Analysis
- max time kernel
94s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 18:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe
- Size 208KB
- Sample261024-wmeanabv31
- SHA256 86e6db5922b63c71b11aa064adce2ef143cfbd585299d43aaf86c2d661eebde6
- MD5 2ca1531566a19b5bc78fa472f14d6755
- SHA1 d277e19dc3791d25ddbc1fcb7b4a04516abc5a56
- SHA512 f7d921a993e7434bdd20b410b7172430a4b8e656011f8c5a27efb4b24bcfcb9f3bc5c964a28afcbe23657687fe458d17c96e781c27e8af8e3c50a8aff40fc240
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfd4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LO1QEj1
- TLSH T148247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4988 XTN.exe 4676 FUDGOUO.exe 1744 AEMFD.exe 5492 EUSFPPX.exe 2544 XPWIUF.exe 3732 OYYNGKJ.exe 3844 JLDX.exe 4180 BOH.exe 3436 NWNAI.exe 5568 XEPGLQX.exe 3152 RSU.exe 1092 SVYTB.exe 1820 FXOJP.exe 4848 OGQWTOL.exe 3048 PJU.exe 4564 EEEWRY.exe 5084 OEGKV.exe 1444 HFN.exe 4144 AAZQRNG.exe 5400 KXFL.exe 5748 NOL.exe 4932 UBKT.exe 5032 XRRTUJP.exe 2408 YUVXHZ.exe 928 THAHKZN.exe 4796 LKDC.exe 4528 QIWRN.exe 2780 QVWGP.exe 2320 FQF.exe 4372 ORHXD.exe 2392 GZJCPM.exe 2524 TKSBVX.exe 3560 XSY.exe 2196 DNYC.exe 1076 WQB.exe 4444 CQJ.exe 6000 CMNPOSK.exe 964 XZSY.exe 2368 PCVCEI.exe 3188 ZAJXL.exe 3548 DQQ.exe 5048 VQSC.exe 2824 JWPZQQ.exe 2060 PWX.exe 4740 TEEUL.exe 5348 ZZDVIO.exe 5856 OUMA.exe 3300 UQMAXDE.exe 5180 YYSI.exe 5644 EYAWBQB.exe 4076 TOBOZ.exe 1252 DBLGPI.exe 3764 UJNTTGG.exe 5344 SKVG.exe 1224 JKXLNF.exe 4964 NAD.exe 2024 TNDUWB.exe 1176 CBNM.exe 3572 XOSWW.exe 5248 IHVOE.exe 1100 FMBELO.exe 2460 FSTSNBK.exe 4712 UNCEY.exe 4756 WLEZE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YAB.exe DMWPRA.exe File created C:\windows\SysWOW64\NOL.exe.bat KXFL.exe File created C:\windows\SysWOW64\PJVPQNA.exe UWRFG.exe File created C:\windows\SysWOW64\WCU.exe ZCKM.exe File created C:\windows\SysWOW64\SVYTB.exe RSU.exe File created C:\windows\SysWOW64\CQJ.exe WQB.exe File opened for modification C:\windows\SysWOW64\PJVPQNA.exe UWRFG.exe File created C:\windows\SysWOW64\PROX.exe.bat MBHXW.exe File created C:\windows\SysWOW64\RSU.exe.bat XEPGLQX.exe File created C:\windows\SysWOW64\AAZQRNG.exe HFN.exe File created C:\windows\SysWOW64\NOL.exe KXFL.exe File created C:\windows\SysWOW64\QVWGP.exe.bat QIWRN.exe File created C:\windows\SysWOW64\SKVG.exe.bat UJNTTGG.exe File created C:\windows\SysWOW64\XEKRBUX.exe RDDD.exe File opened for modification C:\windows\SysWOW64\CMQYQM.exe CYYJH.exe File opened for modification C:\windows\SysWOW64\XNHEMO.exe QSY.exe File opened for modification C:\windows\SysWOW64\VDOY.exe DAK.exe File created C:\windows\SysWOW64\ZCKM.exe.bat TCCYTAY.exe File opened for modification C:\windows\SysWOW64\RSU.exe XEPGLQX.exe File created C:\windows\SysWOW64\PJU.exe OGQWTOL.exe File created C:\windows\SysWOW64\QVWGP.exe QIWRN.exe File created C:\windows\SysWOW64\TKSBVX.exe GZJCPM.exe File created C:\windows\SysWOW64\WQB.exe DNYC.exe File created C:\windows\SysWOW64\CQJ.exe.bat WQB.exe File opened for modification C:\windows\SysWOW64\YYSI.exe UQMAXDE.exe File created C:\windows\SysWOW64\XNHEMO.exe QSY.exe File created C:\windows\SysWOW64\XEPGLQX.exe NWNAI.exe File created C:\windows\SysWOW64\XRRTUJP.exe.bat UBKT.exe File opened for modification C:\windows\SysWOW64\WQB.exe DNYC.exe File created C:\windows\SysWOW64\XNHEMO.exe.bat QSY.exe File created C:\windows\SysWOW64\CLTM.exe.bat WLMYJA.exe File opened for modification