Analysis
- max time kernel
88s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/10/2026, 18:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-19_65c5998a449437b673a17d3605aa1470_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-19_65c5998a449437b673a17d3605aa1470_elex_emotet_stop.exe
- Size 448KB
- Sample261020-ws6bbstsgy
- SHA256 94518025ff33782e91409af1d9e33d5804ac550a6993c0e107fe1d9822be8498
- MD5 65c5998a449437b673a17d3605aa1470
- SHA1 07b0619c51cbf3c075552e150616210e0979e07c
- SHA512 e4a4d3bbf6186178bfe8a8c5f20d4b93ea36db5d53d2c355fb456093e1e4736a571841725a9b9b93bcac6c19a08f2f32d979c6a8024b3639604bf1b5c7452969
- SSDEEP 6144:MlZtbLWIgd1LZ9oECZbxlUS+LOqkEjWbjcSbcY+CaQdaFOY4iGFYtR:OLWI09QZb6LOqkFbz+xt4vF
- TLSH T185A4BF12B6C1C072D8AF01328CE6C7A81BB5BD629F7152CB77D8774E9E721D28A35391
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4568 YIMDDKU.exe 3584 HGGEOGD.exe 4228 STFCU.exe 2900 PJS.exe 2520 XPFAMNK.exe 5356 UUP.exe 5088 AQOQ.exe 4868 IVB.exe 6096 FBLU.exe 2968 NOY.exe 4864 AMYMUXQ.exe 2236 KKMZ.exe 1136 UHRT.exe 200 WFXNYW.exe 696 ANDNLP.exe 5976 EYKI.exe 1476 OWPDSQ.exe 5748 YUVXHZ.exe 5932 GZHEK.exe 5292 ZCLZYNV.exe 6128 ZYPDDD.exe 4948 BVV.exe 3556 FLJYXE.exe 4312 BWSWLO.exe 1100 ZJRXQKE.exe 2452 UUZWEUA.exe 2060 YCGW.exe 1384 NSHVP.exe 3992 PQVHE.exe 2424 BGBPIBH.exe 1756 UJFLWR.exe 3456 YRM.exe 5780 YUPPN.exe 5736 ASDJV.exe 2852 ZDGZ.exe 6036 OTHRK.exe 5192 WYTFV.exe 5468 AOAF.exe 4588 WZJENKN.exe 3044 ACHRV.exe 4348 NFX.exe 900 WNZV.exe 1692 RYIT.exe 5388 VGOTFHW.exe 5704 HUVZKJS.exe 3200 IXZV.exe 2508 XSIZJTC.exe 4372 RFNR.exe 4476 QQQ.exe 2324 DBGYIK.exe 4140 EEKBV.exe 4932 CZJCSD.exe 5064 XMOLCDO.exe 2988 MHYQV.exe 5172 XATJWX.exe 5380 YDF.exe 3732 SQBWL.exe 3560 YQJJCPE.exe 5236 JJMC.exe 3268 TJOHO.exe 4124 IMX.exe 5456 ZNZR.exe 2572 OIJDOGH.exe 6040 FTHTVBC.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\XYN.exe TPHM.exe File created C:\windows\SysWOW64\GZHEK.exe.bat YUVXHZ.exe File created C:\windows\SysWOW64\BVV.exe ZYPDDD.exe File opened for modification C:\windows\SysWOW64\YUPPN.exe YRM.exe File created C:\windows\SysWOW64\MHYQV.exe.bat XMOLCDO.exe File created C:\windows\SysWOW64\ZKE.exe.bat NCXUQS.exe File opened for modification C:\windows\SysWOW64\MJHZ.exe BIAOGI.exe File created C:\windows\SysWOW64\MJHZ.exe.bat BIAOGI.exe File created C:\windows\SysWOW64\GKA.exe.bat MWWTMMY.exe File created C:\windows\SysWOW64\GZHEK.exe YUVXHZ.exe File opened for modification C:\windows\SysWOW64\BVV.exe ZYPDDD.exe File created C:\windows\SysWOW64\NFX.exe.bat ACHRV.exe File created C:\windows\SysWOW64\HUVZKJS.exe VGOTFHW.exe File opened for modification C:\windows\SysWOW64\HUVZKJS.exe VGOTFHW.exe File created C:\windows\SysWOW64\ZNZR.exe.bat IMX.exe File created C:\windows\SysWOW64\CJUCI.exe CECN.exe File opened for modification C:\windows\SysWOW64\HQT.exe WYQRZVL.exe File created C:\windows\SysWOW64\ZYPDDD.exe.bat ZCLZYNV.exe File created C:\windows\SysWOW64\OWPDSQ.exe.bat EYKI.exe File created C:\windows\SysWOW64\ZYPDDD.exe ZCLZYNV.exe File created C:\windows\SysWOW64\CMR.exe JTWUNXF.exe File created C:\windows\SysWOW64\WRODE.exe ODWP.exe File created C:\windows\SysWOW64\XYN.exe TPHM.exe File created C:\windows\SysWOW64\UOU.exe MJHZ.exe File opened for modification C:\windows\SysWOW64\GKA.exe MWWTMMY.exe File created C:\windows\SysWOW64\ANDNLP.exe.bat WFXNYW.exe File created C:\windows\SysWOW64\OWPDSQ.exe EYKI.exe File opened for modification C:\windows\SysWOW64\MHYQV.exe XMOLCDO.exe File opened for modification C:\windows\SysWOW64\ZNZR.exe IMX.exe File opened for modification C:\windows\SysWOW64\FBLU.exe IVB.exe File created C:\windows\SysWOW64\BVV.exe.bat ZYPDDD.exe File created C:\windows\SysWOW64\AOAF.exe WYTFV.exe File opened for modification C:\windows\SysWOW64\IXZV.exe HUVZKJS.exe File created C:\windows\SysWOW64\XMOLCDO.exe.bat CZJCSD.