Analysis
- max time kernel
100s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 08:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_77b70302d4fba1a9d2b7a887107550a3_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_77b70302d4fba1a9d2b7a887107550a3_elex_emotet_stop.exe
- Size 208KB
- Sample261024-jy57asee84
- SHA256 6a66744514d809dba0f9938448910a1ad15e2b6102be13b7a2840c943a0ba6bd
- MD5 77b70302d4fba1a9d2b7a887107550a3
- SHA1 7f68b727b3d48e90067ca0068b96de83bafb9715
- SHA512 a237846362679df59c8172e94a3153bce1d2bc7d0baccdb92aa5daeca95d5a0bf6629f951820d215207f5bced52c3c7f76f2e6ae8706d14227d1d76243e2613d
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfn4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOfkEj1
- TLSH T1A2247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4592 XQKJDF.exe 204 OZGV.exe 5276 XHIAX.exe 5596 LUTBC.exe 1520 EXXX.exe 3028 EABTVR.exe 1668 GYGND.exe 3172 SGV.exe 416 WWCVB.exe 1196 PZFZ.exe 1516 XFGFI.exe 6108 KHO.exe 3064 TQQJ.exe 5484 JLZVTAS.exe 5736 PGZW.exe 6100 JTDFAC.exe 5100 TRJA.exe 2340 MUN.exe 3880 ZFDUJM.exe 5692 AAH.exe 4496 JIJDSH.exe 3668 YDTH.exe 2840 OTUHR.exe 4864 IHYQUPS.exe 5288 DUDZ.exe 3660 SXNEPCP.exe 1732 DQQ.exe 3120 HYWFJ.exe 5936 PDWLLO.exe 2908 YRZD.exe 5980 TEEUL.exe 5388 KMGAPIA.exe 256 WFJ.exe 4360 BFQGG.exe 4684 LFSLJP.exe 4324 LIW.exe 4084 AOCEE.exe 5380 VBHNGPL.exe 3512 RHFK.exe 1432 OEK.exe 5568 ZXNA.exe 5512 FXVOTSY.exe 6120 QQQ.exe 4268 BITS.exe 3780 HJBF.exe 3888 NJITCDF.exe 1944 YCL.exe 3076 NHJJR.exe 4640 TCIKO.exe 828 TNRLCJ.exe 2424 ZNZ.exe 3712 KGUS.exe 3572 STUGV.exe 1244 GRAVKH.exe 5328 OJIXQMV.exe 2088 SSPF.exe 4112 SFHLD.exe 3420 PDNISB.exe 5908 AVQ.exe 1328 XBOYISX.exe 5952 TGTV.exe 3000 TRCP.exe 6060 UUG.exe 3316 FNJL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\JYYOZ.exe JFQV.exe File opened for modification C:\windows\SysWOW64\SSPF.exe OJIXQMV.exe File created C:\windows\SysWOW64\EAUPF.exe.bat HAM.exe File created C:\windows\SysWOW64\HQDQIOV.exe ZKDCHB.exe File created C:\windows\SysWOW64\WWCVB.exe.bat SGV.exe File created C:\windows\SysWOW64\TRCP.exe TGTV.exe File opened for modification C:\windows\SysWOW64\ALYYW.exe EFT.exe File opened for modification C:\windows\SysWOW64\JPN.exe AOLA.exe File opened for modification C:\windows\SysWOW64\CZV.exe KRTS.exe File created C:\windows\SysWOW64\ITAZLQ.exe MNDCEHK.exe File created C:\windows\SysWOW64\LTCWAA.exe JVB.exe File created C:\windows\SysWOW64\TGTV.exe XBOYISX.exe File opened for modification C:\windows\SysWOW64\QDNMGB.exe FLKTY.exe File created C:\windows\SysWOW64\EEIREJ.exe EZPDDW.exe File created C:\windows\SysWOW64\RHFK.exe VBHNGPL.exe File opened for modification C:\windows\SysWOW64\VPSHMSR.exe MBHXW.exe File opened for modification C:\windows\SysWOW64\ITAZLQ.exe MNDCEHK.exe File created C:\windows\SysWOW64\WFJ.exe KMGAPIA.exe File created C:\windows\SysWOW64\BFQGG.exe.bat WFJ.exe File opened for modification C:\windows\SysWOW64\SFHLD.exe SSPF.exe File opened for modification C:\windows\SysWOW64\TRCP.exe TGTV.exe File opened for modification C:\windows\SysWOW64\SRRC.exe QTDIOKX.exe File created C:\windows\SysWOW64\XHIAX.exe OZGV.exe File created C:\windows\SysWOW64\PDNISB.exe.bat SFHLD.exe File created C:\windows\SysWOW64\QTDIOKX.exe WYZZD.exe File created C:\windows\SysWOW64\CSZIHXS.exe IFVZXX.exe File created C:\windows\SysWOW64\XQKJDF.exe 2026-10-22_77b70302d4fba1a9d2b7a887107550a3_elex_emotet_stop.exe File created C:\windows\SysWOW64\RHFK.exe.bat