.exe File created C:\windows\system\BAOKZ.exe SRUF.exe File created C:\windows\system\BAOKZ.exe.bat SRUF.exe File opened for modification C:\windows\ZAKL.exe VSWL.exe File opened for modification C:\windows\CYGMM.exe UTCGC.exe File created C:\windows\system\LAKC.exe FACOCS.exe File opened for modification C:\windows\system\BYG.exe PGDEHCQ.exe File created C:\windows\system\POKUV.exe.bat EWPJ.exe File opened for modification C:\windows\system\LVBA.exe OPVL.exe File created C:\windows\MRNRNBS.exe.bat ELALCDW.exe File created C:\windows\CJMVYF.exe.bat 2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe File created C:\windows\system\MCBLJNZ.exe RHWBZ.exe File created C:\windows\QYGB.exe BVXWPA.exe File created C:\windows\system\OWQZ.exe IWJETYU.exe File opened for modification C:\windows\LBBOO.exe LVBA.exe File opened for modification C:\windows\system\TMOBWP.exe IULJW.exe File created C:\windows\system\VKE.exe.bat AXZLDB.exe File created C:\windows\system\WMAG.exe QMSSFOV.exe File created C:\windows\system\STUGV.exe.bat KGUS.exe File created C:\windows\ELBZNF.exe.bat PQS.exe File created C:\windows\VEL.exe AIGDKD.exe File created C:\windows\system\FZLJ.exe WZJENKN.exe File created C:\windows\system\TMOBWP.exe IULJW.exe File opened for modification C:\windows\XPT.exe NSG.exe File created C:\windows\system\JOH.exe CYGMM.exe File created C:\windows\system\RHWBZ.exe CMNPOSK.exe File opened for modification C:\windows\WDNSCXT.exe CHIIZ.exe File created C:\windows\system\BVXWPA.exe.bat DIX.exe File created C:\windows\BZCZO.exe.bat HMX.exe File created C:\windows\JPNXWFM.exe.bat LCWO.exe File opened for modification C:\windows\HMGHAFQ.exe NQBYQ.exe File opened for modification C:\windows\system\ESX.exe OXNEV.exe File created C:\windows\system\BVXWPA.exe DIX.exe File opened for modification C:\windows\MRNRNBS.exe ELALCDW.exe File created C:\windows\HOD.exe STUGV.exe File created C:\windows\RQSB.exe WDNSCXT.exe File opened for modification C:\windows\LCWO.exe OWQZ.exe File created C:\windows\XPT.exe.bat NSG.exe File created C:\windows\system\WZJENKN.exe QZBQE.exe File created C:\windows\system\ELALCDW.exe.bat JQVBS.exe File opened for modification C:\windows\system\IVWSZJB.exe NHZJOJ.exe File created C:\windows\LCWO.exe OWQZ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1300 cmd.exe 1080 cmd.exe 4232 cmd.exe 5576 cmd.exe 2704 cmd.exe 5948 cmd.exe 3564 cmd.exe 3364 cmd.exe 3204 cmd.exe 1988 cmd.exe 5800 cmd.exe 2888 cmd.exe 3368 cmd.exe 3168 cmd.exe 3136 cmd.exe 2084 cmd.exe 5704 cmd.exe 4676 cmd.exe 2884 cmd.exe 5104 cmd.exe 2796 cmd.exe 1528 cmd.exe 2864 cmd.exe 5044 cmd.exe 5416 cmd.exe 1996 cmd.exe 2924 cmd.exe 5848 cmd.exe 2620 cmd.exe 2068 cmd.exe 2012 cmd.exe 1068 cmd.exe 2668 cmd.exe 1540 cmd.exe 4880 cmd.exe 5404 cmd.exe 4556 cmd.exe 5748 cmd.exe 5560 cmd.exe 5308 cmd.exe 1660 cmd.exe 4996 cmd.exe 4456 cmd.exe 292 cmd.exe 4224 cmd.exe 1772 cmd.exe 5508 cmd.exe 1148 cmd.exe 4860 cmd.exe 4136 cmd.exe 4596 cmd.exe 5924 cmd.exe 1052 cmd.exe 4076 cmd.exe 1464 cmd.exe 4204 cmd.exe 4416 cmd.exe 2560 cmd.exe 2932 cmd.exe 960 cmd.exe 788 cmd.exe 5468 cmd.exe 2740 cmd.exe 1612 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4284 5844 WerFault.exe 88 5768 4320 WerFault.exe 94 6036 3544 WerFault.exe 100 2692 1708 WerFault.exe 105 4500 4276 WerFault.exe 110 5240 1280 WerFault.exe 115 4404 1980 WerFault.exe 120 3168 2708 WerFault.exe 125 3824 4856 WerFault.exe 130 5916 4532 WerFault.exe 135 2080 3024 WerFault.exe 140 2724 4984 WerFault.exe 145 5264 5492 WerFault.exe 150 1476 260 WerFault.exe 155 5508 6052 WerFault.exe 160 3428 1400 WerFault.exe 165 4880 2096 WerFault.exe 170 748 4560 WerFault.exe 175 2064 4868 WerFault.exe 180 4324 3952 WerFault.exe 185 2588 5512 WerFault.exe 190 5444 1252 WerFault.exe 195 4976 5584 WerFault.exe 200 5868 3296 WerFault.exe 205 3416 2148 WerFault.exe 210 4144 5992 WerFault.exe 215 5828 3396 WerFault.exe 220 5504 4732 WerFault.exe 225 5348 4968 WerFault.exe 230 5004 1496 WerFault.exe 235 6088 4208 WerFault.exe 240 4520 1308 WerFault.exe 245 4664 4644 WerFault.exe 250 2628 2844 WerFault.exe 255 3764 1248 WerFault.exe 260 3760 3608 WerFault.exe 265 5884 5000 WerFault.exe 