Analysis
- max time kernel
65s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 18:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-05_9a32fe8b7c44c772825c1160cbf12496_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-05_9a32fe8b7c44c772825c1160cbf12496_elex_emotet_stop.exe
- Size 208KB
- Sample261006-xhvbrac13s
- SHA256 cb0e08c9073855cc0b26372ec87ec370f0c94a1de904a5a7f409e32bec8751de
- MD5 9a32fe8b7c44c772825c1160cbf12496
- SHA1 8b350134d8bd466cc61735ee0d24bfe5388aa00a
- SHA512 f437d5dc85ef84fc2e7fbce9c6a3081c9bf05be02832b40544253313bec3f2fbd365f3c1f802aab05fe31d2d1be88e6dca63cc3fd8df4d2e3fb7dbbd4273c282
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlVKL+LOfE4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlVS+LOMkEj1
- TLSH T134247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4384 LSIP.exe 3380 WDIR.exe 3332 FIU.exe 4004 DTXOBKB.exe 2368 CMAE.exe 3352 GUGE.exe 5612 BFXDKTG.exe 4336 SQATTZ.exe 3504 UDFCDZR.exe 4824 WBKXK.exe 5592 TBUZOL.exe 4932 OMCQ.exe 2124 NXN.exe 624 UNOF.exe 4484 OFWQ.exe 3856 HYLBT.exe 4152 GJOR.exe 5820 YMSNH.exe 2136 VMBXLRM.exe 4536 TCPHAYU.exe 440 PIHWRCW.exe 5276 XNMCTAS.exe 5400 BYKXB.exe 4756 GWC.exe 2300 IUI.exe 5448 LKRWGRT.exe 2656 LNHSU.exe 4676 FSOY.exe 5500 ZOXZ.exe 3388 JLLU.exe 4524 DZKSXYE.exe 1060 UZY.exe 404 GAN.exe 676 KSPKFLY.exe 4000 SGC.exe 1484 PYETUOC.exe 3528 AZTELPL.exe 3940 IEYLWNG.exe 4280 QSKRGMK.exe 3372 ZXXGJK.exe 5192 DYZIV.exe 5580 LDLPF.exe 3120 GZDQRG.exe 4200 OEHXB.exe 5144 YCV.exe 5572 VCXU.exe 1520 FACOCS.exe 2980 HYQIKA.exe 5752 PDVPU.exe 2864 NOFF.exe 5596 XMLZSVO.exe 6052 WXOPTB.exe 5692 VQZXC.exe 5844 GIGQT.exe 2928 OOTX.exe 1256 TOUZ.exe 1764 KWJX.exe 1800 SCV.exe 4196 EUD.exe 4092 CFOEXGV.exe 1488 BYQUFU.exe 712 OBZT.exe 5496 GJBYXD.exe 3284 TMRXLF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\CFOEXGV.exe.bat EUD.exe File created C:\windows\SysWOW64\LKRWGRT.exe IUI.exe File opened for modification C:\windows\SysWOW64\LNHSU.exe LKRWGRT.exe File created C:\windows\SysWOW64\SGC.exe KSPKFLY.exe File created C:\windows\SysWOW64\CFOEXGV.exe EUD.exe File opened for modification C:\windows\SysWOW64\BFXDKTG.exe GUGE.exe File created C:\windows\SysWOW64\YMSNH.exe GJOR.exe File created C:\windows\SysWOW64\SCV.exe.bat KWJX.exe File opened for modification C:\windows\SysWOW64\DED.exe TEBQJAV.exe File created C:\windows\SysWOW64\TBUZOL.exe.bat WBKXK.exe File created C:\windows\SysWOW64\LNHSU.exe LKRWGRT.exe File created C:\windows\SysWOW64\ZXXGJK.exe.bat QSKRGMK.exe File created C:\windows\SysWOW64\DYZIV.exe ZXXGJK.exe File opened for modification C:\windows\SysWOW64\OOTX.exe GIGQT.exe File created C:\windows\SysWOW64\TMRXLF.exe GJBYXD.exe File opened for modification C:\windows\SysWOW64\LFUHQYJ.exe HPNZE.exe File created C:\windows\SysWOW64\LFUHQYJ.exe.bat HPNZE.exe File created C:\windows\SysWOW64\JLLU.exe.bat ZOXZ.exe File created C:\windows\SysWOW64\OOTX.exe.bat GIGQT.exe File opened for modification C:\windows\SysWOW64\TMRXLF.exe GJBYXD.exe File created C:\windows\SysWOW64\LFUHQYJ.exe HPNZE.exe File created C:\windows\SysWOW64\DYZIV.exe.bat ZXXGJK.exe File created C:\windows\SysWOW64\FACOCS.exe.bat VCXU.exe File opened for modification C:\windows\SysWOW64\HYQIKA.exe FACOCS.exe File created C:\windows\SysWOW64\SCV.exe KWJX.exe File opened for modification C:\windows\SysWOW64\FACOCS.exe VCXU.exe File opened for modification C:\windows\SysWOW64\CFOEXGV.exe EUD.exe File opened for modification C:\windows\SysWOW64\BIA.exe BFWSXR.exe File created