Analysis
- max time kernel
73s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe
- Size 208KB
- Sample261009-tkdv1agw3j
- SHA256 e28f524313c44898fa5411b7b6f44c838c1a0b7ef5562a6144b78f7fe69d4ccf
- MD5 448374dd7608a4a0d276eb5a0ba7ee80
- SHA1 50c51b7203c4eea8aead59563d277059532131c4
- SHA512 1ca47de0d10e392a1539834db9d0557b576613738172737a1d5c1e93ca59d85019507de6822398e7e92953a7dcdb385c9a8dc22110776b85bb78a2706dcb8acc
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOf74pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LODkEj1
- TLSH T146247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 256 PQD.exe 5840 PUIS.exe 5776 DKPYE.exe 4740 APHN.exe 5760 IVMU.exe 1872 LLVQE.exe 1200 HEFT.exe 1300 BEME.exe 2180 NHXRII.exe 2264 TCIKO.exe 4160 BIVQZ.exe 5560 JVAFJ.exe 1132 VDTXFG.exe 1936 DRFEP.exe 1760 QPFQ.exe 1352 TKWZD.exe 3808 SVZH.exe 4468 YQL.exe 5420 PYZFM.exe 1580 ZWF.exe 3304 HCR.exe 120 GMUWMQE.exe 4224 IKIRUY.exe 720 SIO.exe 2416 FOOXLKX.exe 3548 NTADWQT.exe 5948 RBHDAB.exe 2368 SEL.exe 1192 JPNXWFM.exe 4572 VFCX.exe 4300 VISTP.exe 5048 ZLQ.exe 4548 DTXOBKB.exe 2748 EWBK.exe 1144 XZFOUY.exe 2760 AHLOG.exe 4912 MXS.exe 1328 JQCYWEX.exe 6140 CTGU.exe 2936 OJZUXYV.exe 2772 WOLBIXQ.exe 4148 PCKYN.exe 1912 RAYTU.exe 1168 SDCXAFX.exe 4956 JLQUMWS.exe 824 LJWOCE.exe 2360 VHBI.exe 3772 LPCAQAY.exe 6028 TCPHAYU.exe 5576 MVERKZK.exe 5468 VDY.exe 5796 PVO.exe 4256 SEUQJQ.exe 4068 IUVP.exe 1624 MKCPCW.exe 2684 UPPWMC.exe 1668 SARMV.exe 4992 GLI.exe 4448 TQIWLXI.exe 2124 ULYK.exe 4496 GBFSMYG.exe 3328 PCH.exe 3868 ESIWWR.exe 692 UVRB.exe - Drops file in System32 directory 63 IoCs
description ioc Process File created C:\windows\SysWOW64\TCIKO.exe NHXRII.exe File opened for modification C:\windows\SysWOW64\FOOXLKX.exe SIO.exe File created C:\windows\SysWOW64\FOOXLKX.exe.bat SIO.exe File created C:\windows\SysWOW64\PCKYN.exe.bat WOLBIXQ.exe File created C:\windows\SysWOW64\GNHLIN.exe WPCRBF.exe File created C:\windows\SysWOW64\KJP.exe.bat VGYPU.exe File created C:\windows\SysWOW64\FOOXLKX.exe SIO.exe File opened for modification C:\windows\SysWOW64\WOLBIXQ.exe OJZUXYV.exe File created C:\windows\SysWOW64\SARMV.exe UPPWMC.exe File created C:\windows\SysWOW64\UYP.exe.bat OCQDZR.exe File opened for modification C:\windows\SysWOW64\DHX.exe BKJY.exe File created C:\windows\SysWOW64\TQIWLXI.exe.bat GLI.exe File opened for modification C:\windows\SysWOW64\ULYK.exe TQIWLXI.exe File opened for modification C:\windows\SysWOW64\LBQT.exe FNR.exe File created C:\windows\SysWOW64\LJWOCE.exe.bat JLQUMWS.exe File created C:\windows\SysWOW64\BDC.exe TQYC.exe File opened for modification C:\windows\SysWOW64\KJP.exe VGYPU.exe File created C:\windows\SysWOW64\WOLBIXQ.exe OJZUXYV.exe File created C:\windows\SysWOW64\TCIKO.exe.bat NHXRII.exe File created C:\windows\SysWOW64\LJWOCE.exe JLQUMWS.exe File opened for modification C:\windows\SysWOW64\SARMV.exe UPPWMC.exe File created C:\windows\SysWOW64\PQD.exe 2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe File created C:\windows\SysWOW64\AHLOG.exe XZFOUY.exe File opened for modification C:\windows\SysWOW64\PCKYN.exe WOLBIXQ.exe File created C:\windows\SysWOW64\MVERKZK.exe TCPHAYU.exe File opened for modification C:\windows\SysWOW64\GNHLIN.exe WPCRBF.exe File created C:\windows\SysWOW64\PQD.exe.bat 2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe File created C:\windows\SysWOW64\SARMV.exe.bat UPPWMC.exe File created C:\windows\SysWOW64\LBQT.exe.bat FNR.exe