Analysis
- max time kernel
96s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 08:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe
- Size 208KB
- Sample261024-j384ras1fw
- SHA256 f948240de058bc0f409ab9f932b26a6a5ff5fb15f08db9cc98f5d8dffb8e928b
- MD5 770470fdbfadaaa76d0f16a70643f113
- SHA1 6c1d47ca8728520a0b7ab31c3804e1eb60e84d82
- SHA512 f95f937aba1218ce420d5a95857aaecd04d9c862a4979da2f5fcbc1ee6512ed79abd65ce58f242f8f7d84b5b436347909a855410314c5eb1ae49b494149e769b
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfH4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LO/kEj1
- TLSH T1C7247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3488 ZLO.exe 1160 ABWJ.exe 248 IPVHIFV.exe 1112 EUSFPPX.exe 6076 NVUKS.exe 2748 ZNXCBCP.exe 4512 ZQB.exe 5764 PLLKZE.exe 1176 EBMKG.exe 4148 CCTYP.exe 4984 EPYHZUD.exe 2548 OXAMD.exe 2056 DSJ.exe 292 DYKF.exe 4760 YLOOZ.exe 4484 AGGYTK.exe 1356 BJK.exe 1708 VXODI.exe 2784 XUUX.exe 4956 SIZHAQ.exe 4424 TLD.exe 4668 LGGGL.exe 5032 OBLQ.exe 5936 IOQHF.exe 3612 UHTSO.exe 2836 OUYBQD.exe 5736 JIV.exe 4788 PICGJ.exe 2032 EYLY.exe 2536 CYLLZV.exe 5484 FUQ.exe 5592 OUSI.exe 2188 LZYX.exe 2624 DDB.exe 5732 JVJOQ.exe 3332 UNMH.exe 1960 GGHAHJ.exe 5404 VJY.exe 4428 PWDOC.exe 4564 HXX.exe 3708 FXFH.exe 1280 NKFV.exe 5092 HYKEAI.exe 3856 LGQMNA.exe 3956 UOSSQFQ.exe 4716 KJCWJ.exe 3248 ZZDVIO.exe 3460 UMI.exe 6068 JHRJDA.exe 752 DDW.exe 2588 NBKNDIA.exe 936 IOOW.exe 5704 ITHLO.exe 4944 OUOYXPT.exe 4700 OZO.exe 2984 QVTW.exe 2392 LIYGTC.exe 2316 UVIYBZN.exe 3420 FOD.exe 464 RGGJ.exe 4256 ZRPLYAZ.exe 1244 KJKDGH.exe 5284 VCNOOOE.exe 4444 GVQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\FUQ.exe CYLLZV.exe File opened for modification C:\windows\SysWOW64\UMI.exe ZZDVIO.exe File created C:\windows\SysWOW64\VCKNR.exe IZBODBD.exe File created C:\windows\SysWOW64\XNRLN.exe RNJ.exe File created C:\windows\SysWOW64\WDEGRIH.exe BIAOGI.exe File opened for modification C:\windows\SysWOW64\IPVHIFV.exe ABWJ.exe File created C:\windows\SysWOW64\NVUKS.exe.bat EUSFPPX.exe File opened for modification C:\windows\SysWOW64\PICGJ.exe JIV.exe File opened for modification C:\windows\SysWOW64\KJCWJ.exe UOSSQFQ.exe File opened for modification C:\windows\SysWOW64\JNM.exe XXFMVW.exe File created C:\windows\SysWOW64\NRDIQ.exe HRV.exe File created C:\windows\SysWOW64\HWSKD.exe JWKWURJ.exe File created C:\windows\SysWOW64\HWSKD.exe.bat JWKWURJ.exe File created C:\windows\SysWOW64\OUYBQD.exe UHTSO.exe File opened for modification C:\windows\SysWOW64\CYLLZV.exe EYLY.exe File created C:\windows\SysWOW64\DDW.exe JHRJDA.exe File created C:\windows\SysWOW64\NRF.exe JJY.exe File opened for modification C:\windows\SysWOW64\HWSKD.exe JWKWURJ.exe File created C:\windows\SysWOW64\WDEGRIH.exe.bat BIAOGI.exe File created C:\windows\SysWOW64\JVTMOX.exe BPBXN.exe File opened for modification C:\windows\SysWOW64\EBMKG.exe PLLKZE.exe File created C:\windows\SysWOW64\EBMKG.exe.bat PLLKZE.exe File created C:\windows\SysWOW64\EYLY.exe.bat PICGJ.exe File created C:\windows\SysWOW64\YCMDZD.exe.bat PTSQV.exe File created C:\windows\SysWOW64\NDQDXY.exe FYYPW.exe File opened for modification C:\windows\SysWOW64\NDQDXY.exe FYYPW.exe File opened for modification C:\windows\SysWOW64\WDEGRIH.exe BIAOGI.exe File created C:\windows\SysWOW64\JVTMOX.exe.bat BPBXN.exe File created C:\windows\SysWOW64\VJY.exe.bat GGHAHJ.exe File opened for modification C:\windows\SysWOW64\DDW.exe JHRJDA.exe File created C:\windows\SysWOW64\JNM.exe.bat