C:\windows\SysWOW64\BYZCCJH.exe AVVYX.exe File created C:\windows\SysWOW64\BYZCCJH.exe.bat AVVYX.exe File created C:\windows\SysWOW64\FGFCP.exe.bat BYZCCJH.exe File opened for modification C:\windows\SysWOW64\OFWQ.exe UNOF.exe File opened for modification C:\windows\SysWOW64\YMSNH.exe GJOR.exe File created C:\windows\SysWOW64\YMSNH.exe.bat GJOR.exe File created C:\windows\SysWOW64\HYQIKA.exe.bat FACOCS.exe File created C:\windows\SysWOW64\HPNZE.exe YPL.exe File created C:\windows\SysWOW64\WDIR.exe LSIP.exe File opened for modification C:\windows\SysWOW64\WDIR.exe LSIP.exe File created C:\windows\SysWOW64\OFWQ.exe UNOF.exe File created C:\windows\SysWOW64\JLLU.exe ZOXZ.exe File opened for modification C:\windows\SysWOW64\JLLU.exe ZOXZ.exe File opened for modification C:\windows\SysWOW64\DYZIV.exe ZXXGJK.exe File created C:\windows\SysWOW64\HYQIKA.exe FACOCS.exe File created C:\windows\SysWOW64\TMRXLF.exe.bat GJBYXD.exe File opened for modification C:\windows\SysWOW64\CMAE.exe DTXOBKB.exe File created C:\windows\SysWOW64\UDFCDZR.exe.bat SQATTZ.exe File created C:\windows\SysWOW64\TBUZOL.exe WBKXK.exe File opened for modification C:\windows\SysWOW64\SCV.exe KWJX.exe File opened for modification C:\windows\SysWOW64\BYZCCJH.exe AVVYX.exe File opened for modification C:\windows\SysWOW64\FGFCP.exe BYZCCJH.exe File opened for modification C:\windows\SysWOW64\LKRWGRT.exe IUI.exe File opened for modification C:\windows\SysWOW64\HPNZE.exe YPL.exe File created C:\windows\SysWOW64\WDIR.exe.bat LSIP.exe File opened for modification C:\windows\SysWOW64\TBUZOL.exe WBKXK.exe File created C:\windows\SysWOW64\ZXXGJK.exe QSKRGMK.exe File created C:\windows\SysWOW64\BIA.exe BFWSXR.exe File created C:\windows\SysWOW64\OFWQ.exe.bat UNOF.exe File created C:\windows\SysWOW64\LNHSU.exe.bat LKRWGRT.exe File opened for modification C:\windows\SysWOW64\ZXXGJK.exe QSKRGMK.exe File created C:\windows\SysWOW64\DED.exe TEBQJAV.exe File created C:\windows\SysWOW64\HPNZE.exe.bat YPL.exe File created C:\windows\SysWOW64\CMAE.exe DTXOBKB.exe File created C:\windows\SysWOW64\BFXDKTG.exe.bat GUGE.exe File created C:\windows\SysWOW64\CMAE.exe.bat DTXOBKB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\BYKXB.exe.bat XNMCTAS.exe File created C:\windows\LDLPF.exe DYZIV.exe File created C:\windows\OMCQ.exe.bat TBUZOL.exe File opened for modification C:\windows\system\HYLBT.exe OFWQ.exe File opened for modification C:\windows\OEHXB.exe GZDQRG.exe File created C:\windows\system\BYQUFU.exe CFOEXGV.exe File created C:\windows\system\HYLBT.exe OFWQ.exe File created C:\windows\ZOXZ.exe.bat FSOY.exe File created C:\windows\UZY.exe DZKSXYE.exe File created C:\windows\QSKRGMK.exe.bat IEYLWNG.exe File created C:\windows\system\TEBQJAV.exe JGNWB.exe File created C:\windows\NXN.exe OMCQ.exe File created C:\windows\OEHXB.exe.bat GZDQRG.exe File created C:\windows\OBZT.exe BYQUFU.exe File created C:\windows\system\JGNWB.exe RDJAOC.exe File opened for modification C:\windows\system\YPL.exe DED.exe File opened for modification C:\windows\SQATTZ.exe BFXDKTG.exe File created C:\windows\FSOY.exe LNHSU.exe File created C:\windows\system\WXOPTB.exe XMLZSVO.exe File opened for modification C:\windows\system\RFU.exe TMRXLF.exe File created C:\windows\RDJAOC.exe BIA.exe File created C:\windows\system\JGNWB.exe.bat RDJAOC.exe File opened for modification C:\windows\system\PYETUOC.exe SGC.exe File created C:\windows\RDJAOC.exe.bat BIA.exe File created C:\windows\system\TEBQJAV.exe.bat JGNWB.exe