Analysis
- max time kernel
98s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 16:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_6ffda09f06b6fa0507cbe9826efb70d2_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-19_6ffda09f06b6fa0507cbe9826efb70d2_elex_emotet_stop.exe
- Size 208KB
- Sample261020-vcadaacd64
- SHA256 1b427537993fa03b6c180f919734ed955fbbe421e149c680342d92b907a8db46
- MD5 6ffda09f06b6fa0507cbe9826efb70d2
- SHA1 4d9e50ac80eeafd8697a3f2ee638abf818c74557
- SHA512 bfb15aa83e7876193f4652ed40df535facbc5d38be3da1f286a1eb9669e5341b4454bcf5c27a0a9c41fcbc9b9aafb43fc65b4a4d8bd4507d5e65d2493708f245
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlydL+LOfT4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFly5+LOrkEj1
- TLSH T149247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2916 OVJSB.exe 344 EEEWRY.exe 1160 SCEITKE.exe 5596 MXJA.exe 6076 QFPAPU.exe 3028 LSU.exe 3356 VQIDH.exe 3172 ZGO.exe 5712 OWPDSQ.exe 5124 SEW.exe 2604 NRBMP.exe 3712 PNFEZIH.exe 4328 KAKN.exe 5876 TAMSMGY.exe 2116 SYXNZL.exe 2620 MLCEKLU.exe 3240 HZHO.exe 5068 PEHCV.exe 3880 EHR.exe 5636 ENJ.exe 3532 ZAOFS.exe 4624 FBV.exe 3328 FGW.exe 5272 UJFLWR.exe 4404 YRM.exe 2548 SEQDK.exe 1732 ASRRUW.exe 4464 PNAV.exe 2640 OIZWJ.exe 1432 JLIVQ.exe 3236 STKABU.exe 6080 YUR.exe 4276 HUTBO.exe 2044 CHYKYT.exe 2680 VIOVHU.exe 2472 MII.exe 5400 KIPOC.exe 3140 CRRTFR.exe 5708 WEW.exe 4652 TKCZX.exe 5980 NXHJHBD.exe 3360 NIPKVFK.exe 3064 VVHZWSM.exe 124 HOKR.exe 5916 BBPBH.exe 3952 WOUKRZF.exe 940 AWBKD.exe 2756 FXIYMLD.exe 2688 PFK.exe 2624 JSPVA.exe 4892 PTXIJLV.exe 4444 MYVX.exe 3400 VYXKC.exe 4940 GRAVKH.exe 1340 CCIU.exe 5100 WPNDAK.exe 3704 IIQWJZG.exe 4540 NSMDOR.exe 3764 NVQYT.exe 1872 DQH.exe 2208 DWZR.exe 1720 ZCFO.exe 1608 KUIHD.exe 2080 CZT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\TDZAF.exe EIQWUIP.exe File opened for modification C:\windows\SysWOW64\AWBKD.exe WOUKRZF.exe File created C:\windows\SysWOW64\AWBKD.exe.bat WOUKRZF.exe File created C:\windows\SysWOW64\FXIYMLD.exe.bat AWBKD.exe File created C:\windows\SysWOW64\DQH.exe.bat NVQYT.exe File created C:\windows\SysWOW64\YKGTZA.exe.bat YPCY.exe File created C:\windows\SysWOW64\VIOVHU.exe CHYKYT.exe File created C:\windows\SysWOW64\PTXIJLV.exe.bat JSPVA.exe File opened for modification C:\windows\SysWOW64\YAB.exe QPS.exe File opened for modification C:\windows\SysWOW64\YJGXA.exe QDO.exe File opened for modification C:\windows\SysWOW64\PEHCV.exe HZHO.exe File created C:\windows\SysWOW64\MII.exe VIOVHU.exe File created C:\windows\SysWOW64\LEOZLH.exe ZLLGD.exe File created C:\windows\SysWOW64\HKMWSR.exe.bat LEOZLH.exe File created C:\windows\SysWOW64\WCU.exe WPT.exe File opened for modification C:\windows\SysWOW64\TKCZX.exe WEW.exe File opened for modification C:\windows\SysWOW64\NVQYT.exe NSMDOR.exe File created C:\windows\SysWOW64\MVU.exe VHKBA.exe File created C:\windows\SysWOW64\EBFYIMO.exe VOVGSPA.exe File created C:\windows\SysWOW64\VUYEEKC.exe TZTUU.exe File created C:\windows\SysWOW64\OWPDSQ.exe.bat ZGO.exe File created C:\windows\SysWOW64\JSPVA.exe PFK.exe File opened for modification C:\windows\SysWOW64\MVU.exe VHKBA.exe File created C:\windows\SysWOW64\JULMK.exe.bat RRHQES.exe File created C:\windows\SysWOW64\LDVPBYM.exe.bat RQYYQ.exe File created C:\windows\SysWOW64\EYJCZL.exe.bat PTMFSBI.exe File created C:\windows\SysWOW64\YJGXA.exe.bat QDO.exe File created C:\windows\SysWOW64\PNAV.exe ASRRUW.exe File created