C:\windows\SysWOW64\QKVSRD.exe CAM.exe File created C:\windows\SysWOW64\TCCYTAY.exe.bat TZYDO.exe File created C:\windows\SysWOW64\XPWIUF.exe EUSFPPX.exe File created C:\windows\SysWOW64\ZAJXL.exe PCVCEI.exe File created C:\windows\SysWOW64\YYSI.exe.bat UQMAXDE.exe File created C:\windows\SysWOW64\EXXWEA.exe EJFHD.exe File created C:\windows\SysWOW64\XEKRBUX.exe.bat RDDD.exe File created C:\windows\SysWOW64\AAZQRNG.exe.bat HFN.exe File opened for modification C:\windows\SysWOW64\XSY.exe TKSBVX.exe File created C:\windows\SysWOW64\XSY.exe.bat TKSBVX.exe File created C:\windows\SysWOW64\SKVG.exe UJNTTGG.exe File opened for modification C:\windows\SysWOW64\FSTSNBK.exe FMBELO.exe File created C:\windows\SysWOW64\PJVPQNA.exe.bat UWRFG.exe File created C:\windows\SysWOW64\ZCKM.exe TCCYTAY.exe File opened for modification C:\windows\SysWOW64\XPWIUF.exe EUSFPPX.exe File opened for modification C:\windows\SysWOW64\TKSBVX.exe GZJCPM.exe File created C:\windows\SysWOW64\ZAJXL.exe.bat PCVCEI.exe File created C:\windows\SysWOW64\CMQYQM.exe.bat CYYJH.exe File opened for modification C:\windows\SysWOW64\TCCYTAY.exe TZYDO.exe File opened for modification C:\windows\SysWOW64\YAB.exe DMWPRA.exe File created C:\windows\SysWOW64\YAB.exe.bat DMWPRA.exe File created C:\windows\SysWOW64\SVYTB.exe.bat RSU.exe File opened for modification C:\windows\SysWOW64\CQJ.exe WQB.exe File created C:\windows\SysWOW64\EXXWEA.exe.bat EJFHD.exe File opened for modification C:\windows\SysWOW64\XEPGLQX.exe NWNAI.exe File opened for modification C:\windows\SysWOW64\SVYTB.exe RSU.exe File opened for modification C:\windows\SysWOW64\NOL.exe KXFL.exe File created C:\windows\SysWOW64\TKSBVX.exe.bat GZJCPM.exe File created C:\windows\SysWOW64\CMQYQM.exe CYYJH.exe File created C:\windows\SysWOW64\HKC.exe.bat EXXWEA.exe File created C:\windows\SysWOW64\QKVSRD.exe CAM.exe File created C:\windows\SysWOW64\WCU.exe.bat ZCKM.exe File created C:\windows\SysWOW64\XPWIUF.exe.bat EUSFPPX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\FQF.exe QVWGP.exe File opened for modification C:\windows\PCVCEI.exe XZSY.exe File created C:\windows\system\CBNM.exe.bat TNDUWB.exe File opened for modification C:\windows\NYORUH.exe WLEZE.exe File created C:\windows\WRBV.exe.bat QQTIWT.exe File opened for modification C:\windows\PRQWF.exe VEL.exe File created C:\windows\system\CBNM.exe TNDUWB.exe File created C:\windows\system\AMBABW.exe CLTM.exe File opened for modification C:\windows\system\WRHXIG.exe AMBABW.exe File created C:\windows\system\ORJC.exe WRHXIG.exe File created C:\windows\CXIYYC.exe QEFFP.exe File created C:\windows\system\CYCOFA.exe.bat BDY.exe File created C:\windows\MWWTMMY.exe.bat PRQWF.exe File created C:\windows\system\HGVK.exe CGOWWBG.exe File created C:\windows\AEMFD.exe FUDGOUO.exe File created C:\windows\system\OGQWTOL.exe.bat FXOJP.exe File created C:\windows\QSY.exe.bat IMX.exe File created C:\windows\system\LKDC.exe THAHKZN.exe File created C:\windows\IMX.exe CMQYQM.exe File created C:\windows\system\QIWRN.exe LKDC.exe File opened for modification C:\windows\system\FUDGOUO.exe XTN.exe File created C:\windows\EEEWRY.exe.bat PJU.exe File opened for modification C:\windows\system\YUVXHZ.exe XRRTUJP.exe File created C:\windows\FQF.exe.bat QVWGP.exe File created C:\windows\system\BDY.exe QKVSRD.exe File created C:\windows\system\BXFMY.exe.bat GKA.exe File opened for modification C:\windows\system\IDJ.exe CDBCXB.exe File created C:\windows\OEGKV.exe.bat