XXFMVW.exe File created C:\windows\SysWOW64\EAHXF.exe PVB.exe File opened for modification C:\windows\SysWOW64\PLLKZE.exe ZQB.exe File created C:\windows\SysWOW64\PLLKZE.exe.bat ZQB.exe File created C:\windows\SysWOW64\CYLLZV.exe.bat EYLY.exe File created C:\windows\SysWOW64\DDW.exe.bat JHRJDA.exe File opened for modification C:\windows\SysWOW64\OUOYXPT.exe ITHLO.exe File created C:\windows\SysWOW64\XNVMKUH.exe.bat GFTHZX.exe File opened for modification C:\windows\SysWOW64\XNRLN.exe RNJ.exe File opened for modification C:\windows\SysWOW64\NRF.exe JJY.exe File created C:\windows\SysWOW64\EYLY.exe PICGJ.exe File created C:\windows\SysWOW64\GGHAHJ.exe.bat UNMH.exe File created C:\windows\SysWOW64\KJCWJ.exe UOSSQFQ.exe File created C:\windows\SysWOW64\JHRJDA.exe.bat UMI.exe File created C:\windows\SysWOW64\FUQ.exe.bat CYLLZV.exe File created C:\windows\SysWOW64\GGHAHJ.exe UNMH.exe File created C:\windows\SysWOW64\VJY.exe GGHAHJ.exe File created C:\windows\SysWOW64\KJCWJ.exe.bat UOSSQFQ.exe File created C:\windows\SysWOW64\UMI.exe ZZDVIO.exe File created C:\windows\SysWOW64\UMI.exe.bat ZZDVIO.exe File created C:\windows\SysWOW64\GVQ.exe.bat VCNOOOE.exe File opened for modification C:\windows\SysWOW64\RNJ.exe RHJJDLY.exe File created C:\windows\SysWOW64\PLLKZE.exe ZQB.exe File created C:\windows\SysWOW64\FUQ.exe CYLLZV.exe File created C:\windows\SysWOW64\VCKNR.exe.bat IZBODBD.exe File opened for modification C:\windows\SysWOW64\EAHXF.exe PVB.exe File opened for modification C:\windows\SysWOW64\VCKNR.exe IZBODBD.exe File opened for modification C:\windows\SysWOW64\VJY.exe GGHAHJ.exe File created C:\windows\SysWOW64\OUOYXPT.exe.bat ITHLO.exe File created C:\windows\SysWOW64\KJKDGH.exe.bat ZRPLYAZ.exe File created C:\windows\SysWOW64\GVQ.exe VCNOOOE.exe File created C:\windows\SysWOW64\MVYVG.exe GVQ.exe File opened for modification C:\windows\SysWOW64\KKXBOT.exe HWSKD.exe File created C:\windows\SysWOW64\IPVHIFV.exe.bat ABWJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\QBKJ.exe.bat SBCVYRJ.exe File created C:\windows\LZYX.exe OUSI.exe File created C:\windows\system\FOD.exe UVIYBZN.exe File created C:\windows\system\FRGKGVP.exe HEPJJA.exe File opened for modification C:\windows\system\XJLFCHR.exe AMFIVY.exe File opened for modification C:\windows\system\ICO.exe XJLFCHR.exe File created C:\windows\EUSFPPX.exe IPVHIFV.exe File created C:\windows\system\DDB.exe LZYX.exe File opened for modification C:\windows\VCNOOOE.exe KJKDGH.exe File created C:\windows\IFUDVZ.exe XNRLN.exe File opened for modification C:\windows\system\HUWO.exe JTPAMQ.exe File created C:\windows\system\WQA.exe.bat DXSHN.exe File created C:\windows\system\RHJJDLY.exe NRDIQ.exe File created C:\windows\system\ABWJ.exe.bat ZLO.exe File created C:\windows\OXAMD.exe EPYHZUD.exe File created C:\windows\system\NKFV.exe.bat FXFH.exe File created C:\windows\system\UOSSQFQ.exe.bat LGQMNA.exe File opened for modification C:\windows\QVTW.exe OZO.exe File opened for modification C:\windows\HIDEQYB.exe MVYVG.exe File created C:\windows\DGJKL.exe UGHF.exe File created C:\windows\system\ZLO.exe.bat 2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe File created C:\windows\system\LIYGTC.exe QVTW.exe File opened for modification C:\windows\DGJKL.exe UGHF.exe File created C:\windows\MTF.exe.bat AACP.exe File created C:\windows\system\DXSHN.exe.bat ICO.exe File opened for modification C:\windows\NXDH.exe YCMDZD.exe File opened for modification C:\windows\AMFIVY.exe