File created C:\windows\system\AVVYX.exe LFUHQYJ.exe File created C:\windows\system\HYLBT.exe.bat OFWQ.exe File created C:\windows\GZDQRG.exe LDLPF.exe File created C:\windows\XMLZSVO.exe.bat NOFF.exe File opened for modification C:\windows\RDJAOC.exe BIA.exe File opened for modification C:\windows\system\TCPHAYU.exe VMBXLRM.exe File created C:\windows\UZY.exe.bat DZKSXYE.exe File created C:\windows\system\PYETUOC.exe SGC.exe File created C:\windows\IEYLWNG.exe.bat AZTELPL.exe File created C:\windows\GZDQRG.exe.bat LDLPF.exe File created C:\windows\NOFF.exe PDVPU.exe File created C:\windows\DTXOBKB.exe.bat FIU.exe File created C:\windows\PIHWRCW.exe.bat TCPHAYU.exe File created C:\windows\XNMCTAS.exe PIHWRCW.exe File created C:\windows\system\PDVPU.exe HYQIKA.exe File created C:\windows\system\VQZXC.exe.bat WXOPTB.exe File created C:\windows\SQATTZ.exe.bat BFXDKTG.exe File created C:\windows\GAN.exe UZY.exe File opened for modification C:\windows\system\KSPKFLY.exe GAN.exe File created C:\windows\GJBYXD.exe OBZT.exe File created C:\windows\system\GUGE.exe CMAE.exe File created C:\windows\BYKXB.exe XNMCTAS.exe File created C:\windows\system\VCXU.exe.bat YCV.exe File created C:\windows\LDLPF.exe.bat DYZIV.exe File created C:\windows\system\VQZXC.exe WXOPTB.exe File created C:\windows\system\VMBXLRM.exe.bat YMSNH.exe File opened for modification C:\windows\DTXOBKB.exe FIU.exe File opened for modification C:\windows\system\GUGE.exe CMAE.exe File created C:\windows\system\WBKXK.exe UDFCDZR.exe File created C:\windows\GAN.exe.bat UZY.exe File created C:\windows\system\PYETUOC.exe.bat SGC.exe File opened for modification C:\windows\LDLPF.exe DYZIV.exe File created C:\windows\TOUZ.exe OOTX.exe File created C:\windows\system\PDVPU.exe.bat HYQIKA.exe File created C:\windows\BFWSXR.exe RFU.exe File opened for modification C:\windows\XNMCTAS.exe PIHWRCW.exe File created C:\windows\FSOY.exe.bat LNHSU.exe File created C:\windows\DZKSXYE.exe JLLU.exe File opened for modification C:\windows\GZDQRG.exe LDLPF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4788 cmd.exe 4600 cmd.exe 1596 cmd.exe 1312 cmd.exe 4348 cmd.exe 6096 cmd.exe 5804 cmd.exe 2120 cmd.exe 1572 cmd.exe 4356 cmd.exe 5688 cmd.exe 3424 cmd.exe 4408 cmd.exe 3008 cmd.exe 2944 cmd.exe 3140 cmd.exe 5948 cmd.exe 3996 cmd.exe 5960 cmd.exe 1016 cmd.exe 4156 cmd.exe 1756 cmd.exe 3520 cmd.exe 1304 cmd.exe 5396 cmd.exe 4728 cmd.exe 3428 cmd.exe 2924 cmd.exe 3720 cmd.exe 1772 cmd.exe 5372 cmd.exe 4912 cmd.exe 4244 cmd.exe 4272 cmd.exe 1248 cmd.exe 2584 cmd.exe 2508 cmd.exe 4648 cmd.exe 4220 cmd.exe 4120 cmd.exe 4264 cmd.exe 4116 cmd.exe 3160 cmd.exe 2800 cmd.exe 3288 cmd.exe 4040 cmd.exe 3256 cmd.exe 2652 cmd.exe 2720 cmd.exe 1732 cmd.exe 952 cmd.exe 3376 cmd.exe 3564 cmd.exe 5984 cmd.exe 868 cmd.exe 4792 cmd.exe 5900 cmd.exe 5184 cmd.exe 3164 cmd.exe 812 cmd.exe 2724 cmd.exe 2952 cmd.exe 6116 cmd.exe 2860 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3328 1984 WerFault.exe 89 3108 4384 WerFault.exe 94 1772 3380 WerFault.exe 100 4500 3332 WerFault.exe 105 5704 4004 WerFault.exe 110 1488 2368 WerFault.exe 115 2344 3352 WerFault.exe 120 2720 5612 WerFault.exe 125 3068 4336 WerFault.exe 130 3964 3504 WerFault.exe 135 5036 4824 WerFault.exe 140 3776 5592 WerFault.exe 145 6084 4932 WerFault.exe 150 5312 2124 WerFault.exe 155 2000 624 WerFault.exe 160 4324 4484 WerFault.exe 165 4672 3856 WerFault.exe 170 4480 4152 WerFault.exe 175 5428 5820 WerFault.exe 180 2652 2136 WerFault.exe 185 4084 4536 