Analysis
- max time kernel
57s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe
- Size 208KB
- Sample261017-bthlfat1dv
- SHA256 3defb4e2ec83554d680824c3cf92341d8197933769c83cebf7c80c9e911ec05f
- MD5 fd1b68b0c7f8fc4a6190d94da53d00dd
- SHA1 c55ba5152023c50058945113f4867b7fdf8e3659
- SHA512 e4a9dd4a337ef4c78cfdf432efbf4959b6b542ed8ef31caf8f67f4048a0d7a58d03c128bba15e598b035a66757486b9098b465df9627e3761ee84940638c4dfc
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOf04pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LO8kEj1
- TLSH T1BD247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5996 USVWP.exe 1092 LLL.exe 264 GYQUI.exe 5612 VWEEYLY.exe 5112 WRHH.exe 2480 QMMRNB.exe 4908 FHWV.exe 1880 ESG.exe 5892 XVKPMR.exe 4616 DWSDDUW.exe 5304 XJXM.exe 1104 SWBVQ.exe 3728 FCBH.exe 296 JKI.exe 6120 BSKU.exe 3284 QNTZAHH.exe 4484 KBYI.exe 4480 DECMQX.exe 2412 UEER.exe 3508 YULRGVW.exe 4740 ISYL.exe 2100 BNC.exe 3004 SVEU.exe 984 LYIQKG.exe 1544 FMN.exe 2136 JUTHGZU.exe 2704 MHYQ.exe 1364 FKCMWO.exe 1484 ZXH.exe 4772 QKROOL.exe 5504 JNV.exe 2824 EBAB.exe 5316 KWZCI.exe 3752 ZRJ.exe 6020 ZXJCDD.exe 4668 DNP.exe 3540 WFKV.exe 1228 ANZVCVE.exe 5668 EDGD.exe 2692 GTZXM.exe 5648 ERS.exe 5208 ZEPKR.exe 1348 ZKPYTU.exe 4680 LAW.exe 3780 WSZR.exe 4588 PWCVTK.exe 3712 VWK.exe 5464 EWMOF.exe 6024 ZJRXQKE.exe 4572 EKZL.exe 1180 FNCGEC.exe 3424 JVJOQ.exe 1240 CYNKEKM.exe 2252 IYUY.exe 4972 CLZPXM.exe 5856 IHYQUPS.exe 4564 OHGE.exe 1448 UHORUL.exe 4900 DQQ.exe 3396 YDUGH.exe 704 UJSDPT.exe 2788 YRZD.exe 5404 TEEUL.exe 2256 WZJENKN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ZRJ.exe KWZCI.exe File created C:\windows\SysWOW64\ZRJ.exe.bat KWZCI.exe File created C:\windows\SysWOW64\EDGD.exe ANZVCVE.exe File created C:\windows\SysWOW64\ZEPKR.exe ERS.exe File opened for modification C:\windows\SysWOW64\VWK.exe PWCVTK.exe File created C:\windows\SysWOW64\VWK.exe.bat PWCVTK.exe File created C:\windows\SysWOW64\DDW.exe YDOFEYQ.exe File created C:\windows\SysWOW64\USVWP.exe 2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\XJXM.exe DWSDDUW.exe File created C:\windows\SysWOW64\ISYL.exe YULRGVW.exe File opened for modification C:\windows\SysWOW64\ZRJ.exe KWZCI.exe File opened for modification C:\windows\SysWOW64\WFKV.exe DNP.exe File opened for modification C:\windows\SysWOW64\EDGD.exe ANZVCVE.exe File created C:\windows\SysWOW64\EDGD.exe.bat ANZVCVE.exe File created C:\windows\SysWOW64\VWK.exe PWCVTK.exe File created C:\windows\SysWOW64\UEER.exe.bat DECMQX.exe File opened for modification C:\windows\SysWOW64\ACOB.exe MWJEIHL.exe File opened for modification C:\windows\SysWOW64\JUTHGZU.exe FMN.exe File opened for modification C:\windows\SysWOW64\ZXJCDD.exe ZRJ.exe File opened for modification C:\windows\SysWOW64\EWMOF.exe VWK.exe File opened for modification C:\windows\SysWOW64\CSFCW.exe HFA.exe File opened for modification C:\windows\SysWOW64\ISYL.exe YULRGVW.exe File created C:\windows\SysWOW64\QKROOL.exe ZXH.exe File opened for modification C:\windows\SysWOW64\DNP.exe ZXJCDD.exe File created C:\windows\SysWOW64\WFKV.exe DNP.exe File opened for modification C:\windows\SysWOW64\DDW.exe YDOFEYQ.exe File created C:\windows\SysWOW64\DNP.exe ZXJCDD.exe File created C:\windows\SysWOW64\WFKV.exe.bat DNP.exe File created C:\windows\SysWOW64\JNV.exe.bat QKROOL.exe File created C:\windows\SysWOW64\ZXJCDD.exe ZRJ.exe File created C:\windows\SysWOW64\ZXJCDD.exe.bat ZRJ.exe File