Analysis
- max time kernel
85s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_6dc3d7bbcbe3c701dc9c40dce30d56b0_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_6dc3d7bbcbe3c701dc9c40dce30d56b0_elex_emotet_stop.exe
- Size 208KB
- Sample261024-lemlysys5m
- SHA256 1afa7b0b0b4ac8ce15e6d33421d3d2484efd683ea978dad6088e0bfe67e08c5f
- MD5 6dc3d7bbcbe3c701dc9c40dce30d56b0
- SHA1 fcc70c6039d5c476b4631e27a2ea014e8d7f58fb
- SHA512 4bab8f883cf16d68f93751e3190573d760cbd4820b8af6fb5c41d5423903b4808ab281ce81559f017608f65f2a247e98fa6905e1ff697c3c92d6c85ebb2bdef8
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcKL+LOfw4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlcS+LOYkEj1
- TLSH T19C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4744 GFGZ.exe 4416 HVOIAHG.exe 2756 JTUDH.exe 2676 ABIAU.exe 1124 GBQODIT.exe 808 BPVF.exe 3100 WUV.exe 264 ADJRB.exe 4880 CAPL.exe 1752 YGVAYW.exe 4908 YLNPZJL.exe 1996 BZSY.exe 2284 UCWCPZ.exe 700 HNM.exe 2536 BARKF.exe 3484 ENWTQJI.exe 2348 ZASD.exe 4748 IJUIDHZ.exe 236 MRJQQ.exe 6072 NUNLVP.exe 1212 CPWQ.exe 4208 AKVZLEM.exe 1692 GKDM.exe 4716 RDYF.exe 5968 SGCBPEE.exe 2300 MTHK.exe 3644 QBVSEWP.exe 5432 HKP.exe 1464 CXHZ.exe 4404 TFJEE.exe 4488 FYMXNS.exe 4660 UTVJ.exe 4840 NWZ.exe 2192 LHCVMIW.exe 2360 GUGE.exe 1220 VPYJH.exe 2956 MXS.exe 1608 QFHWF.exe 4276 LBLFHSZ.exe 5856 UBF.exe 5924 POKUV.exe 2660 VPSHMSR.exe 1436 BKR.exe 2968 HKZEZ.exe 5740 MKG.exe 3048 FOKNO.exe 3388 WOM.exe 5456 IGPL.exe 2556 PBYXL.exe 3460 RXDHVHZ.exe 3244 SCVVW.exe 5056 XDDJN.exe 3480 JVGCOD.exe 4412 YQQG.exe 1200 SEUQJQ.exe 4672 EWXIRXX.exe 5444 PPA.exe 4640 CZJSOP.exe 4496 KFJGPCD.exe 1032 TSTYF.exe 1424 TYMNG.exe 2844 FOS.exe 2236 ABXE.exe 5340 UPCOFW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\HKP.exe QBVSEWP.exe File created C:\windows\SysWOW64\VPSHMSR.exe POKUV.exe File opened for modification C:\windows\SysWOW64\FOS.exe TYMNG.exe File created C:\windows\SysWOW64\UPCOFW.exe ABXE.exe File created C:\windows\SysWOW64\WPMPC.exe KWJX.exe File created C:\windows\SysWOW64\XJPDKU.exe.bat KHTXFCH.exe File created C:\windows\SysWOW64\AKVZLEM.exe.bat CPWQ.exe File created C:\windows\SysWOW64\HKP.exe.bat QBVSEWP.exe File created C:\windows\SysWOW64\HKZEZ.exe.bat BKR.exe File created C:\windows\SysWOW64\CZJSOP.exe.bat PPA.exe File created C:\windows\SysWOW64\FEJKFC.exe.bat OEHXB.exe File created C:\windows\SysWOW64\SMDMBTN.exe.bat XYZCR.exe File opened for modification C:\windows\SysWOW64\NIW.exe BPTDLLE.exe File opened for modification C:\windows\SysWOW64\RDQBR.exe NVBTN.exe File created C:\windows\SysWOW64\BPVF.exe GBQODIT.exe File opened for modification C:\windows\SysWOW64\YGVAYW.exe CAPL.exe File opened for modification C:\windows\SysWOW64\GKDM.exe AKVZLEM.exe File created C:\windows\SysWOW64\MTHK.exe.bat SGCBPEE.exe File created C:\windows\SysWOW64\VPYJH.exe GUGE.exe File opened for modification C:\windows\SysWOW64\QFHWF.exe MXS.exe File opened for modification C:\windows\SysWOW64\BCSZ.exe FWMC.exe File created C:\windows\SysWOW64\CYI.exe SBU.exe File created C:\windows\SysWOW64\BPVF.exe.bat GBQODIT.exe File created C:\windows\SysWOW64\MTHK.exe SGCBPEE.exe File opened for modification C:\windows\SysWOW64\VPYJH.exe GUGE.exe File created C:\windows\SysWOW64\VPYJH.exe.bat GUGE.exe File opened for modification C:\windows\SysWOW64\ABXE.exe FOS.exe File created C:\windows\SysWOW64\SCLFD.exe.bat JCJ.exe File created C:\windows\SysWOW64\WPMPC.exe.bat KWJX.exe File