WerFault.exe 190 3316 440 WerFault.exe 195 1256 5276 WerFault.exe 200 3656 5400 WerFault.exe 205 4780 4756 WerFault.exe 210 4032 2300 WerFault.exe 215 2872 5448 WerFault.exe 220 4220 2656 WerFault.exe 225 1832 4676 WerFault.exe 230 1768 5500 WerFault.exe 235 5644 3388 WerFault.exe 240 4064 4524 WerFault.exe 245 3728 1060 WerFault.exe 250 4296 404 WerFault.exe 255 3188 676 WerFault.exe 260 1764 4000 WerFault.exe 265 4272 1484 WerFault.exe 270 1612 3528 WerFault.exe 275 5704 3940 WerFault.exe 280 3876 4280 WerFault.exe 285 4068 3372 WerFault.exe 290 3720 5192 WerFault.exe 295 5740 5580 WerFault.exe 300 1300 3120 WerFault.exe 305 4412 4200 WerFault.exe 310 4780 5144 WerFault.exe 315 6092 5572 WerFault.exe 320 6116 1520 WerFault.exe 325 5228 2980 WerFault.exe 330 756 5752 WerFault.exe 335 1668 2864 WerFault.exe 340 4084 5596 WerFault.exe 345 5008 6052 WerFault.exe 350 5740 5692 WerFault.exe 355 1616 5844 WerFault.exe 360 2384 2928 WerFault.exe 365 4620 1256 WerFault.exe 370 5680 1764 WerFault.exe 375 6128 1800 WerFault.exe 380 3416 4196 WerFault.exe 385 3596 4092 WerFault.exe 390 3980 1488 WerFault.exe 395 1768 712 WerFault.exe 400 5548 5496 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQATTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFWSXR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMRXLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMBXLRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYKXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LNHSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJBYXD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIGQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDFCDZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNMCTAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BYZCCJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-05_9a32fe8b7c44c772825c1160cbf12496_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXOPTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTXOBKB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKRWGRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LDLPF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMLZSVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OBZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIHWRCW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDVPU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDJAOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PYETUOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYQIKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1984 2026-10-05_9a32fe8b7c44c772825c1160cbf12496_elex_emotet_stop.exe 1984 2026-10-05_9a32fe8b7c44c772825c1160cbf12496_elex_emotet_stop.exe 4384 LSIP.exe 4384 LSIP.exe 3380 WDIR.exe 3380 WDIR.exe 3332 FIU.exe 3332 FIU.exe 4004 DTXOBKB.exe 4004 DTXOBKB.exe 2368 CMAE.exe 2368 CMAE.exe 3352 GUGE.exe 3352 GUGE.exe 5612 BFXDKTG.exe 5612 BFXDKTG.exe 4336 SQATTZ.exe 4336 SQATTZ.exe 3504 UDFCDZR.exe 3504 UDFCDZR.exe 4824 WBKXK.exe 4824 WBKXK.exe 5592 TBUZOL.exe 5592 TBUZOL.exe 4932 OMCQ.exe 4932 OMCQ.exe 2124 NXN.exe 2124 NXN.exe 624 UNOF.exe 624 UNOF.exe 4484 OFWQ.exe 4484 OFWQ.exe 3856 HYLBT.exe 3856 HYLBT.exe 4152 GJOR.exe 4152 GJOR.exe 5820 YMSNH.exe 5820 YMSNH.exe 2136 VMBXLRM.exe 2136 VMBXLRM.exe 4536 TCPHAYU.exe 4536 TCPHAYU.exe 440 PIHWRCW.exe 440 PIHWRCW.exe 5276 XNMCTAS.exe 5276 XNMCTAS.exe 5400 BYKXB.exe 5400 BYKXB.exe 4756 GWC.exe 4756 GWC.exe 2300 IUI.exe 2300 IUI.exe 5448 LKRWGRT.exe 5448 LKRWGRT.exe 2656 LNHSU.exe 2656 LNHSU.exe 4676 FSOY.exe 4676 FSOY.exe 5500 ZOXZ.exe 5500 ZOXZ.exe 3388 JLLU.exe 3388 JLLU.exe 4524 DZKSXYE.exe 4524 DZKSXYE.