C:\windows\SysWOW64\FXIYMLD.exe AWBKD.exe File opened for modification C:\windows\SysWOW64\FXIYMLD.exe AWBKD.exe File created C:\windows\SysWOW64\HUTBO.exe.bat YUR.exe File opened for modification C:\windows\SysWOW64\JSPVA.exe PFK.exe File created C:\windows\SysWOW64\JULMK.exe RRHQES.exe File opened for modification C:\windows\SysWOW64\NTBZXH.exe SFWP.exe File opened for modification C:\windows\SysWOW64\PTXIJLV.exe JSPVA.exe File opened for modification C:\windows\SysWOW64\KUIHD.exe ZCFO.exe File created C:\windows\SysWOW64\NMYBLL.exe YJGXA.exe File created C:\windows\SysWOW64\HUTBO.exe YUR.exe File created C:\windows\SysWOW64\AWBKD.exe WOUKRZF.exe File created C:\windows\SysWOW64\MYVX.exe.bat PTXIJLV.exe File created C:\windows\SysWOW64\LEOZLH.exe.bat ZLLGD.exe File created C:\windows\SysWOW64\TZTUU.exe PRM.exe File created C:\windows\SysWOW64\NSIJZ.exe.bat PSB.exe File opened for modification C:\windows\SysWOW64\PNAV.exe ASRRUW.exe File created C:\windows\SysWOW64\DWZR.exe.bat DQH.exe File created C:\windows\SysWOW64\YAB.exe.bat QPS.exe File created C:\windows\SysWOW64\NTBZXH.exe.bat SFWP.exe File opened for modification C:\windows\SysWOW64\NSIJZ.exe PSB.exe File opened for modification C:\windows\SysWOW64\STI.exe NTBZXH.exe File created C:\windows\SysWOW64\STI.exe.bat NTBZXH.exe File created C:\windows\SysWOW64\DQH.exe NVQYT.exe File created C:\windows\SysWOW64\KUIHD.exe ZCFO.exe File created C:\windows\SysWOW64\IHF.exe IBF.exe File opened for modification C:\windows\SysWOW64\LEOZLH.exe ZLLGD.exe File opened for modification C:\windows\SysWOW64\TZTUU.exe PRM.exe File created C:\windows\SysWOW64\TZTUU.exe.bat PRM.exe File created C:\windows\SysWOW64\KSE.exe.bat VUYEEKC.exe File created C:\windows\SysWOW64\NTBZXH.exe SFWP.exe File created C:\windows\SysWOW64\MVU.exe.bat VHKBA.exe File created C:\windows\SysWOW64\SYIB.exe.bat STI.exe File created C:\windows\SysWOW64\NMYBLL.exe.bat YJGXA.exe File created C:\windows\SysWOW64\ZAOFS.exe ENJ.exe File created C:\windows\SysWOW64\SEQDK.exe.bat YRM.exe File opened for modification C:\windows\SysWOW64\DQH.exe NVQYT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\FLYUG.exe.bat LYT.exe File created C:\windows\NJBI.exe.bat QEVLLQB.exe File opened for modification C:\windows\system\IIQWJZG.exe WPNDAK.exe File created C:\windows\system\IIQWJZG.exe.bat WPNDAK.exe File created C:\windows\IBF.exe CBXLNBD.exe File opened for modification C:\windows\CKVV.exe TFK.exe File created C:\windows\system\EIQWUIP.exe.bat JULMK.exe File created C:\windows\WQERPDE.exe TDZAF.exe File opened for modification C:\windows\system\TCPHAYU.exe HKMWSR.exe File created C:\windows\system\VQIDH.exe LSU.exe File created C:\windows\PTMFSBI.exe.bat WAJMK.exe File opened for modification C:\windows\system\MDZHY.exe NSIJZ.exe File created C:\windows\system\BYLV.exe.bat EBFYIMO.exe File created C:\windows\FJXXLT.exe.bat GTM.exe File created C:\windows\FGW.exe FBV.exe File opened for modification C:\windows\NDYNZ.exe CKVV.exe File created C:\windows\system\HUKWU.exe.bat BYLV.exe File opened for modification C:\windows\system\VEWMFS.exe YZQPYQ.exe File created C:\windows\system\LSU.exe QFPAPU.exe File opened for modification C:\windows\OIZWJ.exe PNAV.exe File opened for modification C:\windows\system\EXLDT.exe EMDKN.exe File created C:\windows\system\QPS.exe.bat FXXMNGN.exe File created C:\windows\system\PSB.exe.bat VEWMFS.exe File opened for modification C:\windows\system\WMAG.exe NMYBLL.exe File created