EEEWRY.exe File created C:\windows\GZJCPM.exe ORHXD.exe File created C:\windows\system\TOBOZ.exe EYAWBQB.exe File opened for modification C:\windows\CXIYYC.exe QEFFP.exe File created C:\windows\system\BZRFO.exe MUL.exe File created C:\windows\PWX.exe JWPZQQ.exe File opened for modification C:\windows\TEEUL.exe PWX.exe File created C:\windows\system\KWAY.exe.bat PJVPQNA.exe File opened for modification C:\windows\system\JWPZQQ.exe VQSC.exe File opened for modification C:\windows\ZNCZ.exe FSY.exe File created C:\windows\system\FUDGOUO.exe.bat XTN.exe File created C:\windows\system\OUMA.exe.bat ZZDVIO.exe File opened for modification C:\windows\JKXLNF.exe SKVG.exe File created C:\windows\IMX.exe.bat CMQYQM.exe File created C:\windows\FLKTY.exe.bat HKC.exe File opened for modification C:\windows\system\ORJC.exe WRHXIG.exe File created C:\windows\system\JWPZQQ.exe VQSC.exe File created C:\windows\UQMAXDE.exe OUMA.exe File created C:\windows\JKXLNF.exe SKVG.exe File created C:\windows\NYORUH.exe.bat WLEZE.exe File created C:\windows\CAM.exe.bat CXIYYC.exe File created C:\windows\JDOM.exe XNHEMO.exe File opened for modification C:\windows\system\BDY.exe QKVSRD.exe File opened for modification C:\windows\CGOWWBG.exe UQN.exe File created C:\windows\system\IDJ.exe CDBCXB.exe File created C:\windows\JLDX.exe OYYNGKJ.exe File created C:\windows\EEEWRY.exe PJU.exe File opened for modification C:\windows\TNDUWB.exe NAD.exe File opened for modification C:\windows\UWRFG.exe JDOM.exe File created C:\windows\VEL.exe.bat JLQUMWS.exe File created C:\windows\HIDD.exe.bat YAB.exe File opened for modification C:\windows\XTN.exe 2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe File opened for modification C:\windows\system\CBNM.exe TNDUWB.exe File created C:\windows\QSY.exe IMX.exe File created C:\windows\system\MBHXW.exe.bat UBF.exe File created C:\windows\system\NWNAI.exe.bat BOH.exe File created C:\windows\system\ORJC.exe.bat WRHXIG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5756 cmd.exe 5872 cmd.exe 5432 cmd.exe 2012 cmd.exe 6100 cmd.exe 5200 cmd.exe 5080 cmd.exe 4656 cmd.exe 1264 cmd.exe 1996 cmd.exe 2848 cmd.exe 636 cmd.exe 4300 cmd.exe 3200 cmd.exe 5828 cmd.exe 1540 cmd.exe 4516 cmd.exe 5372 cmd.exe 4392 cmd.exe 2600 cmd.exe 6084 cmd.exe 5544 cmd.exe 3656 cmd.exe 3224 cmd.exe 4876 cmd.exe 3848 cmd.exe 2672 cmd.exe 600 cmd.exe 3900 cmd.exe 804 cmd.exe 1752 cmd.exe 5812 cmd.exe 2988 cmd.exe 3260 cmd.exe 3768 cmd.exe 1340 cmd.exe 1636 cmd.exe 2940 cmd.exe 4764 cmd.exe 1748 cmd.exe 3412 cmd.exe 2980 cmd.exe 4380 cmd.exe 5472 cmd.exe 3116 cmd.exe 2036 cmd.exe 956 cmd.exe 292 cmd.exe 760 cmd.exe 5152 cmd.exe 5676 cmd.exe 4320 cmd.exe 2800 cmd.exe 1220 cmd.exe 4328 cmd.exe 924 cmd.exe 3396 cmd.exe 248 cmd.exe 3860 cmd.exe 5924 cmd.exe 4220 cmd.exe 2836 cmd.exe 3484 cmd.exe 1956 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 5108 5468 WerFault.exe 88 1440 4988 WerFault.exe 93 3648 4676 WerFault.exe 99 3424 1744 WerFault.exe 104 1748 5492 WerFault.exe 109 4264 2544 WerFault.exe 114 800 3732 WerFault.exe 119 4360 3844 WerFault.exe 124 3548 4180 WerFault.exe 129 5860 3436 WerFault.exe 134 2972 5568 WerFault.exe 139 6032 3152 WerFault.exe 144 1212 1092 WerFault.exe 149 3540 1820 WerFault.exe 154 3272 4848 WerFault.exe 159 5556 3048 WerFault.exe 164 4876 4564 WerFault.exe 169 4064 5084 WerFault.exe 174 1824 1444 WerFault.exe 179 1856 4144 WerFault.exe 184 5000 5400 WerFault.exe 189 2788 