created C:\windows\SysWOW64\ZEPKR.exe.bat ERS.exe File created C:\windows\SysWOW64\CYNKEKM.exe JVJOQ.exe File created C:\windows\SysWOW64\WSZR.exe LAW.exe File opened for modification C:\windows\SysWOW64\USVWP.exe 2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe File created C:\windows\SysWOW64\VWEEYLY.exe GYQUI.exe File opened for modification C:\windows\SysWOW64\QKROOL.exe ZXH.exe File created C:\windows\SysWOW64\LAW.exe.bat ZKPYTU.exe File created C:\windows\SysWOW64\HFA.exe QSP.exe File created C:\windows\SysWOW64\XJXM.exe DWSDDUW.exe File opened for modification C:\windows\SysWOW64\WSZR.exe LAW.exe File created C:\windows\SysWOW64\EWMOF.exe VWK.exe File created C:\windows\SysWOW64\CSFCW.exe HFA.exe File created C:\windows\SysWOW64\VWEEYLY.exe.bat GYQUI.exe File opened for modification C:\windows\SysWOW64\UEER.exe DECMQX.exe File opened for modification C:\windows\SysWOW64\LAW.exe ZKPYTU.exe File created C:\windows\SysWOW64\DDW.exe.bat YDOFEYQ.exe File opened for modification C:\windows\SysWOW64\HFA.exe QSP.exe File created C:\windows\SysWOW64\ISYL.exe.bat YULRGVW.exe File created C:\windows\SysWOW64\DNP.exe.bat ZXJCDD.exe File created C:\windows\SysWOW64\EWMOF.exe.bat VWK.exe File created C:\windows\SysWOW64\ACOB.exe.bat MWJEIHL.exe File opened for modification C:\windows\SysWOW64\ZEPKR.exe ERS.exe File created C:\windows\SysWOW64\LAW.exe ZKPYTU.exe File created C:\windows\SysWOW64\HFA.exe.bat QSP.exe File created C:\windows\SysWOW64\USVWP.exe.bat 2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe File created C:\windows\SysWOW64\UEER.exe DECMQX.exe File created C:\windows\SysWOW64\WSZR.exe.bat LAW.exe File opened for modification C:\windows\SysWOW64\CYNKEKM.exe JVJOQ.exe File created C:\windows\SysWOW64\CYNKEKM.exe.bat JVJOQ.exe File created C:\windows\SysWOW64\ACOB.exe MWJEIHL.exe File created C:\windows\SysWOW64\CSFCW.exe.bat HFA.exe File opened for modification C:\windows\SysWOW64\VWEEYLY.exe GYQUI.exe File created C:\windows\SysWOW64\XJXM.exe.bat DWSDDUW.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\QSP.exe ACOB.exe File opened for modification C:\windows\system\FHWV.exe QMMRNB.exe File opened for modification C:\windows\system\JKI.exe FCBH.exe File opened for modification C:\windows\QNTZAHH.exe BSKU.exe File created C:\windows\YULRGVW.exe.bat UEER.exe File created C:\windows\MHYQ.exe.bat JUTHGZU.exe File created C:\windows\GTZXM.exe.bat EDGD.exe File created C:\windows\EKZL.exe ZJRXQKE.exe File opened for modification C:\windows\UJSDPT.exe YDUGH.exe File created C:\windows\LLL.exe USVWP.exe File created C:\windows\IHYQUPS.exe CLZPXM.exe File created C:\windows\system\OHGE.exe IHYQUPS.exe File opened for modification C:\windows\YRZD.exe UJSDPT.exe File created C:\windows\system\FZLJ.exe WZJENKN.exe File created C:\windows\YQBK.exe DDW.exe File created C:\windows\MWJEIHL.exe.bat BDGTIA.exe File created C:\windows\system\XVKPMR.exe.bat ESG.exe File created C:\windows\system\JKI.exe.bat FCBH.exe File opened for modification C:\windows\system\YDUGH.exe DQQ.exe File created C:\windows\system\WZJENKN.exe TEEUL.exe File created C:\windows\QMMRNB.exe WRHH.exe File created C:\windows\QMMRNB.exe.bat WRHH.exe File opened for modification C:\windows\system\ESG.exe FHWV.exe File created C:\windows\YULRGVW.exe UEER.exe File created C:\windows\system\OHGE.exe.bat IHYQUPS.exe File created C:\windows\TEEUL.exe.bat YRZD.exe File created