Analysis
- max time kernel
69s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_ea77208ed147ea33ab50aaa5db4d3974_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_ea77208ed147ea33ab50aaa5db4d3974_elex_emotet_stop.exe
- Size 208KB
- Sample261023-ewm6gswves
- SHA256 c8c8fce16eeb4aae7c74ef14ad0ce971fd578d9f5f47b83def2e668afb13558a
- MD5 ea77208ed147ea33ab50aaa5db4d3974
- SHA1 a792445d74b583fc619d367c789426d8c62f20eb
- SHA512 a3008e1cac44df4e1e8103be15af0c55f291a5b80987514153d7a4dc6b1df137282bcb0b66c1936defe98e2246e9b39f67d1a7ae63bb6b959f5e0deb93b45021
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfD4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOrkEj1
- TLSH T176247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4780 UTEG.exe 2156 LCHSIMK.exe 4200 CCB.exe 4364 GSQXY.exe 2432 PSKKBHC.exe 1640 SGP.exe 2660 QGWHDB.exe 2564 STBRFBP.exe 5744 NOGA.exe 3540 NUGPR.exe 960 IHLYBNV.exe 2424 XCVCM.exe 2752 HAAX.exe 1868 HOALD.exe 2620 WJK.exe 2928 QWPH.exe 5036 LJTQII.exe 6000 MMX.exe 4996 GACVY.exe 5792 BNHFIXY.exe 5516 QDIEH.exe 836 EOQ.exe 3512 ETQR.exe 3064 JUYFOL.exe 3476 PUG.exe 2644 BNJMF.exe 2640 XSHB.exe 3200 MYMYTG.exe 5444 UDNMVTC.exe 1740 AEUA.exe 1332 LWPTM.exe 5676 UERYXA.exe 2256 JZBC.exe 3460 ENFUTM.exe 4712 PFIETCA.exe 720 AYLX.exe 4616 GYTL.exe 2312 BMYUVL.exe 4300 METNDTN.exe 5692 QUZV.exe 4108 RPD.exe 1500 PIOHDHG.exe 5804 VIWVMJH.exe 4532 ZQCVYTD.exe 1892 PGD.exe 4552 AZGN.exe 5088 YZOAWYJ.exe 3912 EZWO.exe 3564 PSR.exe 2320 VSYVX.exe 2276 VYYJYP.exe 3264 GRBCGXL.exe 4248 MRJQQ.exe 1116 UJKJD.exe 1456 WHLLC.exe 2352 QUQVMAY.exe 3440 CNL.exe 4940 BYT.exe 1680 JDUV.exe 4376 YJRSRI.exe 2416 PWCKGFV.exe 2988 GHAIGZQ.exe 1444 MHIW.exe 6128 INGTWD.exe - Drops file in System32 directory 63 IoCs
description ioc Process File created C:\windows\SysWOW64\JUYFOL.exe.bat ETQR.exe File opened for modification C:\windows\SysWOW64\PUG.exe JUYFOL.exe File created C:\windows\SysWOW64\AZGN.exe.bat PGD.exe File opened for modification C:\windows\SysWOW64\UJKJD.exe MRJQQ.exe File created C:\windows\SysWOW64\XSHB.exe.bat BNJMF.exe File opened for modification C:\windows\SysWOW64\VYYJYP.exe VSYVX.exe File created C:\windows\SysWOW64\NAAA.exe.bat CHF.exe File created C:\windows\SysWOW64\HEO.exe.bat BDGSEZ.exe File created C:\windows\SysWOW64\NJVIYI.exe HJO.exe File created C:\windows\SysWOW64\HEO.exe BDGSEZ.exe File opened for modification C:\windows\SysWOW64\NUGPR.exe NOGA.exe File created C:\windows\SysWOW64\IHLYBNV.exe NUGPR.exe File created C:\windows\SysWOW64\MMX.exe LJTQII.exe File created C:\windows\SysWOW64\QUZV.exe METNDTN.exe File opened for modification C:\windows\SysWOW64\AZGN.exe PGD.exe File opened for modification C:\windows\SysWOW64\PWCKGFV.exe YJRSRI.exe File created C:\windows\SysWOW64\ENFUTM.exe.bat JZBC.exe File created C:\windows\SysWOW64\UJKJD.exe.bat MRJQQ.exe File created C:\windows\SysWOW64\PWCKGFV.exe.bat YJRSRI.exe File opened for modification C:\windows\SysWOW64\GRBCGXL.exe VYYJYP.exe File created C:\windows\SysWOW64\INGTWD.exe MHIW.exe File opened for modification C:\windows\SysWOW64\CZQZEEP.exe CLQKVR.exe File opened for modification C:\windows\SysWOW64\ENFUTM.exe JZBC.exe File opened for modification C:\windows\SysWOW64\QUZV.exe METNDTN.exe File created C:\windows\SysWOW64\VYYJYP.exe VSYVX.exe File opened for modification C:\windows\SysWOW64\HJO.exe HEO.exe File created C:\windows\SysWOW64\HJO.exe.bat HEO.exe File created C:\windows\SysWOW64\PFIETCA.exe