5748 WerFault.exe 194 5412 4932 WerFault.exe 199 5628 5032 WerFault.exe 204 3596 2408 WerFault.exe 209 3564 928 WerFault.exe 214 1264 4796 WerFault.exe 219 4240 4528 WerFault.exe 224 5056 2780 WerFault.exe 229 816 2320 WerFault.exe 234 5012 4372 WerFault.exe 239 2404 2392 WerFault.exe 244 2988 2524 WerFault.exe 249 4636 3560 WerFault.exe 254 3108 2196 WerFault.exe 259 5520 1076 WerFault.exe 264 2656 4444 WerFault.exe 269 2032 6000 WerFault.exe 274 4264 964 WerFault.exe 280 5616 2368 WerFault.exe 285 5452 3188 WerFault.exe 290 5560 3548 WerFault.exe 295 3628 5048 WerFault.exe 300 460 2824 WerFault.exe 305 2868 2060 WerFault.exe 310 6088 4740 WerFault.exe 315 4852 5348 WerFault.exe 320 5368 5856 WerFault.exe 325 3508 3300 WerFault.exe 330 5420 5180 WerFault.exe 335 912 5644 WerFault.exe 340 1460 4076 WerFault.exe 345 4340 1252 WerFault.exe 350 4108 3764 WerFault.exe 355 4656 5344 WerFault.exe 360 2980 1224 WerFault.exe 365 476 4964 WerFault.exe 370 5384 2024 WerFault.exe 375 5100 1176 WerFault.exe 380 600 3572 WerFault.exe 385 5864 5248 WerFault.exe 390 5524 1100 WerFault.exe 395 4680 2460 WerFault.exe 400 5640 4712 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THAHKZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWPZQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOSWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKSBVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCCYTAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUSFPPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUVXHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXXWEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZJCPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQMAXDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CYCOFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XRRTUJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEKRBUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDBCXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XZSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWNAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLKTY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZDVIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5468 2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe 5468 2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe 4988 XTN.exe 4988 XTN.exe 4676 FUDGOUO.exe 4676 FUDGOUO.exe 1744 AEMFD.exe 1744 AEMFD.exe 5492 EUSFPPX.exe 5492 EUSFPPX.exe 2544 XPWIUF.exe 2544 XPWIUF.exe 3732 OYYNGKJ.exe 3732 OYYNGKJ.exe 3844 JLDX.exe 3844 JLDX.exe 4180 BOH.exe 4180 BOH.exe 3436 NWNAI.exe 3436 NWNAI.exe 5568 XEPGLQX.exe 5568 XEPGLQX.exe 3152 RSU.exe 3152 RSU.exe 1092 SVYTB.exe 1092 SVYTB.exe 1820 FXOJP.exe 1820 FXOJP.exe 4848 OGQWTOL.exe 4848 OGQWTOL.exe 3048 PJU.exe 3048 PJU.exe 4564 EEEWRY.exe 4564 EEEWRY.exe 5084 OEGKV.exe 5084 OEGKV.exe 1444 HFN.exe 1444 HFN.exe 4144 AAZQRNG.exe 4144 AAZQRNG.exe 5400 KXFL.exe 5400 KXFL.exe 5748 NOL.exe 5748 NOL.exe 4932 UBKT.exe 4932 UBKT.exe 5032 XRRTUJP.exe 5032 XRRTUJP.exe 2408 YUVXHZ.exe 2408 YUVXHZ.exe 928 THAHKZN.exe 928 THAHKZN.exe 4796 LKDC.exe 4796 LKDC.exe 4528 QIWRN.exe 4528 QIWRN.exe 2780 QVWGP.exe 2780 QVWGP.exe 2320 FQF.exe 2320 FQF.exe 4372 ORHXD.exe 4372 ORHXD.exe 2392 GZJCPM.exe 2392 GZJCPM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5468 2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe 5468 2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe 4988 XTN.exe 