VBHNGPL.exe File created C:\windows\SysWOW64\VPSHMSR.exe.bat MBHXW.exe File created C:\windows\SysWOW64\CSZIHXS.exe.bat IFVZXX.exe File created C:\windows\SysWOW64\DVDM.exe.bat CSZIHXS.exe File opened for modification C:\windows\SysWOW64\AAH.exe ZFDUJM.exe File created C:\windows\SysWOW64\JIJDSH.exe AAH.exe File created C:\windows\SysWOW64\JYYOZ.exe.bat JFQV.exe File opened for modification C:\windows\SysWOW64\AOLA.exe LTCWAA.exe File created C:\windows\SysWOW64\SRRC.exe.bat QTDIOKX.exe File opened for modification C:\windows\SysWOW64\ZNZ.exe TNRLCJ.exe File opened for modification C:\windows\SysWOW64\LTCWAA.exe JVB.exe File created C:\windows\SysWOW64\LTCWAA.exe.bat JVB.exe File opened for modification C:\windows\SysWOW64\DVDM.exe CSZIHXS.exe File created C:\windows\SysWOW64\SFHLD.exe SSPF.exe File created C:\windows\SysWOW64\VZQTBI.exe.bat BMLJY.exe File created C:\windows\SysWOW64\ALYYW.exe.bat EFT.exe File created C:\windows\SysWOW64\JIDSXCA.exe.bat YPAZPV.exe File opened for modification C:\windows\SysWOW64\WFJ.exe KMGAPIA.exe File opened for modification C:\windows\SysWOW64\TGTV.exe XBOYISX.exe File created C:\windows\SysWOW64\QDNMGB.exe FLKTY.exe File created C:\windows\SysWOW64\EZPDDW.exe VLF.exe File created C:\windows\SysWOW64\CZV.exe KRTS.exe File created C:\windows\SysWOW64\SGV.exe.bat GYGND.exe File created C:\windows\SysWOW64\OEK.exe.bat RHFK.exe File opened for modification C:\windows\SysWOW64\BLC.exe QSZXLDE.exe File created C:\windows\SysWOW64\SRRC.exe QTDIOKX.exe File created C:\windows\SysWOW64\PDWLLO.exe HYWFJ.exe File created C:\windows\SysWOW64\PDNISB.exe SFHLD.exe File opened for modification C:\windows\SysWOW64\PDNISB.exe SFHLD.exe File created C:\windows\SysWOW64\HAJWQI.exe.bat BABIHN.exe File created C:\windows\SysWOW64\WWCVB.exe SGV.exe File created C:\windows\SysWOW64\ZNZ.exe TNRLCJ.exe File created C:\windows\SysWOW64\ZNZ.exe.bat TNRLCJ.exe File created C:\windows\SysWOW64\ITAZLQ.exe.bat MNDCEHK.exe File created C:\windows\SysWOW64\BFQGG.exe WFJ.exe File opened for modification C:\windows\SysWOW64\TCIKO.exe NHJJR.exe File created C:\windows\SysWOW64\TCIKO.exe.bat NHJJR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\JLZVTAS.exe TQQJ.exe File created C:\windows\LUTBC.exe XHIAX.exe File created C:\windows\system\QQQ.exe FXVOTSY.exe File created C:\windows\system\FUVL.exe.bat AJRMV.exe File created C:\windows\system\XMT.exe VPSHMSR.exe File created C:\windows\system\MNDCEHK.exe IFOCSWO.exe File opened for modification C:\windows\system\MNDCEHK.exe IFOCSWO.exe File created C:\windows\system\QSZXLDE.exe GULCEUW.exe File created C:\windows\SNXIGKI.exe HUU.exe File created C:\windows\BAPH.exe.bat VZQTBI.exe File created C:\windows\ZXNA.exe.bat OEK.exe File created C:\windows\system\LFSLJP.exe.bat BFQGG.exe File opened for modification C:\windows\NFUDHQ.exe EAUPF.exe File opened for modification C:\windows\system\EXYS.exe GXRFOHC.exe File created C:\windows\FLKTY.exe.bat QFE.exe File opened for modification C:\windows\ZXNA.exe OEK.exe File created C:\windows\system\ZLLGD.exe.bat FYG.exe File opened for modification C:\windows\system\BJEAJ.exe ZLLGD.exe File created C:\windows\YRZQEU.exe.bat SRRC.exe File opened for modification C:\windows\system\EXXX.exe LUTBC.exe File created C:\windows\YCL.exe NJITCDF.exe File opened for modification C:\windows\XBOYISX.exe AVQ.exe File opened for modification C:\windows\FLKTY.exe QFE.exe File opened for modification C:\windows\SNXIGKI.exe