ENFUTM.exe File opened for modification C:\windows\SysWOW64\NAAA.exe CHF.exe File created C:\windows\SysWOW64\ETQR.exe.bat EOQ.exe File created C:\windows\SysWOW64\JUYFOL.exe ETQR.exe File created C:\windows\SysWOW64\XSHB.exe BNJMF.exe File created C:\windows\SysWOW64\PWCKGFV.exe YJRSRI.exe File created C:\windows\SysWOW64\NAAA.exe CHF.exe File opened for modification C:\windows\SysWOW64\XSHB.exe BNJMF.exe File created C:\windows\SysWOW64\VYYJYP.exe.bat VSYVX.exe File created C:\windows\SysWOW64\INGTWD.exe.bat MHIW.exe File created C:\windows\SysWOW64\HJO.exe HEO.exe File created C:\windows\SysWOW64\NJVIYI.exe.bat HJO.exe File created C:\windows\SysWOW64\MMX.exe.bat LJTQII.exe File created C:\windows\SysWOW64\ENFUTM.exe JZBC.exe File created C:\windows\SysWOW64\QUZV.exe.bat METNDTN.exe File created C:\windows\SysWOW64\UJKJD.exe MRJQQ.exe File created C:\windows\SysWOW64\CZQZEEP.exe.bat CLQKVR.exe File created C:\windows\SysWOW64\PUG.exe.bat JUYFOL.exe File opened for modification C:\windows\SysWOW64\NJVIYI.exe HJO.exe File created C:\windows\SysWOW64\NUGPR.exe NOGA.exe File created C:\windows\SysWOW64\NUGPR.exe.bat NOGA.exe File opened for modification C:\windows\SysWOW64\INGTWD.exe MHIW.exe File created C:\windows\SysWOW64\IHLYBNV.exe.bat NUGPR.exe File created C:\windows\SysWOW64\ETQR.exe EOQ.exe File created C:\windows\SysWOW64\GRBCGXL.exe VYYJYP.exe File created C:\windows\SysWOW64\GRBCGXL.exe.bat VYYJYP.exe File opened for modification C:\windows\SysWOW64\HEO.exe BDGSEZ.exe File opened for modification C:\windows\SysWOW64\JUYFOL.exe ETQR.exe File created C:\windows\SysWOW64\PUG.exe JUYFOL.exe File opened for modification C:\windows\SysWOW64\PFIETCA.exe ENFUTM.exe File created C:\windows\SysWOW64\PFIETCA.exe.bat ENFUTM.exe File created C:\windows\SysWOW64\AZGN.exe PGD.exe File created C:\windows\SysWOW64\CZQZEEP.exe CLQKVR.exe File opened for modification C:\windows\SysWOW64\IHLYBNV.exe NUGPR.exe File opened for modification C:\windows\SysWOW64\MMX.exe LJTQII.exe File opened for modification C:\windows\SysWOW64\ETQR.exe EOQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\ZPCSPWA.exe DKWUIMY.exe File created C:\windows\system\CCB.exe LCHSIMK.exe File created C:\windows\system\XCVCM.exe.bat IHLYBNV.exe File created C:\windows\system\LWPTM.exe.bat AEUA.exe File opened for modification C:\windows\VIWVMJH.exe PIOHDHG.exe File created C:\windows\system\PGD.exe ZQCVYTD.exe File opened for modification C:\windows\system\PGD.exe ZQCVYTD.exe File created C:\windows\GHAIGZQ.exe PWCKGFV.exe File created C:\windows\GEQXT.exe.bat MRL.exe File opened for modification C:\windows\system\UTEG.exe 2026-10-22_ea77208ed147ea33ab50aaa5db4d3974_elex_emotet_stop.exe File created C:\windows\GSQXY.exe CCB.exe File opened for modification C:\windows\system\HOALD.exe HAAX.exe File created C:\windows\QDIEH.exe BNHFIXY.exe File opened for modification C:\windows\QDIEH.exe BNHFIXY.exe File created C:\windows\BNJMF.exe.bat PUG.exe File opened for modification C:\windows\system\UERYXA.exe LWPTM.exe File opened for modification C:\windows\YZOAWYJ.exe AZGN.exe File created C:\windows\system\HOALD.exe.bat HAAX.exe File created C:\windows\MYMYTG.exe.bat XSHB.exe File created C:\windows\BMYUVL.exe.bat GYTL.exe File created C:\windows\PIOHDHG.exe.bat RPD.exe File created C:\windows\system\JDUV.exe.bat BYT.exe File opened for modification C:\windows\GHAIGZQ.exe PWCKGFV.exe File opened for modification