4988 XTN.exe 4676 FUDGOUO.exe 4676 FUDGOUO.exe 1744 AEMFD.exe 1744 AEMFD.exe 5492 EUSFPPX.exe 5492 EUSFPPX.exe 2544 XPWIUF.exe 2544 XPWIUF.exe 3732 OYYNGKJ.exe 3732 OYYNGKJ.exe 3844 JLDX.exe 3844 JLDX.exe 4180 BOH.exe 4180 BOH.exe 3436 NWNAI.exe 3436 NWNAI.exe 5568 XEPGLQX.exe 5568 XEPGLQX.exe 3152 RSU.exe 3152 RSU.exe 1092 SVYTB.exe 1092 SVYTB.exe 1820 FXOJP.exe 1820 FXOJP.exe 4848 OGQWTOL.exe 4848 OGQWTOL.exe 3048 PJU.exe 3048 PJU.exe 4564 EEEWRY.exe 4564 EEEWRY.exe 5084 OEGKV.exe 5084 OEGKV.exe 1444 HFN.exe 1444 HFN.exe 4144 AAZQRNG.exe 4144 AAZQRNG.exe 5400 KXFL.exe 5400 KXFL.exe 5748 NOL.exe 5748 NOL.exe 4932 UBKT.exe 4932 UBKT.exe 5032 XRRTUJP.exe 5032 XRRTUJP.exe 2408 YUVXHZ.exe 2408 YUVXHZ.exe 928 THAHKZN.exe 928 THAHKZN.exe 4796 LKDC.exe 4796 LKDC.exe 4528 QIWRN.exe 4528 QIWRN.exe 2780 QVWGP.exe 2780 QVWGP.exe 2320 FQF.exe 2320 FQF.exe 4372 ORHXD.exe 4372 ORHXD.exe 2392 GZJCPM.exe 2392 GZJCPM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5468 wrote to memory of 5784 5468 2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe 89 PID 5784 wrote to memory of 4988 5784 cmd.exe 93 PID 4988 wrote to memory of 4456 4988 XTN.exe 95 PID 4456 wrote to memory of 4676 4456 cmd.exe 99 PID 4676 wrote to memory of 1008 4676 FUDGOUO.exe 100 PID 1008 wrote to memory of 1744 1008 cmd.exe 104 PID 1744 wrote to memory of 2424 1744 AEMFD.exe 105 PID 2424 wrote to memory of 5492 2424 cmd.exe 109 PID 5492 wrote to memory of 4724 5492 EUSFPPX.exe 110 PID 4724 wrote to memory of 2544 4724 cmd.exe 114 PID 2544 wrote to memory of 4792 2544 XPWIUF.exe 115 PID 4792 wrote to memory of 3732 4792 cmd.exe 119 PID 3732 wrote to memory of 2940 3732 OYYNGKJ.exe 120 PID 2940 wrote to memory of 3844 2940 cmd.exe 124 PID 3844 wrote to memory of 1752 3844 JLDX.exe 125 PID 1752 wrote to memory of 4180 1752 cmd.exe 129 PID 4180 wrote to memory of 3856 4180 BOH.exe 130 PID 3856 wrote to memory of 3436 3856 cmd.exe 134 PID 3436 wrote to memory of 5260 3436 NWNAI.exe 135 PID 5260 wrote to memory of 5568 5260 cmd.exe 139 PID 5568 wrote to memory of 2996 5568 XEPGLQX.exe 140 PID 2996 wrote to memory of 3152 2996 cmd.exe 144 PID 3152 wrote to memory of 4172 3152 RSU.exe 145 PID 4172 wrote to memory of 1092 4172 cmd.exe 149 PID 1092 wrote to memory of 5108 1092 SVYTB.exe 150 PID 5108 wrote to memory of 1820 5108 cmd.exe 154 PID 1820 wrote to memory of 3396 1820 FXOJP.exe 155 PID 3396 wrote to memory of 4848 3396 cmd.exe 159 PID 4848 wrote to memory of 248 4848 OGQWTOL.exe 160 PID 248 wrote to memory of 3048 248 cmd.exe 164 PID 3048 wrote to memory of 1800 3048 PJU.exe 165 PID 1800 wrote to memory of 4564 1800 cmd.exe 169 PID 4564 wrote to memory of 4824 4564 EEEWRY.exe 170 PID 4824 wrote to memory of 5084 4824 cmd.exe 174 PID 5084 wrote to memory of 3860 5084 OEGKV.exe 175 PID 3860 wrote to memory of 1444 3860 cmd.exe 179 PID 1444 wrote to memory of 4432 1444 HFN.exe 180 PID 4432 wrote to memory of 4144 4432 cmd.exe 184 PID 4144 wrote to memory of 2100 4144 AAZQRNG.exe 185 PID 2100 wrote to memory of 5400 2100 cmd.exe 189 PID 5400 wrote to memory of 5956 5400 KXFL.exe 190 PID 5956 wrote to memory of 5748 5956 cmd.exe 194 PID 5748 wrote to memory of 3692 5748 NOL.exe 195 PID 3692 wrote to memory of 4932 3692 cmd.exe 199 PID 4932 wrote to memory of 4380 4932 UBKT.exe 200 PID 4380 wrote to memory of 5032 4380 cmd.exe 204 PID 5032 wrote to memory of 3804 5032 XRRTUJP.exe 205 PID 3804 wrote to memory of 2408 3804 cmd.exe 209 