C:\windows\ANZVCVE.exe.bat WFKV.exe File opened for modification C:\windows\EKZL.exe ZJRXQKE.exe File opened for modification C:\windows\JVJOQ.exe FNCGEC.exe File created C:\windows\LLL.exe.bat USVWP.exe File created C:\windows\QNTZAHH.exe BSKU.exe File created C:\windows\system\FMN.exe.bat LYIQKG.exe File opened for modification C:\windows\system\FNCGEC.exe EKZL.exe File created C:\windows\system\BNC.exe.bat ISYL.exe File created C:\windows\system\SWBVQ.exe XJXM.exe File opened for modification C:\windows\QMMRNB.exe WRHH.exe File opened for modification C:\windows\system\EBAB.exe JNV.exe File created C:\windows\system\ERS.exe.bat GTZXM.exe File opened for modification C:\windows\system\YDOFEYQ.exe FZLJ.exe File created C:\windows\system\YDOFEYQ.exe.bat FZLJ.exe File opened for modification C:\windows\system\FMN.exe LYIQKG.exe File opened for modification C:\windows\system\ZXH.exe FKCMWO.exe File created C:\windows\IYUY.exe.bat CYNKEKM.exe File opened for modification C:\windows\system\UHORUL.exe OHGE.exe File opened for modification C:\windows\TEEUL.exe YRZD.exe File opened for modification C:\windows\system\DECMQX.exe KBYI.exe File opened for modification C:\windows\system\ZKPYTU.exe ZEPKR.exe File created C:\windows\IYUY.exe CYNKEKM.exe File created C:\windows\system\SWBVQ.exe.bat XJXM.exe File created C:\windows\system\DECMQX.exe KBYI.exe File created C:\windows\system\FZLJ.exe.bat WZJENKN.exe File created C:\windows\WRHH.exe VWEEYLY.exe File opened for modification C:\windows\BSKU.exe JKI.exe File opened for modification C:\windows\system\KBYI.exe QNTZAHH.exe File opened for modification C:\windows\IHYQUPS.exe CLZPXM.exe File created C:\windows\system\KWZCI.exe.bat EBAB.exe File opened for modification C:\windows\ANZVCVE.exe WFKV.exe File created C:\windows\PWCVTK.exe.bat WSZR.exe File created C:\windows\system\FNCGEC.exe.bat EKZL.exe File created C:\windows\JVJOQ.exe FNCGEC.exe File created C:\windows\system\YDUGH.exe.bat DQQ.exe File opened for modification C:\windows\YQBK.exe DDW.exe File created C:\windows\YQBK.exe.bat DDW.exe File opened for modification C:\windows\WRHH.exe VWEEYLY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5008 cmd.exe 5572 cmd.exe 2312 cmd.exe 5332 cmd.exe 2568 cmd.exe 3252 cmd.exe 1060 cmd.exe 2688 cmd.exe 5536 cmd.exe 980 cmd.exe 1652 cmd.exe 5228 cmd.exe 2244 cmd.exe 200 cmd.exe 6036 cmd.exe 3588 cmd.exe 5904 cmd.exe 4236 cmd.exe 5656 cmd.exe 5724 cmd.exe 3684 cmd.exe 1080 cmd.exe 2744 cmd.exe 1132 cmd.exe 3580 cmd.exe 1948 cmd.exe 4952 cmd.exe 2808 cmd.exe 1900 cmd.exe 4792 cmd.exe 576 cmd.exe 1108 cmd.exe 2020 cmd.exe 748 cmd.exe 4860 cmd.exe 1156 cmd.exe 5868 cmd.exe 4172 cmd.exe 5608 cmd.exe 5500 cmd.exe 2420 cmd.exe 2192 cmd.exe 4736 cmd.exe 1112 cmd.exe 4724 cmd.exe 2780 cmd.exe 4048 cmd.exe 1916 cmd.exe 5820 cmd.exe 4624 cmd.exe 2936 cmd.exe 5872 cmd.exe 3876 cmd.exe 4816 cmd.exe 4556 cmd.exe 4264 cmd.exe 4472 cmd.exe 3476 cmd.exe 4208 cmd.exe 1952 cmd.exe 5064 cmd.exe 2636 cmd.exe 5548 cmd.exe 1252 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2516 3196 WerFault.exe 87 4668 5996 WerFault.exe 92 5920 1092 WerFault.exe 98 5132 264 WerFault.exe 104 3188 5612 WerFault.exe 109 1404 5112 WerFault.exe 114 4368 2480 WerFault.exe 119 6008 4908 WerFault.exe 124 1568 1880 WerFault.exe 129 3364 5892 WerFault.exe 134 5316 4616 WerFault.exe 139 2868 5304 WerFault.exe 144 3564 1104 WerFault.exe 149 2636 3728 WerFault.exe 154 4760 