C:\windows\MHIW.exe GHAIGZQ.exe File created C:\windows\ODWP.exe IDOBLUD.exe File created C:\windows\system\STBRFBP.exe.bat QGWHDB.exe File opened for modification C:\windows\system\WJK.exe HOALD.exe File created C:\windows\system\GACVY.exe MMX.exe File created C:\windows\system\METNDTN.exe BMYUVL.exe File created C:\windows\ZQCVYTD.exe.bat VIWVMJH.exe File created C:\windows\system\EZWO.exe YZOAWYJ.exe File opened for modification C:\windows\system\TESRM.exe CZQZEEP.exe File created C:\windows\system\EXVK.exe.bat TESRM.exe File opened for modification C:\windows\system\CCB.exe LCHSIMK.exe File opened for modification C:\windows\system\PSKKBHC.exe GSQXY.exe File opened for modification C:\windows\system\UDNMVTC.exe MYMYTG.exe File created C:\windows\system\UERYXA.exe.bat LWPTM.exe File opened for modification C:\windows\VSYVX.exe PSR.exe File opened for modification C:\windows\CNL.exe QUQVMAY.exe File created C:\windows\YJRSRI.exe JDUV.exe File created C:\windows\TFJEE.exe.bat INGTWD.exe File created C:\windows\VSYVX.exe.bat PSR.exe File created C:\windows\VYJHA.exe.bat ENKSA.exe File created C:\windows\system\AYQVJVA.exe.bat VYJHA.exe File opened for modification C:\windows\system\NFXPYGV.exe EXVK.exe File opened for modification C:\windows\VDY.exe KKDMNPX.exe File opened for modification C:\windows\GSQXY.exe CCB.exe File created C:\windows\system\XCVCM.exe IHLYBNV.exe File created C:\windows\HAAX.exe XCVCM.exe File opened for modification C:\windows\ZQCVYTD.exe VIWVMJH.exe File created C:\windows\YJRSRI.exe.bat JDUV.exe File opened for modification C:\windows\ODWP.exe IDOBLUD.exe File opened for modification C:\windows\system\CHF.exe FKZ.exe File opened for modification C:\windows\system\LCHSIMK.exe UTEG.exe File created C:\windows\system\UDNMVTC.exe MYMYTG.exe File created C:\windows\system\AYLX.exe PFIETCA.exe File created C:\windows\BYT.exe CNL.exe File created C:\windows\ZWRID.exe.bat ODWP.exe File created C:\windows\system\CHF.exe.bat FKZ.exe File opened for modification C:\windows\CLQKVR.exe LGFSNV.exe File created C:\windows\BDGSEZ.exe.bat VDY.exe File opened for modification C:\windows\system\QWPH.exe WJK.exe File opened for modification C:\windows\BNJMF.exe PUG.exe File created C:\windows\PSR.exe.bat EZWO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4544 cmd.exe 3576 cmd.exe 4572 cmd.exe 3204 cmd.exe 3516 cmd.exe 4368 cmd.exe 4788 cmd.exe 2732 cmd.exe 5312 cmd.exe 4960 cmd.exe 3244 cmd.exe 4672 cmd.exe 1716 cmd.exe 3164 cmd.exe 2940 cmd.exe 2460 cmd.exe 5800 cmd.exe 1728 cmd.exe 4328 cmd.exe 3216 cmd.exe 1572 cmd.exe 3400 cmd.exe 5912 cmd.exe 4492 cmd.exe 1292 cmd.exe 4296 cmd.exe 3040 cmd.exe 2784 cmd.exe 3356 cmd.exe 760 cmd.exe 4120 cmd.exe 2796 cmd.exe 1900 cmd.exe 6036 cmd.exe 2676 cmd.exe 4888 cmd.exe 3828 cmd.exe 5260 cmd.exe 6020 cmd.exe 2116 cmd.exe 3396 cmd.exe 2900 cmd.exe 3424 cmd.exe 3456 cmd.exe 1156 cmd.exe 3580 cmd.exe 5080 cmd.exe 3556 cmd.exe 6068 cmd.exe 2136 cmd.exe 5788 cmd.exe 5720 cmd.exe 2956 cmd.exe 5832 cmd.exe 1340 cmd.exe 4740 cmd.exe 3808 cmd.exe 4400 cmd.exe 1568 cmd.exe 1160 cmd.exe 4624 cmd.exe 1684 cmd.exe 696 cmd.exe 3248 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3040 5068 WerFault.exe 88 5240 4780 WerFault.exe 94 2788 2156 WerFault.exe 100 4872 4200 WerFault.exe 105 4292 4364 WerFault.exe 110 1728 2432 WerFault.exe 115 3292 1640 WerFault.exe 120 2484 2660 WerFault.exe 125 2860 2564 WerFault.exe 130 4876 5744 