PID 2408 wrote to memory of 2664 2408 YUVXHZ.exe 210 PID 2664 wrote to memory of 928 2664 cmd.exe 214 PID 928 wrote to memory of 3356 928 THAHKZN.exe 215 PID 3356 wrote to memory of 4796 3356 cmd.exe 219 PID 4796 wrote to memory of 120 4796 LKDC.exe 220 PID 120 wrote to memory of 4528 120 cmd.exe 224 PID 4528 wrote to memory of 2936 4528 QIWRN.exe 225 PID 2936 wrote to memory of 2780 2936 cmd.exe 229 PID 2780 wrote to memory of 5472 2780 QVWGP.exe 230 PID 5472 wrote to memory of 2320 5472 cmd.exe 234 PID 2320 wrote to memory of 4784 2320 FQF.exe 235 PID 4784 wrote to memory of 4372 4784 cmd.exe 239 PID 4372 wrote to memory of 4928 4372 ORHXD.exe 240 PID 4928 wrote to memory of 2392 4928 cmd.exe 244 PID 2392 wrote to memory of 5924 2392 GZJCPM.exe 245 PID 5924 wrote to memory of 2524 5924 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_2ca1531566a19b5bc78fa472f14d6755_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTN.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\windows\XTN.exeC:\windows\XTN.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUDGOUO.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\system\FUDGOUO.exeC:\windows\system\FUDGOUO.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AEMFD.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\windows\AEMFD.exeC:\windows\AEMFD.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUSFPPX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\windows\EUSFPPX.exeC:\windows\EUSFPPX.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XPWIUF.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\SysWOW64\XPWIUF.exeC:\windows\system32\XPWIUF.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYYNGKJ.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\windows\system\OYYNGKJ.exeC:\windows\system\OYYNGKJ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLDX.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\windows\JLDX.exeC:\windows\JLDX.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOH.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\windows\BOH.exeC:\windows\BOH.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWNAI.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\system\NWNAI.exeC:\windows\system\NWNAI.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XEPGLQX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\SysWOW64\XEPGLQX.exeC:\windows\system32\XEPGLQX.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RSU.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\SysWOW64\RSU.exeC:\windows\system32\RSU.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVYTB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\SysWOW64\SVYTB.exeC:\windows\system32\SVYTB.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FXOJP.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\windows\FXOJP.exeC:\windows\FXOJP.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGQWTOL.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\system\OGQWTOL.exeC:\windows\system\OGQWTOL.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJU.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\SysWOW64\PJU.exeC:\windows\system32\PJU.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEEWRY.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\windows\EEEWRY.exeC:\windows\EEEWRY.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEGKV.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\OEGKV.exeC:\windows\OEGKV.