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1984 2026-10-05_9a32fe8b7c44c772825c1160cbf12496_elex_emotet_stop.exe 1984 2026-10-05_9a32fe8b7c44c772825c1160cbf12496_elex_emotet_stop.exe 4384 LSIP.exe 4384 LSIP.exe 3380 WDIR.exe 3380 WDIR.exe 3332 FIU.exe 3332 FIU.exe 4004 DTXOBKB.exe 4004 DTXOBKB.exe 2368 CMAE.exe 2368 CMAE.exe 3352 GUGE.exe 3352 GUGE.exe 5612 BFXDKTG.exe 5612 BFXDKTG.exe 4336 SQATTZ.exe 4336 SQATTZ.exe 3504 UDFCDZR.exe 3504 UDFCDZR.exe 4824 WBKXK.exe 4824 WBKXK.exe 5592 TBUZOL.exe 5592 TBUZOL.exe 4932 OMCQ.exe 4932 OMCQ.exe 2124 NXN.exe 2124 NXN.exe 624 UNOF.exe 624 UNOF.exe 4484 OFWQ.exe 4484 OFWQ.exe 3856 HYLBT.exe 3856 HYLBT.exe 4152 GJOR.exe 4152 GJOR.exe 5820 YMSNH.exe 5820 YMSNH.exe 2136 VMBXLRM.exe 2136 VMBXLRM.exe 4536 TCPHAYU.exe 4536 TCPHAYU.exe 440 PIHWRCW.exe 440 PIHWRCW.exe 5276 XNMCTAS.exe 5276 XNMCTAS.exe 5400 BYKXB.exe 5400 BYKXB.exe 4756 GWC.exe 4756 GWC.exe 2300 IUI.exe 2300 IUI.exe 5448 LKRWGRT.exe 5448 LKRWGRT.exe 2656 LNHSU.exe 2656 LNHSU.exe 4676 FSOY.exe 4676 FSOY.exe 5500 ZOXZ.exe 5500 ZOXZ.exe 3388 JLLU.exe 3388 JLLU.exe 4524 DZKSXYE.exe 4524 DZKSXYE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 4132 1984 2026-10-05_9a32fe8b7c44c772825c1160cbf12496_elex_emotet_stop.exe 90 PID 4132 wrote to memory of 4384 4132 cmd.exe 94 PID 4384 wrote to memory of 2768 4384 LSIP.exe 96 PID 2768 wrote to memory of 3380 2768 cmd.exe 100 PID 3380 wrote to memory of 6004 3380 WDIR.exe 101 PID 6004 wrote to memory of 3332 6004 cmd.exe 105 PID 3332 wrote to memory of 2724 3332 FIU.exe 106 PID 2724 wrote to memory of 4004 2724 cmd.exe 110 PID 4004 wrote to memory of 1756 4004 DTXOBKB.exe 111 PID 1756 wrote to memory of 2368 1756 cmd.exe 115 PID 2368 wrote to memory of 5492 2368 CMAE.exe 116 PID 5492 wrote to memory of 3352 5492 cmd.exe 120 PID 3352 wrote to memory of 936 3352 GUGE.exe 121 PID 936 wrote to memory of 5612 936 cmd.exe 125 PID 5612 wrote to memory of 4832 5612 BFXDKTG.exe 126 PID 4832 wrote to memory of 4336 4832 cmd.exe 130 PID 4336 wrote to memory of 6096 4336 SQATTZ.exe 131 PID 6096 wrote to memory of 3504 6096 cmd.exe 135 PID 3504 wrote to memory of 4880 3504 UDFCDZR.exe 136 PID 4880 wrote to memory of 4824 4880 cmd.exe 140 PID 4824 wrote to memory of 4576 4824 WBKXK.exe 141 PID 4576 wrote to memory of 5592 4576 cmd.exe 145 PID 5592 wrote to memory of 2956 5592 TBUZOL.exe 146 PID 2956 wrote to memory of 4932 2956 cmd.exe 150 PID 4932 wrote to memory of 4040 4932 OMCQ.exe 151 PID 4040 wrote to memory of 2124 4040 cmd.exe 155 PID 2124 wrote to memory of 1732 2124 NXN.exe 156 PID 1732 wrote to memory of 624 1732 cmd.exe 160 PID 624 wrote to memory of 4544 624 UNOF.exe 161 PID 4544 wrote to memory of 4484 4544 cmd.exe 165 PID 4484 wrote to memory of 3220 4484 OFWQ.exe 166 PID 3220 wrote to memory of 3856 3220 cmd.exe 170 PID 3856 wrote to memory of 4488 3856 HYLBT.exe 171 PID 4488 wrote to memory of 4152 4488 cmd.exe 175 PID 4152 wrote to memory of 3520 4152 GJOR.exe 176 PID 3520 wrote to memory of 5820 3520 cmd.exe 180 PID 5820 wrote to memory of 4352 5820 YMSNH.exe 181 PID 4352 wrote to memory of 2136 4352 cmd.exe 185 PID 2136 wrote to memory of 1820 2136 VMBXLRM.exe 186 PID 1820 wrote to memory of 4536 1820 cmd.exe 190 PID 4536 wrote to memory of 1304 4536 TCPHAYU.exe 191 PID 1304 wrote to memory of 440 1304 cmd.exe 195 PID 440 wrote to memory of 1252 440 