WerFault.exe 135 1180 3540 WerFault.exe 140 2784 960 WerFault.exe 145 3512 2424 WerFault.exe 150 5804 2752 WerFault.exe 155 5800 1868 WerFault.exe 160 6008 2620 WerFault.exe 165 4832 2928 WerFault.exe 170 5868 5036 WerFault.exe 175 5144 6000 WerFault.exe 180 2184 4996 WerFault.exe 185 5236 5792 WerFault.exe 190 4172 5516 WerFault.exe 195 5560 836 WerFault.exe 200 3372 3512 WerFault.exe 205 3568 3064 WerFault.exe 210 2576 3476 WerFault.exe 215 4552 2644 WerFault.exe 220 3252 2640 WerFault.exe 225 4472 3200 WerFault.exe 230 3120 5444 WerFault.exe 235 5232 1740 WerFault.exe 240 2276 1332 WerFault.exe 245 4784 5676 WerFault.exe 250 3040 2256 WerFault.exe 255 4824 3460 WerFault.exe 260 5076 4712 WerFault.exe 265 5004 720 WerFault.exe 270 1788 4616 WerFault.exe 275 6068 2312 WerFault.exe 280 3044 4300 WerFault.exe 285 4156 5692 WerFault.exe 291 4732 4108 WerFault.exe 296 2180 1500 WerFault.exe 301 1444 5804 WerFault.exe 306 3720 4532 WerFault.exe 311 3260 1892 WerFault.exe 316 5788 4552 WerFault.exe 321 5348 5088 WerFault.exe 326 4120 3912 WerFault.exe 331 5228 3564 WerFault.exe 336 4376 2320 WerFault.exe 341 2748 2276 WerFault.exe 346 4800 3264 WerFault.exe 351 5768 4248 WerFault.exe 356 3652 1116 WerFault.exe 361 5260 1456 WerFault.exe 366 1804 2352 WerFault.exe 371 3008 3440 WerFault.exe 376 5248 4940 WerFault.exe 381 4584 1680 WerFault.exe 386 4344 4376 WerFault.exe 391 4800 2416 WerFault.exe 396 1604 2988 WerFault.exe 401 4724 1444 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUYFOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCHSIMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WJK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMYUVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GRBCGXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENKSA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZOAWYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIOHDHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLQKVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZQZEEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGWHDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIWVMJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWRID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TESRM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNHFIXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QDIEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZWO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5068 2026-10-22_ea77208ed147ea33ab50aaa5db4d3974_elex_emotet_stop.exe 5068 2026-10-22_ea77208ed147ea33ab50aaa5db4d3974_elex_emotet_stop.exe 4780 UTEG.exe 4780 UTEG.exe 2156 LCHSIMK.exe 2156 LCHSIMK.exe 4200 CCB.exe 4200 CCB.exe 4364 GSQXY.exe 4364 GSQXY.exe 2432 PSKKBHC.exe 2432 PSKKBHC.exe 1640 SGP.exe 1640 SGP.exe 2660 QGWHDB.exe 2660 QGWHDB.exe 2564 STBRFBP.exe 2564 STBRFBP.exe 5744 NOGA.exe 5744 NOGA.exe 3540 NUGPR.exe 3540 NUGPR.exe 960 IHLYBNV.exe 960 IHLYBNV.exe 2424 XCVCM.exe 2424 XCVCM.exe 2752 HAAX.exe 2752 HAAX.exe 1868 HOALD.exe 1868 HOALD.exe 2620 WJK.exe 2620 WJK.exe 2928 QWPH.exe 2928 QWPH.exe 5036 LJTQII.exe 5036 LJTQII.exe 6000 MMX.exe 6000 MMX.exe 4996 GACVY.exe 4996 GACVY.exe 5792 BNHFIXY.exe 5792 BNHFIXY.exe 5516 QDIEH.exe 5516 QDIEH.exe 836 EOQ.exe 836 EOQ.exe 3512 ETQR.exe 3512 ETQR.exe 3064 JUYFOL.exe 3064 JUYFOL.exe 3476 PUG.exe 3476 PUG.exe 2644 BNJMF.exe 2644 BNJMF.exe 2640 XSHB.exe 2640 XSHB.exe 3200 MYMYTG.exe 3200 MYMYTG.exe 