File created C:\windows\SysWOW64\IVMU.exe APHN.exe File opened for modification C:\windows\SysWOW64\TCIKO.exe NHXRII.exe File created C:\windows\SysWOW64\TQIWLXI.exe GLI.exe File created C:\windows\SysWOW64\KJP.exe VGYPU.exe File created C:\windows\SysWOW64\DHX.exe BKJY.exe File opened for modification C:\windows\SysWOW64\AHLOG.exe XZFOUY.exe File opened for modification C:\windows\SysWOW64\PQD.exe 2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe File created C:\windows\SysWOW64\ULYK.exe TQIWLXI.exe File created C:\windows\SysWOW64\BEME.exe HEFT.exe File created C:\windows\SysWOW64\QPFQ.exe DRFEP.exe File created C:\windows\SysWOW64\ULYK.exe.bat TQIWLXI.exe File created C:\windows\SysWOW64\QPFQ.exe.bat DRFEP.exe File created C:\windows\SysWOW64\AHLOG.exe.bat XZFOUY.exe File opened for modification C:\windows\SysWOW64\MVERKZK.exe TCPHAYU.exe File created C:\windows\SysWOW64\BDC.exe.bat TQYC.exe File created C:\windows\SysWOW64\LBQT.exe FNR.exe File created C:\windows\SysWOW64\GNHLIN.exe.bat WPCRBF.exe File created C:\windows\SysWOW64\DHX.exe.bat BKJY.exe File created C:\windows\SysWOW64\IVMU.exe.bat APHN.exe File opened for modification C:\windows\SysWOW64\QPFQ.exe DRFEP.exe File opened for modification C:\windows\SysWOW64\NTADWQT.exe FOOXLKX.exe File opened for modification C:\windows\SysWOW64\TQIWLXI.exe GLI.exe File opened for modification C:\windows\SysWOW64\IVMU.exe APHN.exe File created C:\windows\SysWOW64\BEME.exe.bat HEFT.exe File created C:\windows\SysWOW64\NTADWQT.exe.bat FOOXLKX.exe File opened for modification C:\windows\SysWOW64\UYP.exe OCQDZR.exe File opened for modification C:\windows\SysWOW64\BEME.exe HEFT.exe File created C:\windows\SysWOW64\NTADWQT.exe FOOXLKX.exe File created C:\windows\SysWOW64\MVERKZK.exe.bat TCPHAYU.exe File opened for modification C:\windows\SysWOW64\BDC.exe TQYC.exe File created C:\windows\SysWOW64\UYP.exe OCQDZR.exe File opened for modification C:\windows\SysWOW64\LJWOCE.exe JLQUMWS.exe File created C:\windows\SysWOW64\WOLBIXQ.exe.bat OJZUXYV.exe File created C:\windows\SysWOW64\PCKYN.exe WOLBIXQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\XZFOUY.exe.bat EWBK.exe File created C:\windows\system\LPCAQAY.exe VHBI.exe File created C:\windows\system\ESIWWR.exe PCH.exe File opened for modification C:\windows\system\WOJRCC.exe MQDWNU.exe File opened for modification C:\windows\system\VGYPU.exe XTGOQOD.exe File opened for modification C:\windows\BKJY.exe KJP.exe File opened for modification C:\windows\BIVQZ.exe TCIKO.exe File created C:\windows\system\IKIRUY.exe GMUWMQE.exe File created C:\windows\DTXOBKB.exe.bat ZLQ.exe File opened for modification C:\windows\system\DRFEP.exe VDTXFG.exe File created C:\windows\system\VISTP.exe.bat VFCX.exe File created C:\windows\system\LPCAQAY.exe.bat VHBI.exe File created C:\windows\GLI.exe SARMV.exe File opened for modification C:\windows\system\PCH.exe GBFSMYG.exe File created C:\windows\system\GXDXPT.exe.bat IHSUCOV.exe File created C:\windows\system\LLVQE.exe.bat IVMU.exe File created C:\windows\DTXOBKB.exe ZLQ.exe File created C:\windows\XZFOUY.exe EWBK.exe File opened for modification C:\windows\system\JQCYWEX.exe MXS.exe File created C:\windows\OJZUXYV.exe.bat CTGU.exe File opened for modification C:\windows\system\TCPHAYU.exe LPCAQAY.exe File created C:\windows\OCQDZR.exe.bat GXDXPT.exe File created C:\windows\system\DRFEP.exe VDTXFG.exe File created C:\windows\system\NHXRII.exe BEME.exe File opened