C:\windows\WQERPDE.exe.bat TDZAF.exe File created C:\windows\BBPBH.exe.bat HOKR.exe File created C:\windows\system\LYT.exe JAS.exe File created C:\windows\system\WMAG.exe.bat NMYBLL.exe File created C:\windows\system\NRBMP.exe.bat SEW.exe File created C:\windows\KIPOC.exe.bat MII.exe File created C:\windows\system\NSOS.exe.bat CZT.exe File created C:\windows\SFWP.exe.bat KSE.exe File opened for modification C:\windows\system\QTFHKHC.exe MDZHY.exe File created C:\windows\ZGO.exe VQIDH.exe File opened for modification C:\windows\ZGO.exe VQIDH.exe File created C:\windows\system\ASRRUW.exe SEQDK.exe File opened for modification C:\windows\JLIVQ.exe OIZWJ.exe File opened for modification C:\windows\CCIU.exe GRAVKH.exe File created C:\windows\system\ZCFO.exe DWZR.exe File created C:\windows\QFPAPU.exe.bat MXJA.exe File created C:\windows\system\VQIDH.exe.bat LSU.exe File created C:\windows\JLIVQ.exe.bat OIZWJ.exe File created C:\windows\PFK.exe.bat FXIYMLD.exe File created C:\windows\system\TCPHAYU.exe.bat HKMWSR.exe File opened for modification C:\windows\FJXXLT.exe GTM.exe File opened for modification C:\windows\system\FXXMNGN.exe FJXXLT.exe File created C:\windows\FGW.exe.bat FBV.exe File opened for modification C:\windows\system\ASRRUW.exe SEQDK.exe File opened for modification C:\windows\GRAVKH.exe VYXKC.exe File opened for modification C:\windows\system\NSOS.exe CZT.exe File created C:\windows\CKVV.exe.bat TFK.exe File created C:\windows\system\ZTFW.exe.bat NDYNZ.exe File opened for modification C:\windows\WQERPDE.exe TDZAF.exe File created C:\windows\system\ZLLGD.exe OTIN.exe File opened for modification C:\windows\VOVGSPA.exe EDEISV.exe File created C:\windows\system\FXXMNGN.exe.bat FJXXLT.exe File created C:\windows\VYXKC.exe.bat MYVX.exe File opened for modification C:\windows\system\VQIDH.exe LSU.exe File created C:\windows\system\NSMDOR.exe IIQWJZG.exe File created C:\windows\system\FXXMNGN.exe FJXXLT.exe File created C:\windows\system\PNFEZIH.exe.bat NRBMP.exe File created C:\windows\CCIU.exe.bat GRAVKH.exe File created C:\windows\system\EXLDT.exe EMDKN.exe File created C:\windows\VHKBA.exe.bat EXLDT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5540 cmd.exe 5868 cmd.exe 6132 cmd.exe 4232 cmd.exe 608 cmd.exe 6088 cmd.exe 4140 cmd.exe 5856 cmd.exe 480 cmd.exe 4684 cmd.exe 2912 cmd.exe 2676 cmd.exe 4556 cmd.exe 5544 cmd.exe 1632 cmd.exe 5536 cmd.exe 812 cmd.exe 5416 cmd.exe 2104 cmd.exe 3732 cmd.exe 1984 cmd.exe 252 cmd.exe 4080 cmd.exe 1540 cmd.exe 52 cmd.exe 108 cmd.exe 2976 cmd.exe 1364 cmd.exe 3376 cmd.exe 4368 cmd.exe 4536 cmd.exe 2908 cmd.exe 3420 cmd.exe 4976 cmd.exe 2500 cmd.exe 1284 cmd.exe 828 cmd.exe 1120 cmd.exe 260 cmd.exe 1936 cmd.exe 2244 cmd.exe 1100 cmd.exe 5260 cmd.exe 428 cmd.exe 5828 cmd.exe 2936 cmd.exe 4936 cmd.exe 5532 cmd.exe 3300 cmd.exe 4848 cmd.exe 5504 cmd.exe 4872 cmd.exe 4324 cmd.exe 5984 cmd.exe 2004 cmd.exe 5912 cmd.exe 1496 cmd.exe 1828 cmd.exe 6064 cmd.exe 2364 cmd.exe 3000 cmd.exe 1844 cmd.exe 3524 cmd.exe 4108 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1632 3472 WerFault.exe 89 3792 2916 WerFault.exe 94 5536 344 WerFault.exe 100 2616 1160 WerFault.exe 105 1184 5596 WerFault.exe 110 4308 6076 WerFault.exe 115 3120 3028 WerFault.exe 120 4284 3356 WerFault.exe 125 1000 3172 WerFault.exe 130 1392 5712 WerFault.exe 135 2220 5124 WerFault.exe 140 2264 2604 WerFault.exe 145 4228 3712 WerFault.exe 150 2080 4328 WerFault.exe 155 6132 5876 WerFault.exe 