Analysis
- max time kernel
97s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 23:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe
- Size 208KB
- Sample261015-3krljaef89
- SHA256 89452f26bdb0c8a677029eac01c68a12e92ba7cccbd2e65a3a6463399ea62d7f
- MD5 f07fa5f07c589596cad9b5a46115f31b
- SHA1 8b6bcefb8a6afb2a53710e523fa678a4a47b1135
- SHA512 bd9359ff7456588a70844558fb60a2239099875d5b76c41c28bd238851bd50c078af3e7153c51992490c7fe26c267ce53c47085f39592654d96b1023d2e80b09
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb1lldL+LOft4pLthEjQT6j:MlZtbLWIgd1LZ9oECZb1ll5+LOlkEj1
- TLSH T1F6247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1244 NJCHC.exe 2480 WHXIW.exe 1856 VRM.exe 5004 UCPGOYB.exe 4136 OXTP.exe 2036 BAKOMBL.exe 3340 RQLFL.exe 3324 MBT.exe 4208 HOYNK.exe 4684 HCYCL.exe 4896 MCG.exe 3512 FXKLI.exe 2244 USTYTRY.exe 1960 GLWQ.exe 5932 OYOF.exe 4500 IMTONL.exe 6036 DZY.exe 1872 JZGLG.exe 2456 BCJHLDX.exe 5788 NVM.exe 6020 SVUODN.exe 5384 WDB.exe 3996 OMDB.exe 1300 IZIKDC.exe 1220 XURP.exe 2016 JMUHW.exe 5392 XSSEDGK.exe 5388 YVWA.exe 5076 HVYNU.exe 3376 NWFBDEX.exe 1540 IJKK.exe 848 QXKZP.exe 4320 FSU.exe 3844 TXZA.exe 344 BDSPQ.exe 440 QIXEX.exe 1652 LWCVIBD.exe 3044 LZGRN.exe 4572 CERJDO.exe 4600 VHUFI.exe 4908 SNACP.exe 3056 KQEF.exe 5312 SVEU.exe 1624 HQOYPDR.exe 2612 CDSI.exe 3344 XRXRKD.exe 5448 IJSKKSJ.exe 4372 OKAY.exe 4340 OXAMD.exe 4876 GSEQIPP.exe 4280 JOJZ.exe 3308 HOQNBR.exe 3068 DLWCIT.exe 2384 VUYP.exe 4936 GMTIU.exe 236 PAESKD.exe 1964 MXJ.exe 716 XQMIZUW.exe 4652 ZOGKGRM.exe 1432 IBQCV.exe 796 HMGSV.exe 3160 VRMPC.exe 3768 BSUDLMZ.exe 832 YPAA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\ZDGZ.exe OKD.exe File opened for modification C:\windows\SysWOW64\TXZA.exe FSU.exe File created C:\windows\SysWOW64\TXZA.exe.bat FSU.exe File created C:\windows\SysWOW64\CERJDO.exe LZGRN.exe File opened for modification C:\windows\SysWOW64\CDSI.exe HQOYPDR.exe File created C:\windows\SysWOW64\CDSI.exe.bat HQOYPDR.exe File created C:\windows\SysWOW64\VWHZFK.exe LIW.exe File opened for modification C:\windows\SysWOW64\TXIVN.exe LEHC.exe File opened for modification C:\windows\SysWOW64\JZGLG.exe DZY.exe File created C:\windows\SysWOW64\NWFBDEX.exe.bat HVYNU.exe File opened for modification C:\windows\SysWOW64\CERJDO.exe LZGRN.exe File created C:\windows\SysWOW64\GMTIU.exe.bat VUYP.exe File opened for modification C:\windows\SysWOW64\MUJUX.exe XPEX.exe File created C:\windows\SysWOW64\ULXVPW.exe.bat JTUDH.exe File created C:\windows\SysWOW64\DDTHWK.exe XDLTFI.exe File created C:\windows\SysWOW64\DDTHWK.exe.bat XDLTFI.exe File created C:\windows\SysWOW64\RQLFL.exe.bat BAKOMBL.exe File created C:\windows\SysWOW64\IMTONL.exe.bat OYOF.exe File created C:\windows\SysWOW64\YVWA.exe.bat XSSEDGK.exe File created C:\windows\SysWOW64\CERJDO.exe.bat LZGRN.exe File created C:\windows\SysWOW64\QZX.exe IGXNBBS.exe File created C:\windows\SysWOW64\QZX.exe.bat IGXNBBS.exe File created C:\windows\SysWOW64\EXXWEA.exe EJFHD.exe File created C:\windows\SysWOW64\NJCHC.exe 2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\HOYNK.exe MBT.exe File created C:\windows\SysWOW64\YVWA.exe XSSEDGK.exe File opened for modification C:\windows\SysWOW64\NWFBDEX.exe HVYNU.exe File opened for modification C:\windows\SysWOW64\LWCVIBD.exe QIXEX.exe File created C:\windows\SysWOW64\MUJUX.exe XPEX.exe File created C:\windows\SysWOW64\WTWA.exe.bat NGMHYZY.exe File created