for modification C:\windows\system\CTGU.exe JQCYWEX.exe File created C:\windows\system\CTGU.exe.bat JQCYWEX.exe File created C:\windows\UPPWMC.exe MKCPCW.exe File created C:\windows\system\YWMTLSR.exe.bat BDC.exe File opened for modification C:\windows\XTGOQOD.exe UYP.exe File created C:\windows\system\SIO.exe IKIRUY.exe File created C:\windows\system\VFCX.exe JPNXWFM.exe File created C:\windows\SDCXAFX.exe RAYTU.exe File created C:\windows\VHBI.exe.bat LJWOCE.exe File created C:\windows\XTGOQOD.exe.bat UYP.exe File opened for modification C:\windows\system\HEFT.exe LLVQE.exe File opened for modification C:\windows\system\VDTXFG.exe JVAFJ.exe File opened for modification C:\windows\PYZFM.exe YQL.exe File opened for modification C:\windows\system\RBHDAB.exe NTADWQT.exe File created C:\windows\system\UVRB.exe ESIWWR.exe File created C:\windows\PUIS.exe PQD.exe File opened for modification C:\windows\APHN.exe DKPYE.exe File created C:\windows\SVZH.exe.bat TKWZD.exe File opened for modification C:\windows\VHBI.exe LJWOCE.exe File opened for modification C:\windows\system\LPCAQAY.exe VHBI.exe File created C:\windows\system\TCPHAYU.exe.bat LPCAQAY.exe File opened for modification C:\windows\system\GBFSMYG.exe ULYK.exe File created C:\windows\system\ESIWWR.exe.bat PCH.exe File opened for modification C:\windows\system\TKWZD.exe QPFQ.exe File opened for modification C:\windows\system\IKIRUY.exe GMUWMQE.exe File opened for modification C:\windows\system\VFCX.exe JPNXWFM.exe File created C:\windows\system\MXS.exe.bat AHLOG.exe File created C:\windows\OJZUXYV.exe CTGU.exe File opened for modification C:\windows\system\SEUQJQ.exe PVO.exe File created C:\windows\GLI.exe.bat SARMV.exe File created C:\windows\system\UVRB.exe.bat ESIWWR.exe File opened for modification C:\windows\PUIS.exe PQD.exe File created C:\windows\PUIS.exe.bat PQD.exe File opened for modification C:\windows\system\DKPYE.exe PUIS.exe File created C:\windows\system\TKWZD.exe QPFQ.exe File created C:\windows\JLQUMWS.exe.bat SDCXAFX.exe File created C:\windows\system\TCPHAYU.exe LPCAQAY.exe File opened for modification C:\windows\VDY.exe MVERKZK.exe File created C:\windows\system\MQDWNU.exe UVRB.exe File created C:\windows\system\SEL.exe.bat RBHDAB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3164 cmd.exe 2436 cmd.exe 4768 cmd.exe 4092 cmd.exe 5340 cmd.exe 3636 cmd.exe 4164 cmd.exe 4920 cmd.exe 5464 cmd.exe 4324 cmd.exe 2716 cmd.exe 752 cmd.exe 2888 cmd.exe 1696 cmd.exe 6000 cmd.exe 4072 cmd.exe 4380 cmd.exe 3016 cmd.exe 5816 cmd.exe 3436 cmd.exe 3520 cmd.exe 4296 cmd.exe 4716 cmd.exe 3752 cmd.exe 1456 cmd.exe 4492 cmd.exe 4536 cmd.exe 1508 cmd.exe 1932 cmd.exe 5716 cmd.exe 1704 cmd.exe 3796 cmd.exe 4368 cmd.exe 5452 cmd.exe 3728 cmd.exe 4888 cmd.exe 5944 cmd.exe 424 cmd.exe 4700 cmd.exe 5660 cmd.exe 2796 cmd.exe 2912 cmd.exe 5624 cmd.exe 4400 cmd.exe 1700 cmd.exe 5360 cmd.exe 2780 cmd.exe 1944 cmd.exe 2600 cmd.exe 2500 cmd.exe 4736 cmd.exe 3112 cmd.exe 2568 cmd.exe 3776 cmd.exe 2636 cmd.exe 2948 cmd.exe 5332 cmd.exe 2208 cmd.exe 6048 cmd.exe 5336 cmd.exe 5460 cmd.exe 3712 cmd.exe 6004 cmd.exe 3136 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4256 4656 WerFault.exe 88 2600 256 WerFault.exe 93 2948 5840 WerFault.exe 99 5332 5776 WerFault.exe 104 5360 4740 WerFault.exe 109 6020 5760 WerFault.exe 114 3404 1872 WerFault.exe 119 4696 1200 WerFault.exe 124 5420 1300 WerFault.exe 129 3960 2180 WerFault.exe 134 3928 2264 WerFault.exe 