160 1120 2116 WerFault.exe 165 2912 2620 WerFault.exe 170 4964 3240 WerFault.exe 175 5936 5068 WerFault.exe 180 5772 3880 WerFault.exe 185 5344 5636 WerFault.exe 190 5664 3532 WerFault.exe 195 1136 4624 WerFault.exe 200 6056 3328 WerFault.exe 205 3956 5272 WerFault.exe 210 3448 4404 WerFault.exe 215 1052 2548 WerFault.exe 220 3140 1732 WerFault.exe 225 5520 4464 WerFault.exe 230 4872 2640 WerFault.exe 235 1428 1432 WerFault.exe 240 2244 3236 WerFault.exe 245 4636 6080 WerFault.exe 250 108 4276 WerFault.exe 255 5544 2044 WerFault.exe 260 5208 2680 WerFault.exe 265 1464 2472 WerFault.exe 270 5108 5400 WerFault.exe 275 6032 3140 WerFault.exe 280 5604 5708 WerFault.exe 286 5412 4652 WerFault.exe 291 3176 5980 WerFault.exe 296 3620 3360 WerFault.exe 301 5492 3064 WerFault.exe 306 2844 124 WerFault.exe 311 2832 5916 WerFault.exe 316 4380 3952 WerFault.exe 321 4700 940 WerFault.exe 326 4540 2756 WerFault.exe 331 2448 2688 WerFault.exe 336 4080 2624 WerFault.exe 341 1712 4892 WerFault.exe 346 3460 4444 WerFault.exe 351 5404 3400 WerFault.exe 356 2996 4940 WerFault.exe 361 2836 1340 WerFault.exe 366 6032 5100 WerFault.exe 371 5964 3704 WerFault.exe 376 1680 4540 WerFault.exe 381 4080 3764 WerFault.exe 386 3624 1872 WerFault.exe 391 2248 2208 WerFault.exe 396 3160 1720 WerFault.exe 401 5792 1608 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKCZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPNDAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUKWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLLGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXHJHBD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZQPYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AWBKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMYBLL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRHQES.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HOKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUYEEKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSIJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBFYIMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIPOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OTIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQERPDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SYXNZL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3472 2026-10-19_6ffda09f06b6fa0507cbe9826efb70d2_elex_emotet_stop.exe 3472 2026-10-19_6ffda09f06b6fa0507cbe9826efb70d2_elex_emotet_stop.exe 2916 OVJSB.exe 2916 OVJSB.exe 344 EEEWRY.exe 344 EEEWRY.exe 1160 SCEITKE.exe 1160 SCEITKE.exe 5596 MXJA.exe 5596 MXJA.exe 6076 QFPAPU.exe 6076 QFPAPU.exe 3028 LSU.exe 3028 LSU.exe 3356 VQIDH.exe 3356 VQIDH.exe 3172 ZGO.exe 3172 ZGO.exe 5712 OWPDSQ.exe 5712 OWPDSQ.exe 5124 SEW.exe 5124 SEW.exe 2604 NRBMP.exe 2604 NRBMP.exe 3712 PNFEZIH.exe 3712 PNFEZIH.exe 4328 KAKN.exe 4328 KAKN.exe 5876 TAMSMGY.exe 5876 TAMSMGY.exe 2116 SYXNZL.exe 2116 SYXNZL.exe 2620 MLCEKLU.exe 2620 MLCEKLU.exe 3240 HZHO.exe 3240 HZHO.exe 5068 PEHCV.exe 5068 PEHCV.exe 3880 EHR.exe 3880 EHR.exe 5636 ENJ.exe 5636 ENJ.exe 3532 ZAOFS.exe 3532 ZAOFS.exe 4624 FBV.exe 4624 FBV.exe 3328 FGW.exe 3328 FGW.exe 5272 UJFLWR.exe 5272 UJFLWR.exe 4404 YRM.exe 4404 YRM.exe 2548 SEQDK.exe 2548 SEQDK.exe 1732 ASRRUW.exe 1732 ASRRUW.exe 4464 PNAV.exe 4464 PNAV.exe 2640 OIZWJ.exe 2640 OIZWJ.exe 1432 JLIVQ.exe 1432 JLIVQ.exe 3236 STKABU.exe 3236 STKABU.