C:\windows\SysWOW64\TRCP.exe.bat WTWA.exe File opened for modification C:\windows\SysWOW64\HCYCL.exe HOYNK.exe File created C:\windows\SysWOW64\JMUHW.exe XURP.exe File opened for modification C:\windows\SysWOW64\YVWA.exe XSSEDGK.exe File created C:\windows\SysWOW64\LWCVIBD.exe.bat QIXEX.exe File created C:\windows\SysWOW64\GMTIU.exe VUYP.exe File opened for modification C:\windows\SysWOW64\GMTIU.exe VUYP.exe File created C:\windows\SysWOW64\NFHODSF.exe FZHHBF.exe File created C:\windows\SysWOW64\KJCM.exe.bat VOK.exe File opened for modification C:\windows\SysWOW64\OXTP.exe UCPGOYB.exe File created C:\windows\SysWOW64\RQLFL.exe BAKOMBL.exe File created C:\windows\SysWOW64\JMUHW.exe.bat XURP.exe File created C:\windows\SysWOW64\NWFBDEX.exe HVYNU.exe File created C:\windows\SysWOW64\HQOYPDR.exe SVEU.exe File created C:\windows\SysWOW64\MUJUX.exe.bat XPEX.exe File created C:\windows\SysWOW64\ULXVPW.exe JTUDH.exe File created C:\windows\SysWOW64\TCF.exe NCXUQS.exe File opened for modification C:\windows\SysWOW64\NJCHC.exe 2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\IMTONL.exe OYOF.exe File created C:\windows\SysWOW64\HQOYPDR.exe.bat SVEU.exe File created C:\windows\SysWOW64\YSAU.exe.bat SSSGZH.exe File opened for modification C:\windows\SysWOW64\LZHN.exe ULXVPW.exe File created C:\windows\SysWOW64\TXIVN.exe LEHC.exe File opened for modification C:\windows\SysWOW64\NFHODSF.exe FZHHBF.exe File opened for modification C:\windows\SysWOW64\TRCP.exe WTWA.exe File created C:\windows\SysWOW64\HCYCL.exe HOYNK.exe File created C:\windows\SysWOW64\OXTP.exe UCPGOYB.exe File created C:\windows\SysWOW64\JZGLG.exe DZY.exe File created C:\windows\SysWOW64\VWHZFK.exe.bat LIW.exe File opened for modification C:\windows\SysWOW64\XDLTFI.exe AXFW.exe File created C:\windows\SysWOW64\WTWA.exe NGMHYZY.exe File opened for modification C:\windows\SysWOW64\RQLFL.exe BAKOMBL.exe File created C:\windows\SysWOW64\CDSI.exe HQOYPDR.exe File created C:\windows\SysWOW64\ZDGZ.exe OKD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\SVEU.exe.bat KQEF.exe File created C:\windows\HOQNBR.exe.bat JOJZ.exe File created C:\windows\system\OKD.exe TXGXTG.exe File created C:\windows\UWTPMI.exe XRNS.exe File created C:\windows\WDB.exe.bat SVUODN.exe File created C:\windows\JLIVQ.exe.bat XTN.exe File created C:\windows\NVM.exe.bat BCJHLDX.exe File opened for modification C:\windows\TEXWFC.exe RHWBZ.exe File created C:\windows\system\OKD.exe.bat TXGXTG.exe File created C:\windows\USTYTRY.exe.bat FXKLI.exe File created C:\windows\DLWCIT.exe HOQNBR.exe File opened for modification C:\windows\PAESKD.exe GMTIU.exe File created C:\windows\system\YPAA.exe BSUDLMZ.exe File created C:\windows\ZXNA.exe.bat MUJUX.exe File created C:\windows\system\FAVIKF.exe QFE.exe File opened for modification C:\windows\system\WHXIW.exe NJCHC.exe File created C:\windows\system\WHXIW.exe.bat NJCHC.exe File created C:\windows\VHUFI.exe.bat CERJDO.exe File opened for modification C:\windows\system\YQELVDT.exe CLGOGTR.exe File created C:\windows\NGMHYZY.exe FAUTWM.exe File created C:\windows\system\VOK.exe.bat ZINKJC.exe File created C:\windows\BCJHLDX.exe JZGLG.exe File opened for modification C:\windows\NGMHYZY.exe FAUTWM.exe File opened for modification C:\windows\system\ZOGKGRM.exe XQMIZUW.exe File created C:\windows\MCG.exe.bat HCYCL.exe File opened for modification C:\windows\QIXEX.exe BDSPQ.exe File created C:\windows\system\IBQCV.exe.bat