5444 UDNMVTC.exe 5444 UDNMVTC.exe 1740 AEUA.exe 1740 AEUA.exe 1332 LWPTM.exe 1332 LWPTM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5068 2026-10-22_ea77208ed147ea33ab50aaa5db4d3974_elex_emotet_stop.exe 5068 2026-10-22_ea77208ed147ea33ab50aaa5db4d3974_elex_emotet_stop.exe 4780 UTEG.exe 4780 UTEG.exe 2156 LCHSIMK.exe 2156 LCHSIMK.exe 4200 CCB.exe 4200 CCB.exe 4364 GSQXY.exe 4364 GSQXY.exe 2432 PSKKBHC.exe 2432 PSKKBHC.exe 1640 SGP.exe 1640 SGP.exe 2660 QGWHDB.exe 2660 QGWHDB.exe 2564 STBRFBP.exe 2564 STBRFBP.exe 5744 NOGA.exe 5744 NOGA.exe 3540 NUGPR.exe 3540 NUGPR.exe 960 IHLYBNV.exe 960 IHLYBNV.exe 2424 XCVCM.exe 2424 XCVCM.exe 2752 HAAX.exe 2752 HAAX.exe 1868 HOALD.exe 1868 HOALD.exe 2620 WJK.exe 2620 WJK.exe 2928 QWPH.exe 2928 QWPH.exe 5036 LJTQII.exe 5036 LJTQII.exe 6000 MMX.exe 6000 MMX.exe 4996 GACVY.exe 4996 GACVY.exe 5792 BNHFIXY.exe 5792 BNHFIXY.exe 5516 QDIEH.exe 5516 QDIEH.exe 836 EOQ.exe 836 EOQ.exe 3512 ETQR.exe 3512 ETQR.exe 3064 JUYFOL.exe 3064 JUYFOL.exe 3476 PUG.exe 3476 PUG.exe 2644 BNJMF.exe 2644 BNJMF.exe 2640 XSHB.exe 2640 XSHB.exe 3200 MYMYTG.exe 3200 MYMYTG.exe 5444 UDNMVTC.exe 5444 UDNMVTC.exe 1740 AEUA.exe 1740 AEUA.exe 1332 LWPTM.exe 1332 LWPTM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5068 wrote to memory of 3396 5068 2026-10-22_ea77208ed147ea33ab50aaa5db4d3974_elex_emotet_stop.exe 90 PID 3396 wrote to memory of 4780 3396 cmd.exe 94 PID 4780 wrote to memory of 3400 4780 UTEG.exe 96 PID 3400 wrote to memory of 2156 3400 cmd.exe 100 PID 2156 wrote to memory of 5360 2156 LCHSIMK.exe 101 PID 5360 wrote to memory of 4200 5360 cmd.exe 105 PID 4200 wrote to memory of 4428 4200 CCB.exe 106 PID 4428 wrote to memory of 4364 4428 cmd.exe 110 PID 4364 wrote to memory of 1508 4364 GSQXY.exe 111 PID 1508 wrote to memory of 2432 1508 cmd.exe 115 PID 2432 wrote to memory of 5896 2432 PSKKBHC.exe 116 PID 5896 wrote to memory of 1640 5896 cmd.exe 120 PID 1640 wrote to memory of 4844 1640 SGP.exe 121 PID 4844 wrote to memory of 2660 4844 cmd.exe 125 PID 2660 wrote to memory of 4104 2660 QGWHDB.exe 126 PID 4104 wrote to memory of 2564 4104 cmd.exe 130 PID 2564 wrote to memory of 5628 2564 STBRFBP.exe 131 PID 5628 wrote to memory of 5744 5628 cmd.exe 135 PID 5744 wrote to memory of 5164 5744 NOGA.exe 136 PID 5164 wrote to memory of 3540 5164 cmd.exe 140 PID 3540 wrote to memory of 1424 3540 NUGPR.exe 141 PID 1424 wrote to memory of 960 1424 cmd.exe 145 PID 960 wrote to memory of 3868 960 IHLYBNV.exe 146 PID 3868 wrote to memory of 2424 3868 cmd.exe 150 PID 2424 wrote to memory of 5284 2424 XCVCM.exe 151 PID 5284 wrote to memory of 2752 5284 cmd.exe 155 PID 2752 wrote to memory of 4804 2752 HAAX.exe 156 PID 4804 wrote to memory of 1868 4804 cmd.exe 160 PID 1868 wrote to memory of 5324 1868 HOALD.exe 161 PID 5324 wrote to memory of 2620 5324 cmd.exe 165 PID 2620 wrote to memory of 1308 2620 WJK.exe 166 PID 1308 wrote to memory of 2928 1308 cmd.exe 170 PID 2928 wrote to memory of 1728 2928 QWPH.exe 171 PID 1728 wrote to memory of 5036 1728 cmd.exe 175 PID 5036 wrote to memory of 3808 5036 LJTQII.exe 176 PID 3808 wrote to memory of 6000 3808 cmd.exe 180 PID 6000 wrote to memory of 4908 6000 MMX.exe 181 PID 4908 wrote to memory of 4996 4908 cmd.exe 185 PID 4996 wrote to memory of 5912 4996 GACVY.exe 186 PID 5912 wrote to memory of 5792 5912 cmd.exe 190 PID 5792 wrote to memory of 4272 5792 BNHFIXY.exe 191 PID 4272 wrote to memory of 5516 4272 cmd.exe 195 PID 