296 WerFault.exe 159 3088 6120 WerFault.exe 164 3148 3284 WerFault.exe 169 2816 4484 WerFault.exe 174 4268 4480 WerFault.exe 179 5504 2412 WerFault.exe 184 2824 3508 WerFault.exe 189 4244 4740 WerFault.exe 194 3340 2100 WerFault.exe 199 4500 3004 WerFault.exe 204 5856 984 WerFault.exe 209 5132 1544 WerFault.exe 214 5948 2136 WerFault.exe 219 4984 2704 WerFault.exe 224 1832 1364 WerFault.exe 229 1180 1484 WerFault.exe 234 5296 4772 WerFault.exe 239 1240 5504 WerFault.exe 244 4632 2824 WerFault.exe 249 2148 5316 WerFault.exe 254 3252 3752 WerFault.exe 259 3348 6020 WerFault.exe 264 2556 4668 WerFault.exe 269 3392 3540 WerFault.exe 274 4416 1228 WerFault.exe 280 3396 5668 WerFault.exe 284 1568 2692 WerFault.exe 290 3380 5648 WerFault.exe 295 828 5208 WerFault.exe 300 4144 1348 WerFault.exe 305 4492 4680 WerFault.exe 310 3012 3780 WerFault.exe 315 1932 4588 WerFault.exe 320 1216 3712 WerFault.exe 325 3084 5464 WerFault.exe 330 2292 6024 WerFault.exe 335 4260 4572 WerFault.exe 340 3856 1180 WerFault.exe 345 5988 3424 WerFault.exe 350 5596 1240 WerFault.exe 355 1336 2252 WerFault.exe 360 5792 4972 WerFault.exe 365 3764 5856 WerFault.exe 370 5172 4564 WerFault.exe 375 4968 1448 WerFault.exe 380 5836 4900 WerFault.exe 385 5128 3396 WerFault.exe 390 1204 704 WerFault.exe 395 4212 2788 WerFault.exe 400 4560 5404 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XJXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMMRNB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUTHGZU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVJOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BSKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTZXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWCVTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OHGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDUGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNTZAHH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYIQKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWMOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANZVCVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECMQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKCMWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEEUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UHORUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3196 2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe 3196 2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe 5996 USVWP.exe 5996 USVWP.exe 1092 LLL.exe 1092 LLL.exe 264 GYQUI.exe 264 GYQUI.exe 5612 VWEEYLY.exe 5612 VWEEYLY.exe 5112 WRHH.exe 5112 WRHH.exe 2480 QMMRNB.exe 2480 QMMRNB.exe 4908 FHWV.exe 4908 FHWV.exe 1880 ESG.exe 1880 ESG.exe 5892 XVKPMR.exe 5892 XVKPMR.exe 4616 DWSDDUW.exe 4616 DWSDDUW.exe 5304 XJXM.exe 5304 XJXM.exe 1104 SWBVQ.exe 1104 SWBVQ.exe 3728 FCBH.exe 3728 FCBH.exe 296 JKI.exe 296 JKI.exe 6120 BSKU.exe 6120 BSKU.exe 3284 QNTZAHH.exe 3284 QNTZAHH.exe 4484 KBYI.exe 4484 KBYI.exe 4480 DECMQX.exe 4480 DECMQX.exe 2412 UEER.exe 2412 UEER.exe 3508 YULRGVW.exe 3508 YULRGVW.exe 4740 ISYL.exe 4740 ISYL.exe 2100 BNC.exe 2100 BNC.exe 3004 SVEU.exe 3004 SVEU.exe 984 LYIQKG.exe 984 LYIQKG.exe 1544 FMN.exe 1544 FMN.exe 2136 JUTHGZU.exe 2136 JUTHGZU.exe 2704 MHYQ.exe 2704 MHYQ.exe 1364 FKCMWO.exe 1364 FKCMWO.exe 1484 ZXH.exe 1484 ZXH.exe 4772 QKROOL.exe 4772 QKROOL.exe 5504 JNV.exe 5504 JNV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3196 