ZOGKGRM.exe File opened for modification C:\windows\HMGSV.exe IBQCV.exe File opened for modification C:\windows\system\BSUDLMZ.exe VRMPC.exe File created C:\windows\system\NROEH.exe.bat JJH.exe File created C:\windows\ZFDUJM.exe.bat EKZL.exe File created C:\windows\system\XPEX.exe.bat PJL.exe File created C:\windows\VRM.exe.bat WHXIW.exe File created C:\windows\OMDB.exe WDB.exe File created C:\windows\IZIKDC.exe OMDB.exe File created C:\windows\system\FSU.exe.bat QXKZP.exe File created C:\windows\SNACP.exe VHUFI.exe File created C:\windows\system\OKAY.exe IJSKKSJ.exe File created C:\windows\GSEQIPP.exe OXAMD.exe File created C:\windows\XTN.exe.bat ZDGZ.exe File created C:\windows\system\XPEX.exe PJL.exe File opened for modification C:\windows\ZXNA.exe MUJUX.exe File opened for modification C:\windows\QFE.exe EXXWEA.exe File created C:\windows\system\FAVIKF.exe.bat QFE.exe File created C:\windows\MBT.exe RQLFL.exe File opened for modification C:\windows\system\XSSEDGK.exe JMUHW.exe File created C:\windows\OXAMD.exe.bat OKAY.exe File opened for modification C:\windows\GSEQIPP.exe OXAMD.exe File opened for modification C:\windows\system\OKD.exe TXGXTG.exe File created C:\windows\system\AMBABW.exe CLTM.exe File created C:\windows\OYOF.exe.bat GLWQ.exe File opened for modification C:\windows\BAKOMBL.exe OXTP.exe File created C:\windows\system\FXKLI.exe.bat MCG.exe File opened for modification C:\windows\OMDB.exe WDB.exe File created C:\windows\system\TXGXTG.exe.bat TEXWFC.exe File opened for modification C:\windows\PJL.exe VWHZFK.exe File created C:\windows\LEHC.exe LZHN.exe File created C:\windows\QFE.exe EXXWEA.exe File created C:\windows\system\UCPGOYB.exe.bat VRM.exe File created C:\windows\USTYTRY.exe FXKLI.exe File created C:\windows\VHUFI.exe CERJDO.exe File opened for modification C:\windows\system\XRXRKD.exe CDSI.exe File opened for modification C:\windows\system\TRLYMAC.exe LLLKKV.exe File created C:\windows\system\RHWBZ.exe.bat TRLYMAC.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1792 cmd.exe 2608 cmd.exe 1588 cmd.exe 1304 cmd.exe 1276 cmd.exe 428 cmd.exe 4892 cmd.exe 568 cmd.exe 3976 cmd.exe 5028 cmd.exe 1704 cmd.exe 4396 cmd.exe 2836 cmd.exe 4224 cmd.exe 2420 cmd.exe 5572 cmd.exe 1904 cmd.exe 1320 cmd.exe 4700 cmd.exe 1044 cmd.exe 2360 cmd.exe 1224 cmd.exe 4472 cmd.exe 6140 cmd.exe 2760 cmd.exe 2920 cmd.exe 3080 cmd.exe 4268 cmd.exe 2532 cmd.exe 5760 cmd.exe 3748 cmd.exe 4540 cmd.exe 5872 cmd.exe 4144 cmd.exe 3132 cmd.exe 4744 cmd.exe 3932 cmd.exe 3628 cmd.exe 5416 cmd.exe 2508 cmd.exe 5964 cmd.exe 3148 cmd.exe 3504 cmd.exe 2528 cmd.exe 6132 cmd.exe 5064 cmd.exe 3852 cmd.exe 5700 cmd.exe 1200 cmd.exe 2088 cmd.exe 5352 cmd.exe 5732 cmd.exe 5908 cmd.exe 6136 cmd.exe 6004 cmd.exe 4148 cmd.exe 4952 cmd.exe 2724 cmd.exe 3420 cmd.exe 896 cmd.exe 2844 cmd.exe 2056 cmd.exe 3544 cmd.exe 4356 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1692 5556 WerFault.exe 89 4192 1244 WerFault.exe 94 5588 2480 WerFault.exe 100 1200 1856 WerFault.exe 105 5448 5004 WerFault.exe 110 1796 4136 WerFault.exe 115 3332 2036 WerFault.exe 120 3160 3340 WerFault.exe 125 4940 3324 WerFault.exe 130 1132 4208 WerFault.exe 135 5312 4684 WerFault.exe 140 2948 4896 WerFault.exe 145 3148 3512 WerFault.exe 150 4728 2244 WerFault.exe 155 2016 1960 WerFault.exe 160 4488 5932 WerFault.exe 165 4508 4500 WerFault.exe 170 4704 6036 WerFault.exe 175 3312 1872 WerFault.exe 180 1924 