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3472 2026-10-19_6ffda09f06b6fa0507cbe9826efb70d2_elex_emotet_stop.exe 3472 2026-10-19_6ffda09f06b6fa0507cbe9826efb70d2_elex_emotet_stop.exe 2916 OVJSB.exe 2916 OVJSB.exe 344 EEEWRY.exe 344 EEEWRY.exe 1160 SCEITKE.exe 1160 SCEITKE.exe 5596 MXJA.exe 5596 MXJA.exe 6076 QFPAPU.exe 6076 QFPAPU.exe 3028 LSU.exe 3028 LSU.exe 3356 VQIDH.exe 3356 VQIDH.exe 3172 ZGO.exe 3172 ZGO.exe 5712 OWPDSQ.exe 5712 OWPDSQ.exe 5124 SEW.exe 5124 SEW.exe 2604 NRBMP.exe 2604 NRBMP.exe 3712 PNFEZIH.exe 3712 PNFEZIH.exe 4328 KAKN.exe 4328 KAKN.exe 5876 TAMSMGY.exe 5876 TAMSMGY.exe 2116 SYXNZL.exe 2116 SYXNZL.exe 2620 MLCEKLU.exe 2620 MLCEKLU.exe 3240 HZHO.exe 3240 HZHO.exe 5068 PEHCV.exe 5068 PEHCV.exe 3880 EHR.exe 3880 EHR.exe 5636 ENJ.exe 5636 ENJ.exe 3532 ZAOFS.exe 3532 ZAOFS.exe 4624 FBV.exe 4624 FBV.exe 3328 FGW.exe 3328 FGW.exe 5272 UJFLWR.exe 5272 UJFLWR.exe 4404 YRM.exe 4404 YRM.exe 2548 SEQDK.exe 2548 SEQDK.exe 1732 ASRRUW.exe 1732 ASRRUW.exe 4464 PNAV.exe 4464 PNAV.exe 2640 OIZWJ.exe 2640 OIZWJ.exe 1432 JLIVQ.exe 1432 JLIVQ.exe 3236 STKABU.exe 3236 STKABU.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3472 wrote to memory of 3308 3472 2026-10-19_6ffda09f06b6fa0507cbe9826efb70d2_elex_emotet_stop.exe 90 PID 3308 wrote to memory of 2916 3308 cmd.exe 94 PID 2916 wrote to memory of 5512 2916 OVJSB.exe 96 PID 5512 wrote to memory of 344 5512 cmd.exe 100 PID 344 wrote to memory of 3856 344 EEEWRY.exe 101 PID 3856 wrote to memory of 1160 3856 cmd.exe 105 PID 1160 wrote to memory of 760 1160 SCEITKE.exe 106 PID 760 wrote to memory of 5596 760 cmd.exe 110 PID 5596 wrote to memory of 2592 5596 MXJA.exe 111 PID 2592 wrote to memory of 6076 2592 cmd.exe 115 PID 6076 wrote to memory of 5432 6076 QFPAPU.exe 116 PID 5432 wrote to memory of 3028 5432 cmd.exe 120 PID 3028 wrote to memory of 2664 3028 LSU.exe 121 PID 2664 wrote to memory of 3356 2664 cmd.exe 125 PID 3356 wrote to memory of 3376 3356 VQIDH.exe 126 PID 3376 wrote to memory of 3172 3376 cmd.exe 130 PID 3172 wrote to memory of 5436 3172 ZGO.exe 131 PID 5436 wrote to memory of 5712 5436 cmd.exe 135 PID 5712 wrote to memory of 5568 5712 OWPDSQ.exe 136 PID 5568 wrote to memory of 5124 5568 cmd.exe 140 PID 5124 wrote to memory of 5652 5124 SEW.exe 141 PID 5652 wrote to memory of 2604 5652 cmd.exe 145 PID 2604 wrote to memory of 3284 2604 NRBMP.exe 146 PID 3284 wrote to memory of 3712 3284 cmd.exe 150 PID 3712 wrote to memory of 5192 3712 PNFEZIH.exe 151 PID 5192 wrote to memory of 4328 5192 cmd.exe 155 PID 4328 wrote to memory of 5536 4328 KAKN.exe 156 PID 5536 wrote to memory of 5876 5536 cmd.exe 160 PID 5876 wrote to memory of 824 5876 TAMSMGY.exe 161 PID 824 wrote to memory of 2116 824 cmd.exe 165 PID 2116 wrote to memory of 4324 2116 SYXNZL.exe 166 PID 4324 wrote to memory of 2620 4324 cmd.exe 170 PID 2620 wrote to memory of 1944 2620 MLCEKLU.exe 171 PID 1944 wrote to memory of 3240 1944 cmd.exe 175 PID 3240 wrote to memory of 4368 3240 HZHO.exe 176 PID 4368 wrote to memory of 5068 4368 cmd.exe 180 PID 5068 wrote to memory of 3864 5068 PEHCV.exe 181 PID 3864 wrote to memory of 3880 3864 cmd.exe 185 PID 3880 wrote to memory of 5488 3880 EHR.exe 186 PID 5488 wrote to memory of 5636 5488 cmd.exe 190 PID 5636 wrote to memory of 5828 5636 ENJ.exe 191 PID 5828 wrote to memory of 3532 5828 cmd.exe 195 PID 3532 wrote to memory of 3092 3532 ZAOFS.exe 196 PID 3092 wrote to memory of 4624 3092 cmd.exe 200 PID 4624 wrote to memory of 1580 4624 FBV.exe 201 PID 1580 wrote to memory of 3328 1580 