2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe 3196 2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe 5996 USVWP.exe 5996 USVWP.exe 1092 LLL.exe 1092 LLL.exe 264 GYQUI.exe 264 GYQUI.exe 5612 VWEEYLY.exe 5612 VWEEYLY.exe 5112 WRHH.exe 5112 WRHH.exe 2480 QMMRNB.exe 2480 QMMRNB.exe 4908 FHWV.exe 4908 FHWV.exe 1880 ESG.exe 1880 ESG.exe 5892 XVKPMR.exe 5892 XVKPMR.exe 4616 DWSDDUW.exe 4616 DWSDDUW.exe 5304 XJXM.exe 5304 XJXM.exe 1104 SWBVQ.exe 1104 SWBVQ.exe 3728 FCBH.exe 3728 FCBH.exe 296 JKI.exe 296 JKI.exe 6120 BSKU.exe 6120 BSKU.exe 3284 QNTZAHH.exe 3284 QNTZAHH.exe 4484 KBYI.exe 4484 KBYI.exe 4480 DECMQX.exe 4480 DECMQX.exe 2412 UEER.exe 2412 UEER.exe 3508 YULRGVW.exe 3508 YULRGVW.exe 4740 ISYL.exe 4740 ISYL.exe 2100 BNC.exe 2100 BNC.exe 3004 SVEU.exe 3004 SVEU.exe 984 LYIQKG.exe 984 LYIQKG.exe 1544 FMN.exe 1544 FMN.exe 2136 JUTHGZU.exe 2136 JUTHGZU.exe 2704 MHYQ.exe 2704 MHYQ.exe 1364 FKCMWO.exe 1364 FKCMWO.exe 1484 ZXH.exe 1484 ZXH.exe 4772 QKROOL.exe 4772 QKROOL.exe 5504 JNV.exe 5504 JNV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3196 wrote to memory of 1080 3196 2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe 89 PID 1080 wrote to memory of 5996 1080 cmd.exe 92 PID 5996 wrote to memory of 4928 5996 USVWP.exe 95 PID 4928 wrote to memory of 1092 4928 cmd.exe 98 PID 1092 wrote to memory of 4608 1092 LLL.exe 100 PID 4608 wrote to memory of 264 4608 cmd.exe 104 PID 264 wrote to memory of 6068 264 GYQUI.exe 105 PID 6068 wrote to memory of 5612 6068 cmd.exe 109 PID 5612 wrote to memory of 5848 5612 VWEEYLY.exe 110 PID 5848 wrote to memory of 5112 5848 cmd.exe 114 PID 5112 wrote to memory of 3400 5112 WRHH.exe 115 PID 3400 wrote to memory of 2480 3400 cmd.exe 119 PID 2480 wrote to memory of 5872 2480 QMMRNB.exe 120 PID 5872 wrote to memory of 4908 5872 cmd.exe 124 PID 4908 wrote to memory of 1948 4908 FHWV.exe 125 PID 1948 wrote to memory of 1880 1948 cmd.exe 129 PID 1880 wrote to memory of 1108 1880 ESG.exe 130 PID 1108 wrote to memory of 5892 1108 cmd.exe 134 PID 5892 wrote to memory of 2744 5892 XVKPMR.exe 135 PID 2744 wrote to memory of 4616 2744 cmd.exe 139 PID 4616 wrote to memory of 1156 4616 DWSDDUW.exe 140 PID 1156 wrote to memory of 5304 1156 cmd.exe 144 PID 5304 wrote to memory of 5656 5304 XJXM.exe 145 PID 5656 wrote to memory of 1104 5656 cmd.exe 149 PID 1104 wrote to memory of 1268 1104 SWBVQ.exe 150 PID 1268 wrote to memory of 3728 1268 cmd.exe 154 PID 3728 wrote to memory of 2132 3728 FCBH.exe 155 PID 2132 wrote to memory of 296 2132 cmd.exe 159 PID 296 wrote to memory of 5072 296 JKI.exe 160 PID 5072 wrote to memory of 6120 5072 cmd.exe 164 PID 6120 wrote to memory of 1112 6120 BSKU.exe 165 PID 1112 wrote to memory of 3284 1112 cmd.exe 169 PID 3284 wrote to memory of 2988 3284 QNTZAHH.exe 170 PID 2988 wrote to memory of 4484 2988 cmd.exe 174 PID 4484 wrote to memory of 5084 4484 KBYI.exe 175 PID 5084 wrote to memory of 4480 5084 cmd.exe 179 PID 4480 wrote to memory of 5624 4480 DECMQX.exe 180 PID 5624 wrote to memory of 2412 5624 cmd.exe 184 PID 2412 wrote to memory of 1796 2412 UEER.exe 185 PID 1796 wrote to memory of 3508 1796 cmd.exe 189 PID 3508 wrote to memory of 5868 3508 YULRGVW.exe 190 PID 5868 wrote to memory of 4740 5868 cmd.exe 194 PID 4740 wrote to memory of 4188 4740 ISYL.exe 195 PID 4188 wrote to memory of 2100 4188 cmd.exe 199 PID 2100 wrote to memory of 1116 2100 BNC.exe 200 PID 1116 wrote to memory