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe CECN.exe File opened for modification C:\windows\SysWOW64\WRODE.exe ODWP.exe File created C:\windows\SysWOW64\IXETF.exe LRY.exe File opened for modification C:\windows\SysWOW64\ANDNLP.exe WFXNYW.exe File created C:\windows\SysWOW64\BWSWLO.exe FLJYXE.exe File created C:\windows\SysWOW64\YUPPN.exe YRM.exe File created C:\windows\SysWOW64\ZDGZ.exe ASDJV.exe File created C:\windows\SysWOW64\WYTFV.exe.bat OTHRK.exe File created C:\windows\SysWOW64\WNZV.exe.bat NFX.exe File opened for modification C:\windows\SysWOW64\IXETF.exe LRY.exe File created C:\windows\SysWOW64\UOU.exe.bat MJHZ.exe File opened for modification C:\windows\SysWOW64\ZYPDDD.exe ZCLZYNV.exe File created C:\windows\SysWOW64\FLJYXE.exe.bat BVV.exe File created C:\windows\SysWOW64\EYKI.exe ANDNLP.exe File created C:\windows\SysWOW64\EYKI.exe.bat ANDNLP.exe File created C:\windows\SysWOW64\YRM.exe UJFLWR.exe File created C:\windows\SysWOW64\YUPPN.exe.bat YRM.exe File created C:\windows\SysWOW64\CMR.exe.bat JTWUNXF.exe File created C:\windows\SysWOW64\ZKE.exe NCXUQS.exe File opened for modification C:\windows\SysWOW64\YCGW.exe UUZWEUA.exe File created C:\windows\SysWOW64\ZNZR.exe IMX.exe File created C:\windows\SysWOW64\HQT.exe WYQRZVL.exe File created C:\windows\SysWOW64\UUZWEUA.exe.bat ZJRXQKE.exe File opened for modification C:\windows\SysWOW64\AOAF.exe WYTFV.exe File created C:\windows\SysWOW64\NFX.exe ACHRV.exe File created C:\windows\SysWOW64\MHYQV.exe XMOLCDO.exe File created C:\windows\SysWOW64\FBLU.exe.bat IVB.exe File opened for modification C:\windows\SysWOW64\YRM.exe UJFLWR.exe File opened for modification C:\windows\SysWOW64\WYTFV.exe OTHRK.exe File created C:\windows\SysWOW64\XMOLCDO.exe CZJCSD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\AVVZAU.exe FIQQ.exe File created C:\windows\AXZLDB.exe.bat PEESV.exe File created C:\windows\HGGEOGD.exe.bat YIMDDKU.exe File created C:\windows\system\XSIZJTC.exe IXZV.exe File opened for modification C:\windows\system\MAZXIUV.exe RFUOX.exe File created C:\windows\PEESV.exe GWC.exe File created C:\windows\UHRT.exe KKMZ.exe File opened for modification C:\windows\NCXUQS.exe CJUCI.exe File created C:\windows\system\BIAOGI.exe MAZXIUV.exe File opened for modification C:\windows\FIQQ.exe MQAFHU.exe File created C:\windows\system\AVVZAU.exe.bat FIQQ.exe File created C:\windows\BGBPIBH.exe.bat PQVHE.exe File opened for modification C:\windows\system\WYQRZVL.exe BKMIW.exe File created C:\windows\RRX.exe CMR.exe File opened for modification C:\windows\system\BQQQNEQ.exe HVLHC.exe File opened for modification C:\windows\AQOQ.exe UUP.exe File created C:\windows\ZJRXQKE.exe BWSWLO.exe File created C:\windows\BGBPIBH.exe PQVHE.exe File opened for modification C:\windows\system\JTWUNXF.exe AOMK.exe File created C:\windows\system\VGOTFHW.exe.bat RYIT.exe File created C:\windows\system\AOMK.exe.bat FTHTVBC.exe File created C:\windows\LFCU.exe RRX.exe File opened for modification C:\windows\system\VFKHHZ.exe GKA.exe File created C:\windows\RFNR.exe.bat XSIZJTC.exe File created C:\windows\NQBYQ.exe HQT.exe File created C:\windows\system\AMYMUXQ.exe.bat NOY.exe File opened for modification C:\windows\system\VGOTFHW.exe