cmd.exe 205 PID 3328 wrote to memory of 2936 3328 FGW.exe 206 PID 2936 wrote to memory of 5272 2936 cmd.exe 210 PID 5272 wrote to memory of 3000 5272 UJFLWR.exe 211 PID 3000 wrote to memory of 4404 3000 cmd.exe 215 PID 4404 wrote to memory of 2260 4404 YRM.exe 216 PID 2260 wrote to memory of 2548 2260 cmd.exe 220 PID 2548 wrote to memory of 1120 2548 SEQDK.exe 221 PID 1120 wrote to memory of 1732 1120 cmd.exe 225 PID 1732 wrote to memory of 4332 1732 ASRRUW.exe 226 PID 4332 wrote to memory of 4464 4332 cmd.exe 230 PID 4464 wrote to memory of 2824 4464 PNAV.exe 231 PID 2824 wrote to memory of 2640 2824 cmd.exe 235 PID 2640 wrote to memory of 476 2640 OIZWJ.exe 236 PID 476 wrote to memory of 1432 476 cmd.exe 240 PID 1432 wrote to memory of 2852 1432 JLIVQ.exe 241 PID 2852 wrote to memory of 3236 2852 cmd.exe 245 PID 3236 wrote to memory of 4936 3236 STKABU.exe 246 PID 4936 wrote to memory of 6080 4936 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_6ffda09f06b6fa0507cbe9826efb70d2_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_6ffda09f06b6fa0507cbe9826efb70d2_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVJSB.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\windows\system\OVJSB.exeC:\windows\system\OVJSB.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEEWRY.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\windows\EEEWRY.exeC:\windows\EEEWRY.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCEITKE.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\SCEITKE.exeC:\windows\SCEITKE.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXJA.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\windows\system\MXJA.exeC:\windows\system\MXJA.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFPAPU.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\QFPAPU.exeC:\windows\QFPAPU.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\windows\system\LSU.exeC:\windows\system\LSU.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQIDH.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\windows\system\VQIDH.exeC:\windows\system\VQIDH.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\ZGO.exeC:\windows\ZGO.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWPDSQ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\OWPDSQ.exeC:\windows\system32\OWPDSQ.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEW.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\windows\SysWOW64\SEW.exeC:\windows\system32\SEW.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRBMP.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\system\NRBMP.exeC:\windows\system\NRBMP.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PNFEZIH.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\windows\system\PNFEZIH.exeC:\windows\system\PNFEZIH.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KAKN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\windows\KAKN.exeC:\windows\KAKN.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAMSMGY.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\windows\TAMSMGY.exeC:\windows\TAMSMGY.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SYXNZL.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:824 -