270 4880 3708 WerFault.exe 275 5196 4488 WerFault.exe 281 1116 5348 WerFault.exe 286 2576 2908 WerFault.exe 291 432 2840 WerFault.exe 296 4540 4436 WerFault.exe 301 6036 5616 WerFault.exe 306 1156 2360 WerFault.exe 311 5260 5784 WerFault.exe 316 872 5852 WerFault.exe 321 3904 6076 WerFault.exe 326 4548 1296 WerFault.exe 331 2924 4264 WerFault.exe 336 4676 2468 WerFault.exe 341 4664 2368 WerFault.exe 346 6136 2724 WerFault.exe 351 4780 5312 WerFault.exe 356 5692 2584 WerFault.exe 361 2460 2208 WerFault.exe 366 6004 2224 WerFault.exe 371 4148 1096 WerFault.exe 376 468 4548 WerFault.exe 381 824 4820 WerFault.exe 386 2976 3188 WerFault.exe 391 1500 3016 WerFault.exe 396 5740 5016 WerFault.exe 401 5560 2364 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFNBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVWSZJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXJDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZCZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABUVGTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FONYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OPVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVGIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PEESV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AYLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMYUVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FACOCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELALCDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DRZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UARPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSHDAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVOGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXNEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASLJAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STUGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTFIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AETAE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBBOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5844 2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe 5844 2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe 4320 CJMVYF.exe 4320 CJMVYF.exe 3544 GJJXLV.exe 3544 GJJXLV.exe 1708 OXNEV.exe 1708 OXNEV.exe 4276 ESX.exe 4276 ESX.exe 1280 NSZN.exe 1280 NSZN.exe 1980 INEXUL.exe 1980 INEXUL.exe 2708 NOL.exe 2708 NOL.exe 4856 FONYP.exe 4856 FONYP.exe 4532 XRRTUJP.exe 4532 XRRTUJP.exe 3024 DRZH.exe 3024 DRZH.exe 4984 THAHKZN.exe 4984 THAHKZN.exe 5492 VFNBZ.exe 5492 VFNBZ.exe 260 BFNPIBP.exe 260 BFNPIBP.exe 6052 QVWGP.exe 6052 QVWGP.exe 1400 ATB.exe 1400 ATB.exe 2096 LMET.exe 2096 LMET.exe 4560 EHI.exe 4560 EHI.exe 4868 RSRNYN.exe 4868 RSRNYN.exe 3952 DIX.exe 3952 DIX.exe 5512 BVXWPA.exe 5512 BVXWPA.exe 1252 QYGB.exe 1252 QYGB.exe 5584 YDGPC.exe 5584 YDGPC.exe 3296 CMNPOSK.exe 3296 CMNPOSK.exe 2148 RHWBZ.exe 2148 RHWBZ.exe 5992 MCBLJNZ.exe 5992 MCBLJNZ.exe 3396 XUE.exe 3396 XUE.exe 4732 BCLEW.exe 4732 BCLEW.exe 4968 WQPNGNR.exe 4968 WQPNGNR.exe 1496 ABOIO.exe 1496 ABOIO.exe 4208 GBVWXAD.exe 4208 GBVWXAD.exe 1308 QZBQE.exe 1308 QZBQE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5844 2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe 5844 2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe 4320 CJMVYF.exe 4320 CJMVYF.exe 3544 GJJXLV.exe 3544 GJJXLV.exe 1708 OXNEV.exe 1708 OXNEV.exe 4276 ESX.exe 4276 ESX.exe 1280 NSZN.exe 1280 NSZN.exe 1980 INEXUL.exe 1980 INEXUL.exe 2708 NOL.exe 2708 NOL.exe 4856 FONYP.exe 4856 FONYP.exe 4532 XRRTUJP.exe 4532 XRRTUJP.exe 3024 DRZH.exe 3024 DRZH.exe 4984 THAHKZN.exe 4984 THAHKZN.exe 5492 VFNBZ.exe 5492 VFNBZ.exe 260 BFNPIBP.exe 260 BFNPIBP.exe 6052 QVWGP.exe 6052 QVWGP.exe 1400 ATB.exe 1400 ATB.exe 2096 LMET.exe 2096 LMET.exe 4560 EHI.exe 4560 EHI.exe 4868 RSRNYN.exe 4868 RSRNYN.exe 3952 DIX.exe 3952 DIX.exe 5512 BVXWPA.exe 5512 BVXWPA.exe 1252 QYGB.exe 1252 QYGB.exe 5584 YDGPC.exe 5584 YDGPC.exe 3296 CMNPOSK.exe 3296 CMNPOSK.exe 2148 RHWBZ.exe 2148 RHWBZ.exe 5992 MCBLJNZ.exe 5992 MCBLJNZ.exe 3396 XUE.exe 3396 XUE.exe 4732 BCLEW.exe 4732 BCLEW.exe 4968 WQPNGNR.exe 4968 WQPNGNR.exe 1496 ABOIO.exe 1496 ABOIO.exe 