HUU.exe File created C:\windows\system\HAM.exe.bat EEIREJ.exe File created C:\windows\SNXIGKI.exe.bat HUU.exe File opened for modification C:\windows\system\JVB.exe MQDWNU.exe File created C:\windows\LUTBC.exe.bat XHIAX.exe File opened for modification C:\windows\system\ZKDCHB.exe EXYS.exe File created C:\windows\system\PGZW.exe.bat JLZVTAS.exe File opened for modification C:\windows\system\LFSLJP.exe BFQGG.exe File created C:\windows\system\NQRZWBH.exe.bat ELHH.exe File opened for modification C:\windows\JLZVTAS.exe TQQJ.exe File opened for modification C:\windows\system\OJIXQMV.exe GRAVKH.exe File opened for modification C:\windows\system\VISTP.exe BVN.exe File created C:\windows\system\XWWBMQW.exe.bat CJASCQ.exe File created C:\windows\system\JVB.exe MQDWNU.exe File created C:\windows\OZGV.exe.bat XQKJDF.exe File created C:\windows\SXNEPCP.exe DUDZ.exe File created C:\windows\system\NJITCDF.exe.bat HJBF.exe File created C:\windows\XBOYISX.exe.bat AVQ.exe File created C:\windows\ELHH.exe.bat STE.exe File opened for modification C:\windows\system\NQRZWBH.exe ELHH.exe File created C:\windows\OTUHR.exe.bat YDTH.exe File created C:\windows\system\OJIXQMV.exe.bat GRAVKH.exe File created C:\windows\system\WMAG.exe CZV.exe File created C:\windows\ZFDUJM.exe MUN.exe File created C:\windows\ELHH.exe STE.exe File opened for modification C:\windows\DUDZ.exe IHYQUPS.exe File opened for modification C:\windows\system\VOK.exe VISTP.exe File opened for modification C:\windows\system\HAM.exe EEIREJ.exe File created C:\windows\system\KRTS.exe.bat QDO.exe File created C:\windows\HYWFJ.exe DQQ.exe File opened for modification C:\windows\system\HJBF.exe BITS.exe File opened for modification C:\windows\system\YPAZPV.exe NWXGG.exe File created C:\windows\HUU.exe HKMWSR.exe File created C:\windows\CJASCQ.exe ALYYW.exe File created C:\windows\YDTH.exe.bat JIJDSH.exe File created C:\windows\system\NWXGG.exe.bat SJS.exe File created C:\windows\EFT.exe.bat SNXIGKI.exe File created C:\windows\VLF.exe NGFWLMO.exe File created C:\windows\system\NHJJR.exe YCL.exe File opened for modification C:\windows\system\NWXGG.exe SJS.exe File opened for modification C:\windows\system\STE.exe HAJWQI.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2500 cmd.exe 4520 cmd.exe 1496 cmd.exe 4804 cmd.exe 4896 cmd.exe 1056 cmd.exe 3292 cmd.exe 5856 cmd.exe 4152 cmd.exe 5684 cmd.exe 3400 cmd.exe 2776 cmd.exe 3184 cmd.exe 2396 cmd.exe 5412 cmd.exe 5804 cmd.exe 5308 cmd.exe 5008 cmd.exe 4532 cmd.exe 2156 cmd.exe 1404 cmd.exe 1796 cmd.exe 1964 cmd.exe 6028 cmd.exe 3036 cmd.exe 6112 cmd.exe 5516 cmd.exe 2208 cmd.exe 3240 cmd.exe 1600 cmd.exe 796 cmd.exe 3328 cmd.exe 3376 cmd.exe 4740 cmd.exe 5696 cmd.exe 4860 cmd.exe 3864 cmd.exe 1472 cmd.exe 5752 cmd.exe 1184 cmd.exe 4236 cmd.exe 4748 cmd.exe 5368 cmd.exe 4636 cmd.exe 3444 cmd.exe 4368 cmd.exe 4576 cmd.exe 4276 cmd.exe 1540 cmd.exe 2828 cmd.exe 8 cmd.exe 2756 cmd.exe 428 cmd.exe 4104 cmd.exe 5608 cmd.exe 4756 cmd.exe 4404 cmd.exe 4612 cmd.exe 4996 cmd.exe 4296 cmd.exe 4392 cmd.exe 2732 cmd.exe 1508 cmd.exe 616 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4160 4564 WerFault.exe 88 4268 4592 WerFault.exe 94 3780 204 WerFault.exe 100 2260 5276 WerFault.exe 105 1984 5596 WerFault.exe 110 1052 1520 WerFault.exe 115 2836 3028 WerFault.exe 120 4284 1668 WerFault.exe 125 1828 3172 WerFault.exe 130 428 416 WerFault.exe 135 696 1196 WerFault.exe 140 3464 1516 WerFault.exe 145 4228 6108 WerFault.exe 150 5084 