5516 wrote to memory of 4368 5516 QDIEH.exe 196 PID 4368 wrote to memory of 836 4368 cmd.exe 200 PID 836 wrote to memory of 5588 836 EOQ.exe 201 PID 5588 wrote to memory of 3512 5588 cmd.exe 205 PID 3512 wrote to memory of 4788 3512 ETQR.exe 206 PID 4788 wrote to memory of 3064 4788 cmd.exe 210 PID 3064 wrote to memory of 5956 3064 JUYFOL.exe 211 PID 5956 wrote to memory of 3476 5956 cmd.exe 215 PID 3476 wrote to memory of 1972 3476 PUG.exe 216 PID 1972 wrote to memory of 2644 1972 cmd.exe 220 PID 2644 wrote to memory of 3704 2644 BNJMF.exe 221 PID 3704 wrote to memory of 2640 3704 cmd.exe 225 PID 2640 wrote to memory of 5256 2640 XSHB.exe 226 PID 5256 wrote to memory of 3200 5256 cmd.exe 230 PID 3200 wrote to memory of 3280 3200 MYMYTG.exe 231 PID 3280 wrote to memory of 5444 3280 cmd.exe 235 PID 5444 wrote to memory of 3484 5444 UDNMVTC.exe 236 PID 3484 wrote to memory of 1740 3484 cmd.exe 240 PID 1740 wrote to memory of 4932 1740 AEUA.exe 241 PID 4932 wrote to memory of 1332 4932 cmd.exe 245 PID 1332 wrote to memory of 6036 1332 LWPTM.exe 246 PID 6036 wrote to memory of 5676 6036 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_ea77208ed147ea33ab50aaa5db4d3974_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_ea77208ed147ea33ab50aaa5db4d3974_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTEG.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\system\UTEG.exeC:\windows\system\UTEG.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LCHSIMK.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\system\LCHSIMK.exeC:\windows\system\LCHSIMK.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CCB.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\windows\system\CCB.exeC:\windows\system\CCB.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSQXY.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\windows\GSQXY.exeC:\windows\GSQXY.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PSKKBHC.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\system\PSKKBHC.exeC:\windows\system\PSKKBHC.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGP.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\windows\system\SGP.exeC:\windows\system\SGP.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGWHDB.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\windows\QGWHDB.exeC:\windows\QGWHDB.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STBRFBP.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\system\STBRFBP.exeC:\windows\system\STBRFBP.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NOGA.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\NOGA.exeC:\windows\NOGA.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUGPR.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\windows\SysWOW64\NUGPR.exeC:\windows\system32\NUGPR.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHLYBNV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\windows\SysWOW64\IHLYBNV.exeC:\windows\system32\IHLYBNV.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCVCM.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\windows\system\XCVCM.exeC:\windows\system\XCVCM.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAAX.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\windows\HAAX.exeC:\windows\HAAX.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOALD.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\system\HOALD.exeC:\windows\system\HOALD.