Analysis
- max time kernel
109s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 23:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe
- Size 208KB
- Sample261023-3lencsdh27
- SHA256 81f4b98c5c9be38536610681a306acdcff38af8d7f7fc22662754c94c247c283
- MD5 b5eb8aba298f81bd20dda71c3f3f97d3
- SHA1 3b13ceef72e9e8f2c905a82a25285d64cb8f5dd1
- SHA512 d0b06bd7be34260736030644ff2e087525ef1e5e00e22b05af76c1b78ca31d16d12165291106dda71f8ee18ef66258d4c6badabeeff26ae0097efe52450688a1
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUKL+LOfN4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUS+LOVkEj1
- TLSH T10C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2316 RIPUYI.exe 4420 DLAHHUG.exe 3568 XYFQ.exe 3772 NWSIZB.exe 1388 YPVBHI.exe 2644 EPD.exe 1044 BNJMF.exe 3320 OXFK.exe 5404 ILKTU.exe 5000 OLR.exe 4496 AEUA.exe 4888 DUBAQF.exe 1864 PMW.exe 6092 FCDEKGO.exe 3872 QVG.exe 3968 NAD.exe 5096 NGEABL.exe 5376 ITIJLKX.exe 5472 PMR.exe 4768 PRJ.exe 2988 VRRNJW.exe 2896 BSZ.exe 3580 MKCTBFY.exe 956 YDF.exe 4108 SQBWL.exe 796 YQJJCPE.exe 4412 IRLO.exe 2396 EWRMN.exe 5072 PPUEVDP.exe 5844 MUSTCN.exe 3600 FYDXI.exe 5900 KYLLZ.exe 6068 FLIU.exe 3948 WLKZMC.exe 4776 CMR.exe 3240 XHWWG.exe 1560 PCAALUK.exe 964 VCIO.exe 2920 FLKTY.exe 5996 ZYPCIUL.exe 1156 FYWQ.exe 4772 QRZJZ.exe 5508 IZBODBD.exe 1364 ORJC.exe 4880 XADPX.exe 4196 TFJEE.exe 5716 MAMI.exe 3300 HWRRUA.exe 2756 WRBV.exe 6040 SWG.exe 3440 NKLCE.exe 4972 PHEEDT.exe 3056 AAHXLBO.exe 4988 NDMVQS.exe 420 KIJ.exe 4324 TWUKN.exe 4572 VLVF.exe 5788 IWRLY.exe 1040 IHANM.exe 1600 FMFCTAZ.exe 816 HKZEZ.exe 3644 GVH.exe 5028 XGY.exe 3196 QLJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\TMBV.exe UWVSB.exe File created C:\windows\SysWOW64\KHLBWEN.exe.bat URM.exe File created C:\windows\SysWOW64\OLR.exe ILKTU.exe File opened for modification C:\windows\SysWOW64\FLIU.exe KYLLZ.exe File created C:\windows\SysWOW64\VBDBWP.exe OQVAID.exe File created C:\windows\SysWOW64\IWMZIO.exe.bat TQGKBNC.exe File opened for modification C:\windows\SysWOW64\QAVDEH.exe EHSKW.exe File opened for modification C:\windows\SysWOW64\XYRRE.exe ZYK.exe File opened for modification C:\windows\SysWOW64\KYLLZ.exe FYDXI.exe File created C:\windows\SysWOW64\XEKRBUX.exe.bat IYFDD.exe File opened for modification C:\windows\SysWOW64\RUKJ.exe FBH.exe File created C:\windows\SysWOW64\QAVDEH.exe EHSKW.exe File created C:\windows\SysWOW64\GKV.exe THRW.exe File opened for modification C:\windows\SysWOW64\PPUEVDP.exe EWRMN.exe File created C:\windows\SysWOW64\HKZEZ.exe FMFCTAZ.exe File created C:\windows\SysWOW64\IYFDD.exe.bat XFKKDI.exe File opened for modification C:\windows\SysWOW64\GKV.exe THRW.exe File created C:\windows\SysWOW64\CMFCR.exe.bat RUKJ.exe File created C:\windows\SysWOW64\TYCQMR.exe.bat IFZX.exe File created C:\windows\SysWOW64\PPUEVDP.exe EWRMN.exe File created C:\windows\SysWOW64\XADPX.exe.bat ORJC.exe File opened for modification C:\windows\SysWOW64\XEKRBUX.exe IYFDD.exe File created C:\windows\SysWOW64\GKV.exe.bat THRW.exe File created C:\windows\SysWOW64\DVOGZ.exe.bat DLNEL.exe File opened for modification C:\windows\SysWOW64\UNP.exe GHKEVP.exe File opened for modification C:\windows\SysWOW64\PMR.exe ITIJLKX.exe File opened for modification C:\windows\SysWOW64\DLAHHUG.exe RIPUYI.exe File opened for modification C:\windows\SysWOW64\NWSIZB.exe XYFQ.exe File opened for modification C:\windows\SysWOW64\PDSGAFY.exe SFUJL.exe File created