RYIT.exe File opened for modification C:\windows\HVLHC.exe BVD.exe File created C:\windows\system\LRY.exe URWRNEI.exe File created C:\windows\UUP.exe XPFAMNK.exe File opened for modification C:\windows\UHRT.exe KKMZ.exe File created C:\windows\system\YQJJCPE.exe SQBWL.exe File created C:\windows\system\BQQQNEQ.exe HVLHC.exe File created C:\windows\system\HQXEWGZ.exe.bat BQQQNEQ.exe File created C:\windows\system\LRY.exe.bat URWRNEI.exe File created C:\windows\system\BIAOGI.exe.bat MAZXIUV.exe File created C:\windows\system\WYQRZVL.exe.bat BKMIW.exe File created C:\windows\system\JJMC.exe.bat YQJJCPE.exe File created C:\windows\system\WZJENKN.exe.bat AOAF.exe File opened for modification C:\windows\RFNR.exe XSIZJTC.exe File created C:\windows\system\SQBWL.exe YDF.exe File opened for modification C:\windows\system\YQJJCPE.exe SQBWL.exe File created C:\windows\KOWZIAO.exe.bat PBRQX.exe File created C:\windows\NQBYQ.exe.bat HQT.exe File created C:\windows\CZLY.exe.bat WZDLBKE.exe File opened for modification C:\windows\system\XPFAMNK.exe PJS.exe File created C:\windows\system\FYMXNS.exe TFJEE.exe File opened for modification C:\windows\MQAFHU.exe VFKHHZ.exe File opened for modification C:\windows\AXZLDB.exe PEESV.exe File created C:\windows\UHRT.exe.bat KKMZ.exe File created C:\windows\system\VGOTFHW.exe RYIT.exe File created C:\windows\system\YQJJCPE.exe.bat SQBWL.exe File created C:\windows\system\XPFAMNK.exe.bat PJS.exe File created C:\windows\KOWZIAO.exe PBRQX.exe File opened for modification C:\windows\NSHVP.exe YCGW.exe File opened for modification C:\windows\system\AOMK.exe FTHTVBC.exe File created C:\windows\system\MAZXIUV.exe RFUOX.exe File created C:\windows\system\AMYMUXQ.exe NOY.exe File opened for modification C:\windows\system\ACHRV.exe WZJENKN.exe File created C:\windows\TFJEE.exe.bat ZKE.exe File opened for modification C:\windows\system\FYMXNS.exe TFJEE.exe File opened for modification C:\windows\system\AMYMUXQ.exe NOY.exe File opened for modification C:\windows\CZJCSD.exe EEKBV.exe File opened for modification C:\windows\system\URWRNEI.exe WRODE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 264 cmd.exe 2772 cmd.exe 4108 cmd.exe 984 cmd.exe 3040 cmd.exe 1340 cmd.exe 4748 cmd.exe 5004 cmd.exe 6092 cmd.exe 4804 cmd.exe 3168 cmd.exe 3768 cmd.exe 2188 cmd.exe 4244 cmd.exe 2436 cmd.exe 3380 cmd.exe 4920 cmd.exe 1696 cmd.exe 1196 cmd.exe 4652 cmd.exe 1164 cmd.exe 6108 cmd.exe 5712 cmd.exe 5340 cmd.exe 592 cmd.exe 4324 cmd.exe 6072 cmd.exe 1304 cmd.exe 3784 cmd.exe 3420 cmd.exe 4844 cmd.exe 1420 cmd.exe 1824 cmd.exe 3160 cmd.exe 1560 cmd.exe 2248 cmd.exe 3748 cmd.exe 3108 cmd.exe 3592 cmd.exe 5164 cmd.exe 1416 cmd.exe 4812 cmd.exe 5248 cmd.exe 2008 cmd.exe 4940 cmd.exe 1760 cmd.exe 5128 cmd.exe 4636 cmd.exe 4900 cmd.exe 4912 cmd.exe 5392 cmd.exe 3636 cmd.exe 4532 cmd.exe 5168 cmd.exe 2100 cmd.exe 2976 cmd.exe 2488 cmd.exe 4300 cmd.exe 2152 cmd.exe 2964 cmd.exe 4360 cmd.exe 3756 cmd.exe 4420 cmd.exe 2408 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1136 3564 WerFault.exe 87 4340 4568 WerFault.exe 93 2116 3584 WerFault.exe 99 5672 4228 WerFault.exe 104 5168 2900 WerFault.exe 109 4300 2520 WerFault.exe 114 5708 5356 WerFault.exe 119 4376 5088 WerFault.exe 124 4256 4868 WerFault.exe 129 4468 6096 WerFault.exe 134 1968 2968 WerFault.exe 139 5504 4864 WerFault.exe 144 5460 2236 WerFault.exe 149 1780 1136 WerFault.exe 154 1900 200 WerFault.exe 159 2508 696 WerFault.exe 164 428 5976 WerFault.exe 169 2996 1476 WerFault.exe 174 3572 5748 