of 3004 1116 cmd.exe 204 PID 3004 wrote to memory of 2020 3004 SVEU.exe 205 PID 2020 wrote to memory of 984 2020 cmd.exe 209 PID 984 wrote to memory of 2040 984 LYIQKG.exe 210 PID 2040 wrote to memory of 1544 2040 cmd.exe 214 PID 1544 wrote to memory of 3876 1544 FMN.exe 215 PID 3876 wrote to memory of 2136 3876 cmd.exe 219 PID 2136 wrote to memory of 3088 2136 JUTHGZU.exe 220 PID 3088 wrote to memory of 2704 3088 cmd.exe 224 PID 2704 wrote to memory of 5636 2704 MHYQ.exe 225 PID 5636 wrote to memory of 1364 5636 cmd.exe 229 PID 1364 wrote to memory of 3200 1364 FKCMWO.exe 230 PID 3200 wrote to memory of 1484 3200 cmd.exe 234 PID 1484 wrote to memory of 988 1484 ZXH.exe 235 PID 988 wrote to memory of 4772 988 cmd.exe 239 PID 4772 wrote to memory of 4724 4772 QKROOL.exe 240 PID 4724 wrote to memory of 5504 4724 cmd.exe 244 PID 5504 wrote to memory of 4076 5504 JNV.exe 245 PID 4076 wrote to memory of 2824 4076 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_fd1b68b0c7f8fc4a6190d94da53d00dd_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USVWP.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\windows\SysWOW64\USVWP.exeC:\windows\system32\USVWP.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LLL.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\windows\LLL.exeC:\windows\LLL.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYQUI.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\windows\system\GYQUI.exeC:\windows\system\GYQUI.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWEEYLY.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\SysWOW64\VWEEYLY.exeC:\windows\system32\VWEEYLY.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRHH.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\windows\WRHH.exeC:\windows\WRHH.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMMRNB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\QMMRNB.exeC:\windows\QMMRNB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FHWV.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\system\FHWV.exeC:\windows\system\FHWV.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESG.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\windows\system\ESG.exeC:\windows\system\ESG.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XVKPMR.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\windows\system\XVKPMR.exeC:\windows\system\XVKPMR.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWSDDUW.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\windows\system\DWSDDUW.exeC:\windows\system\DWSDDUW.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XJXM.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\windows\SysWOW64\XJXM.exeC:\windows\system32\XJXM.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SWBVQ.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\system\SWBVQ.exeC:\windows\system\SWBVQ.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCBH.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\windows\FCBH.exeC:\windows\FCBH.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JKI.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\windows\system\JKI.exeC:\windows\system\JKI.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BSKU.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\windows\BSKU.exeC:\windows\BSKU.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QNTZAHH.