C:\windows\SysWOW64\JUSJOJQ.exe CZV.exe File created C:\windows\SysWOW64\ZYK.exe TYCQMR.exe File created C:\windows\SysWOW64\CZV.exe OORYZRF.exe File created C:\windows\SysWOW64\TYCQMR.exe IFZX.exe File created C:\windows\SysWOW64\OLR.exe.bat ILKTU.exe File created C:\windows\SysWOW64\URM.exe.bat SULW.exe File created C:\windows\SysWOW64\KYLLZ.exe.bat FYDXI.exe File created C:\windows\SysWOW64\FYWQ.exe ZYPCIUL.exe File opened for modification C:\windows\SysWOW64\KHLBWEN.exe URM.exe File created C:\windows\SysWOW64\FBH.exe TLARW.exe File created C:\windows\SysWOW64\LPSHSG.exe.bat ZXPOR.exe File opened for modification C:\windows\SysWOW64\OLR.exe ILKTU.exe File created C:\windows\SysWOW64\RIPUYI.exe.bat 2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe File created C:\windows\SysWOW64\MUSTCN.exe PPUEVDP.exe File created C:\windows\SysWOW64\YSPA.exe KHLBWEN.exe File opened for modification C:\windows\SysWOW64\JUSJOJQ.exe CZV.exe File created C:\windows\SysWOW64\YJCS.exe ZZU.exe File created C:\windows\SysWOW64\CMFCR.exe RUKJ.exe File opened for modification C:\windows\SysWOW64\QBENKBZ.exe IWMZIO.exe File created C:\windows\SysWOW64\OXFK.exe.bat BNJMF.exe File created C:\windows\SysWOW64\CMR.exe WLKZMC.exe File created C:\windows\SysWOW64\FYWQ.exe.bat ZYPCIUL.exe File created C:\windows\SysWOW64\OLY.exe.bat QNZASUG.exe File created C:\windows\SysWOW64\YXXB.exe.bat TMBV.exe File created C:\windows\SysWOW64\DLAHHUG.exe RIPUYI.exe File created C:\windows\SysWOW64\NDMVQS.exe AAHXLBO.exe File opened for modification C:\windows\SysWOW64\KIJ.exe NDMVQS.exe File created C:\windows\SysWOW64\LFXI.exe PASLG.exe File opened for modification C:\windows\SysWOW64\LFXI.exe PASLG.exe File opened for modification C:\windows\SysWOW64\IWMZIO.exe TQGKBNC.exe File created C:\windows\SysWOW64\QBENKBZ.exe.bat IWMZIO.exe File created C:\windows\SysWOW64\OLY.exe QNZASUG.exe File created C:\windows\SysWOW64\RIPUYI.exe 2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe File created C:\windows\SysWOW64\DLAHHUG.exe.bat RIPUYI.exe File created C:\windows\SysWOW64\IYFDD.exe XFKKDI.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\VRRNJW.exe PRJ.exe File created C:\windows\UWVSB.exe UQCEALN.exe File created C:\windows\IFZX.exe.bat LZBAX.exe File created C:\windows\system\YPVBHI.exe.bat NWSIZB.exe File opened for modification C:\windows\system\ILKTU.exe OXFK.exe File opened for modification C:\windows\RCOKK.exe DWR.exe File created C:\windows\OQVQJRM.exe.bat JFRJDZ.exe File opened for modification C:\windows\IFZX.exe LZBAX.exe File opened for modification C:\windows\NZGW.exe FGXC.exe File created C:\windows\system\DWR.exe PUNP.exe File opened for modification C:\windows\system\YPVBHI.exe NWSIZB.exe File created C:\windows\PASLG.exe.bat PUZXXMR.exe File created C:\windows\TQO.exe.bat RSNR.exe File created C:\windows\system\LEO.exe JGNWB.exe File created C:\windows\system\ZWLL.exe XYRRE.exe File created C:\windows\BNJMF.exe EPD.exe File created C:\windows\ITIJLKX.exe NGEABL.exe File opened for modification C:\windows\VRRNJW.exe PRJ.exe File created C:\windows\BSZ.exe VRRNJW.exe File created C:\windows\system\FMFCTAZ.exe IHANM.exe File created C:\windows\system\JVGMQ.exe VPIPJ.exe File opened for modification C:\windows\system\ZXPOR.exe ZMGUD.exe File created C:\windows\system\EPD.exe YPVBHI.exe File created C:\windows\system\QRZJZ.exe.bat FYWQ.exe File created C:\windows\system\HWRRUA.exe MAMI.exe