139 252 4160 WerFault.exe 144 3796 5560 WerFault.exe 149 2544 1132 WerFault.exe 154 3164 1936 WerFault.exe 159 4856 1760 WerFault.exe 164 4700 1352 WerFault.exe 168 6000 3808 WerFault.exe 174 4608 4468 WerFault.exe 179 3068 5420 WerFault.exe 184 4812 1580 WerFault.exe 189 5468 3304 WerFault.exe 194 4492 120 WerFault.exe 199 3264 4224 WerFault.exe 204 4260 720 WerFault.exe 209 2832 2416 WerFault.exe 214 5028 3548 WerFault.exe 219 472 5948 WerFault.exe 224 1340 2368 WerFault.exe 229 5888 1192 WerFault.exe 234 5476 4572 WerFault.exe 239 1140 4300 WerFault.exe 244 1236 5048 WerFault.exe 249 4544 4548 WerFault.exe 254 4556 2748 WerFault.exe 260 5016 1144 WerFault.exe 265 5028 2760 WerFault.exe 270 4700 4912 WerFault.exe 275 2312 1328 WerFault.exe 280 2852 6140 WerFault.exe 285 4812 2936 WerFault.exe 290 4948 2772 WerFault.exe 295 908 4148 WerFault.exe 300 5252 1912 WerFault.exe 305 4564 1168 WerFault.exe 310 5004 4956 WerFault.exe 315 2296 824 WerFault.exe 320 5108 2360 WerFault.exe 325 4092 3772 WerFault.exe 330 5972 6028 WerFault.exe 335 3252 5576 WerFault.exe 340 4480 5468 WerFault.exe 345 6080 5796 WerFault.exe 350 3868 4256 WerFault.exe 355 5380 4068 WerFault.exe 360 6012 1624 WerFault.exe 365 2676 2684 WerFault.exe 370 2584 1668 WerFault.exe 375 5536 4992 WerFault.exe 380 5716 4448 WerFault.exe 385 2780 2124 WerFault.exe 390 1108 4496 WerFault.exe 395 4964 3328 WerFault.exe 400 1548 3868 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDTXFG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKPYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVAFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJWOCE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCIKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIVQZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPPWMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXDXPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCQDZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOLBIXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTADWQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UVRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPNXWFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLQUMWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MQDWNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMUWMQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VISTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPCAQAY.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4656 2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe 4656 2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe 256 PQD.exe 256 PQD.exe 5840 PUIS.exe 5840 PUIS.exe 5776 DKPYE.exe 5776 DKPYE.exe 4740 APHN.exe 4740 APHN.exe 5760 IVMU.exe 5760 IVMU.exe 1872 LLVQE.exe 1872 LLVQE.exe 1200 HEFT.exe 1200 HEFT.exe 1300 BEME.exe 1300 BEME.exe 2180 NHXRII.exe 2180 NHXRII.exe 2264 TCIKO.exe 2264 TCIKO.exe 4160 BIVQZ.exe 4160 BIVQZ.exe 5560 JVAFJ.exe 5560 JVAFJ.exe 1132 VDTXFG.exe 1132 VDTXFG.exe 1936 DRFEP.exe 1936 DRFEP.exe 1760 QPFQ.exe 1760 QPFQ.exe 1352 TKWZD.exe 1352 TKWZD.exe 3808 SVZH.exe 3808 SVZH.exe 4468 YQL.exe 4468 YQL.exe 5420 PYZFM.exe 5420 PYZFM.exe 1580 ZWF.exe 1580 ZWF.exe 3304 HCR.exe 3304 HCR.exe 120 GMUWMQE.exe 120 GMUWMQE.exe 4224 IKIRUY.exe 4224 IKIRUY.exe 720 SIO.exe 720 SIO.exe 2416 FOOXLKX.exe 2416 FOOXLKX.exe 3548 NTADWQT.exe 3548 NTADWQT.exe 5948 RBHDAB.exe 5948 RBHDAB.exe 2368 SEL.exe 2368 SEL.exe 1192 JPNXWFM.exe 