WerFault.exe 179 5676 5932 WerFault.exe 184 5140 5292 WerFault.exe 189 2504 6128 WerFault.exe 194 1856 4948 WerFault.exe 199 3748 3556 WerFault.exe 204 3384 4312 WerFault.exe 209 6136 1100 WerFault.exe 214 3512 2452 WerFault.exe 219 3444 2060 WerFault.exe 224 3044 1384 WerFault.exe 229 4456 3992 WerFault.exe 234 5712 2424 WerFault.exe 239 3872 1756 WerFault.exe 244 5056 3456 WerFault.exe 249 4484 5780 WerFault.exe 254 2008 5736 WerFault.exe 259 2688 2852 WerFault.exe 264 1016 6036 WerFault.exe 270 1884 5192 WerFault.exe 275 5652 5468 WerFault.exe 280 1876 4588 WerFault.exe 285 4124 3044 WerFault.exe 290 840 4348 WerFault.exe 295 1672 900 WerFault.exe 300 4488 1692 WerFault.exe 305 3232 5388 WerFault.exe 310 5672 5704 WerFault.exe 315 2084 3200 WerFault.exe 320 4516 2508 WerFault.exe 325 1172 4372 WerFault.exe 330 3192 4476 WerFault.exe 335 2072 2324 WerFault.exe 340 1292 4140 WerFault.exe 345 3900 4932 WerFault.exe 350 984 5064 WerFault.exe 355 3172 2988 WerFault.exe 360 2784 5172 WerFault.exe 365 4548 5380 WerFault.exe 370 4168 3732 WerFault.exe 375 980 3560 WerFault.exe 380 5624 5236 WerFault.exe 385 5916 3268 WerFault.exe 390 5248 4124 WerFault.exe 395 2492 5456 WerFault.exe 400 1380 2572 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VGOTFHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CECN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URWRNEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBRQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BGBPIBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVLHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YIMDDKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIAOGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHYQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYQRZVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSHVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZDLBKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUVXHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASDJV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEKBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BWSWLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUPPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UOU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-19_65c5998a449437b673a17d3605aa1470_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWPDSQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQOQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXETF.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3564 2026-10-19_65c5998a449437b673a17d3605aa1470_elex_emotet_stop.exe 3564 2026-10-19_65c5998a449437b673a17d3605aa1470_elex_emotet_stop.exe 4568 YIMDDKU.exe 4568 YIMDDKU.exe 3584 HGGEOGD.exe 3584 HGGEOGD.exe 4228 STFCU.exe 4228 STFCU.exe 2900 PJS.exe 2900 PJS.exe 2520 XPFAMNK.exe 2520 XPFAMNK.exe 5356 UUP.exe 5356 UUP.exe 5088 AQOQ.exe 5088 AQOQ.exe 4868 IVB.exe 4868 IVB.exe 6096 FBLU.exe 6096 FBLU.exe 2968 NOY.exe 2968 NOY.exe 4864 AMYMUXQ.exe 4864 AMYMUXQ.exe 2236 KKMZ.exe 2236 KKMZ.exe 1136 UHRT.exe 1136 UHRT.exe 200 WFXNYW.exe 200 WFXNYW.exe 696 ANDNLP.exe 696 ANDNLP.exe 5976 EYKI.exe 5976 EYKI.exe 1476 OWPDSQ.exe 1476 OWPDSQ.exe 5748 YUVXHZ.exe 5748 YUVXHZ.exe 5932 GZHEK.exe 5932 GZHEK.exe 5292 ZCLZYNV.exe 5292 ZCLZYNV.exe 6128 ZYPDDD.exe 6128 ZYPDDD.exe 4948 BVV.exe 4948 BVV.exe 3556 FLJYXE.exe 3556 FLJYXE.exe 4312 BWSWLO.exe 4312 BWSWLO.exe 1100 ZJRXQKE.exe 1100 ZJRXQKE.exe 2452 UUZWEUA.exe 2452 UUZWEUA.exe 2060 YCGW.exe 2060 YCGW.exe 1384 NSHVP.exe 1384 