2456 WerFault.exe 185 3868 5788 WerFault.exe 190 5772 6020 WerFault.exe 195 3844 5384 WerFault.exe 200 5940 3996 WerFault.exe 205 4764 1300 WerFault.exe 210 1544 1220 WerFault.exe 215 4740 2016 WerFault.exe 220 4924 5392 WerFault.exe 225 3332 5388 WerFault.exe 230 5752 5076 WerFault.exe 235 1080 3376 WerFault.exe 240 3272 1540 WerFault.exe 245 5112 848 WerFault.exe 250 3976 4320 WerFault.exe 255 4824 3844 WerFault.exe 260 2560 344 WerFault.exe 265 2432 440 WerFault.exe 270 432 1652 WerFault.exe 275 2236 3044 WerFault.exe 280 1180 4572 WerFault.exe 286 4332 4600 WerFault.exe 291 4464 4908 WerFault.exe 296 1980 3056 WerFault.exe 301 4620 5312 WerFault.exe 306 4588 1624 WerFault.exe 311 4544 2612 WerFault.exe 316 3148 3344 WerFault.exe 320 4488 5448 WerFault.exe 326 1728 4372 WerFault.exe 331 1344 4340 WerFault.exe 336 5752 4876 WerFault.exe 341 3172 4280 WerFault.exe 346 5568 3308 WerFault.exe 351 4568 3068 WerFault.exe 356 4912 2384 WerFault.exe 361 5420 4936 WerFault.exe 366 4192 236 WerFault.exe 371 1304 1964 WerFault.exe 376 4508 716 WerFault.exe 381 2500 4652 WerFault.exe 386 5028 1432 WerFault.exe 391 3628 796 WerFault.exe 396 2536 3160 WerFault.exe 401 2820 3768 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHXIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHUFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMGSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVUODN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXKZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXZA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDLTFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMBABW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ULXVPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCYCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOYNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZGRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LLLKKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JTUDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZHHBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAKOMBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MCG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XURP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUOSCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZFDUJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZINKJC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5556 2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe 5556 2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe 1244 NJCHC.exe 1244 NJCHC.exe 2480 WHXIW.exe 2480 WHXIW.exe 1856 VRM.exe 1856 VRM.exe 5004 UCPGOYB.exe 5004 UCPGOYB.exe 4136 OXTP.exe 4136 OXTP.exe 2036 BAKOMBL.exe 2036 BAKOMBL.exe 3340 RQLFL.exe 3340 RQLFL.exe 3324 MBT.exe 3324 MBT.exe 4208 HOYNK.exe 4208 HOYNK.exe 4684 HCYCL.exe 4684 HCYCL.exe 4896 MCG.exe 4896 MCG.exe 3512 FXKLI.exe 3512 FXKLI.exe 2244 USTYTRY.exe 2244 USTYTRY.exe 1960 GLWQ.exe 1960 GLWQ.exe 5932 OYOF.exe 5932 OYOF.exe 4500 IMTONL.exe 4500 IMTONL.exe 6036 DZY.exe 6036 DZY.exe 1872 JZGLG.exe 1872 JZGLG.exe 2456 BCJHLDX.exe 2456 BCJHLDX.exe 5788 NVM.exe 5788 NVM.exe 6020 SVUODN.exe 6020 SVUODN.exe 5384 WDB.exe 5384 WDB.exe 3996 OMDB.exe 3996 OMDB.exe 1300 IZIKDC.exe 1300 IZIKDC.exe 1220 XURP.exe 1220 XURP.exe 2016 JMUHW.exe 2016 JMUHW.exe 5392 XSSEDGK.exe 5392 XSSEDGK.exe 5388 YVWA.exe 5388 YVWA.exe 5076 HVYNU.exe 5076 HVYNU.exe 3376 NWFBDEX.exe 