created C:\windows\SysWOW64\NIW.exe.bat BPTDLLE.exe File created C:\windows\SysWOW64\GKDM.exe.bat AKVZLEM.exe File created C:\windows\SysWOW64\QFHWF.exe MXS.exe File opened for modification C:\windows\SysWOW64\HKZEZ.exe BKR.exe File created C:\windows\SysWOW64\MKG.exe HKZEZ.exe File created C:\windows\SysWOW64\KVO.exe YCTTMYQ.exe File opened for modification C:\windows\SysWOW64\XJPDKU.exe KHTXFCH.exe File created C:\windows\SysWOW64\AKHT.exe.bat ZHDQR.exe File opened for modification C:\windows\SysWOW64\MTHK.exe SGCBPEE.exe File created C:\windows\SysWOW64\NWZ.exe UTVJ.exe File created C:\windows\SysWOW64\SCVVW.exe.bat RXDHVHZ.exe File created C:\windows\SysWOW64\ABXE.exe FOS.exe File created C:\windows\SysWOW64\SMDMBTN.exe XYZCR.exe File created C:\windows\SysWOW64\RDQBR.exe NVBTN.exe File created C:\windows\SysWOW64\XJPDKU.exe KHTXFCH.exe File created C:\windows\SysWOW64\SAETRGY.exe.bat MFNSUC.exe File created C:\windows\SysWOW64\YGVAYW.exe.bat CAPL.exe File opened for modification C:\windows\SysWOW64\AKVZLEM.exe CPWQ.exe File opened for modification C:\windows\SysWOW64\SCVVW.exe RXDHVHZ.exe File created C:\windows\SysWOW64\FOS.exe.bat TYMNG.exe File opened for modification C:\windows\SysWOW64\AKHT.exe ZHDQR.exe File created C:\windows\SysWOW64\GKDM.exe AKVZLEM.exe File created C:\windows\SysWOW64\HKP.exe QBVSEWP.exe File created C:\windows\SysWOW64\CZJSOP.exe PPA.exe File created C:\windows\SysWOW64\UPCOFW.exe.bat ABXE.exe File created C:\windows\SysWOW64\ENWTQJI.exe.bat BARKF.exe File opened for modification C:\windows\SysWOW64\QBVSEWP.exe MTHK.exe File created C:\windows\SysWOW64\QFHWF.exe.bat MXS.exe File opened for modification C:\windows\SysWOW64\VPSHMSR.exe POKUV.exe File created C:\windows\SysWOW64\SCLFD.exe JCJ.exe File opened for modification C:\windows\SysWOW64\FEJKFC.exe OEHXB.exe File created C:\windows\SysWOW64\CYI.exe.bat SBU.exe File created C:\windows\SysWOW64\WNHO.exe.bat NIW.exe File created C:\windows\SysWOW64\QBVSEWP.exe MTHK.exe File created C:\windows\SysWOW64\SCVVW.exe RXDHVHZ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\BZSY.exe YLNPZJL.exe File created C:\windows\system\BCCGY.exe.bat TJT.exe File created C:\windows\OEHXB.exe BTZGN.exe File created C:\windows\system\GUGE.exe.bat LHCVMIW.exe File created C:\windows\system\FOKNO.exe MKG.exe File opened for modification C:\windows\system\SEUQJQ.exe YQQG.exe File created C:\windows\system\PPA.exe.bat EWXIRXX.exe File created C:\windows\system\CLU.exe IQPBET.exe File opened for modification C:\windows\system\XYZCR.exe CLU.exe File opened for modification C:\windows\CJR.exe CYI.exe File created C:\windows\system\FYMXNS.exe TFJEE.exe File created C:\windows\system\MXS.exe.bat VPYJH.exe File created C:\windows\system\UBF.exe.bat LBLFHSZ.exe File created C:\windows\system\SEUQJQ.exe.bat YQQG.exe File opened for modification C:\windows\BISOGSF.exe BCSZ.exe File created C:\windows\system\BCCGY.exe TJT.exe File created C:\windows\system\HNM.exe UCWCPZ.exe File opened for modification C:\windows\system\HNM.exe UCWCPZ.exe File created C:\windows\system\POKUV.exe.bat UBF.exe File opened for modification C:\windows\system\FOKNO.exe MKG.exe File created C:\windows\YQQG.exe JVGCOD.exe File created C:\windows\MHMUX.exe GHFGNDB.exe File created C:\windows\system\IQPBET.exe LSRM.exe File created C:\windows\system\FKOHO.exe AKHT.exe File opened for modification C:\windows\system\UTVJ.exe FYMXNS.exe File opened for modification