File opened for modification C:\windows\system\KOOPGM.exe XEKRBUX.exe File opened for modification C:\windows\PRKWLDM.exe KOOPGM.exe File created C:\windows\system\DUBAQF.exe.bat AEUA.exe File opened for modification C:\windows\ITIJLKX.exe NGEABL.exe File created C:\windows\FYDXI.exe MUSTCN.exe File created C:\windows\RSNR.exe UNP.exe File created C:\windows\system\EHSKW.exe.bat CJZQPD.exe File opened for modification C:\windows\system\JFRJDZ.exe LPSHSG.exe File created C:\windows\ZYPCIUL.exe FLKTY.exe File created C:\windows\WRBV.exe.bat HWRRUA.exe File opened for modification C:\windows\system\ZLXD.exe RFXW.exe File created C:\windows\IFZX.exe LZBAX.exe File created C:\windows\system\IRLO.exe YQJJCPE.exe File created C:\windows\FNUTP.exe.bat IIOW.exe File opened for modification C:\windows\YXBDHL.exe WZIJJ.exe File opened for modification C:\windows\QQE.exe TLGNBWE.exe File created C:\windows\system\TWUKN.exe KIJ.exe File created C:\windows\system\WZIJJ.exe NZGW.exe File opened for modification C:\windows\VLVF.exe TWUKN.exe File created C:\windows\system\IIOW.exe GKV.exe File created C:\windows\system\HFHHEW.exe FIONX.exe File created C:\windows\system\JFRJDZ.exe LPSHSG.exe File created C:\windows\system\QAZFDDE.exe.bat OLY.exe File created C:\windows\system\GHKEVP.exe YXBDHL.exe File opened for modification C:\windows\OIC.exe PSE.exe File created C:\windows\UWVSB.exe.bat UQCEALN.exe File created C:\windows\XFKKDI.exe JVGMQ.exe File created C:\windows\system\ZLXD.exe.bat RFXW.exe File opened for modification C:\windows\RSNR.exe UNP.exe File created C:\windows\ZYPCIUL.exe.bat FLKTY.exe File created C:\windows\system\QTT.exe LIXDHPA.exe File created C:\windows\system\PUNP.exe QBENKBZ.exe File opened for modification C:\windows\system\LZBAX.exe YXXB.exe File created C:\windows\system\ILKTU.exe.bat OXFK.exe File created C:\windows\system\VCIO.exe.bat PCAALUK.exe File created C:\windows\FLKTY.exe VCIO.exe File created C:\windows\system\NKLCE.exe SWG.exe File created C:\windows\system\AEUA.exe.bat OLR.exe File created C:\windows\QVG.exe.bat FCDEKGO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 252 cmd.exe 5608 cmd.exe 3228 cmd.exe 2152 cmd.exe 4204 cmd.exe 5524 cmd.exe 3908 cmd.exe 3932 cmd.exe 3492 cmd.exe 1472 cmd.exe 5860 cmd.exe 1928 cmd.exe 5380 cmd.exe 3696 cmd.exe 4232 cmd.exe 2364 cmd.exe 3820 cmd.exe 3944 cmd.exe 5572 cmd.exe 2404 cmd.exe 3428 cmd.exe 4624 cmd.exe 6132 cmd.exe 4504 cmd.exe 2356 cmd.exe 2708 cmd.exe 5044 cmd.exe 1408 cmd.exe 4296 cmd.exe 2604 cmd.exe 5116 cmd.exe 1556 cmd.exe 1732 cmd.exe 2056 cmd.exe 5100 cmd.exe 3956 cmd.exe 3844 cmd.exe 4940 cmd.exe 5128 cmd.exe 2476 cmd.exe 1896 cmd.exe 3312 cmd.exe 5936 cmd.exe 4564 cmd.exe 3004 cmd.exe 4280 cmd.exe 1752 cmd.exe 2600 cmd.exe 4680 cmd.exe 2912 cmd.exe 5728 cmd.exe 3120 cmd.exe 4252 cmd.exe 3332 cmd.exe 2712 cmd.exe 5968 cmd.exe 1464 cmd.exe 4548 cmd.exe 4328 cmd.exe 1452 cmd.exe 4968 cmd.exe 5724 cmd.exe 4652 cmd.exe 4584 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1928 4136 WerFault.exe 88 3420 2316 WerFault.exe 94 2788 4420 WerFault.exe 100 1804 3568 WerFault.exe 105 4860 3772 WerFault.exe 110 5804 1388 WerFault.exe 115 820 2644 WerFault.exe 120 1560 1044 WerFault.exe 124 2036 3320 WerFault.exe 130 6120 5404 WerFault.exe 135 6020 5000 WerFault.exe 140 5148 4496 WerFault.exe 145 4640 4888 WerFault.exe 150 956 1864 WerFault.exe 154 1668 6092 WerFault.exe 160 1632 3872 WerFault.exe 