3376 NWFBDEX.exe 1540 IJKK.exe 1540 IJKK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5556 2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe 5556 2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe 1244 NJCHC.exe 1244 NJCHC.exe 2480 WHXIW.exe 2480 WHXIW.exe 1856 VRM.exe 1856 VRM.exe 5004 UCPGOYB.exe 5004 UCPGOYB.exe 4136 OXTP.exe 4136 OXTP.exe 2036 BAKOMBL.exe 2036 BAKOMBL.exe 3340 RQLFL.exe 3340 RQLFL.exe 3324 MBT.exe 3324 MBT.exe 4208 HOYNK.exe 4208 HOYNK.exe 4684 HCYCL.exe 4684 HCYCL.exe 4896 MCG.exe 4896 MCG.exe 3512 FXKLI.exe 3512 FXKLI.exe 2244 USTYTRY.exe 2244 USTYTRY.exe 1960 GLWQ.exe 1960 GLWQ.exe 5932 OYOF.exe 5932 OYOF.exe 4500 IMTONL.exe 4500 IMTONL.exe 6036 DZY.exe 6036 DZY.exe 1872 JZGLG.exe 1872 JZGLG.exe 2456 BCJHLDX.exe 2456 BCJHLDX.exe 5788 NVM.exe 5788 NVM.exe 6020 SVUODN.exe 6020 SVUODN.exe 5384 WDB.exe 5384 WDB.exe 3996 OMDB.exe 3996 OMDB.exe 1300 IZIKDC.exe 1300 IZIKDC.exe 1220 XURP.exe 1220 XURP.exe 2016 JMUHW.exe 2016 JMUHW.exe 5392 XSSEDGK.exe 5392 XSSEDGK.exe 5388 YVWA.exe 5388 YVWA.exe 5076 HVYNU.exe 5076 HVYNU.exe 3376 NWFBDEX.exe 3376 NWFBDEX.exe 1540 IJKK.exe 1540 IJKK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5556 wrote to memory of 2372 5556 2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe 90 PID 2372 wrote to memory of 1244 2372 cmd.exe 94 PID 1244 wrote to memory of 3984 1244 NJCHC.exe 96 PID 3984 wrote to memory of 2480 3984 cmd.exe 100 PID 2480 wrote to memory of 4268 2480 WHXIW.exe 101 PID 4268 wrote to memory of 1856 4268 cmd.exe 105 PID 1856 wrote to memory of 2676 1856 VRM.exe 106 PID 2676 wrote to memory of 5004 2676 cmd.exe 110 PID 5004 wrote to memory of 1276 5004 UCPGOYB.exe 111 PID 1276 wrote to memory of 4136 1276 cmd.exe 115 PID 4136 wrote to memory of 1272 4136 OXTP.exe 116 PID 1272 wrote to memory of 2036 1272 cmd.exe 120 PID 2036 wrote to memory of 4312 2036 BAKOMBL.exe 121 PID 4312 wrote to memory of 3340 4312 cmd.exe 125 PID 3340 wrote to memory of 2968 3340 RQLFL.exe 126 PID 2968 wrote to memory of 3324 2968 cmd.exe 130 PID 3324 wrote to memory of 5356 3324 MBT.exe 131 PID 5356 wrote to memory of 4208 5356 cmd.exe 135 PID 4208 wrote to memory of 2532 4208 HOYNK.exe 136 PID 2532 wrote to memory of 4684 2532 cmd.exe 140 PID 4684 wrote to memory of 1716 4684 HCYCL.exe 141 PID 1716 wrote to memory of 4896 1716 cmd.exe 145 PID 4896 wrote to memory of 4264 4896 MCG.exe 146 PID 4264 wrote to memory of 3512 4264 cmd.exe 150 PID 3512 wrote to memory of 5760 3512 FXKLI.exe 151 PID 5760 wrote to memory of 2244 5760 cmd.exe 155 PID 2244 wrote to memory of 2632 2244 USTYTRY.exe 156 PID 2632 wrote to memory of 1960 2632 cmd.exe 160 PID 1960 wrote to memory of 2932 1960 GLWQ.exe 161 PID 2932 wrote to memory of 5932 2932 cmd.exe 165 PID 5932 wrote to memory of 2092 5932 OYOF.exe 166 PID 2092 wrote to memory of 4500 2092 cmd.exe 170 PID 4500 wrote to memory of 1044 4500 IMTONL.exe 171 PID 1044 wrote to memory of 6036 1044 cmd.exe 175 PID 6036 wrote to memory of 2876 6036 DZY.exe 176 PID 2876 wrote to memory of 1872 2876 cmd.exe 180 PID 1872 wrote to memory of 2360 1872 JZGLG.exe 181 PID 2360 wrote to memory of 2456 2360 cmd.exe 185 PID 2456 wrote to memory of 2784 2456 BCJHLDX.exe 186 PID 2784 wrote to memory of 5788 2784 cmd.exe 190 PID 5788 wrote to memory of 4744 5788 NVM.exe 191 PID 4744 wrote to memory of 6020 4744 cmd.exe 195 PID 6020 wrote to memory of 5292 6020 SVUODN.exe 196 PID 5292 