C:\windows\system\IGPL.exe WOM.exe File created C:\windows\system\NVBTN.exe WNHO.exe File opened for modification C:\windows\ADJRB.exe WUV.exe File created C:\windows\system\BARKF.exe HNM.exe File opened for modification C:\windows\CXHZ.exe HKP.exe File created C:\windows\CXHZ.exe.bat HKP.exe File created C:\windows\system\PBYXL.exe.bat IGPL.exe File created C:\windows\XOU.exe BQW.exe File opened for modification C:\windows\system\TJT.exe DZD.exe File opened for modification C:\windows\RDYF.exe GKDM.exe File created C:\windows\system\UTVJ.exe.bat FYMXNS.exe File created C:\windows\system\IQPBET.exe.bat LSRM.exe File created C:\windows\system\SGCBPEE.exe RDYF.exe File opened for modification C:\windows\BKR.exe VPSHMSR.exe File opened for modification C:\windows\system\FKOHO.exe AKHT.exe File opened for modification C:\windows\system\ABIAU.exe JTUDH.exe File created C:\windows\CAPL.exe.bat ADJRB.exe File opened for modification C:\windows\system\EWXIRXX.exe SEUQJQ.exe File created C:\windows\KHTXFCH.exe.bat RDQBR.exe File created C:\windows\system\MFNSUC.exe QAHVF.exe File created C:\windows\ADJRB.exe.bat WUV.exe File created C:\windows\system\NUNLVP.exe MRJQQ.exe File opened for modification C:\windows\system\NUNLVP.exe MRJQQ.exe File opened for modification C:\windows\KWJX.exe CJR.exe File created C:\windows\BPTDLLE.exe.bat WPMPC.exe File opened for modification C:\windows\system\FYMXNS.exe TFJEE.exe File created C:\windows\RXDHVHZ.exe.bat PBYXL.exe File created C:\windows\system\QAHVF.exe BCCGY.exe File opened for modification C:\windows\BZSY.exe YLNPZJL.exe File opened for modification C:\windows\UCWCPZ.exe BZSY.exe File opened for modification C:\windows\system\HIZCPUO.exe BISOGSF.exe File created C:\windows\WUV.exe.bat BPVF.exe File created C:\windows\system\PBYXL.exe IGPL.exe File created C:\windows\CAPL.exe ADJRB.exe File created C:\windows\ZASD.exe.bat ENWTQJI.exe File opened for modification C:\windows\system\HVOIAHG.exe GFGZ.exe File created C:\windows\system\HNM.exe.bat UCWCPZ.exe File created C:\windows\system\LFRY.exe FEJKFC.exe File created C:\windows\KHTXFCH.exe RDQBR.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3204 cmd.exe 2904 cmd.exe 1420 cmd.exe 5192 cmd.exe 2628 cmd.exe 4444 cmd.exe 1152 cmd.exe 4684 cmd.exe 5680 cmd.exe 912 cmd.exe 832 cmd.exe 5268 cmd.exe 2112 cmd.exe 4472 cmd.exe 1244 cmd.exe 5492 cmd.exe 1044 cmd.exe 1860 cmd.exe 5024 cmd.exe 4540 cmd.exe 1628 cmd.exe 560 cmd.exe 2548 cmd.exe 4044 cmd.exe 5156 cmd.exe 2692 cmd.exe 2784 cmd.exe 3376 cmd.exe 4040 cmd.exe 6004 cmd.exe 5520 cmd.exe 3232 cmd.exe 2620 cmd.exe 4824 cmd.exe 4776 cmd.exe 5940 cmd.exe 4848 cmd.exe 1292 cmd.exe 4980 cmd.exe 4984 cmd.exe 4084 cmd.exe 4576 cmd.exe 5028 cmd.exe 1400 cmd.exe 1624 cmd.exe 6032 cmd.exe 552 cmd.exe 4752 cmd.exe 4964 cmd.exe 3196 cmd.exe 6052 cmd.exe 1980 cmd.exe 5980 cmd.exe 4552 cmd.exe 5236 cmd.exe 5344 cmd.exe 3884 cmd.exe 4760 cmd.exe 4736 cmd.exe 2728 cmd.exe 2432 cmd.exe 2108 cmd.exe 4456 cmd.exe 2920 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4660 3452 WerFault.exe 87 3852 4744 WerFault.exe 93 5012 4416 WerFault.exe 99 5212 2756 WerFault.exe 104 560 2676 WerFault.exe 109 5068 1124 WerFault.exe 114 1892 808 WerFault.exe 119 5920 3100 WerFault.exe 124 1496 264 WerFault.exe 129 3152 4880 WerFault.exe 134 2772 1752 WerFault.exe 139 3092 4908 WerFault.exe 143 5012 1996 WerFault.exe 149 3348 2284 WerFault.exe 154 612 700 WerFault.exe 159 3444 2536 