3064 WerFault.exe 155 2080 5484 WerFault.exe 160 2900 5736 WerFault.exe 165 4708 6100 WerFault.exe 170 544 5100 WerFault.exe 175 4852 2340 WerFault.exe 180 4440 3880 WerFault.exe 185 1248 5692 WerFault.exe 190 3384 4496 WerFault.exe 195 3088 3668 WerFault.exe 200 6060 2840 WerFault.exe 205 4300 4864 WerFault.exe 210 1988 5288 WerFault.exe 215 4296 3660 WerFault.exe 220 4536 1732 WerFault.exe 225 1964 3120 WerFault.exe 230 1352 5936 WerFault.exe 235 1284 2908 WerFault.exe 240 5412 5980 WerFault.exe 245 4624 5388 WerFault.exe 250 1704 256 WerFault.exe 255 2844 4360 WerFault.exe 260 1464 4684 WerFault.exe 265 1844 4324 WerFault.exe 270 1944 4084 WerFault.exe 275 4492 5380 WerFault.exe 281 712 3512 WerFault.exe 286 1480 1432 WerFault.exe 291 2220 5568 WerFault.exe 296 1116 5512 WerFault.exe 301 5360 6120 WerFault.exe 306 4940 4268 WerFault.exe 311 5328 3780 WerFault.exe 316 2888 3888 WerFault.exe 321 2732 1944 WerFault.exe 326 5800 3076 WerFault.exe 331 2020 4640 WerFault.exe 336 6080 828 WerFault.exe 341 4848 2424 WerFault.exe 346 4328 3712 WerFault.exe 351 3592 3572 WerFault.exe 356 4756 1244 WerFault.exe 361 6104 5328 WerFault.exe 366 2412 2088 WerFault.exe 371 712 4112 WerFault.exe 376 5260 3420 WerFault.exe 381 3320 5908 WerFault.exe 386 2240 1328 WerFault.exe 391 3284 5952 WerFault.exe 396 2680 3000 WerFault.exe 401 1356 6060 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTDIOKX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYGND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WEUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJASCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJIXQMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SNXIGKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VISTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRJA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFHLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYWFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGFWLMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXNA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HQDQIOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XFGFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEEUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZPDDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSZXLDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EABTVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBHNGPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWXGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJRMV.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4564 2026-10-22_77b70302d4fba1a9d2b7a887107550a3_elex_emotet_stop.exe 4564 2026-10-22_77b70302d4fba1a9d2b7a887107550a3_elex_emotet_stop.exe 4592 XQKJDF.exe 4592 XQKJDF.exe 204 OZGV.exe 204 OZGV.exe 5276 XHIAX.exe 5276 XHIAX.exe 5596 LUTBC.exe 5596 LUTBC.exe 1520 EXXX.exe 1520 EXXX.exe 3028 EABTVR.exe 3028 EABTVR.exe 1668 GYGND.exe 1668 GYGND.exe 3172 SGV.exe 3172 SGV.exe 416 WWCVB.exe 416 WWCVB.exe 1196 PZFZ.exe 1196 PZFZ.exe 1516 XFGFI.exe 1516 XFGFI.exe 6108 KHO.exe 6108 KHO.exe 3064 TQQJ.exe 3064 TQQJ.exe 5484 JLZVTAS.exe 5484 JLZVTAS.exe 5736 PGZW.exe 5736 PGZW.exe 6100 JTDFAC.exe 6100 JTDFAC.exe 5100 TRJA.exe 5100 TRJA.exe 2340 MUN.exe 2340 MUN.exe 3880 ZFDUJM.exe 3880 ZFDUJM.exe 5692 AAH.exe 5692 AAH.exe 4496 JIJDSH.exe 4496 JIJDSH.exe 3668 YDTH.exe 3668 YDTH.exe 2840 OTUHR.exe 2840 OTUHR.exe 4864 IHYQUPS.exe 4864 IHYQUPS.exe 5288 DUDZ.exe 5288 DUDZ.exe 3660 SXNEPCP.exe 3660 SXNEPCP.exe 1732 DQQ.exe 1732 DQQ.exe 3120 HYWFJ.exe 3120 HYWFJ.exe 5936 PDWLLO.exe 5936 PDWLLO.exe 2908 YRZD.exe 2908 YRZD.exe 5980 TEEUL.exe 5980 TEEUL.