165 3108 3968 WerFault.exe 170 5952 5096 WerFault.exe 175 1672 5376 WerFault.exe 180 3044 5472 WerFault.exe 185 2420 4768 WerFault.exe 190 5148 2988 WerFault.exe 195 4640 2896 WerFault.exe 200 2056 3580 WerFault.exe 205 1960 956 WerFault.exe 210 2660 4108 WerFault.exe 215 1164 796 WerFault.exe 220 2984 4412 WerFault.exe 225 4428 2396 WerFault.exe 230 1796 5072 WerFault.exe 235 5492 5844 WerFault.exe 240 4660 3600 WerFault.exe 245 5632 5900 WerFault.exe 250 2464 6068 WerFault.exe 255 424 3948 WerFault.exe 260 5188 4776 WerFault.exe 265 5428 3240 WerFault.exe 270 1700 1560 WerFault.exe 275 3288 964 WerFault.exe 280 4696 2920 WerFault.exe 285 4540 5996 WerFault.exe 291 5628 1156 WerFault.exe 296 3312 4772 WerFault.exe 301 4296 5508 WerFault.exe 306 5044 1364 WerFault.exe 311 1164 4880 WerFault.exe 316 2328 4196 WerFault.exe 321 3364 5716 WerFault.exe 326 3428 3300 WerFault.exe 331 2404 2756 WerFault.exe 336 4312 6040 WerFault.exe 341 2492 3440 WerFault.exe 346 4160 4972 WerFault.exe 351 5028 3056 WerFault.exe 356 1524 4988 WerFault.exe 361 6124 420 WerFault.exe 366 120 4324 WerFault.exe 371 5568 4572 WerFault.exe 376 6100 5788 WerFault.exe 381 4652 1040 WerFault.exe 386 6044 1600 WerFault.exe 391 3500 816 WerFault.exe 396 2416 3644 WerFault.exe 401 4668 5028 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NZGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHSKW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLARW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQCEALN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJZQPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TMBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQVAID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BSZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKCTBFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAHXLBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUSJOJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUBAQF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZYPCIUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFRJDZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLKTY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKZEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUZXXMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IYFDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFHHEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNZASUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLGNBWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIXDHPA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4136 2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe 4136 2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe 2316 RIPUYI.exe 2316 RIPUYI.exe 4420 DLAHHUG.exe 4420 DLAHHUG.exe 3568 XYFQ.exe 3568 XYFQ.exe 3772 NWSIZB.exe 3772 NWSIZB.exe 1388 YPVBHI.exe 1388 YPVBHI.exe 2644 EPD.exe 2644 EPD.exe 1044 BNJMF.exe 1044 BNJMF.exe 3320 OXFK.exe 3320 OXFK.exe 5404 ILKTU.exe 5404 ILKTU.exe 5000 OLR.exe 5000 OLR.exe 4496 AEUA.exe 4496 AEUA.exe 4888 DUBAQF.exe 4888 DUBAQF.exe 1864 PMW.exe 1864 PMW.exe 6092 FCDEKGO.exe 6092 FCDEKGO.exe 3872 QVG.exe 3872 QVG.exe 3968 NAD.exe 3968 NAD.exe 5096 NGEABL.exe 5096 NGEABL.exe 5376 ITIJLKX.exe 5376 ITIJLKX.exe 5472 PMR.exe 5472 PMR.exe 4768 PRJ.exe 4768 PRJ.exe 2988 VRRNJW.exe 2988 VRRNJW.exe 2896 BSZ.exe 2896 BSZ.exe 3580 MKCTBFY.exe 3580 MKCTBFY.exe 956 YDF.exe 956 YDF.exe 4108 SQBWL.exe 4108 SQBWL.exe 796 YQJJCPE.exe 796 YQJJCPE.exe 4412 IRLO.exe 4412 IRLO.exe 2396 EWRMN.exe 2396 EWRMN.exe 5072 PPUEVDP.exe 5072 PPUEVDP.exe 5844 MUSTCN.exe 5844 MUSTCN.exe 3600 FYDXI.exe 3600 FYDXI.