1192 JPNXWFM.exe 4572 VFCX.exe 4572 VFCX.exe 4300 VISTP.exe 4300 VISTP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4656 2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe 4656 2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe 256 PQD.exe 256 PQD.exe 5840 PUIS.exe 5840 PUIS.exe 5776 DKPYE.exe 5776 DKPYE.exe 4740 APHN.exe 4740 APHN.exe 5760 IVMU.exe 5760 IVMU.exe 1872 LLVQE.exe 1872 LLVQE.exe 1200 HEFT.exe 1200 HEFT.exe 1300 BEME.exe 1300 BEME.exe 2180 NHXRII.exe 2180 NHXRII.exe 2264 TCIKO.exe 2264 TCIKO.exe 4160 BIVQZ.exe 4160 BIVQZ.exe 5560 JVAFJ.exe 5560 JVAFJ.exe 1132 VDTXFG.exe 1132 VDTXFG.exe 1936 DRFEP.exe 1936 DRFEP.exe 1760 QPFQ.exe 1760 QPFQ.exe 1352 TKWZD.exe 1352 TKWZD.exe 3808 SVZH.exe 3808 SVZH.exe 4468 YQL.exe 4468 YQL.exe 5420 PYZFM.exe 5420 PYZFM.exe 1580 ZWF.exe 1580 ZWF.exe 3304 HCR.exe 3304 HCR.exe 120 GMUWMQE.exe 120 GMUWMQE.exe 4224 IKIRUY.exe 4224 IKIRUY.exe 720 SIO.exe 720 SIO.exe 2416 FOOXLKX.exe 2416 FOOXLKX.exe 3548 NTADWQT.exe 3548 NTADWQT.exe 5948 RBHDAB.exe 5948 RBHDAB.exe 2368 SEL.exe 2368 SEL.exe 1192 JPNXWFM.exe 1192 JPNXWFM.exe 4572 VFCX.exe 4572 VFCX.exe 4300 VISTP.exe 4300 VISTP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4656 wrote to memory of 4920 4656 2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe 89 PID 4920 wrote to memory of 256 4920 cmd.exe 93 PID 256 wrote to memory of 5852 256 PQD.exe 95 PID 5852 wrote to memory of 5840 5852 cmd.exe 99 PID 5840 wrote to memory of 4400 5840 PUIS.exe 100 PID 4400 wrote to memory of 5776 4400 cmd.exe 104 PID 5776 wrote to memory of 1652 5776 DKPYE.exe 105 PID 1652 wrote to memory of 4740 1652 cmd.exe 109 PID 4740 wrote to memory of 548 4740 APHN.exe 110 PID 548 wrote to memory of 5760 548 cmd.exe 114 PID 5760 wrote to memory of 3136 5760 IVMU.exe 115 PID 3136 wrote to memory of 1872 3136 cmd.exe 119 PID 1872 wrote to memory of 3220 1872 LLVQE.exe 120 PID 3220 wrote to memory of 1200 3220 cmd.exe 124 PID 1200 wrote to memory of 4636 1200 HEFT.exe 125 PID 4636 wrote to memory of 1300 4636 cmd.exe 129 PID 1300 wrote to memory of 4536 1300 BEME.exe 130 PID 4536 wrote to memory of 2180 4536 cmd.exe 134 PID 2180 wrote to memory of 5644 2180 NHXRII.exe 135 PID 5644 wrote to memory of 2264 5644 cmd.exe 139 PID 2264 wrote to memory of 3732 2264 TCIKO.exe 140 PID 3732 wrote to memory of 4160 3732 cmd.exe 144 PID 4160 wrote to memory of 4888 4160 BIVQZ.exe 145 PID 4888 wrote to memory of 5560 4888 cmd.exe 149 PID 5560 wrote to memory of 1944 5560 JVAFJ.exe 150 PID 1944 wrote to memory of 1132 1944 cmd.exe 154 PID 1132 wrote to memory of 3412 1132 VDTXFG.exe 155 PID 3412 wrote to memory of 1936 3412 cmd.exe 159 PID 1936 wrote to memory of 2208 1936 DRFEP.exe 160 PID 2208 wrote to memory of 1760 2208 cmd.exe 164 PID 1760 wrote to memory of 6048 1760 QPFQ.exe 165 PID 6048 wrote to memory of 1352 6048 cmd.exe 168 PID 1352 wrote to memory of 4176 1352 TKWZD.exe 170 PID 4176 wrote to memory of 3808 4176 cmd.exe 174 PID 3808 wrote to memory of 3916 3808 SVZH.exe 175 PID 3916 wrote to memory of 4468 3916 cmd.exe 179 PID 4468 wrote to memory of 1252 4468 YQL.exe 180 PID 1252 wrote to memory of 5420 1252 cmd.exe 184 PID 5420 wrote to memory of 2084 5420 PYZFM.exe 185 PID 2084 wrote to memory of 1580 2084 cmd.exe 189 PID 1580 wrote to memory of 5816 1580 ZWF.exe 190 PID 5816 wrote to memory of 3304 5816 cmd.exe 194 PID 3304 wrote to memory of 5364 3304 HCR.exe 195 PID 5364 wrote to memory of 120 5364 