C:\windows\SYXNZL.exeC:\windows\SYXNZL.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLCEKLU.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\SysWOW64\MLCEKLU.exeC:\windows\system32\MLCEKLU.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZHO.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\windows\HZHO.exeC:\windows\HZHO.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PEHCV.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\SysWOW64\PEHCV.exeC:\windows\system32\PEHCV.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHR.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\EHR.exeC:\windows\EHR.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENJ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\windows\ENJ.exeC:\windows\ENJ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAOFS.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\windows\SysWOW64\ZAOFS.exeC:\windows\system32\ZAOFS.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBV.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\windows\system\FBV.exeC:\windows\system\FBV.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FGW.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\windows\FGW.exeC:\windows\FGW.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJFLWR.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\windows\system\UJFLWR.exeC:\windows\system\UJFLWR.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRM.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\windows\SysWOW64\YRM.exeC:\windows\system32\YRM.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEQDK.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\SysWOW64\SEQDK.exeC:\windows\system32\SEQDK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASRRUW.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\windows\system\ASRRUW.exeC:\windows\system\ASRRUW.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PNAV.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\SysWOW64\PNAV.exeC:\windows\system32\PNAV.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIZWJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\windows\OIZWJ.exeC:\windows\OIZWJ.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLIVQ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:476 -
C:\windows\JLIVQ.exeC:\windows\JLIVQ.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STKABU.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\STKABU.exeC:\windows\STKABU.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUR.exe.bat" "64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\windows\YUR.exeC:\windows\YUR.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUTBO.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5540 -
C:\windows\SysWOW64\HUTBO.exeC:\windows\system32\HUTBO.exe67⤵
- Executes dropped EXE
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHYKYT.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5852 -
C:\windows\system\CHYKYT.exeC:\windows\system\CHYKYT.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VIOVHU.exe.bat" "70⤵PID:4188
-
C:\windows\SysWOW64\VIOVHU.exeC:\windows\system32\VIOVHU.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MII.exe.bat" "72⤵
- Executes a command shell one-liner
PID:5868 -
C:\windows\SysWOW64\MII.exeC:\windows\system32\MII.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIPOC.exe.bat" "74⤵PID:4572
-
C:\windows\KIPOC.exeC:\windows\KIPOC.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRRTFR.exe.bat" "76⤵PID:5864
-
C:\windows\system\CRRTFR.exeC:\windows\system\CRRTFR.exe77⤵
- Executes dropped EXE
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WEW.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2228 -