NSHVP.exe 3992 PQVHE.exe 3992 PQVHE.exe 2424 BGBPIBH.exe 2424 BGBPIBH.exe 1756 UJFLWR.exe 1756 UJFLWR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3564 2026-10-19_65c5998a449437b673a17d3605aa1470_elex_emotet_stop.exe 3564 2026-10-19_65c5998a449437b673a17d3605aa1470_elex_emotet_stop.exe 4568 YIMDDKU.exe 4568 YIMDDKU.exe 3584 HGGEOGD.exe 3584 HGGEOGD.exe 4228 STFCU.exe 4228 STFCU.exe 2900 PJS.exe 2900 PJS.exe 2520 XPFAMNK.exe 2520 XPFAMNK.exe 5356 UUP.exe 5356 UUP.exe 5088 AQOQ.exe 5088 AQOQ.exe 4868 IVB.exe 4868 IVB.exe 6096 FBLU.exe 6096 FBLU.exe 2968 NOY.exe 2968 NOY.exe 4864 AMYMUXQ.exe 4864 AMYMUXQ.exe 2236 KKMZ.exe 2236 KKMZ.exe 1136 UHRT.exe 1136 UHRT.exe 200 WFXNYW.exe 200 WFXNYW.exe 696 ANDNLP.exe 696 ANDNLP.exe 5976 EYKI.exe 5976 EYKI.exe 1476 OWPDSQ.exe 1476 OWPDSQ.exe 5748 YUVXHZ.exe 5748 YUVXHZ.exe 5932 GZHEK.exe 5932 GZHEK.exe 5292 ZCLZYNV.exe 5292 ZCLZYNV.exe 6128 ZYPDDD.exe 6128 ZYPDDD.exe 4948 BVV.exe 4948 BVV.exe 3556 FLJYXE.exe 3556 FLJYXE.exe 4312 BWSWLO.exe 4312 BWSWLO.exe 1100 ZJRXQKE.exe 1100 ZJRXQKE.exe 2452 UUZWEUA.exe 2452 UUZWEUA.exe 2060 YCGW.exe 2060 YCGW.exe 1384 NSHVP.exe 1384 NSHVP.exe 3992 PQVHE.exe 3992 PQVHE.exe 2424 BGBPIBH.exe 2424 BGBPIBH.exe 1756 UJFLWR.exe 1756 UJFLWR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3564 wrote to memory of 2976 3564 2026-10-19_65c5998a449437b673a17d3605aa1470_elex_emotet_stop.exe 89 PID 2976 wrote to memory of 4568 2976 cmd.exe 93 PID 4568 wrote to memory of 3328 4568 YIMDDKU.exe 95 PID 3328 wrote to memory of 3584 3328 cmd.exe 99 PID 3584 wrote to memory of 2020 3584 HGGEOGD.exe 100 PID 2020 wrote to memory of 4228 2020 cmd.exe 104 PID 4228 wrote to memory of 264 4228 STFCU.exe 105 PID 264 wrote to memory of 2900 264 cmd.exe 109 PID 2900 wrote to memory of 5080 2900 PJS.exe 110 PID 5080 wrote to memory of 2520 5080 cmd.exe 114 PID 2520 wrote to memory of 4748 2520 XPFAMNK.exe 115 PID 4748 wrote to memory of 5356 4748 cmd.exe 119 PID 5356 wrote to memory of 2772 5356 UUP.exe 120 PID 2772 wrote to memory of 5088 2772 cmd.exe 124 PID 5088 wrote to memory of 4520 5088 AQOQ.exe 125 PID 4520 wrote to memory of 4868 4520 cmd.exe 129 PID 4868 wrote to memory of 4192 4868 IVB.exe 130 PID 4192 wrote to memory of 6096 4192 cmd.exe 134 PID 6096 wrote to memory of 1164 6096 FBLU.exe 135 PID 1164 wrote to memory of 2968 1164 cmd.exe 139 PID 2968 wrote to memory of 3528 2968 NOY.exe 140 PID 3528 wrote to memory of 4864 3528 cmd.exe 144 PID 4864 wrote to memory of 3064 4864 AMYMUXQ.exe 145 PID 3064 wrote to memory of 2236 3064 cmd.exe 149 PID 2236 wrote to memory of 5004 2236 KKMZ.exe 150 PID 5004 wrote to memory of 1136 5004 cmd.exe 154 PID 1136 wrote to memory of 4636 1136 UHRT.exe 155 PID 4636 wrote to memory of 200 4636 cmd.exe 159 PID 200 wrote to memory of 4176 200 WFXNYW.exe 160 PID 4176 wrote to memory of 696 4176 cmd.exe 164 PID 696 wrote to memory of 2796 696 ANDNLP.exe 165 PID 2796 wrote to memory of 5976 2796 cmd.exe 169 PID 5976 wrote to memory of 928 5976 EYKI.exe 170 PID 928 wrote to memory of 1476 928 cmd.exe 174 PID 1476 wrote to memory of 3240 1476 OWPDSQ.exe 175 PID 3240 wrote to memory of 5748 3240 cmd.exe 179 PID 5748 wrote to memory of 6004 5748 YUVXHZ.exe 180 PID 6004 wrote to memory of 5932 6004 cmd.exe 184 PID 5932 wrote to memory of 2408 5932 GZHEK.exe 185 PID 2408 wrote to memory of 5292 2408 cmd.exe 189 PID 5292 wrote to memory of 4324 5292 ZCLZYNV.exe 190 PID 4324 wrote to memory of 6128 4324 cmd.exe 194 PID 6128 wrote to memory of 1968 6128 ZYPDDD.exe 195 PID 1968 wrote to