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4564 2026-10-22_77b70302d4fba1a9d2b7a887107550a3_elex_emotet_stop.exe 4564 2026-10-22_77b70302d4fba1a9d2b7a887107550a3_elex_emotet_stop.exe 4592 XQKJDF.exe 4592 XQKJDF.exe 204 OZGV.exe 204 OZGV.exe 5276 XHIAX.exe 5276 XHIAX.exe 5596 LUTBC.exe 5596 LUTBC.exe 1520 EXXX.exe 1520 EXXX.exe 3028 EABTVR.exe 3028 EABTVR.exe 1668 GYGND.exe 1668 GYGND.exe 3172 SGV.exe 3172 SGV.exe 416 WWCVB.exe 416 WWCVB.exe 1196 PZFZ.exe 1196 PZFZ.exe 1516 XFGFI.exe 1516 XFGFI.exe 6108 KHO.exe 6108 KHO.exe 3064 TQQJ.exe 3064 TQQJ.exe 5484 JLZVTAS.exe 5484 JLZVTAS.exe 5736 PGZW.exe 5736 PGZW.exe 6100 JTDFAC.exe 6100 JTDFAC.exe 5100 TRJA.exe 5100 TRJA.exe 2340 MUN.exe 2340 MUN.exe 3880 ZFDUJM.exe 3880 ZFDUJM.exe 5692 AAH.exe 5692 AAH.exe 4496 JIJDSH.exe 4496 JIJDSH.exe 3668 YDTH.exe 3668 YDTH.exe 2840 OTUHR.exe 2840 OTUHR.exe 4864 IHYQUPS.exe 4864 IHYQUPS.exe 5288 DUDZ.exe 5288 DUDZ.exe 3660 SXNEPCP.exe 3660 SXNEPCP.exe 1732 DQQ.exe 1732 DQQ.exe 3120 HYWFJ.exe 3120 HYWFJ.exe 5936 PDWLLO.exe 5936 PDWLLO.exe 2908 YRZD.exe 2908 YRZD.exe 5980 TEEUL.exe 5980 TEEUL.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 5164 4564 2026-10-22_77b70302d4fba1a9d2b7a887107550a3_elex_emotet_stop.exe 90 PID 5164 wrote to memory of 4592 5164 cmd.exe 94 PID 4592 wrote to memory of 2560 4592 XQKJDF.exe 96 PID 2560 wrote to memory of 204 2560 cmd.exe 100 PID 204 wrote to memory of 2440 204 OZGV.exe 101 PID 2440 wrote to memory of 5276 2440 cmd.exe 105 PID 5276 wrote to memory of 3956 5276 XHIAX.exe 106 PID 3956 wrote to memory of 5596 3956 cmd.exe 110 PID 5596 wrote to memory of 2116 5596 LUTBC.exe 111 PID 2116 wrote to memory of 1520 2116 cmd.exe 115 PID 1520 wrote to memory of 5432 1520 EXXX.exe 116 PID 5432 wrote to memory of 3028 5432 cmd.exe 120 PID 3028 wrote to memory of 4608 3028 EABTVR.exe 121 PID 4608 wrote to memory of 1668 4608 cmd.exe 125 PID 1668 wrote to memory of 3376 1668 GYGND.exe 126 PID 3376 wrote to memory of 3172 3376 cmd.exe 130 PID 3172 wrote to memory of 5436 3172 SGV.exe 131 PID 5436 wrote to memory of 416 5436 cmd.exe 135 PID 416 wrote to memory of 4596 416 WWCVB.exe 136 PID 4596 wrote to memory of 1196 4596 cmd.exe 140 PID 1196 wrote to memory of 5652 1196 PZFZ.exe 141 PID 5652 wrote to memory of 1516 5652 cmd.exe 145 PID 1516 wrote to memory of 4904 1516 XFGFI.exe 146 PID 4904 wrote to memory of 6108 4904 cmd.exe 150 PID 6108 wrote to memory of 5192 6108 KHO.exe 151 PID 5192 wrote to memory of 3064 5192 cmd.exe 155 PID 3064 wrote to memory of 2504 3064 TQQJ.exe 156 PID 2504 wrote to memory of 5484 2504 cmd.exe 160 PID 5484 wrote to memory of 1540 5484 JLZVTAS.exe 161 PID 1540 wrote to memory of 5736 1540 cmd.exe 165 PID 5736 wrote to memory of 3964 5736 PGZW.exe 166 PID 3964 wrote to memory of 6100 3964 cmd.exe 170 PID 6100 wrote to memory of 1292 6100 JTDFAC.exe 171 PID 1292 wrote to memory of 5100 1292 cmd.exe 175 PID 5100 wrote to memory of 472 5100 TRJA.exe 176 PID 472 wrote to memory of 2340 472 cmd.exe 180 PID 2340 wrote to memory of 4740 2340 MUN.exe 181 PID 4740 wrote to memory of 3880 4740 cmd.exe 185 PID 3880 wrote to memory of 1000 3880 ZFDUJM.exe 186 PID 1000 wrote to memory of 5692 1000 cmd.exe 190 PID 5692 wrote to memory of 3764 5692 AAH.exe 191 PID 3764 wrote to memory of 