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4136 2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe 4136 2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe 2316 RIPUYI.exe 2316 RIPUYI.exe 4420 DLAHHUG.exe 4420 DLAHHUG.exe 3568 XYFQ.exe 3568 XYFQ.exe 3772 NWSIZB.exe 3772 NWSIZB.exe 1388 YPVBHI.exe 1388 YPVBHI.exe 2644 EPD.exe 2644 EPD.exe 1044 BNJMF.exe 1044 BNJMF.exe 3320 OXFK.exe 3320 OXFK.exe 5404 ILKTU.exe 5404 ILKTU.exe 5000 OLR.exe 5000 OLR.exe 4496 AEUA.exe 4496 AEUA.exe 4888 DUBAQF.exe 4888 DUBAQF.exe 1864 PMW.exe 1864 PMW.exe 6092 FCDEKGO.exe 6092 FCDEKGO.exe 3872 QVG.exe 3872 QVG.exe 3968 NAD.exe 3968 NAD.exe 5096 NGEABL.exe 5096 NGEABL.exe 5376 ITIJLKX.exe 5376 ITIJLKX.exe 5472 PMR.exe 5472 PMR.exe 4768 PRJ.exe 4768 PRJ.exe 2988 VRRNJW.exe 2988 VRRNJW.exe 2896 BSZ.exe 2896 BSZ.exe 3580 MKCTBFY.exe 3580 MKCTBFY.exe 956 YDF.exe 956 YDF.exe 4108 SQBWL.exe 4108 SQBWL.exe 796 YQJJCPE.exe 796 YQJJCPE.exe 4412 IRLO.exe 4412 IRLO.exe 2396 EWRMN.exe 2396 EWRMN.exe 5072 PPUEVDP.exe 5072 PPUEVDP.exe 5844 MUSTCN.exe 5844 MUSTCN.exe 3600 FYDXI.exe 3600 FYDXI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4136 wrote to memory of 1016 4136 2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe 90 PID 1016 wrote to memory of 2316 1016 cmd.exe 94 PID 2316 wrote to memory of 2708 2316 RIPUYI.exe 96 PID 2708 wrote to memory of 4420 2708 cmd.exe 100 PID 4420 wrote to memory of 4876 4420 DLAHHUG.exe 101 PID 4876 wrote to memory of 3568 4876 cmd.exe 105 PID 3568 wrote to memory of 2476 3568 XYFQ.exe 106 PID 2476 wrote to memory of 3772 2476 cmd.exe 110 PID 3772 wrote to memory of 3264 3772 NWSIZB.exe 111 PID 3264 wrote to memory of 1388 3264 cmd.exe 115 PID 1388 wrote to memory of 2976 1388 YPVBHI.exe 116 PID 2976 wrote to memory of 2644 2976 cmd.exe 120 PID 2644 wrote to memory of 5984 2644 EPD.exe 121 PID 5984 wrote to memory of 1044 5984 cmd.exe 124 PID 1044 wrote to memory of 1200 1044 BNJMF.exe 126 PID 1200 wrote to memory of 3320 1200 cmd.exe 130 PID 3320 wrote to memory of 1368 3320 OXFK.exe 131 PID 1368 wrote to memory of 5404 1368 cmd.exe 135 PID 5404 wrote to memory of 2600 5404 ILKTU.exe 136 PID 2600 wrote to memory of 5000 2600 cmd.exe 140 PID 5000 wrote to memory of 4344 5000 OLR.exe 141 PID 4344 wrote to memory of 4496 4344 cmd.exe 145 PID 4496 wrote to memory of 2848 4496 AEUA.exe 146 PID 2848 wrote to memory of 4888 2848 cmd.exe 150 PID 4888 wrote to memory of 3256 4888 DUBAQF.exe 151 PID 3256 wrote to memory of 1864 3256 cmd.exe 154 PID 1864 wrote to memory of 4648 1864 PMW.exe 156 PID 4648 wrote to memory of 6092 4648 cmd.exe 160 PID 6092 wrote to memory of 5768 6092 FCDEKGO.exe 161 PID 5768 wrote to memory of 3872 5768 cmd.exe 165 PID 3872 wrote to memory of 3272 3872 QVG.exe 166 PID 3272 wrote to memory of 3968 3272 cmd.exe 170 PID 3968 wrote to memory of 5968 3968 NAD.exe 171 PID 5968 wrote to memory of 5096 5968 cmd.exe 175 PID 5096 wrote to memory of 5412 5096 NGEABL.exe 176 PID 5412 wrote to memory of 5376 5412 cmd.exe 180 PID 5376 wrote to memory of 5364 5376 ITIJLKX.exe 181 PID 5364 wrote to memory of 5472 5364 cmd.exe 185 PID 5472 wrote to memory of 1464 5472 PMR.exe 186 PID 1464 wrote to memory of 4768 1464 cmd.exe 190 PID 4768 wrote