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HFN.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\windows\system\HFN.exeC:\windows\system\HFN.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAZQRNG.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\SysWOW64\AAZQRNG.exeC:\windows\system32\AAZQRNG.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXFL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\windows\KXFL.exeC:\windows\KXFL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOL.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\windows\SysWOW64\NOL.exeC:\windows\system32\NOL.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBKT.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\windows\system\UBKT.exeC:\windows\system\UBKT.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XRRTUJP.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\windows\SysWOW64\XRRTUJP.exeC:\windows\system32\XRRTUJP.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YUVXHZ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\windows\system\YUVXHZ.exeC:\windows\system\YUVXHZ.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THAHKZN.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\windows\THAHKZN.exeC:\windows\THAHKZN.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LKDC.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\windows\system\LKDC.exeC:\windows\system\LKDC.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIWRN.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:120 -
C:\windows\system\QIWRN.exeC:\windows\system\QIWRN.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVWGP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\windows\SysWOW64\QVWGP.exeC:\windows\system32\QVWGP.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQF.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\windows\FQF.exeC:\windows\FQF.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORHXD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\windows\system\ORHXD.exeC:\windows\system\ORHXD.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJCPM.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\windows\GZJCPM.exeC:\windows\GZJCPM.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKSBVX.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\windows\SysWOW64\TKSBVX.exeC:\windows\system32\TKSBVX.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSY.exe.bat" "66⤵PID:4048
-
C:\windows\SysWOW64\XSY.exeC:\windows\system32\XSY.exe67⤵
- Executes dropped EXE
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNYC.exe.bat" "68⤵PID:4224
-
C:\windows\system\DNYC.exeC:\windows\system\DNYC.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQB.exe.bat" "70⤵PID:764
-
C:\windows\SysWOW64\WQB.exeC:\windows\system32\WQB.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQJ.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4716 -
C:\windows\SysWOW64\CQJ.exeC:\windows\system32\CQJ.exe73⤵
- Executes dropped EXE
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMNPOSK.exe.bat" "74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3656 -
C:\windows\CMNPOSK.exeC:\windows\CMNPOSK.exe75⤵
- Executes dropped EXE
PID:6000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XZSY.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2240 -
C:\windows\system\XZSY.exeC:\windows\system\XZSY.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PCVCEI.exe.bat" "78⤵
- Executes a command shell one-liner