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\windows\QNTZAHH.exeC:\windows\QNTZAHH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KBYI.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\windows\system\KBYI.exeC:\windows\system\KBYI.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DECMQX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\windows\system\DECMQX.exeC:\windows\system\DECMQX.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UEER.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\SysWOW64\UEER.exeC:\windows\system32\UEER.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YULRGVW.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\windows\YULRGVW.exeC:\windows\YULRGVW.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ISYL.exe.bat" "42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\SysWOW64\ISYL.exeC:\windows\system32\ISYL.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNC.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\windows\system\BNC.exeC:\windows\system\BNC.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SVEU.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\system\SVEU.exeC:\windows\system\SVEU.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYIQKG.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\windows\system\LYIQKG.exeC:\windows\system\LYIQKG.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMN.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\system\FMN.exeC:\windows\system\FMN.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUTHGZU.exe.bat" "52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\windows\SysWOW64\JUTHGZU.exeC:\windows\system32\JUTHGZU.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHYQ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\windows\MHYQ.exeC:\windows\MHYQ.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKCMWO.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\windows\FKCMWO.exeC:\windows\FKCMWO.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZXH.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\windows\system\ZXH.exeC:\windows\system\ZXH.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKROOL.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:988 -
C:\windows\SysWOW64\QKROOL.exeC:\windows\system32\QKROOL.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNV.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\SysWOW64\JNV.exeC:\windows\system32\JNV.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBAB.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\system\EBAB.exeC:\windows\system\EBAB.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWZCI.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1132 -
C:\windows\system\KWZCI.exeC:\windows\system\KWZCI.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZRJ.exe.bat" "68⤵PID:4160
-
C:\windows\SysWOW64\ZRJ.exeC:\windows\system32\ZRJ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXJCDD.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\windows\SysWOW64\ZXJCDD.exeC:\windows\system32\ZXJCDD.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DNP.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4688 -
C:\windows\SysWOW64\DNP.exeC:\windows\system32\DNP.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFKV.exe.bat" "74⤵PID:3420
-
C:\windows\SysWOW64\WFKV.exeC:\windows\system32\WFKV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ANZVCVE.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2236 -