cmd.exe 199 PID 120 wrote to memory of 2596 120 GMUWMQE.exe 200 PID 2596 wrote to memory of 4224 2596 cmd.exe 204 PID 4224 wrote to memory of 1968 4224 IKIRUY.exe 205 PID 1968 wrote to memory of 720 1968 cmd.exe 209 PID 720 wrote to memory of 3576 720 SIO.exe 210 PID 3576 wrote to memory of 2416 3576 cmd.exe 214 PID 2416 wrote to memory of 2592 2416 FOOXLKX.exe 215 PID 2592 wrote to memory of 3548 2592 cmd.exe 219 PID 3548 wrote to memory of 5152 3548 NTADWQT.exe 220 PID 5152 wrote to memory of 5948 5152 cmd.exe 224 PID 5948 wrote to memory of 1304 5948 RBHDAB.exe 225 PID 1304 wrote to memory of 2368 1304 cmd.exe 229 PID 2368 wrote to memory of 5708 2368 SEL.exe 230 PID 5708 wrote to memory of 1192 5708 cmd.exe 234 PID 1192 wrote to memory of 4368 1192 JPNXWFM.exe 235 PID 4368 wrote to memory of 4572 4368 cmd.exe 239 PID 4572 wrote to memory of 1508 4572 VFCX.exe 240 PID 1508 wrote to memory of 4300 1508 cmd.exe 244 PID 4300 wrote to memory of 5800 4300 VISTP.exe 245 PID 5800 wrote to memory of 5048 5800 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-08_448374dd7608a4a0d276eb5a0ba7ee80_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQD.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\windows\SysWOW64\PQD.exeC:\windows\system32\PQD.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUIS.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\windows\PUIS.exeC:\windows\PUIS.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKPYE.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\windows\system\DKPYE.exeC:\windows\system\DKPYE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APHN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\windows\APHN.exeC:\windows\APHN.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVMU.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\windows\SysWOW64\IVMU.exeC:\windows\system32\IVMU.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLVQE.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\system\LLVQE.exeC:\windows\system\LLVQE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HEFT.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\system\HEFT.exeC:\windows\system\HEFT.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHXRII.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\windows\system\NHXRII.exeC:\windows\system\NHXRII.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCIKO.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\SysWOW64\TCIKO.exeC:\windows\system32\TCIKO.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BIVQZ.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\windows\BIVQZ.exeC:\windows\BIVQZ.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVAFJ.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\JVAFJ.exeC:\windows\JVAFJ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VDTXFG.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\windows\system\VDTXFG.exeC:\windows\system\VDTXFG.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRFEP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\system\DRFEP.exeC:\windows\system\DRFEP.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QPFQ.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\windows\SysWOW64\QPFQ.exeC:\windows\system32\QPFQ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKWZD.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\windows\system\TKWZD.exeC:\windows\system\TKWZD.