PTKP.exe File created C:\windows\FQCXING.exe WQA.exe File created C:\windows\system\HXX.exe PWDOC.exe File created C:\windows\system\ZLO.exe 2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe File created C:\windows\CCTYP.exe.bat EBMKG.exe File created C:\windows\system\EPYHZUD.exe CCTYP.exe File opened for modification C:\windows\system\ZQB.exe ZNXCBCP.exe File opened for modification C:\windows\system\NKFV.exe FXFH.exe File opened for modification C:\windows\SBCVYRJ.exe WDEGRIH.exe File created C:\windows\system\DXSHN.exe ICO.exe File created C:\windows\system\RGJX.exe FQCXING.exe File opened for modification C:\windows\system\EPYHZUD.exe CCTYP.exe File opened for modification C:\windows\system\LGGGL.exe TLD.exe File created C:\windows\system\ZZDVIO.exe.bat KJCWJ.exe File created C:\windows\IOOW.exe NBKNDIA.exe File created C:\windows\system\ITHLO.exe IOOW.exe File created C:\windows\system\IZBODBD.exe QRZJZ.exe File created C:\windows\system\DYKF.exe DSJ.exe File opened for modification C:\windows\SIZHAQ.exe XUUX.exe File created C:\windows\system\VMYOZ.exe.bat FRGKGVP.exe File created C:\windows\PVB.exe JVTMOX.exe File opened for modification C:\windows\BJK.exe AGGYTK.exe File created C:\windows\system\BEHW.exe.bat HIDEQYB.exe File opened for modification C:\windows\system\IZBODBD.exe QRZJZ.exe File created C:\windows\AGGYTK.exe YLOOZ.exe File created C:\windows\FXFH.exe HXX.exe File created C:\windows\system\UVIYBZN.exe LIYGTC.exe File opened for modification C:\windows\system\JJY.exe IFUDVZ.exe File created C:\windows\system\UGHF.exe JNM.exe File created C:\windows\system\UGHF.exe.bat JNM.exe File created C:\windows\QPOWBM.exe VCKNR.exe File created C:\windows\KKT.exe.bat QPOWBM.exe File created C:\windows\JTPAMQ.exe GGKRJ.exe File opened for modification C:\windows\system\UTAJ.exe XNVMKUH.exe File created C:\windows\system\GGKRJ.exe.bat MTF.exe File created C:\windows\system\XJLFCHR.exe AMFIVY.exe File created C:\windows\system\LGGGL.exe TLD.exe File created C:\windows\system\PWDOC.exe VJY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1908 cmd.exe 1368 cmd.exe 6064 cmd.exe 4156 cmd.exe 2440 cmd.exe 824 cmd.exe 3592 cmd.exe 124 cmd.exe 5476 cmd.exe 3312 cmd.exe 2964 cmd.exe 1788 cmd.exe 3128 cmd.exe 4140 cmd.exe 2428 cmd.exe 712 cmd.exe 2488 cmd.exe 5760 cmd.exe 3456 cmd.exe 1080 cmd.exe 1820 cmd.exe 4372 cmd.exe 4792 cmd.exe 3396 cmd.exe 1812 cmd.exe 3676 cmd.exe 4136 cmd.exe 4892 cmd.exe 2504 cmd.exe 4324 cmd.exe 1296 cmd.exe 2092 cmd.exe 5892 cmd.exe 5628 cmd.exe 4476 cmd.exe 4272 cmd.exe 4676 cmd.exe 888 cmd.exe 2300 cmd.exe 2868 cmd.exe 3896 cmd.exe 5832 cmd.exe 2424 cmd.exe 4924 cmd.exe 5860 cmd.exe 2416 cmd.exe 1720 cmd.exe 480 cmd.exe 780 cmd.exe 4212 cmd.exe 4736 cmd.exe 5916 cmd.exe 3260 cmd.exe 1452 cmd.exe 1784 cmd.exe 5448 cmd.exe 1524 cmd.exe 5888 cmd.exe 4412 cmd.exe 2520 cmd.exe 2116 cmd.exe 2960 cmd.exe 4660 cmd.exe 1196 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1936 4612 WerFault.exe 87 2864 3488 WerFault.exe 93 292 1160 WerFault.exe 99 4744 248 WerFault.exe 104 4072 1112 WerFault.exe 109 5896 6076 WerFault.exe 114 4672 2748 WerFault.exe 119 3628 4512 WerFault.exe 124 4324 5764 WerFault.exe 129 936 1176 WerFault.exe 134 5280 4148 WerFault.exe 139 2920 4984 WerFault.exe 144 1068 2548 WerFault.exe 149 364 2056 WerFault.exe 154 2184 292 WerFault.exe 159 3216 4760 WerFault.exe 164 5896 4484 WerFault.exe 169 4672 1356 WerFault.exe 174 2976 1708 WerFault.exe 179 2788 2784 