wrote to memory of 5384 5292 cmd.exe 200 PID 5384 wrote to memory of 2528 5384 WDB.exe 201 PID 2528 wrote to memory of 3996 2528 cmd.exe 205 PID 3996 wrote to memory of 5212 3996 OMDB.exe 206 PID 5212 wrote to memory of 1300 5212 cmd.exe 210 PID 1300 wrote to memory of 4628 1300 IZIKDC.exe 211 PID 4628 wrote to memory of 1220 4628 cmd.exe 215 PID 1220 wrote to memory of 5564 1220 XURP.exe 216 PID 5564 wrote to memory of 2016 5564 cmd.exe 220 PID 2016 wrote to memory of 3104 2016 JMUHW.exe 221 PID 3104 wrote to memory of 5392 3104 cmd.exe 225 PID 5392 wrote to memory of 5352 5392 XSSEDGK.exe 226 PID 5352 wrote to memory of 5388 5352 cmd.exe 230 PID 5388 wrote to memory of 4676 5388 YVWA.exe 231 PID 4676 wrote to memory of 5076 4676 cmd.exe 235 PID 5076 wrote to memory of 6100 5076 HVYNU.exe 236 PID 6100 wrote to memory of 3376 6100 cmd.exe 240 PID 3376 wrote to memory of 4468 3376 NWFBDEX.exe 241 PID 4468 wrote to memory of 1540 4468 cmd.exe 245 PID 1540 wrote to memory of 3748 1540 IJKK.exe 246 PID 3748 wrote to memory of 848 3748 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_f07fa5f07c589596cad9b5a46115f31b_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJCHC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\SysWOW64\NJCHC.exeC:\windows\system32\NJCHC.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WHXIW.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\windows\system\WHXIW.exeC:\windows\system\WHXIW.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRM.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\VRM.exeC:\windows\VRM.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UCPGOYB.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\system\UCPGOYB.exeC:\windows\system\UCPGOYB.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXTP.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\windows\SysWOW64\OXTP.exeC:\windows\system32\OXTP.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BAKOMBL.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\windows\BAKOMBL.exeC:\windows\BAKOMBL.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQLFL.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\SysWOW64\RQLFL.exeC:\windows\system32\RQLFL.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MBT.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\windows\MBT.exeC:\windows\MBT.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOYNK.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\SysWOW64\HOYNK.exeC:\windows\system32\HOYNK.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HCYCL.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\windows\SysWOW64\HCYCL.exeC:\windows\system32\HCYCL.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MCG.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\windows\MCG.exeC:\windows\MCG.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXKLI.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\windows\system\FXKLI.exeC:\windows\system\FXKLI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USTYTRY.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\windows\USTYTRY.exeC:\windows\USTYTRY.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GLWQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\SysWOW64\GLWQ.exeC:\windows\system32\GLWQ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OYOF.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\windows\OYOF.exeC:\windows\OYOF.