to memory of 1556 4768 PRJ.exe 191 PID 1556 wrote to memory of 2988 1556 cmd.exe 195 PID 2988 wrote to memory of 4548 2988 VRRNJW.exe 196 PID 4548 wrote to memory of 2896 4548 cmd.exe 200 PID 2896 wrote to memory of 784 2896 BSZ.exe 201 PID 784 wrote to memory of 3580 784 cmd.exe 205 PID 3580 wrote to memory of 4680 3580 MKCTBFY.exe 206 PID 4680 wrote to memory of 956 4680 cmd.exe 210 PID 956 wrote to memory of 4860 956 YDF.exe 211 PID 4860 wrote to memory of 4108 4860 cmd.exe 215 PID 4108 wrote to memory of 5860 4108 SQBWL.exe 216 PID 5860 wrote to memory of 796 5860 cmd.exe 220 PID 796 wrote to memory of 416 796 YQJJCPE.exe 221 PID 416 wrote to memory of 4412 416 cmd.exe 225 PID 4412 wrote to memory of 2356 4412 IRLO.exe 226 PID 2356 wrote to memory of 2396 2356 cmd.exe 230 PID 2396 wrote to memory of 4156 2396 EWRMN.exe 231 PID 4156 wrote to memory of 5072 4156 cmd.exe 235 PID 5072 wrote to memory of 2540 5072 PPUEVDP.exe 236 PID 2540 wrote to memory of 5844 2540 cmd.exe 240 PID 5844 wrote to memory of 3228 5844 MUSTCN.exe 241 PID 3228 wrote to memory of 3600 3228 cmd.exe 245 PID 3600 wrote to memory of 4924 3600 FYDXI.exe 246 PID 4924 wrote to memory of 5900 4924 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_b5eb8aba298f81bd20dda71c3f3f97d3_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIPUYI.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\windows\SysWOW64\RIPUYI.exeC:\windows\system32\RIPUYI.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLAHHUG.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\windows\SysWOW64\DLAHHUG.exeC:\windows\system32\DLAHHUG.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYFQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\XYFQ.exeC:\windows\XYFQ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWSIZB.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\windows\SysWOW64\NWSIZB.exeC:\windows\system32\NWSIZB.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPVBHI.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\system\YPVBHI.exeC:\windows\system\YPVBHI.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPD.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\system\EPD.exeC:\windows\system\EPD.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\windows\BNJMF.exeC:\windows\BNJMF.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OXFK.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\windows\SysWOW64\OXFK.exeC:\windows\system32\OXFK.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILKTU.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\windows\system\ILKTU.exeC:\windows\system\ILKTU.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLR.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\SysWOW64\OLR.exeC:\windows\system32\OLR.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AEUA.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\windows\system\AEUA.exeC:\windows\system\AEUA.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DUBAQF.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\windows\system\DUBAQF.exeC:\windows\system\DUBAQF.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMW.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\SysWOW64\PMW.exeC:\windows\system32\PMW.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCDEKGO.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\SysWOW64\FCDEKGO.exeC:\windows\system32\FCDEKGO.