4496 3764 cmd.exe 195 PID 4496 wrote to memory of 1616 4496 JIJDSH.exe 196 PID 1616 wrote to memory of 3668 1616 cmd.exe 200 PID 3668 wrote to memory of 4160 3668 YDTH.exe 201 PID 4160 wrote to memory of 2840 4160 cmd.exe 205 PID 2840 wrote to memory of 1868 2840 OTUHR.exe 206 PID 1868 wrote to memory of 4864 1868 cmd.exe 210 PID 4864 wrote to memory of 3036 4864 IHYQUPS.exe 211 PID 3036 wrote to memory of 5288 3036 cmd.exe 215 PID 5288 wrote to memory of 1380 5288 DUDZ.exe 216 PID 1380 wrote to memory of 3660 1380 cmd.exe 220 PID 3660 wrote to memory of 2900 3660 SXNEPCP.exe 221 PID 2900 wrote to memory of 1732 2900 cmd.exe 225 PID 1732 wrote to memory of 5944 1732 DQQ.exe 226 PID 5944 wrote to memory of 3120 5944 cmd.exe 230 PID 3120 wrote to memory of 4392 3120 HYWFJ.exe 231 PID 4392 wrote to memory of 5936 4392 cmd.exe 235 PID 5936 wrote to memory of 4532 5936 PDWLLO.exe 236 PID 4532 wrote to memory of 2908 4532 cmd.exe 240 PID 2908 wrote to memory of 5696 2908 YRZD.exe 241 PID 5696 wrote to memory of 5980 5696 cmd.exe 245 PID 5980 wrote to memory of 5808 5980 TEEUL.exe 246 PID 5808 wrote to memory of 5388 5808 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_77b70302d4fba1a9d2b7a887107550a3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_77b70302d4fba1a9d2b7a887107550a3_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQKJDF.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\windows\SysWOW64\XQKJDF.exeC:\windows\system32\XQKJDF.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZGV.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\windows\OZGV.exeC:\windows\OZGV.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XHIAX.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\windows\SysWOW64\XHIAX.exeC:\windows\system32\XHIAX.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUTBC.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\windows\LUTBC.exeC:\windows\LUTBC.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXXX.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\windows\system\EXXX.exeC:\windows\system\EXXX.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EABTVR.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\windows\EABTVR.exeC:\windows\EABTVR.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYGND.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\windows\GYGND.exeC:\windows\GYGND.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGV.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\SysWOW64\SGV.exeC:\windows\system32\SGV.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWCVB.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\WWCVB.exeC:\windows\system32\WWCVB.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZFZ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\windows\PZFZ.exeC:\windows\PZFZ.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XFGFI.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\XFGFI.exeC:\windows\XFGFI.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KHO.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\windows\KHO.exeC:\windows\KHO.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQQJ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\windows\system\TQQJ.exeC:\windows\system\TQQJ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLZVTAS.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\windows\JLZVTAS.exeC:\windows\JLZVTAS.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGZW.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\windows\system\PGZW.exeC:\windows\system\PGZW.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTDFAC.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\windows\system\JTDFAC.exeC:\windows\system\JTDFAC.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRJA.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\windows\TRJA.exeC:\windows\TRJA.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUN.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:472 -