memory of 4948 1968 cmd.exe 199 PID 4948 wrote to memory of 5956 4948 BVV.exe 200 PID 5956 wrote to memory of 3556 5956 cmd.exe 204 PID 3556 wrote to memory of 4660 3556 FLJYXE.exe 205 PID 4660 wrote to memory of 4312 4660 cmd.exe 209 PID 4312 wrote to memory of 1032 4312 BWSWLO.exe 210 PID 1032 wrote to memory of 1100 1032 cmd.exe 214 PID 1100 wrote to memory of 1824 1100 ZJRXQKE.exe 215 PID 1824 wrote to memory of 2452 1824 cmd.exe 219 PID 2452 wrote to memory of 2436 2452 UUZWEUA.exe 220 PID 2436 wrote to memory of 2060 2436 cmd.exe 224 PID 2060 wrote to memory of 3160 2060 YCGW.exe 225 PID 3160 wrote to memory of 1384 3160 cmd.exe 229 PID 1384 wrote to memory of 1888 1384 NSHVP.exe 230 PID 1888 wrote to memory of 3992 1888 cmd.exe 234 PID 3992 wrote to memory of 4500 3992 PQVHE.exe 235 PID 4500 wrote to memory of 2424 4500 cmd.exe 239 PID 2424 wrote to memory of 4280 2424 BGBPIBH.exe 240 PID 4280 wrote to memory of 1756 4280 cmd.exe 244 PID 1756 wrote to memory of 4848 1756 UJFLWR.exe 245 PID 4848 wrote to memory of 3456 4848 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_65c5998a449437b673a17d3605aa1470_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_65c5998a449437b673a17d3605aa1470_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YIMDDKU.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\system\YIMDDKU.exeC:\windows\system\YIMDDKU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HGGEOGD.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\windows\HGGEOGD.exeC:\windows\HGGEOGD.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STFCU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\windows\STFCU.exeC:\windows\STFCU.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJS.exe.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:264 -
C:\windows\PJS.exeC:\windows\PJS.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPFAMNK.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\windows\system\XPFAMNK.exeC:\windows\system\XPFAMNK.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UUP.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\windows\UUP.exeC:\windows\UUP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AQOQ.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\AQOQ.exeC:\windows\AQOQ.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVB.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\IVB.exeC:\windows\IVB.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBLU.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\windows\SysWOW64\FBLU.exeC:\windows\system32\FBLU.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NOY.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\windows\NOY.exeC:\windows\NOY.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMYMUXQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\windows\system\AMYMUXQ.exeC:\windows\system\AMYMUXQ.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKMZ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\SysWOW64\KKMZ.exeC:\windows\system32\KKMZ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHRT.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\windows\UHRT.exeC:\windows\UHRT.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFXNYW.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\windows\WFXNYW.exeC:\windows\WFXNYW.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANDNLP.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\windows\SysWOW64\ANDNLP.exeC:\windows\system32\ANDNLP.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYKI.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\windows\SysWOW64\EYKI.exeC:\windows\system32\EYKI.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWPDSQ.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:928 -