WerFault.exe 184 4892 4956 WerFault.exe 189 2860 4424 WerFault.exe 194 5284 4668 WerFault.exe 199 4912 5032 WerFault.exe 204 4516 5936 WerFault.exe 209 3816 3612 WerFault.exe 214 2092 2836 WerFault.exe 219 4204 5736 WerFault.exe 224 3260 4788 WerFault.exe 229 5452 2032 WerFault.exe 234 3264 2536 WerFault.exe 239 4192 5484 WerFault.exe 244 3480 5592 WerFault.exe 248 2864 2188 WerFault.exe 254 1776 2624 WerFault.exe 259 296 5732 WerFault.exe 264 5524 3332 WerFault.exe 269 3392 1960 WerFault.exe 274 5724 5404 WerFault.exe 279 5880 4428 WerFault.exe 285 1344 4564 WerFault.exe 290 2852 3708 WerFault.exe 295 4296 1280 WerFault.exe 300 5868 5092 WerFault.exe 305 1752 3856 WerFault.exe 310 1628 3956 WerFault.exe 315 4952 4716 WerFault.exe 320 4216 3248 WerFault.exe 325 4728 3460 WerFault.exe 330 1424 6068 WerFault.exe 335 3048 752 WerFault.exe 340 2996 2588 WerFault.exe 345 4664 936 WerFault.exe 350 5284 5704 WerFault.exe 355 1092 4944 WerFault.exe 360 244 4700 WerFault.exe 365 5344 2984 WerFault.exe 370 5840 2392 WerFault.exe 375 928 2316 WerFault.exe 380 3276 3420 WerFault.exe 385 3224 464 WerFault.exe 390 4724 4256 WerFault.exe 395 4692 1244 WerFault.exe 400 5260 5284 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOQHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XUUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGGGL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIYGTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYYPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJKDGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXRFCRB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZDVIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIDEQYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MVYVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNVMKUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTMOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDQDXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKXBOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXAMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCNOOOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRGKGVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRZJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVUKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLOOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYKEAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCKNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4612 2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe 4612 2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe 3488 ZLO.exe 3488 ZLO.exe 1160 ABWJ.exe 1160 ABWJ.exe 248 IPVHIFV.exe 248 IPVHIFV.exe 1112 EUSFPPX.exe 1112 EUSFPPX.exe 6076 NVUKS.exe 6076 NVUKS.exe 2748 ZNXCBCP.exe 2748 ZNXCBCP.exe 4512 ZQB.exe 4512 ZQB.exe 5764 PLLKZE.exe 5764 PLLKZE.exe 1176 EBMKG.exe 1176 EBMKG.exe 4148 CCTYP.exe 4148 CCTYP.exe 4984 EPYHZUD.exe 4984 EPYHZUD.exe 2548 OXAMD.exe 2548 OXAMD.exe 2056 DSJ.exe 2056 DSJ.exe 292 DYKF.exe 292 DYKF.exe 4760 YLOOZ.exe 4760 YLOOZ.exe 4484 AGGYTK.exe 4484 AGGYTK.exe 1356 BJK.exe 1356 BJK.exe 1708 VXODI.exe 1708 VXODI.exe 2784 XUUX.exe 2784 XUUX.exe 4956 SIZHAQ.exe 4956 SIZHAQ.exe 4424 TLD.exe 4424 TLD.exe 4668 LGGGL.exe 4668 LGGGL.exe 5032 OBLQ.exe 5032 OBLQ.exe 5936 IOQHF.exe 5936 IOQHF.exe 3612 UHTSO.exe 3612 UHTSO.exe 2836 OUYBQD.exe 2836 OUYBQD.exe 5736 JIV.exe 5736 JIV.exe 4788 PICGJ.exe 4788 PICGJ.exe 2032 EYLY.exe 2032 EYLY.exe 2536 CYLLZV.exe 2536 