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WJK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\windows\system\WJK.exeC:\windows\system\WJK.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWPH.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\windows\system\QWPH.exeC:\windows\system\QWPH.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJTQII.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\LJTQII.exeC:\windows\LJTQII.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMX.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\windows\SysWOW64\MMX.exeC:\windows\system32\MMX.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GACVY.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\system\GACVY.exeC:\windows\system\GACVY.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNHFIXY.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\BNHFIXY.exeC:\windows\BNHFIXY.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QDIEH.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\windows\QDIEH.exeC:\windows\QDIEH.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EOQ.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\system\EOQ.exeC:\windows\system\EOQ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETQR.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\windows\SysWOW64\ETQR.exeC:\windows\system32\ETQR.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUYFOL.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\windows\SysWOW64\JUYFOL.exeC:\windows\system32\JUYFOL.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUG.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\windows\SysWOW64\PUG.exeC:\windows\system32\PUG.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\BNJMF.exeC:\windows\BNJMF.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYMYTG.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\windows\MYMYTG.exeC:\windows\MYMYTG.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDNMVTC.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\windows\system\UDNMVTC.exeC:\windows\system\UDNMVTC.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AEUA.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\windows\system\AEUA.exeC:\windows\system\AEUA.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWPTM.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\windows\system\LWPTM.exeC:\windows\system\LWPTM.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UERYXA.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\system\UERYXA.exeC:\windows\system\UERYXA.exe65⤵
- Executes dropped EXE
PID:5676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZBC.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:3128 -
C:\windows\JZBC.exeC:\windows\JZBC.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENFUTM.exe.bat" "68⤵
- Executes a command shell one-liner
PID:4492 -
C:\windows\SysWOW64\ENFUTM.exeC:\windows\system32\ENFUTM.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PFIETCA.exe.bat" "70⤵PID:4508
-
C:\windows\SysWOW64\PFIETCA.exeC:\windows\system32\PFIETCA.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYLX.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:2892 -
C:\windows\system\AYLX.exeC:\windows\system\AYLX.exe73⤵
- Executes dropped EXE
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYTL.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3240 -
C:\windows\GYTL.exeC:\windows\GYTL.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMYUVL.exe.bat" "76⤵PID:5176