PIHWRCW.exe 196 PID 1252 wrote to memory of 5276 1252 cmd.exe 200 PID 5276 wrote to memory of 4264 5276 XNMCTAS.exe 201 PID 4264 wrote to memory of 5400 4264 cmd.exe 205 PID 5400 wrote to memory of 1164 5400 BYKXB.exe 206 PID 1164 wrote to memory of 4756 1164 cmd.exe 210 PID 4756 wrote to memory of 3736 4756 GWC.exe 211 PID 3736 wrote to memory of 2300 3736 cmd.exe 215 PID 2300 wrote to memory of 1676 2300 IUI.exe 216 PID 1676 wrote to memory of 5448 1676 cmd.exe 220 PID 5448 wrote to memory of 2636 5448 LKRWGRT.exe 221 PID 2636 wrote to memory of 2656 2636 cmd.exe 225 PID 2656 wrote to memory of 4192 2656 LNHSU.exe 226 PID 4192 wrote to memory of 4676 4192 cmd.exe 230 PID 4676 wrote to memory of 1248 4676 FSOY.exe 231 PID 1248 wrote to memory of 5500 1248 cmd.exe 235 PID 5500 wrote to memory of 200 5500 ZOXZ.exe 236 PID 200 wrote to memory of 3388 200 cmd.exe 240 PID 3388 wrote to memory of 4792 3388 JLLU.exe 241 PID 4792 wrote to memory of 4524 4792 cmd.exe 245 PID 4524 wrote to memory of 3256 4524 DZKSXYE.exe 246 PID 3256 wrote to memory of 1060 3256 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_9a32fe8b7c44c772825c1160cbf12496_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_9a32fe8b7c44c772825c1160cbf12496_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSIP.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\LSIP.exeC:\windows\LSIP.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDIR.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\windows\SysWOW64\WDIR.exeC:\windows\system32\WDIR.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FIU.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\FIU.exeC:\windows\FIU.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTXOBKB.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\DTXOBKB.exeC:\windows\DTXOBKB.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMAE.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\windows\SysWOW64\CMAE.exeC:\windows\system32\CMAE.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GUGE.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\system\GUGE.exeC:\windows\system\GUGE.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFXDKTG.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\windows\SysWOW64\BFXDKTG.exeC:\windows\system32\BFXDKTG.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SQATTZ.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\windows\SQATTZ.exeC:\windows\SQATTZ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UDFCDZR.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\SysWOW64\UDFCDZR.exeC:\windows\system32\UDFCDZR.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WBKXK.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\system\WBKXK.exeC:\windows\system\WBKXK.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBUZOL.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\windows\SysWOW64\TBUZOL.exeC:\windows\system32\TBUZOL.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMCQ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\windows\OMCQ.exeC:\windows\OMCQ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXN.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\windows\NXN.exeC:\windows\NXN.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNOF.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\windows\system\UNOF.exeC:\windows\system\UNOF.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OFWQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\SysWOW64\OFWQ.exeC:\windows\system32\OFWQ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HYLBT.