CYLLZV.exe 5484 FUQ.exe 5484 FUQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4612 2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe 4612 2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe 3488 ZLO.exe 3488 ZLO.exe 1160 ABWJ.exe 1160 ABWJ.exe 248 IPVHIFV.exe 248 IPVHIFV.exe 1112 EUSFPPX.exe 1112 EUSFPPX.exe 6076 NVUKS.exe 6076 NVUKS.exe 2748 ZNXCBCP.exe 2748 ZNXCBCP.exe 4512 ZQB.exe 4512 ZQB.exe 5764 PLLKZE.exe 5764 PLLKZE.exe 1176 EBMKG.exe 1176 EBMKG.exe 4148 CCTYP.exe 4148 CCTYP.exe 4984 EPYHZUD.exe 4984 EPYHZUD.exe 2548 OXAMD.exe 2548 OXAMD.exe 2056 DSJ.exe 2056 DSJ.exe 292 DYKF.exe 292 DYKF.exe 4760 YLOOZ.exe 4760 YLOOZ.exe 4484 AGGYTK.exe 4484 AGGYTK.exe 1356 BJK.exe 1356 BJK.exe 1708 VXODI.exe 1708 VXODI.exe 2784 XUUX.exe 2784 XUUX.exe 4956 SIZHAQ.exe 4956 SIZHAQ.exe 4424 TLD.exe 4424 TLD.exe 4668 LGGGL.exe 4668 LGGGL.exe 5032 OBLQ.exe 5032 OBLQ.exe 5936 IOQHF.exe 5936 IOQHF.exe 3612 UHTSO.exe 3612 UHTSO.exe 2836 OUYBQD.exe 2836 OUYBQD.exe 5736 JIV.exe 5736 JIV.exe 4788 PICGJ.exe 4788 PICGJ.exe 2032 EYLY.exe 2032 EYLY.exe 2536 CYLLZV.exe 2536 CYLLZV.exe 5484 FUQ.exe 5484 FUQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4612 wrote to memory of 2416 4612 2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe 89 PID 2416 wrote to memory of 3488 2416 cmd.exe 93 PID 3488 wrote to memory of 3456 3488 ZLO.exe 95 PID 3456 wrote to memory of 1160 3456 cmd.exe 99 PID 1160 wrote to memory of 4500 1160 ABWJ.exe 100 PID 4500 wrote to memory of 248 4500 cmd.exe 104 PID 248 wrote to memory of 1788 248 IPVHIFV.exe 105 PID 1788 wrote to memory of 1112 1788 cmd.exe 109 PID 1112 wrote to memory of 2300 1112 EUSFPPX.exe 110 PID 2300 wrote to memory of 6076 2300 cmd.exe 114 PID 6076 wrote to memory of 1720 6076 NVUKS.exe 115 PID 1720 wrote to memory of 2748 1720 cmd.exe 119 PID 2748 wrote to memory of 4164 2748 ZNXCBCP.exe 120 PID 4164 wrote to memory of 4512 4164 cmd.exe 124 PID 4512 wrote to memory of 2812 4512 ZQB.exe 125 PID 2812 wrote to memory of 5764 2812 cmd.exe 129 PID 5764 wrote to memory of 2664 5764 PLLKZE.exe 130 PID 2664 wrote to memory of 1176 2664 cmd.exe 134 PID 1176 wrote to memory of 3068 1176 EBMKG.exe 135 PID 3068 wrote to memory of 4148 3068 cmd.exe 139 PID 4148 wrote to memory of 2500 4148 CCTYP.exe 140 PID 2500 wrote to memory of 4984 2500 cmd.exe 144 PID 4984 wrote to memory of 4736 4984 EPYHZUD.exe 145 PID 4736 wrote to memory of 2548 4736 cmd.exe 149 PID 2548 wrote to memory of 5888 2548 OXAMD.exe 150 PID 5888 wrote to memory of 2056 5888 cmd.exe 154 PID 2056 wrote to memory of 5400 2056 DSJ.exe 155 PID 5400 wrote to memory of 292 5400 cmd.exe 159 PID 292 wrote to memory of 2440 292 DYKF.exe 160 PID 2440 wrote to memory of 4760 2440 cmd.exe 164 PID 4760 wrote to memory of 1260 4760 YLOOZ.exe 165 PID 1260 wrote to memory of 4484 1260 cmd.exe 169 PID 4484 wrote to memory of 4136 4484 AGGYTK.exe 170 PID 4136 wrote to memory of 1356 4136 cmd.exe 174 PID 1356 wrote to memory of 1152 1356 BJK.exe 175 PID 1152 wrote to memory of 1708 1152 cmd.exe 179 PID 1708 wrote to memory of 1128 1708 VXODI.exe 180 PID 1128 wrote to memory of 2784 1128 cmd.exe 184 PID 2784 wrote to memory of 1028 2784 XUUX.exe 185 PID 1028 wrote to memory of 4956 1028 cmd.exe 189 PID 4956 wrote to memory of 2576 4956 SIZHAQ.exe 190 PID 2576 wrote to memory of 4424 2576 cmd.exe 194 PID 4424 wrote to memory of 2744 4424 TLD.exe 195 PID 2744 wrote to memory of 4668 2744 cmd.exe 199 PID 4668 wrote to memory of 4060 