4208 GBVWXAD.exe 4208 GBVWXAD.exe 1308 QZBQE.exe 1308 QZBQE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5844 wrote to memory of 1284 5844 2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe 90 PID 1284 wrote to memory of 4320 1284 cmd.exe 94 PID 4320 wrote to memory of 4360 4320 CJMVYF.exe 96 PID 4360 wrote to memory of 3544 4360 cmd.exe 100 PID 3544 wrote to memory of 52 3544 GJJXLV.exe 101 PID 52 wrote to memory of 1708 52 cmd.exe 105 PID 1708 wrote to memory of 1144 1708 OXNEV.exe 106 PID 1144 wrote to memory of 4276 1144 cmd.exe 110 PID 4276 wrote to memory of 5080 4276 ESX.exe 111 PID 5080 wrote to memory of 1280 5080 cmd.exe 115 PID 1280 wrote to memory of 5156 1280 NSZN.exe 116 PID 5156 wrote to memory of 1980 5156 cmd.exe 120 PID 1980 wrote to memory of 1636 1980 INEXUL.exe 121 PID 1636 wrote to memory of 2708 1636 cmd.exe 125 PID 2708 wrote to memory of 1988 2708 NOL.exe 126 PID 1988 wrote to memory of 4856 1988 cmd.exe 130 PID 4856 wrote to memory of 4888 4856 FONYP.exe 131 PID 4888 wrote to memory of 4532 4888 cmd.exe 135 PID 4532 wrote to memory of 5308 4532 XRRTUJP.exe 136 PID 5308 wrote to memory of 3024 5308 cmd.exe 140 PID 3024 wrote to memory of 5592 3024 DRZH.exe 141 PID 5592 wrote to memory of 4984 5592 cmd.exe 145 PID 4984 wrote to memory of 5576 4984 THAHKZN.exe 146 PID 5576 wrote to memory of 5492 5576 cmd.exe 150 PID 5492 wrote to memory of 1660 5492 VFNBZ.exe 151 PID 1660 wrote to memory of 260 1660 cmd.exe 155 PID 260 wrote to memory of 5320 260 BFNPIBP.exe 156 PID 5320 wrote to memory of 6052 5320 cmd.exe 160 PID 6052 wrote to memory of 2704 6052 QVWGP.exe 161 PID 2704 wrote to memory of 1400 2704 cmd.exe 165 PID 1400 wrote to memory of 1340 1400 ATB.exe 166 PID 1340 wrote to memory of 2096 1340 cmd.exe 170 PID 2096 wrote to memory of 4328 2096 LMET.exe 171 PID 4328 wrote to memory of 4560 4328 cmd.exe 175 PID 4560 wrote to memory of 2532 4560 EHI.exe 176 PID 2532 wrote to memory of 4868 2532 cmd.exe 180 PID 4868 wrote to memory of 5580 4868 RSRNYN.exe 181 PID 5580 wrote to memory of 3952 5580 cmd.exe 185 PID 3952 wrote to memory of 712 3952 DIX.exe 186 PID 712 wrote to memory of 5512 712 cmd.exe 190 PID 5512 wrote to memory of 4544 5512 BVXWPA.exe 191 PID 4544 wrote to memory of 1252 4544 cmd.exe 195 PID 1252 wrote to memory of 3500 1252 QYGB.exe 196 PID 3500 wrote to memory of 5584 3500 cmd.exe 200 PID 5584 wrote to memory of 5280 5584 YDGPC.exe 201 PID 5280 wrote to memory of 3296 5280 cmd.exe 205 PID 3296 wrote to memory of 256 3296 CMNPOSK.exe 206 PID 256 wrote to memory of 2148 256 cmd.exe 210 PID 2148 wrote to memory of 2176 2148 RHWBZ.exe 211 PID 2176 wrote to memory of 5992 2176 cmd.exe 215 PID 5992 wrote to memory of 1148 5992 MCBLJNZ.exe 216 PID 1148 wrote to memory of 3396 1148 cmd.exe 220 PID 3396 wrote to memory of 1068 3396 XUE.exe 221 PID 1068 wrote to memory of 4732 1068 cmd.exe 225 PID 4732 wrote to memory of 1520 4732 BCLEW.exe 226 PID 1520 wrote to memory of 4968 1520 cmd.exe 230 PID 4968 wrote to memory of 4860 4968 WQPNGNR.exe 231 PID 4860 wrote to memory of 1496 4860 cmd.exe 235 PID 1496 wrote to memory of 4076 1496 ABOIO.exe 236 PID 4076 wrote to memory of 4208 4076 cmd.exe 240 PID 4208 wrote to memory of 848 4208 GBVWXAD.exe 241 PID 848 wrote to memory of 1308 848 cmd.exe 245 PID 1308 wrote to memory of 5764 1308 QZBQE.exe 246 PID 5764 wrote to memory of 4644 5764 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_0f80ab359b00154bd500c66ef4551764_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJMVYF.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\windows\CJMVYF.exeC:\windows\CJMVYF.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJJXLV.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\SysWOW64\GJJXLV.exeC:\windows\system32\GJJXLV.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXNEV.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:52 -