C:\windows\MUN.exeC:\windows\MUN.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFDUJM.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\ZFDUJM.exeC:\windows\ZFDUJM.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAH.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\windows\SysWOW64\AAH.exeC:\windows\system32\AAH.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIJDSH.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\SysWOW64\JIJDSH.exeC:\windows\system32\JIJDSH.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\windows\YDTH.exeC:\windows\YDTH.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTUHR.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\OTUHR.exeC:\windows\OTUHR.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHYQUPS.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\windows\IHYQUPS.exeC:\windows\IHYQUPS.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DUDZ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\windows\DUDZ.exeC:\windows\DUDZ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXNEPCP.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\windows\SXNEPCP.exeC:\windows\SXNEPCP.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQQ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\system\DQQ.exeC:\windows\system\DQQ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYWFJ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\HYWFJ.exeC:\windows\HYWFJ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDWLLO.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\windows\SysWOW64\PDWLLO.exeC:\windows\system32\PDWLLO.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YRZD.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\YRZD.exeC:\windows\YRZD.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEEUL.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\windows\TEEUL.exeC:\windows\TEEUL.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMGAPIA.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\KMGAPIA.exeC:\windows\KMGAPIA.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFJ.exe.bat" "66⤵PID:2976
-
C:\windows\SysWOW64\WFJ.exeC:\windows\system32\WFJ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFQGG.exe.bat" "68⤵PID:6056
-
C:\windows\SysWOW64\BFQGG.exeC:\windows\system32\BFQGG.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFSLJP.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4860 -
C:\windows\system\LFSLJP.exeC:\windows\system\LFSLJP.exe71⤵
- Executes dropped EXE
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIW.exe.bat" "72⤵PID:5768
-
C:\windows\system\LIW.exeC:\windows\system\LIW.exe73⤵
- Executes dropped EXE
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOCEE.exe.bat" "74⤵PID:1612
-
C:\windows\system\AOCEE.exeC:\windows\system\AOCEE.exe75⤵
- Executes dropped EXE
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBHNGPL.exe.bat" "76⤵
- Executes a command shell one-liner
PID:3292 -