4668 LGGGL.exe 200 PID 4060 wrote to memory of 5032 4060 cmd.exe 204 PID 5032 wrote to memory of 824 5032 OBLQ.exe 205 PID 824 wrote to memory of 5936 824 cmd.exe 209 PID 5936 wrote to memory of 3128 5936 IOQHF.exe 210 PID 3128 wrote to memory of 3612 3128 cmd.exe 214 PID 3612 wrote to memory of 1372 3612 UHTSO.exe 215 PID 1372 wrote to memory of 2836 1372 cmd.exe 219 PID 2836 wrote to memory of 4968 2836 OUYBQD.exe 220 PID 4968 wrote to memory of 5736 4968 cmd.exe 224 PID 5736 wrote to memory of 4412 5736 JIV.exe 225 PID 4412 wrote to memory of 4788 4412 cmd.exe 229 PID 4788 wrote to memory of 4220 4788 PICGJ.exe 230 PID 4220 wrote to memory of 2032 4220 cmd.exe 234 PID 2032 wrote to memory of 1080 2032 EYLY.exe 235 PID 1080 wrote to memory of 2536 1080 cmd.exe 239 PID 2536 wrote to memory of 5056 2536 CYLLZV.exe 240 PID 5056 wrote to memory of 5484 5056 cmd.exe 244 PID 5484 wrote to memory of 4892 5484 FUQ.exe 245 PID 4892 wrote to memory of 5592 4892 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_770470fdbfadaaa76d0f16a70643f113_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZLO.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\windows\system\ZLO.exeC:\windows\system\ZLO.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABWJ.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\windows\system\ABWJ.exeC:\windows\system\ABWJ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IPVHIFV.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\windows\SysWOW64\IPVHIFV.exeC:\windows\system32\IPVHIFV.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUSFPPX.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\windows\EUSFPPX.exeC:\windows\EUSFPPX.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVUKS.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\windows\SysWOW64\NVUKS.exeC:\windows\system32\NVUKS.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZNXCBCP.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\windows\system\ZNXCBCP.exeC:\windows\system\ZNXCBCP.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZQB.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\windows\system\ZQB.exeC:\windows\system\ZQB.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PLLKZE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\windows\SysWOW64\PLLKZE.exeC:\windows\system32\PLLKZE.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBMKG.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\windows\SysWOW64\EBMKG.exeC:\windows\system32\EBMKG.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCTYP.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\windows\CCTYP.exeC:\windows\CCTYP.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPYHZUD.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\system\EPYHZUD.exeC:\windows\system\EPYHZUD.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXAMD.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\OXAMD.exeC:\windows\OXAMD.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DSJ.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\system\DSJ.exeC:\windows\system\DSJ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYKF.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\system\DYKF.exeC:\windows\system\DYKF.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLOOZ.exe.bat" "30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\windows\YLOOZ.exeC:\windows\YLOOZ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGGYTK.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\windows\AGGYTK.exeC:\windows\AGGYTK.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BJK.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\BJK.exeC:\windows\BJK.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VXODI.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\windows\SysWOW64\VXODI.exeC:\windows\system32\VXODI.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUUX.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\windows\system\XUUX.exeC:\windows\system\XUUX.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIZHAQ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\windows\SIZHAQ.exeC:\windows\SIZHAQ.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TLD.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\TLD.exeC:\windows\TLD.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LGGGL.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\windows\system\LGGGL.exeC:\windows\system\LGGGL.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OBLQ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\windows\OBLQ.exeC:\windows\OBLQ.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOQHF.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:824 -
C:\windows\system\IOQHF.exeC:\windows\system\IOQHF.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UHTSO.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\windows\UHTSO.exeC:\windows\UHTSO.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUYBQD.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\windows\SysWOW64\OUYBQD.exeC:\windows\system32\OUYBQD.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JIV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\JIV.exeC:\windows\JIV.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PICGJ.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\SysWOW64\PICGJ.exeC:\windows\system32\PICGJ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYLY.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\windows\SysWOW64\EYLY.exeC:\windows\system32\EYLY.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYLLZV.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\windows\SysWOW64\CYLLZV.exeC:\windows\system32\CYLLZV.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUQ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\windows\SysWOW64\FUQ.exeC:\windows\system32\FUQ.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OUSI.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\windows\OUSI.exeC:\windows\OUSI.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZYX.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:480 -
C:\windows\LZYX.exeC:\windows\LZYX.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDB.exe.bat" "68⤵
- Executes a command shell one-liner
PID:5916 -
C:\windows\system\DDB.exeC:\windows\system\DDB.exe69⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVJOQ.exe.bat" "70⤵PID:5992
-
C:\windows\JVJOQ.exeC:\windows\JVJOQ.exe71⤵
- Executes dropped EXE
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNMH.exe.bat" "72⤵
- Executes a command shell one-liner
PID:1820 -
C:\windows\system\UNMH.exeC:\windows\system\UNMH.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GGHAHJ.exe.bat" "74⤵PID:2832
-
C:\windows\SysWOW64\GGHAHJ.exeC:\windows\system32\GGHAHJ.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJY.exe.bat" "76⤵PID:4184
-
C:\windows\SysWOW64\VJY.exeC:\windows\system32\VJY.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWDOC.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4140 -