C:\windows\system\OXNEV.exeC:\windows\system\OXNEV.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESX.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\windows\system\ESX.exeC:\windows\system\ESX.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSZN.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\windows\system\NSZN.exeC:\windows\system\NSZN.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INEXUL.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\windows\SysWOW64\INEXUL.exeC:\windows\system32\INEXUL.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOL.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\windows\SysWOW64\NOL.exeC:\windows\system32\NOL.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FONYP.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\windows\SysWOW64\FONYP.exeC:\windows\system32\FONYP.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRRTUJP.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\SysWOW64\XRRTUJP.exeC:\windows\system32\XRRTUJP.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DRZH.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\windows\DRZH.exeC:\windows\DRZH.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THAHKZN.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\windows\THAHKZN.exeC:\windows\THAHKZN.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VFNBZ.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\windows\SysWOW64\VFNBZ.exeC:\windows\system32\VFNBZ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFNPIBP.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\windows\SysWOW64\BFNPIBP.exeC:\windows\system32\BFNPIBP.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVWGP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\windows\SysWOW64\QVWGP.exeC:\windows\system32\QVWGP.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LMET.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\windows\SysWOW64\LMET.exeC:\windows\system32\LMET.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHI.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\EHI.exeC:\windows\EHI.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RSRNYN.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\windows\system\RSRNYN.exeC:\windows\system\RSRNYN.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DIX.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\DIX.exeC:\windows\DIX.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BVXWPA.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:712 -
C:\windows\system\BVXWPA.exeC:\windows\system\BVXWPA.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYGB.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\QYGB.exeC:\windows\QYGB.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDGPC.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\windows\SysWOW64\YDGPC.exeC:\windows\system32\YDGPC.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMNPOSK.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\windows\CMNPOSK.exeC:\windows\CMNPOSK.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHWBZ.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:256 -
C:\windows\system\RHWBZ.exeC:\windows\system\RHWBZ.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCBLJNZ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\windows\system\MCBLJNZ.exeC:\windows\system\MCBLJNZ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUE.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\system\XUE.exeC:\windows\system\XUE.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCLEW.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\windows\system\BCLEW.exeC:\windows\system\BCLEW.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQPNGNR.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\windows\SysWOW64\WQPNGNR.exeC:\windows\system32\WQPNGNR.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABOIO.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\windows\SysWOW64\ABOIO.exeC:\windows\system32\ABOIO.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBVWXAD.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\SysWOW64\GBVWXAD.exeC:\windows\system32\GBVWXAD.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZBQE.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:848 -
C:\windows\SysWOW64\QZBQE.exeC:\windows\system32\QZBQE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZJENKN.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\windows\system\WZJENKN.exeC:\windows\system\WZJENKN.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZLJ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4904 -