-
C:\windows\BMYUVL.exeC:\windows\BMYUVL.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\METNDTN.exe.bat" "78⤵
- Executes a command shell one-liner
PID:4960 -
C:\windows\system\METNDTN.exeC:\windows\system\METNDTN.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "80⤵
- Executes a command shell one-liner
PID:4296 -
C:\windows\SysWOW64\QUZV.exeC:\windows\system32\QUZV.exe81⤵
- Executes dropped EXE
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPD.exe.bat" "82⤵PID:940
-
C:\windows\system\RPD.exeC:\windows\system\RPD.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIOHDHG.exe.bat" "84⤵PID:5416
-
C:\windows\PIOHDHG.exeC:\windows\PIOHDHG.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VIWVMJH.exe.bat" "86⤵PID:2680
-
C:\windows\VIWVMJH.exeC:\windows\VIWVMJH.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQCVYTD.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2900 -
C:\windows\ZQCVYTD.exeC:\windows\ZQCVYTD.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGD.exe.bat" "90⤵PID:5936
-
C:\windows\system\PGD.exeC:\windows\system\PGD.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZGN.exe.bat" "92⤵PID:4736
-
C:\windows\SysWOW64\AZGN.exeC:\windows\system32\AZGN.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YZOAWYJ.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4340 -
C:\windows\YZOAWYJ.exeC:\windows\YZOAWYJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZWO.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:2372 -
C:\windows\system\EZWO.exeC:\windows\system\EZWO.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSR.exe.bat" "98⤵
- Executes a command shell one-liner
PID:3424 -
C:\windows\PSR.exeC:\windows\PSR.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSYVX.exe.bat" "100⤵PID:3452
-
C:\windows\VSYVX.exeC:\windows\VSYVX.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYYJYP.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:6024 -
C:\windows\SysWOW64\VYYJYP.exeC:\windows\system32\VYYJYP.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GRBCGXL.exe.bat" "104⤵PID:2936
-
C:\windows\SysWOW64\GRBCGXL.exeC:\windows\system32\GRBCGXL.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRJQQ.exe.bat" "106⤵PID:5836
-
C:\windows\system\MRJQQ.exeC:\windows\system\MRJQQ.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UJKJD.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3456 -
C:\windows\SysWOW64\UJKJD.exeC:\windows\system32\UJKJD.exe109⤵
- Executes dropped EXE
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WHLLC.exe.bat" "110⤵PID:5100
-
C:\windows\WHLLC.exeC:\windows\WHLLC.exe111⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUQVMAY.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:828 -
C:\windows\QUQVMAY.exeC:\windows\QUQVMAY.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNL.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:2948 -
C:\windows\CNL.exeC:\windows\CNL.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BYT.exe.bat" "116⤵
- Executes a command shell one-liner
PID:6068 -
C:\windows\BYT.exeC:\windows\BYT.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JDUV.exe.bat" "118⤵PID:6012
-
C:\windows\system\JDUV.exeC:\windows\system\JDUV.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YJRSRI.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5848 -
C:\windows\YJRSRI.exeC:\windows\YJRSRI.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-