WerFault.exe 164 3048 3484 WerFault.exe 169 3128 2348 WerFault.exe 174 5952 4748 WerFault.exe 179 2808 236 WerFault.exe 184 5060 6072 WerFault.exe 189 4100 1212 WerFault.exe 194 4604 4208 WerFault.exe 199 3348 1692 WerFault.exe 204 1064 4716 WerFault.exe 209 3088 5968 WerFault.exe 214 4492 2300 WerFault.exe 219 3104 3644 WerFault.exe 224 2920 5432 WerFault.exe 229 2252 1464 WerFault.exe 233 3460 4404 WerFault.exe 239 8 4488 WerFault.exe 244 5992 4660 WerFault.exe 249 1404 4840 WerFault.exe 254 4336 2192 WerFault.exe 259 2332 2360 WerFault.exe 264 3440 1220 WerFault.exe 269 2856 2956 WerFault.exe 274 4640 1608 WerFault.exe 280 5940 4276 WerFault.exe 285 5060 5856 WerFault.exe 290 2788 5924 WerFault.exe 295 4848 2660 WerFault.exe 300 3036 1436 WerFault.exe 305 4332 2968 WerFault.exe 310 4772 5740 WerFault.exe 315 620 3048 WerFault.exe 320 1232 3388 WerFault.exe 325 5392 5456 WerFault.exe 330 4052 2556 WerFault.exe 335 1132 3460 WerFault.exe 340 4088 3244 WerFault.exe 345 2948 5056 WerFault.exe 350 1912 3480 WerFault.exe 355 4280 4412 WerFault.exe 360 4440 1200 WerFault.exe 365 5076 4672 WerFault.exe 370 4984 5444 WerFault.exe 375 2088 4640 WerFault.exe 380 3260 4496 WerFault.exe 385 3812 1032 WerFault.exe 390 4604 1424 WerFault.exe 395 6096 2844 WerFault.exe 400 6132 2236 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPMPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UBF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FKOHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHMUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IGPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SOZIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJZTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPTDLLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGVAYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QBVSEWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFHWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBYXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCVVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKZEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGCBPEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TYMNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBQODIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPYJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTZGN.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3452 2026-10-22_6dc3d7bbcbe3c701dc9c40dce30d56b0_elex_emotet_stop.exe 3452 2026-10-22_6dc3d7bbcbe3c701dc9c40dce30d56b0_elex_emotet_stop.exe 4744 GFGZ.exe 4744 GFGZ.exe 4416 HVOIAHG.exe 4416 HVOIAHG.exe 2756 JTUDH.exe 2756 JTUDH.exe 2676 ABIAU.exe 2676 ABIAU.exe 1124 GBQODIT.exe 1124 GBQODIT.exe 808 BPVF.exe 808 BPVF.exe 3100 WUV.exe 3100 WUV.exe 264 ADJRB.exe 264 ADJRB.exe 4880 CAPL.exe 4880 CAPL.exe 1752 YGVAYW.exe 1752 YGVAYW.exe 4908 YLNPZJL.exe 4908 YLNPZJL.exe 1996 BZSY.exe 1996 BZSY.exe 2284 UCWCPZ.exe 2284 UCWCPZ.exe 700 HNM.exe 700 HNM.exe 2536 BARKF.exe 2536 BARKF.exe 3484 ENWTQJI.exe 3484 ENWTQJI.exe 2348 ZASD.exe 2348 ZASD.exe 4748 IJUIDHZ.exe 4748 IJUIDHZ.exe 236 MRJQQ.exe 236 MRJQQ.exe 6072 NUNLVP.exe 6072 NUNLVP.exe 1212 CPWQ.exe 1212 CPWQ.exe 4208 AKVZLEM.exe 4208 AKVZLEM.exe 1692 GKDM.exe 1692 GKDM.exe 4716 RDYF.exe 4716 RDYF.exe 5968 SGCBPEE.exe 5968 SGCBPEE.exe 2300 MTHK.exe 2300 MTHK.exe 3644 QBVSEWP.exe 3644 QBVSEWP.exe 5432 HKP.exe 5432 HKP.exe 1464 CXHZ.exe 1464 CXHZ.exe 4404 TFJEE.exe 4404 TFJEE.exe 