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVZH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\windows\SVZH.exeC:\windows\SVZH.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQL.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\windows\system\YQL.exeC:\windows\system\YQL.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PYZFM.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\windows\PYZFM.exeC:\windows\PYZFM.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWF.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\windows\ZWF.exeC:\windows\ZWF.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCR.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\windows\HCR.exeC:\windows\HCR.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMUWMQE.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\GMUWMQE.exeC:\windows\GMUWMQE.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IKIRUY.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\system\IKIRUY.exeC:\windows\system\IKIRUY.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIO.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\system\SIO.exeC:\windows\system\SIO.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FOOXLKX.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\windows\SysWOW64\FOOXLKX.exeC:\windows\system32\FOOXLKX.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NTADWQT.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\SysWOW64\NTADWQT.exeC:\windows\system32\NTADWQT.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBHDAB.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\windows\system\RBHDAB.exeC:\windows\system\RBHDAB.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEL.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\windows\system\SEL.exeC:\windows\system\SEL.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JPNXWFM.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\windows\JPNXWFM.exeC:\windows\JPNXWFM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VFCX.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\system\VFCX.exeC:\windows\system\VFCX.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VISTP.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\system\VISTP.exeC:\windows\system\VISTP.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLQ.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\windows\ZLQ.exeC:\windows\ZLQ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTXOBKB.exe.bat" "66⤵
- Executes a command shell one-liner
PID:752 -
C:\windows\DTXOBKB.exeC:\windows\DTXOBKB.exe67⤵
- Executes dropped EXE
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWBK.exe.bat" "68⤵
- Executes a command shell one-liner
PID:2888 -
C:\windows\system\EWBK.exeC:\windows\system\EWBK.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XZFOUY.exe.bat" "70⤵PID:3020
-
C:\windows\XZFOUY.exeC:\windows\XZFOUY.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AHLOG.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3752 -
C:\windows\SysWOW64\AHLOG.exeC:\windows\system32\AHLOG.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXS.exe.bat" "74⤵PID:2380
-
C:\windows\system\MXS.exeC:\windows\system\MXS.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JQCYWEX.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5844 -
C:\windows\system\JQCYWEX.exeC:\windows\system\JQCYWEX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CTGU.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5076 -