C:\windows\SysWOW64\OWPDSQ.exeC:\windows\system32\OWPDSQ.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUVXHZ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\windows\system\YUVXHZ.exeC:\windows\system\YUVXHZ.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GZHEK.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\SysWOW64\GZHEK.exeC:\windows\system32\GZHEK.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCLZYNV.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\windows\ZCLZYNV.exeC:\windows\ZCLZYNV.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZYPDDD.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\SysWOW64\ZYPDDD.exeC:\windows\system32\ZYPDDD.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVV.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\SysWOW64\BVV.exeC:\windows\system32\BVV.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLJYXE.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\windows\SysWOW64\FLJYXE.exeC:\windows\system32\FLJYXE.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BWSWLO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\SysWOW64\BWSWLO.exeC:\windows\system32\BWSWLO.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJRXQKE.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\windows\ZJRXQKE.exeC:\windows\ZJRXQKE.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UUZWEUA.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\windows\SysWOW64\UUZWEUA.exeC:\windows\system32\UUZWEUA.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YCGW.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\windows\SysWOW64\YCGW.exeC:\windows\system32\YCGW.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NSHVP.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\NSHVP.exeC:\windows\NSHVP.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQVHE.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\windows\system\PQVHE.exeC:\windows\system\PQVHE.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BGBPIBH.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\windows\BGBPIBH.exeC:\windows\BGBPIBH.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJFLWR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\windows\system\UJFLWR.exeC:\windows\system\UJFLWR.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRM.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\SysWOW64\YRM.exeC:\windows\system32\YRM.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YUPPN.exe.bat" "66⤵PID:3588
-
C:\windows\SysWOW64\YUPPN.exeC:\windows\system32\YUPPN.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASDJV.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:4592 -
C:\windows\system\ASDJV.exeC:\windows\system\ASDJV.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDGZ.exe.bat" "70⤵
- Executes a command shell one-liner
PID:6108 -
C:\windows\SysWOW64\ZDGZ.exeC:\windows\system32\ZDGZ.exe71⤵
- Executes dropped EXE
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTHRK.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4336 -
C:\windows\OTHRK.exeC:\windows\OTHRK.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WYTFV.exe.bat" "74⤵PID:3940
-
C:\windows\SysWOW64\WYTFV.exeC:\windows\system32\WYTFV.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOAF.exe.bat" "76⤵