4488 FYMXNS.exe 4488 FYMXNS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3452 2026-10-22_6dc3d7bbcbe3c701dc9c40dce30d56b0_elex_emotet_stop.exe 3452 2026-10-22_6dc3d7bbcbe3c701dc9c40dce30d56b0_elex_emotet_stop.exe 4744 GFGZ.exe 4744 GFGZ.exe 4416 HVOIAHG.exe 4416 HVOIAHG.exe 2756 JTUDH.exe 2756 JTUDH.exe 2676 ABIAU.exe 2676 ABIAU.exe 1124 GBQODIT.exe 1124 GBQODIT.exe 808 BPVF.exe 808 BPVF.exe 3100 WUV.exe 3100 WUV.exe 264 ADJRB.exe 264 ADJRB.exe 4880 CAPL.exe 4880 CAPL.exe 1752 YGVAYW.exe 1752 YGVAYW.exe 4908 YLNPZJL.exe 4908 YLNPZJL.exe 1996 BZSY.exe 1996 BZSY.exe 2284 UCWCPZ.exe 2284 UCWCPZ.exe 700 HNM.exe 700 HNM.exe 2536 BARKF.exe 2536 BARKF.exe 3484 ENWTQJI.exe 3484 ENWTQJI.exe 2348 ZASD.exe 2348 ZASD.exe 4748 IJUIDHZ.exe 4748 IJUIDHZ.exe 236 MRJQQ.exe 236 MRJQQ.exe 6072 NUNLVP.exe 6072 NUNLVP.exe 1212 CPWQ.exe 1212 CPWQ.exe 4208 AKVZLEM.exe 4208 AKVZLEM.exe 1692 GKDM.exe 1692 GKDM.exe 4716 RDYF.exe 4716 RDYF.exe 5968 SGCBPEE.exe 5968 SGCBPEE.exe 2300 MTHK.exe 2300 MTHK.exe 3644 QBVSEWP.exe 3644 QBVSEWP.exe 5432 HKP.exe 5432 HKP.exe 1464 CXHZ.exe 1464 CXHZ.exe 4404 TFJEE.exe 4404 TFJEE.exe 4488 FYMXNS.exe 4488 FYMXNS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 3196 3452 2026-10-22_6dc3d7bbcbe3c701dc9c40dce30d56b0_elex_emotet_stop.exe 89 PID 3196 wrote to memory of 4744 3196 cmd.exe 93 PID 4744 wrote to memory of 3040 4744 GFGZ.exe 95 PID 3040 wrote to memory of 4416 3040 cmd.exe 99 PID 4416 wrote to memory of 4888 4416 HVOIAHG.exe 100 PID 4888 wrote to memory of 2756 4888 cmd.exe 104 PID 2756 wrote to memory of 3292 2756 JTUDH.exe 105 PID 3292 wrote to memory of 2676 3292 cmd.exe 109 PID 2676 wrote to memory of 4996 2676 ABIAU.exe 110 PID 4996 wrote to memory of 1124 4996 cmd.exe 114 PID 1124 wrote to memory of 5268 1124 GBQODIT.exe 115 PID 5268 wrote to memory of 808 5268 cmd.exe 119 PID 808 wrote to memory of 6052 808 BPVF.exe 120 PID 6052 wrote to memory of 3100 6052 cmd.exe 124 PID 3100 wrote to memory of 6120 3100 WUV.exe 125 PID 6120 wrote to memory of 264 6120 cmd.exe 129 PID 264 wrote to memory of 4864 264 ADJRB.exe 130 PID 4864 wrote to memory of 4880 4864 cmd.exe 134 PID 4880 wrote to memory of 3204 4880 CAPL.exe 135 PID 3204 wrote to memory of 1752 3204 cmd.exe 139 PID 1752 wrote to memory of 2904 1752 YGVAYW.exe 140 PID 2904 wrote to memory of 4908 2904 cmd.exe 143 PID 4908 wrote to memory of 1860 4908 YLNPZJL.exe 145 PID 1860 wrote to memory of 1996 1860 cmd.exe 149 PID 1996 wrote to memory of 4040 1996 BZSY.exe 150 PID 4040 wrote to memory of 2284 4040 cmd.exe 154 PID 2284 wrote to memory of 2552 2284 UCWCPZ.exe 155 PID 2552 wrote to memory of 700 2552 cmd.exe 159 PID 700 wrote to memory of 4544 700 HNM.exe 160 PID 4544 wrote to memory of 2536 4544 cmd.exe 164 PID 2536 wrote to memory of 1916 2536 BARKF.exe 165 PID 1916 wrote to memory of 3484 1916 cmd.exe 169 PID 3484 wrote to memory of 4044 3484 ENWTQJI.exe 170 PID 4044 wrote to memory of 2348 4044 cmd.exe 174 PID 2348 wrote to memory of 1564 2348 ZASD.exe 175 PID 1564 wrote to memory of 4748 1564 cmd.exe 179 PID 4748 wrote to memory of 3560 4748 IJUIDHZ.exe 180 PID 3560 wrote to memory of 236 3560 cmd.exe 184 PID 236 wrote to memory of 5724 236 MRJQQ.exe 185 PID 5724 wrote to memory of 6072 5724 cmd.exe 189 PID 6072 wrote to memory of 5932 6072 NUNLVP.exe 190 PID 5932 wrote to memory of 1212 5932 cmd.exe 194 PID 1212 wrote to memory of 5164 1212 CPWQ.exe 195 PID 5164 wrote to memory of 4208 5164 cmd.exe 