C:\windows\system\CTGU.exeC:\windows\system\CTGU.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJZUXYV.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3368 -
C:\windows\OJZUXYV.exeC:\windows\OJZUXYV.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOLBIXQ.exe.bat" "82⤵
- Executes a command shell one-liner
PID:5944 -
C:\windows\SysWOW64\WOLBIXQ.exeC:\windows\system32\WOLBIXQ.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCKYN.exe.bat" "84⤵PID:4108
-
C:\windows\SysWOW64\PCKYN.exeC:\windows\system32\PCKYN.exe85⤵
- Executes dropped EXE
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RAYTU.exe.bat" "86⤵PID:272
-
C:\windows\RAYTU.exeC:\windows\RAYTU.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SDCXAFX.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:3324 -
C:\windows\SDCXAFX.exeC:\windows\SDCXAFX.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLQUMWS.exe.bat" "90⤵
- Executes a command shell one-liner
PID:3436 -
C:\windows\JLQUMWS.exeC:\windows\JLQUMWS.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJWOCE.exe.bat" "92⤵PID:5172
-
C:\windows\SysWOW64\LJWOCE.exeC:\windows\system32\LJWOCE.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHBI.exe.bat" "94⤵
- Executes a command shell one-liner
PID:3164 -
C:\windows\VHBI.exeC:\windows\VHBI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPCAQAY.exe.bat" "96⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5336 -
C:\windows\system\LPCAQAY.exeC:\windows\system\LPCAQAY.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TCPHAYU.exe.bat" "98⤵
- Executes a command shell one-liner
PID:424 -
C:\windows\system\TCPHAYU.exeC:\windows\system\TCPHAYU.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVERKZK.exe.bat" "100⤵PID:3768
-
C:\windows\SysWOW64\MVERKZK.exeC:\windows\system32\MVERKZK.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VDY.exe.bat" "102⤵
- Executes a command shell one-liner
PID:2600 -
C:\windows\VDY.exeC:\windows\VDY.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PVO.exe.bat" "104⤵
- Executes a command shell one-liner
PID:1700 -
C:\windows\PVO.exeC:\windows\PVO.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEUQJQ.exe.bat" "106⤵PID:2544
-
C:\windows\system\SEUQJQ.exeC:\windows\system\SEUQJQ.exe107⤵
- Executes dropped EXE
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IUVP.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3112 -
C:\windows\system\IUVP.exeC:\windows\system\IUVP.exe109⤵
- Executes dropped EXE
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKCPCW.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2640 -
C:\windows\system\MKCPCW.exeC:\windows\system\MKCPCW.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPPWMC.exe.bat" "112⤵PID:4724
-
C:\windows\UPPWMC.exeC:\windows\UPPWMC.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SARMV.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4700 -
C:\windows\SysWOW64\SARMV.exeC:\windows\system32\SARMV.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLI.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2312 -
C:\windows\GLI.exeC:\windows\GLI.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TQIWLXI.exe.bat" "118⤵PID:5908
-
C:\windows\SysWOW64\TQIWLXI.exeC:\windows\system32\TQIWLXI.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ULYK.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2500 -
C:\windows\SysWOW64\ULYK.exeC:\windows\system32\ULYK.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-