- Executes a command shell one-liner
PID:6072 -
C:\windows\SysWOW64\AOAF.exeC:\windows\system32\AOAF.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZJENKN.exe.bat" "78⤵PID:4856
-
C:\windows\system\WZJENKN.exeC:\windows\system\WZJENKN.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ACHRV.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4900 -
C:\windows\system\ACHRV.exeC:\windows\system\ACHRV.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NFX.exe.bat" "82⤵PID:3348
-
C:\windows\SysWOW64\NFX.exeC:\windows\system32\NFX.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WNZV.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6092 -
C:\windows\SysWOW64\WNZV.exeC:\windows\system32\WNZV.exe85⤵
- Executes dropped EXE
PID:900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYIT.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5164 -
C:\windows\system\RYIT.exeC:\windows\system\RYIT.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VGOTFHW.exe.bat" "88⤵
- Executes a command shell one-liner
PID:4912 -
C:\windows\system\VGOTFHW.exeC:\windows\system\VGOTFHW.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUVZKJS.exe.bat" "90⤵PID:4564
-
C:\windows\SysWOW64\HUVZKJS.exeC:\windows\system32\HUVZKJS.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5684 -
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSIZJTC.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2488 -
C:\windows\system\XSIZJTC.exeC:\windows\system\XSIZJTC.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFNR.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:3832 -
C:\windows\RFNR.exeC:\windows\RFNR.exe97⤵
- Executes dropped EXE
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QQQ.exe.bat" "98⤵PID:2372
-
C:\windows\system\QQQ.exeC:\windows\system\QQQ.exe99⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBGYIK.exe.bat" "100⤵PID:4988
-
C:\windows\SysWOW64\DBGYIK.exeC:\windows\system32\DBGYIK.exe101⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EEKBV.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1416 -
C:\windows\system\EEKBV.exeC:\windows\system\EEKBV.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZJCSD.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5712 -
C:\windows\CZJCSD.exeC:\windows\CZJCSD.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XMOLCDO.exe.bat" "106⤵PID:3872
-
C:\windows\SysWOW64\XMOLCDO.exeC:\windows\system32\XMOLCDO.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHYQV.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1304 -
C:\windows\SysWOW64\MHYQV.exeC:\windows\system32\MHYQV.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XATJWX.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:3468 -
C:\windows\XATJWX.exeC:\windows\XATJWX.exe111⤵
- Executes dropped EXE
PID:5172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDF.exe.bat" "112⤵PID:1184
-
C:\windows\system\YDF.exeC:\windows\system\YDF.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQBWL.exe.bat" "114⤵PID:2184
-
C:\windows\system\SQBWL.exeC:\windows\system\SQBWL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQJJCPE.exe.bat" "116⤵PID:2728
-
C:\windows\system\YQJJCPE.exeC:\windows\system\YQJJCPE.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "118⤵PID:5856
-
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe119⤵
- Executes dropped EXE
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "120⤵PID:5200
-
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe121⤵
- Executes dropped EXE
PID:3268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-