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMTONL.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\windows\SysWOW64\IMTONL.exeC:\windows\system32\IMTONL.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DZY.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\windows\system\DZY.exeC:\windows\system\DZY.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JZGLG.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\windows\SysWOW64\JZGLG.exeC:\windows\system32\JZGLG.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCJHLDX.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\BCJHLDX.exeC:\windows\BCJHLDX.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NVM.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\windows\NVM.exeC:\windows\NVM.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SVUODN.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\windows\system\SVUODN.exeC:\windows\system\SVUODN.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDB.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\windows\WDB.exeC:\windows\WDB.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMDB.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\windows\OMDB.exeC:\windows\OMDB.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZIKDC.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\windows\IZIKDC.exeC:\windows\IZIKDC.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XURP.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\windows\XURP.exeC:\windows\XURP.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMUHW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\windows\SysWOW64\JMUHW.exeC:\windows\system32\JMUHW.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSSEDGK.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\windows\system\XSSEDGK.exeC:\windows\system\XSSEDGK.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YVWA.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\windows\SysWOW64\YVWA.exeC:\windows\system32\YVWA.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVYNU.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\system\HVYNU.exeC:\windows\system\HVYNU.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWFBDEX.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\windows\SysWOW64\NWFBDEX.exeC:\windows\system32\NWFBDEX.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJKK.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\system\IJKK.exeC:\windows\system\IJKK.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QXKZP.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\windows\QXKZP.exeC:\windows\QXKZP.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FSU.exe.bat" "66⤵
- Executes a command shell one-liner
PID:4540 -
C:\windows\system\FSU.exeC:\windows\system\FSU.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXZA.exe.bat" "68⤵PID:5316
-
C:\windows\SysWOW64\TXZA.exeC:\windows\system32\TXZA.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDSPQ.exe.bat" "70⤵PID:1144
-
C:\windows\BDSPQ.exeC:\windows\BDSPQ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QIXEX.exe.bat" "72⤵PID:3368
-
C:\windows\QIXEX.exeC:\windows\QIXEX.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWCVIBD.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4196 -
C:\windows\SysWOW64\LWCVIBD.exeC:\windows\system32\LWCVIBD.exe75⤵
- Executes dropped EXE
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZGRN.exe.bat" "76⤵PID:124