C:\windows\system\WEW.exeC:\windows\system\WEW.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKCZX.exe.bat" "80⤵PID:1104
-
C:\windows\SysWOW64\TKCZX.exeC:\windows\system32\TKCZX.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXHJHBD.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3816 -
C:\windows\system\NXHJHBD.exeC:\windows\system\NXHJHBD.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIPKVFK.exe.bat" "84⤵PID:6096
-
C:\windows\NIPKVFK.exeC:\windows\NIPKVFK.exe85⤵
- Executes dropped EXE
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVHZWSM.exe.bat" "86⤵PID:3820
-
C:\windows\system\VVHZWSM.exeC:\windows\system\VVHZWSM.exe87⤵
- Executes dropped EXE
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOKR.exe.bat" "88⤵PID:3412
-
C:\windows\system\HOKR.exeC:\windows\system\HOKR.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BBPBH.exe.bat" "90⤵
- Executes a command shell one-liner
PID:6132 -
C:\windows\BBPBH.exeC:\windows\BBPBH.exe91⤵
- Executes dropped EXE
PID:5916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOUKRZF.exe.bat" "92⤵PID:2724
-
C:\windows\WOUKRZF.exeC:\windows\WOUKRZF.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AWBKD.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2372 -
C:\windows\SysWOW64\AWBKD.exeC:\windows\system32\AWBKD.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIYMLD.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4536 -
C:\windows\SysWOW64\FXIYMLD.exeC:\windows\system32\FXIYMLD.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFK.exe.bat" "98⤵PID:5908
-
C:\windows\PFK.exeC:\windows\PFK.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSPVA.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5900 -
C:\windows\SysWOW64\JSPVA.exeC:\windows\system32\JSPVA.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PTXIJLV.exe.bat" "102⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:828 -
C:\windows\SysWOW64\PTXIJLV.exeC:\windows\system32\PTXIJLV.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYVX.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5856 -
C:\windows\SysWOW64\MYVX.exeC:\windows\system32\MYVX.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VYXKC.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:252 -
C:\windows\VYXKC.exeC:\windows\VYXKC.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRAVKH.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5768 -
C:\windows\GRAVKH.exeC:\windows\GRAVKH.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCIU.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4232 -
C:\windows\CCIU.exeC:\windows\CCIU.exe111⤵
- Executes dropped EXE
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WPNDAK.exe.bat" "112⤵PID:472
-
C:\windows\WPNDAK.exeC:\windows\WPNDAK.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIQWJZG.exe.bat" "114⤵PID:4112
-
C:\windows\system\IIQWJZG.exeC:\windows\system\IIQWJZG.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSMDOR.exe.bat" "116⤵
- Executes a command shell one-liner
PID:2908 -
C:\windows\system\NSMDOR.exeC:\windows\system\NSMDOR.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVQYT.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5984 -
C:\windows\SysWOW64\NVQYT.exeC:\windows\system32\NVQYT.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQH.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5476 -
C:\windows\SysWOW64\DQH.exeC:\windows\system32\DQH.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-