199 PID 4208 wrote to memory of 2548 4208 AKVZLEM.exe 200 PID 2548 wrote to memory of 1692 2548 cmd.exe 204 PID 1692 wrote to memory of 5748 1692 GKDM.exe 205 PID 5748 wrote to memory of 4716 5748 cmd.exe 209 PID 4716 wrote to memory of 1756 4716 RDYF.exe 210 PID 1756 wrote to memory of 5968 1756 cmd.exe 214 PID 5968 wrote to memory of 5108 5968 SGCBPEE.exe 215 PID 5108 wrote to memory of 2300 5108 cmd.exe 219 PID 2300 wrote to memory of 1276 2300 MTHK.exe 220 PID 1276 wrote to memory of 3644 1276 cmd.exe 224 PID 3644 wrote to memory of 4084 3644 QBVSEWP.exe 225 PID 4084 wrote to memory of 5432 4084 cmd.exe 229 PID 5432 wrote to memory of 5872 5432 HKP.exe 230 PID 5872 wrote to memory of 1464 5872 cmd.exe 233 PID 1464 wrote to memory of 5104 1464 CXHZ.exe 235 PID 5104 wrote to memory of 4404 5104 cmd.exe 239 PID 4404 wrote to memory of 2112 4404 TFJEE.exe 240 PID 2112 wrote to memory of 4488 2112 cmd.exe 244 PID 4488 wrote to memory of 3092 4488 FYMXNS.exe 245 PID 3092 wrote to memory of 4660 3092 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_6dc3d7bbcbe3c701dc9c40dce30d56b0_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_6dc3d7bbcbe3c701dc9c40dce30d56b0_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFGZ.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\windows\system\GFGZ.exeC:\windows\system\GFGZ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVOIAHG.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\system\HVOIAHG.exeC:\windows\system\HVOIAHG.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTUDH.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\system\JTUDH.exeC:\windows\system\JTUDH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABIAU.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\windows\system\ABIAU.exeC:\windows\system\ABIAU.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BPVF.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\windows\SysWOW64\BPVF.exeC:\windows\system32\BPVF.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUV.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\WUV.exeC:\windows\WUV.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADJRB.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\windows\ADJRB.exeC:\windows\ADJRB.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAPL.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\windows\CAPL.exeC:\windows\CAPL.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGVAYW.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\SysWOW64\YGVAYW.exeC:\windows\system32\YGVAYW.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLNPZJL.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\windows\YLNPZJL.exeC:\windows\YLNPZJL.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZSY.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\windows\BZSY.exeC:\windows\BZSY.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCWCPZ.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\windows\UCWCPZ.exeC:\windows\UCWCPZ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HNM.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\windows\system\HNM.exeC:\windows\system\HNM.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BARKF.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\system\BARKF.exeC:\windows\system\BARKF.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENWTQJI.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\windows\SysWOW64\ENWTQJI.exeC:\windows\system32\ENWTQJI.