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\system\HYLBT.exeC:\windows\system\HYLBT.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJOR.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\windows\GJOR.exeC:\windows\GJOR.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YMSNH.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\windows\SysWOW64\YMSNH.exeC:\windows\system32\YMSNH.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMBXLRM.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\windows\system\VMBXLRM.exeC:\windows\system\VMBXLRM.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TCPHAYU.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\windows\system\TCPHAYU.exeC:\windows\system\TCPHAYU.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIHWRCW.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\windows\PIHWRCW.exeC:\windows\PIHWRCW.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XNMCTAS.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\XNMCTAS.exeC:\windows\XNMCTAS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYKXB.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\windows\BYKXB.exeC:\windows\BYKXB.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GWC.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\windows\system\GWC.exeC:\windows\system\GWC.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IUI.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\windows\IUI.exeC:\windows\IUI.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKRWGRT.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\windows\SysWOW64\LKRWGRT.exeC:\windows\system32\LKRWGRT.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LNHSU.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\SysWOW64\LNHSU.exeC:\windows\system32\LNHSU.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FSOY.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\FSOY.exeC:\windows\FSOY.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOXZ.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\ZOXZ.exeC:\windows\ZOXZ.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JLLU.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\SysWOW64\JLLU.exeC:\windows\system32\JLLU.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZKSXYE.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\windows\DZKSXYE.exeC:\windows\DZKSXYE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UZY.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\UZY.exeC:\windows\UZY.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAN.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5620 -
C:\windows\GAN.exeC:\windows\GAN.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KSPKFLY.exe.bat" "68⤵
- Executes a command shell one-liner
PID:3428 -
C:\windows\system\KSPKFLY.exeC:\windows\system\KSPKFLY.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGC.exe.bat" "70⤵PID:2796
-
C:\windows\SysWOW64\SGC.exeC:\windows\system32\SGC.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PYETUOC.exe.bat" "72⤵PID:1548
-
C:\windows\system\PYETUOC.exeC:\windows\system\PYETUOC.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZTELPL.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:1640 -
C:\windows\AZTELPL.exeC:\windows\AZTELPL.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IEYLWNG.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2860 -