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVG.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\QVG.exeC:\windows\QVG.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAD.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\windows\NAD.exeC:\windows\NAD.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NGEABL.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\system\NGEABL.exeC:\windows\system\NGEABL.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ITIJLKX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\windows\ITIJLKX.exeC:\windows\ITIJLKX.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMR.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\SysWOW64\PMR.exeC:\windows\system32\PMR.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJ.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\windows\SysWOW64\PRJ.exeC:\windows\system32\PRJ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRRNJW.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\windows\VRRNJW.exeC:\windows\VRRNJW.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BSZ.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\BSZ.exeC:\windows\BSZ.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKCTBFY.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\windows\system\MKCTBFY.exeC:\windows\system\MKCTBFY.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDF.exe.bat" "48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\system\YDF.exeC:\windows\system\YDF.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQBWL.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\windows\system\SQBWL.exeC:\windows\system\SQBWL.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQJJCPE.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\windows\system\YQJJCPE.exeC:\windows\system\YQJJCPE.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRLO.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:416 -
C:\windows\system\IRLO.exeC:\windows\system\IRLO.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWRMN.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\system\EWRMN.exeC:\windows\system\EWRMN.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUSTCN.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\SysWOW64\MUSTCN.exeC:\windows\system32\MUSTCN.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\windows\FYDXI.exeC:\windows\FYDXI.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYLLZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\SysWOW64\KYLLZ.exeC:\windows\system32\KYLLZ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLIU.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2152 -
C:\windows\SysWOW64\FLIU.exeC:\windows\system32\FLIU.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WLKZMC.exe.bat" "68⤵PID:4672
-
C:\windows\WLKZMC.exeC:\windows\WLKZMC.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMR.exe.bat" "70⤵PID:5540
-
C:\windows\SysWOW64\CMR.exeC:\windows\system32\CMR.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHWWG.exe.bat" "72⤵PID:1632
-
C:\windows\XHWWG.exeC:\windows\XHWWG.exe73⤵
- Executes dropped EXE
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PCAALUK.exe.bat" "74⤵PID:5020
-
C:\windows\SysWOW64\PCAALUK.exeC:\windows\system32\PCAALUK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCIO.exe.bat" "76⤵PID:1180
-
C:\windows\system\VCIO.exeC:\windows\system\VCIO.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FLKTY.exe.bat" "78⤵