-
C:\windows\system\LZGRN.exeC:\windows\system\LZGRN.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CERJDO.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5872 -
C:\windows\SysWOW64\CERJDO.exeC:\windows\system32\CERJDO.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHUFI.exe.bat" "80⤵PID:1052
-
C:\windows\VHUFI.exeC:\windows\VHUFI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNACP.exe.bat" "82⤵PID:3616
-
C:\windows\SNACP.exeC:\windows\SNACP.exe83⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KQEF.exe.bat" "84⤵PID:3296
-
C:\windows\KQEF.exeC:\windows\KQEF.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SVEU.exe.bat" "86⤵PID:2796
-
C:\windows\system\SVEU.exeC:\windows\system\SVEU.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HQOYPDR.exe.bat" "88⤵PID:880
-
C:\windows\SysWOW64\HQOYPDR.exeC:\windows\system32\HQOYPDR.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CDSI.exe.bat" "90⤵
- Executes a command shell one-liner
PID:6132 -
C:\windows\SysWOW64\CDSI.exeC:\windows\system32\CDSI.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRXRKD.exe.bat" "92⤵
- Executes a command shell one-liner
PID:428 -
C:\windows\system\XRXRKD.exeC:\windows\system\XRXRKD.exe93⤵
- Executes dropped EXE
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJSKKSJ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4892 -
C:\windows\IJSKKSJ.exeC:\windows\IJSKKSJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKAY.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:4916 -
C:\windows\system\OKAY.exeC:\windows\system\OKAY.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXAMD.exe.bat" "98⤵PID:5108
-
C:\windows\OXAMD.exeC:\windows\OXAMD.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSEQIPP.exe.bat" "100⤵
- Executes a command shell one-liner
PID:568 -
C:\windows\GSEQIPP.exeC:\windows\GSEQIPP.exe101⤵
- Executes dropped EXE
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JOJZ.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:5492 -
C:\windows\system\JOJZ.exeC:\windows\system\JOJZ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOQNBR.exe.bat" "104⤵PID:4424
-
C:\windows\HOQNBR.exeC:\windows\HOQNBR.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLWCIT.exe.bat" "106⤵PID:3116
-
C:\windows\DLWCIT.exeC:\windows\DLWCIT.exe107⤵
- Executes dropped EXE
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUYP.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5064 -
C:\windows\VUYP.exeC:\windows\VUYP.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GMTIU.exe.bat" "110⤵PID:6128
-
C:\windows\SysWOW64\GMTIU.exeC:\windows\system32\GMTIU.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PAESKD.exe.bat" "112⤵PID:2052
-
C:\windows\PAESKD.exeC:\windows\PAESKD.exe113⤵
- Executes dropped EXE
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXJ.exe.bat" "114⤵PID:4764
-
C:\windows\MXJ.exeC:\windows\MXJ.exe115⤵
- Executes dropped EXE
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XQMIZUW.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3744 -
C:\windows\system\XQMIZUW.exeC:\windows\system\XQMIZUW.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOGKGRM.exe.bat" "118⤵PID:1664
-
C:\windows\system\ZOGKGRM.exeC:\windows\system\ZOGKGRM.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBQCV.exe.bat" "120⤵PID:3956
-
C:\windows\system\IBQCV.exeC:\windows\system\IBQCV.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-