C:\windows\system\PWDOC.exeC:\windows\system\PWDOC.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXX.exe.bat" "80⤵
- Executes a command shell one-liner
PID:3260 -
C:\windows\system\HXX.exeC:\windows\system\HXX.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXFH.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:1228 -
C:\windows\FXFH.exeC:\windows\FXFH.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NKFV.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4476 -
C:\windows\system\NKFV.exeC:\windows\system\NKFV.exe85⤵
- Executes dropped EXE
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HYKEAI.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2520 -
C:\windows\system\HYKEAI.exeC:\windows\system\HYKEAI.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LGQMNA.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1452 -
C:\windows\LGQMNA.exeC:\windows\LGQMNA.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOSSQFQ.exe.bat" "90⤵PID:5264
-
C:\windows\system\UOSSQFQ.exeC:\windows\system\UOSSQFQ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCWJ.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2428 -
C:\windows\SysWOW64\KJCWJ.exeC:\windows\system32\KJCWJ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZDVIO.exe.bat" "94⤵PID:1932
-
C:\windows\system\ZZDVIO.exeC:\windows\system\ZZDVIO.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMI.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1576 -
C:\windows\SysWOW64\UMI.exeC:\windows\system32\UMI.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JHRJDA.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5536 -
C:\windows\SysWOW64\JHRJDA.exeC:\windows\system32\JHRJDA.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDW.exe.bat" "100⤵PID:1800
-
C:\windows\SysWOW64\DDW.exeC:\windows\system32\DDW.exe101⤵
- Executes dropped EXE
PID:752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBKNDIA.exe.bat" "102⤵PID:3840
-
C:\windows\NBKNDIA.exeC:\windows\NBKNDIA.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOOW.exe.bat" "104⤵PID:5116
-
C:\windows\IOOW.exeC:\windows\IOOW.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ITHLO.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2868 -
C:\windows\system\ITHLO.exeC:\windows\system\ITHLO.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUOYXPT.exe.bat" "108⤵
- Executes a command shell one-liner
PID:1784 -
C:\windows\SysWOW64\OUOYXPT.exeC:\windows\system32\OUOYXPT.exe109⤵
- Executes dropped EXE
PID:4944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZO.exe.bat" "110⤵PID:5520
-
C:\windows\OZO.exeC:\windows\OZO.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVTW.exe.bat" "112⤵PID:4432
-
C:\windows\QVTW.exeC:\windows\QVTW.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIYGTC.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3004 -
C:\windows\system\LIYGTC.exeC:\windows\system\LIYGTC.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UVIYBZN.exe.bat" "116⤵PID:4180
-
C:\windows\system\UVIYBZN.exeC:\windows\system\UVIYBZN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOD.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4372 -
C:\windows\system\FOD.exeC:\windows\system\FOD.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGGJ.exe.bat" "120⤵PID:1308
-
C:\windows\system\RGGJ.exeC:\windows\system\RGGJ.exe121⤵
- Executes dropped EXE
PID:464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-