C:\windows\ANZVCVE.exeC:\windows\ANZVCVE.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EDGD.exe.bat" "78⤵PID:4312
-
C:\windows\SysWOW64\EDGD.exeC:\windows\system32\EDGD.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTZXM.exe.bat" "80⤵PID:5436
-
C:\windows\GTZXM.exeC:\windows\GTZXM.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ERS.exe.bat" "82⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4816 -
C:\windows\system\ERS.exeC:\windows\system\ERS.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZEPKR.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4172 -
C:\windows\SysWOW64\ZEPKR.exeC:\windows\system32\ZEPKR.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZKPYTU.exe.bat" "86⤵PID:4124
-
C:\windows\system\ZKPYTU.exeC:\windows\system\ZKPYTU.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LAW.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4952 -
C:\windows\SysWOW64\LAW.exeC:\windows\system32\LAW.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSZR.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4208 -
C:\windows\SysWOW64\WSZR.exeC:\windows\system32\WSZR.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWCVTK.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4864 -
C:\windows\PWCVTK.exeC:\windows\PWCVTK.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VWK.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5228 -
C:\windows\SysWOW64\VWK.exeC:\windows\system32\VWK.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWMOF.exe.bat" "96⤵
- Executes a command shell one-liner
PID:5332 -
C:\windows\SysWOW64\EWMOF.exeC:\windows\system32\EWMOF.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJRXQKE.exe.bat" "98⤵PID:4880
-
C:\windows\ZJRXQKE.exeC:\windows\ZJRXQKE.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EKZL.exe.bat" "100⤵PID:4856
-
C:\windows\EKZL.exeC:\windows\EKZL.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNCGEC.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5724 -
C:\windows\system\FNCGEC.exeC:\windows\system\FNCGEC.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVJOQ.exe.bat" "104⤵PID:4068
-
C:\windows\JVJOQ.exeC:\windows\JVJOQ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYNKEKM.exe.bat" "106⤵
- Executes a command shell one-liner
PID:748 -
C:\windows\SysWOW64\CYNKEKM.exeC:\windows\system32\CYNKEKM.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYUY.exe.bat" "108⤵PID:2084
-
C:\windows\IYUY.exeC:\windows\IYUY.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLZPXM.exe.bat" "110⤵PID:1760
-
C:\windows\system\CLZPXM.exeC:\windows\system\CLZPXM.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHYQUPS.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:368 -
C:\windows\IHYQUPS.exeC:\windows\IHYQUPS.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHGE.exe.bat" "114⤵PID:2444
-
C:\windows\system\OHGE.exeC:\windows\system\OHGE.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UHORUL.exe.bat" "116⤵PID:3564
-
C:\windows\system\UHORUL.exeC:\windows\system\UHORUL.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQQ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3100 -
C:\windows\system\DQQ.exeC:\windows\system\DQQ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDUGH.exe.bat" "120⤵
- Executes a command shell one-liner
PID:1952 -
C:\windows\system\YDUGH.exeC:\windows\system\YDUGH.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-