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZASD.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\windows\ZASD.exeC:\windows\ZASD.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IJUIDHZ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\windows\IJUIDHZ.exeC:\windows\IJUIDHZ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRJQQ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\windows\system\MRJQQ.exeC:\windows\system\MRJQQ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUNLVP.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\system\NUNLVP.exeC:\windows\system\NUNLVP.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPWQ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\CPWQ.exeC:\windows\CPWQ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AKVZLEM.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\windows\SysWOW64\AKVZLEM.exeC:\windows\system32\AKVZLEM.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKDM.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\windows\SysWOW64\GKDM.exeC:\windows\system32\GKDM.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDYF.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\RDYF.exeC:\windows\RDYF.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGCBPEE.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\windows\system\SGCBPEE.exeC:\windows\system\SGCBPEE.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTHK.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\windows\SysWOW64\MTHK.exeC:\windows\system32\MTHK.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QBVSEWP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\windows\SysWOW64\QBVSEWP.exeC:\windows\system32\QBVSEWP.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKP.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\windows\SysWOW64\HKP.exeC:\windows\system32\HKP.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXHZ.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\CXHZ.exeC:\windows\CXHZ.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TFJEE.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\windows\TFJEE.exeC:\windows\TFJEE.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FYMXNS.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\windows\system\FYMXNS.exeC:\windows\system\FYMXNS.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTVJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\windows\system\UTVJ.exeC:\windows\system\UTVJ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWZ.exe.bat" "66⤵
- Executes a command shell one-liner
PID:2108 -
C:\windows\SysWOW64\NWZ.exeC:\windows\system32\NWZ.exe67⤵
- Executes dropped EXE
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LHCVMIW.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1364 -
C:\windows\LHCVMIW.exeC:\windows\LHCVMIW.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GUGE.exe.bat" "70⤵PID:1300
-
C:\windows\system\GUGE.exeC:\windows\system\GUGE.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPYJH.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3012 -
C:\windows\SysWOW64\VPYJH.exeC:\windows\system32\VPYJH.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXS.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:2888 -
C:\windows\system\MXS.exeC:\windows\system\MXS.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFHWF.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5024 -