C:\windows\IEYLWNG.exeC:\windows\IEYLWNG.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSKRGMK.exe.bat" "78⤵
- Executes a command shell one-liner
PID:3008 -
C:\windows\QSKRGMK.exeC:\windows\QSKRGMK.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXXGJK.exe.bat" "80⤵PID:2648
-
C:\windows\SysWOW64\ZXXGJK.exeC:\windows\system32\ZXXGJK.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DYZIV.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4788 -
C:\windows\SysWOW64\DYZIV.exeC:\windows\system32\DYZIV.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LDLPF.exe.bat" "84⤵
- Executes a command shell one-liner
PID:5804 -
C:\windows\LDLPF.exeC:\windows\LDLPF.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZDQRG.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:760 -
C:\windows\GZDQRG.exeC:\windows\GZDQRG.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEHXB.exe.bat" "88⤵PID:4980
-
C:\windows\OEHXB.exeC:\windows\OEHXB.exe89⤵
- Executes dropped EXE
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YCV.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5388 -
C:\windows\system\YCV.exeC:\windows\system\YCV.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCXU.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5776 -
C:\windows\system\VCXU.exeC:\windows\system\VCXU.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FACOCS.exe.bat" "94⤵PID:3900
-
C:\windows\SysWOW64\FACOCS.exeC:\windows\system32\FACOCS.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HYQIKA.exe.bat" "96⤵PID:5956
-
C:\windows\SysWOW64\HYQIKA.exeC:\windows\system32\HYQIKA.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PDVPU.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5520 -
C:\windows\system\PDVPU.exeC:\windows\system\PDVPU.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NOFF.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1832 -
C:\windows\NOFF.exeC:\windows\NOFF.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XMLZSVO.exe.bat" "102⤵PID:1920
-
C:\windows\XMLZSVO.exeC:\windows\XMLZSVO.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXOPTB.exe.bat" "104⤵
- Executes a command shell one-liner
PID:2120 -
C:\windows\system\WXOPTB.exeC:\windows\system\WXOPTB.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQZXC.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2952 -
C:\windows\system\VQZXC.exeC:\windows\system\VQZXC.exe107⤵
- Executes dropped EXE
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIGQT.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5508 -
C:\windows\GIGQT.exeC:\windows\GIGQT.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OOTX.exe.bat" "110⤵PID:4784
-
C:\windows\SysWOW64\OOTX.exeC:\windows\system32\OOTX.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TOUZ.exe.bat" "112⤵
- Executes a command shell one-liner
PID:1572 -
C:\windows\TOUZ.exeC:\windows\TOUZ.exe113⤵
- Executes dropped EXE
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWJX.exe.bat" "114⤵PID:3296
-
C:\windows\KWJX.exeC:\windows\KWJX.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SCV.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2944 -
C:\windows\SysWOW64\SCV.exeC:\windows\system32\SCV.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUD.exe.bat" "118⤵PID:5376
-
C:\windows\EUD.exeC:\windows\EUD.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CFOEXGV.exe.bat" "120⤵
- Executes a command shell one-liner
PID:3140 -
C:\windows\SysWOW64\CFOEXGV.exeC:\windows\system32\CFOEXGV.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-