C:\windows\system\FZLJ.exeC:\windows\system\FZLJ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXY.exe.bat" "68⤵PID:1484
-
C:\windows\SysWOW64\PXY.exeC:\windows\system32\PXY.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDQS.exe.bat" "70⤵
- Executes a command shell one-liner
PID:2668 -
C:\windows\SysWOW64\PDQS.exeC:\windows\system32\PDQS.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JQVBS.exe.bat" "72⤵PID:1164
-
C:\windows\SysWOW64\JQVBS.exeC:\windows\system32\JQVBS.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELALCDW.exe.bat" "74⤵PID:1224
-
C:\windows\system\ELALCDW.exeC:\windows\system\ELALCDW.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MRNRNBS.exe.bat" "76⤵
- Executes a command shell one-liner
PID:5416 -
C:\windows\MRNRNBS.exeC:\windows\MRNRNBS.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRUF.exe.bat" "78⤵PID:748
-
C:\windows\SysWOW64\SRUF.exeC:\windows\system32\SRUF.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BAOKZ.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:1684 -
C:\windows\system\BAOKZ.exeC:\windows\system\BAOKZ.exe81⤵
- Executes dropped EXE
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NID.exe.bat" "82⤵PID:5328
-
C:\windows\SysWOW64\NID.exeC:\windows\system32\NID.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASLJAW.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4428 -
C:\windows\SysWOW64\ASLJAW.exeC:\windows\system32\ASLJAW.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYLX.exe.bat" "86⤵PID:6044
-
C:\windows\system\AYLX.exeC:\windows\system\AYLX.exe87⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SLWP.exe.bat" "88⤵PID:3636
-
C:\windows\system\SLWP.exeC:\windows\system\SLWP.exe89⤵
- Executes dropped EXE
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMYUVL.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:1476 -
C:\windows\BMYUVL.exeC:\windows\BMYUVL.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMX.exe.bat" "92⤵
- Executes a command shell one-liner
PID:1996 -
C:\windows\HMX.exeC:\windows\HMX.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZCZO.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5104 -
C:\windows\BZCZO.exeC:\windows\BZCZO.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPD.exe.bat" "96⤵PID:992
-
C:\windows\system\RPD.exeC:\windows\system\RPD.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VFSZH.exe.bat" "98⤵PID:4404
-
C:\windows\VFSZH.exeC:\windows\VFSZH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EGUEKRI.exe.bat" "100⤵PID:3556
-
C:\windows\system\EGUEKRI.exeC:\windows\system\EGUEKRI.exe101⤵
- Executes dropped EXE
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KGUS.exe.bat" "102⤵PID:5652
-
C:\windows\system\KGUS.exeC:\windows\system\KGUS.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STUGV.exe.bat" "104⤵PID:672
-
C:\windows\system\STUGV.exeC:\windows\system\STUGV.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOD.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5264 -
C:\windows\HOD.exeC:\windows\HOD.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHGD.exe.bat" "108⤵PID:1584
-
C:\windows\SysWOW64\SHGD.exeC:\windows\system32\SHGD.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2232 -
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDNSCXT.exe.bat" "112⤵PID:2916
-
C:\windows\WDNSCXT.exeC:\windows\WDNSCXT.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RQSB.exe.bat" "114⤵
- Executes a command shell one-liner
PID:2084 -
C:\windows\RQSB.exeC:\windows\RQSB.exe115⤵
- Executes dropped EXE
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PGDEHCQ.exe.bat" "116⤵PID:1776
-
C:\windows\PGDEHCQ.exeC:\windows\PGDEHCQ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYG.exe.bat" "118⤵PID:4616
-
C:\windows\system\BYG.exeC:\windows\system\BYG.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEYL.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\windows\SysWOW64\JEYL.exeC:\windows\system32\JEYL.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-