- Executes a command shell one-liner
PID:1896 -
C:\windows\FLKTY.exeC:\windows\FLKTY.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZYPCIUL.exe.bat" "80⤵PID:5528
-
C:\windows\ZYPCIUL.exeC:\windows\ZYPCIUL.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYWQ.exe.bat" "82⤵PID:1188
-
C:\windows\SysWOW64\FYWQ.exeC:\windows\system32\FYWQ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QRZJZ.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:940 -
C:\windows\system\QRZJZ.exeC:\windows\system\QRZJZ.exe85⤵
- Executes dropped EXE
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZBODBD.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5084 -
C:\windows\system\IZBODBD.exeC:\windows\system\IZBODBD.exe87⤵
- Executes dropped EXE
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORJC.exe.bat" "88⤵PID:6036
-
C:\windows\system\ORJC.exeC:\windows\system\ORJC.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XADPX.exe.bat" "90⤵PID:3620
-
C:\windows\SysWOW64\XADPX.exeC:\windows\system32\XADPX.exe91⤵
- Executes dropped EXE
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TFJEE.exe.bat" "92⤵PID:1692
-
C:\windows\TFJEE.exeC:\windows\TFJEE.exe93⤵
- Executes dropped EXE
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MAMI.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:260 -
C:\windows\system\MAMI.exeC:\windows\system\MAMI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWRRUA.exe.bat" "96⤵PID:4508
-
C:\windows\system\HWRRUA.exeC:\windows\system\HWRRUA.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRBV.exe.bat" "98⤵PID:6096
-
C:\windows\WRBV.exeC:\windows\WRBV.exe99⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SWG.exe.bat" "100⤵PID:4400
-
C:\windows\SysWOW64\SWG.exeC:\windows\system32\SWG.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NKLCE.exe.bat" "102⤵
- Executes a command shell one-liner
PID:1928 -
C:\windows\system\NKLCE.exeC:\windows\system\NKLCE.exe103⤵
- Executes dropped EXE
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHEEDT.exe.bat" "104⤵PID:1196
-
C:\windows\system\PHEEDT.exeC:\windows\system\PHEEDT.exe105⤵
- Executes dropped EXE
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAHXLBO.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3312 -
C:\windows\SysWOW64\AAHXLBO.exeC:\windows\system32\AAHXLBO.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NDMVQS.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5936 -
C:\windows\SysWOW64\NDMVQS.exeC:\windows\system32\NDMVQS.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIJ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:5044 -
C:\windows\SysWOW64\KIJ.exeC:\windows\system32\KIJ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWUKN.exe.bat" "112⤵PID:2852
-
C:\windows\system\TWUKN.exeC:\windows\system\TWUKN.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLVF.exe.bat" "114⤵PID:5916
-
C:\windows\VLVF.exeC:\windows\VLVF.exe115⤵
- Executes dropped EXE
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IWRLY.exe.bat" "116⤵PID:1672
-
C:\windows\system\IWRLY.exeC:\windows\system\IWRLY.exe117⤵
- Executes dropped EXE
PID:5788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IHANM.exe.bat" "118⤵PID:1468
-
C:\windows\system\IHANM.exeC:\windows\system\IHANM.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMFCTAZ.exe.bat" "120⤵PID:4932
-
C:\windows\system\FMFCTAZ.exeC:\windows\system\FMFCTAZ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-