C:\windows\system\VBHNGPL.exeC:\windows\system\VBHNGPL.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHFK.exe.bat" "78⤵PID:2752
-
C:\windows\SysWOW64\RHFK.exeC:\windows\system32\RHFK.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEK.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4236 -
C:\windows\SysWOW64\OEK.exeC:\windows\system32\OEK.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXNA.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2156 -
C:\windows\ZXNA.exeC:\windows\ZXNA.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXVOTSY.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4748 -
C:\windows\system\FXVOTSY.exeC:\windows\system\FXVOTSY.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QQQ.exe.bat" "86⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5856 -
C:\windows\system\QQQ.exeC:\windows\system\QQQ.exe87⤵
- Executes dropped EXE
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BITS.exe.bat" "88⤵PID:260
-
C:\windows\system\BITS.exeC:\windows\system\BITS.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HJBF.exe.bat" "90⤵
- Executes a command shell one-liner
PID:6112 -
C:\windows\system\HJBF.exeC:\windows\system\HJBF.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NJITCDF.exe.bat" "92⤵PID:4232
-
C:\windows\system\NJITCDF.exeC:\windows\system\NJITCDF.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCL.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\windows\YCL.exeC:\windows\YCL.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHJJR.exe.bat" "96⤵PID:3040
-
C:\windows\system\NHJJR.exeC:\windows\system\NHJJR.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCIKO.exe.bat" "98⤵PID:4548
-
C:\windows\SysWOW64\TCIKO.exeC:\windows\system32\TCIKO.exe99⤵
- Executes dropped EXE
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNRLCJ.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1256 -
C:\windows\SysWOW64\TNRLCJ.exeC:\windows\system32\TNRLCJ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNZ.exe.bat" "102⤵PID:4448
-
C:\windows\SysWOW64\ZNZ.exeC:\windows\system32\ZNZ.exe103⤵
- Executes dropped EXE
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KGUS.exe.bat" "104⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2828 -
C:\windows\system\KGUS.exeC:\windows\system\KGUS.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STUGV.exe.bat" "106⤵PID:5792
-
C:\windows\system\STUGV.exeC:\windows\system\STUGV.exe107⤵
- Executes dropped EXE
PID:3572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRAVKH.exe.bat" "108⤵PID:2188
-
C:\windows\GRAVKH.exeC:\windows\GRAVKH.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJIXQMV.exe.bat" "110⤵PID:1844
-
C:\windows\system\OJIXQMV.exeC:\windows\system\OJIXQMV.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSPF.exe.bat" "112⤵PID:1652
-
C:\windows\SysWOW64\SSPF.exeC:\windows\system32\SSPF.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFHLD.exe.bat" "114⤵PID:1412
-
C:\windows\SysWOW64\SFHLD.exeC:\windows\system32\SFHLD.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDNISB.exe.bat" "116⤵PID:1104
-
C:\windows\SysWOW64\PDNISB.exeC:\windows\system32\PDNISB.exe117⤵
- Executes dropped EXE
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVQ.exe.bat" "118⤵PID:5712
-
C:\windows\system\AVQ.exeC:\windows\system\AVQ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBOYISX.exe.bat" "120⤵PID:5564
-
C:\windows\XBOYISX.exeC:\windows\XBOYISX.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-