C:\windows\SysWOW64\QFHWF.exeC:\windows\system32\QFHWF.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBLFHSZ.exe.bat" "78⤵
- Executes a command shell one-liner
PID:6004 -
C:\windows\LBLFHSZ.exeC:\windows\LBLFHSZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBF.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:2296 -
C:\windows\system\UBF.exeC:\windows\system\UBF.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\POKUV.exe.bat" "82⤵PID:4808
-
C:\windows\system\POKUV.exeC:\windows\system\POKUV.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPSHMSR.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2620 -
C:\windows\SysWOW64\VPSHMSR.exeC:\windows\system32\VPSHMSR.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKR.exe.bat" "86⤵PID:940
-
C:\windows\BKR.exeC:\windows\BKR.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKZEZ.exe.bat" "88⤵PID:1452
-
C:\windows\SysWOW64\HKZEZ.exeC:\windows\system32\HKZEZ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKG.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2616 -
C:\windows\SysWOW64\MKG.exeC:\windows\system32\MKG.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FOKNO.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3868 -
C:\windows\system\FOKNO.exeC:\windows\system\FOKNO.exe93⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOM.exe.bat" "94⤵PID:2488
-
C:\windows\WOM.exeC:\windows\WOM.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGPL.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1724 -
C:\windows\system\IGPL.exeC:\windows\system\IGPL.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PBYXL.exe.bat" "98⤵PID:1484
-
C:\windows\system\PBYXL.exeC:\windows\system\PBYXL.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RXDHVHZ.exe.bat" "100⤵PID:948
-
C:\windows\RXDHVHZ.exeC:\windows\RXDHVHZ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SCVVW.exe.bat" "102⤵PID:5928
-
C:\windows\SysWOW64\SCVVW.exeC:\windows\system32\SCVVW.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDDJN.exe.bat" "104⤵PID:5948
-
C:\windows\XDDJN.exeC:\windows\XDDJN.exe105⤵
- Executes dropped EXE
PID:5056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVGCOD.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1044 -
C:\windows\JVGCOD.exeC:\windows\JVGCOD.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQG.exe.bat" "108⤵PID:3624
-
C:\windows\YQQG.exeC:\windows\YQQG.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEUQJQ.exe.bat" "110⤵PID:5792
-
C:\windows\system\SEUQJQ.exeC:\windows\system\SEUQJQ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWXIRXX.exe.bat" "112⤵
- Executes a command shell one-liner
PID:5492 -
C:\windows\system\EWXIRXX.exeC:\windows\system\EWXIRXX.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PPA.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3300 -
C:\windows\system\PPA.exeC:\windows\system\PPA.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CZJSOP.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4108 -
C:\windows\SysWOW64\CZJSOP.exeC:\windows\system32\CZJSOP.exe117⤵
- Executes dropped EXE
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KFJGPCD.exe.bat" "118⤵PID:5392
-
C:\windows\SysWOW64\KFJGPCD.exeC:\windows\system32\KFJGPCD.exe119⤵
- Executes dropped EXE
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSTYF.exe.bat" "120⤵PID:4292
-
C:\windows\TSTYF.exeC:\windows\TSTYF.exe121⤵
- Executes dropped EXE
PID:1032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-