PID:5812 -
C:\windows\PCVCEI.exeC:\windows\PCVCEI.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAJXL.exe.bat" "80⤵PID:2724
-
C:\windows\SysWOW64\ZAJXL.exeC:\windows\system32\ZAJXL.exe81⤵
- Executes dropped EXE
PID:3188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQQ.exe.bat" "82⤵PID:4112
-
C:\windows\system\DQQ.exeC:\windows\system\DQQ.exe83⤵
- Executes dropped EXE
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQSC.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5112 -
C:\windows\system\VQSC.exeC:\windows\system\VQSC.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWPZQQ.exe.bat" "86⤵PID:2404
-
C:\windows\system\JWPZQQ.exeC:\windows\system\JWPZQQ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWX.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2988 -
C:\windows\PWX.exeC:\windows\PWX.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEEUL.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2704 -
C:\windows\TEEUL.exeC:\windows\TEEUL.exe91⤵
- Executes dropped EXE
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZDVIO.exe.bat" "92⤵PID:1296
-
C:\windows\system\ZZDVIO.exeC:\windows\system\ZZDVIO.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OUMA.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4904 -
C:\windows\system\OUMA.exeC:\windows\system\OUMA.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQMAXDE.exe.bat" "96⤵PID:6080
-
C:\windows\UQMAXDE.exeC:\windows\UQMAXDE.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YYSI.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1996 -
C:\windows\SysWOW64\YYSI.exeC:\windows\system32\YYSI.exe99⤵
- Executes dropped EXE
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EYAWBQB.exe.bat" "100⤵PID:3432
-
C:\windows\system\EYAWBQB.exeC:\windows\system\EYAWBQB.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TOBOZ.exe.bat" "102⤵PID:2268
-
C:\windows\system\TOBOZ.exeC:\windows\system\TOBOZ.exe103⤵
- Executes dropped EXE
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DBLGPI.exe.bat" "104⤵
- Executes a command shell one-liner
PID:3224 -
C:\windows\DBLGPI.exeC:\windows\DBLGPI.exe105⤵
- Executes dropped EXE
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UJNTTGG.exe.bat" "106⤵PID:1768
-
C:\windows\system\UJNTTGG.exeC:\windows\system\UJNTTGG.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKVG.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5828 -
C:\windows\SysWOW64\SKVG.exeC:\windows\system32\SKVG.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKXLNF.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4764 -
C:\windows\JKXLNF.exeC:\windows\JKXLNF.exe111⤵
- Executes dropped EXE
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAD.exe.bat" "112⤵PID:2064
-
C:\windows\NAD.exeC:\windows\NAD.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNDUWB.exe.bat" "114⤵PID:1616
-
C:\windows\TNDUWB.exeC:\windows\TNDUWB.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CBNM.exe.bat" "116⤵PID:6044
-
C:\windows\system\CBNM.exeC:\windows\system\CBNM.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOSWW.exe.bat" "118⤵
- Executes a command shell one-liner
PID:2848 -
C:\windows\system\XOSWW.exeC:\windows\system\XOSWW.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHVOE.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2796 -
C:\windows\IHVOE.exeC:\windows\IHVOE.exe121⤵
- Executes dropped EXE
PID:5248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-