Analysis
- max time kernel
96s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 02:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe
- Size 208KB
- Sample261030-c4yk3sda97
- SHA256 2b52e640cf45faf2c7bbffd37dce58d2dd47ac930ccc317a0d6ac0c81b0c463f
- MD5 6bb4781c08e9186f5c9270e6f7af875b
- SHA1 705db3876dc8da3cb78ef9529f07263824ec3dfe
- SHA512 d28606e86052b4bcdf539cadaf4bae05d5dbe84e3a4cb04a7a0f9df3a8ac57a48d9d59484f20aae5ac4880b4932d3d59cf86692650c719fd354aef537a6ab3b5
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfR4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOpkEj1
- TLSH T197247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4636 POGHAGL.exe 1988 GJF.exe 596 XSHL.exe 5980 KUQC.exe 4544 JNASNA.exe 5440 WQJQCL.exe 4960 VJMGK.exe 4328 TUXWTXU.exe 2964 CZB.exe 6088 LXPXLM.exe 1264 UKTEW.exe 3344 MFXA.exe 5628 NIJDOQ.exe 4524 FMN.exe 124 ZEU.exe 916 MPL.exe 432 ZNLUTWL.exe 1464 YXNK.exe 1240 IVB.exe 3652 MLIFWK.exe 5540 VLKKHIG.exe 4460 YHBTTTW.exe 2440 ZCFPYR.exe 4512 DSLP.exe 4300 XFQHVB.exe 3328 HDWTC.exe 4744 PTXSJF.exe 3780 UTEG.exe 4688 ERS.exe 5376 ORMFL.exe 1736 OUYBQD.exe 4108 HXCFD.exe 3216 GIEV.exe 1320 KYLVQZN.exe 3336 KTPZ.exe 5280 OJVZIH.exe 6056 BMMXWK.exe 1140 EHR.exe 4776 CVQH.exe 2480 MSW.exe 3176 UGI.exe 2300 TRLYMAC.exe 1808 XZSY.exe 1944 IRVRY.exe 4644 HPGU.exe 1496 ZSKQZD.exe 4800 ANNU.exe 4276 PDWLLO.exe 5676 IGAPQ.exe 4908 MWHPDWL.exe 5092 OKMY.exe 3460 EFVLYJI.exe 2820 WIZG.exe 6064 WNZV.exe 3560 XQD.exe 5072 BYKYFU.exe 5780 QTTD.exe 3476 UERYXA.exe 2976 YNYG.exe 776 TADPMS.exe 3368 IVMU.exe 5972 QIMI.exe 5908 UQTILKX.exe 5876 DZVVW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\ZNLUTWL.exe MPL.exe File opened for modification C:\windows\SysWOW64\FYCYLOW.exe PIBZEA.exe File opened for modification C:\windows\SysWOW64\TCCYTAY.exe ZOXPJ.exe File created C:\windows\SysWOW64\WQJQCL.exe.bat JNASNA.exe File created C:\windows\SysWOW64\KTPZ.exe KYLVQZN.exe File opened for modification C:\windows\SysWOW64\BMMXWK.exe OJVZIH.exe File created C:\windows\SysWOW64\UGI.exe MSW.exe File created C:\windows\SysWOW64\IRVRY.exe XZSY.exe File created C:\windows\SysWOW64\WNZV.exe.bat WIZG.exe File opened for modification C:\windows\SysWOW64\HUAXSV.exe YUYKO.exe File created C:\windows\SysWOW64\JULMK.exe PHG.exe File created C:\windows\SysWOW64\WIZG.exe.bat EFVLYJI.exe File created C:\windows\SysWOW64\DZVVW.exe.bat UQTILKX.exe File created C:\windows\SysWOW64\TCCYTAY.exe.bat ZOXPJ.exe File opened for modification C:\windows\SysWOW64\HPGU.exe IRVRY.exe File created C:\windows\SysWOW64\HPGU.exe.bat IRVRY.exe File created C:\windows\SysWOW64\PDWLLO.exe ANNU.exe File created C:\windows\SysWOW64\IVMU.exe TADPMS.exe File opened for modification C:\windows\SysWOW64\SUE.exe DZVVW.exe File created C:\windows\SysWOW64\XNHEMO.exe.bat DACVJ.exe File opened for modification C:\windows\SysWOW64\NDMVQS.exe TPHM.exe File created C:\windows\SysWOW64\PDWLLO.exe.bat ANNU.exe File created C:\windows\SysWOW64\XNHEMO.exe DACVJ.exe File created C:\windows\SysWOW64\PATOCP.exe.bat PVTAT.exe File opened for modification C:\windows\SysWOW64\MBVHPPA.exe VAB.exe File created C:\windows\SysWOW64\VLKKHIG.exe.bat MLIFWK.exe File opened for modification C:\windows\SysWOW64\XNHEMO.exe DACVJ.exe File created C:\windows\SysWOW64\PATOCP.exe PVTAT.exe File created C:\windows\SysWOW64\HMTXHDU.exe TCCYTAY.exe File opened for modification C:\windows\SysWOW64\VJMGK.exe WQJQCL.exe File created C:\windows\SysWOW64\MSW.exe CVQH.exe File opened for modification C:\windows\SysWOW64\WIZG.exe EFVLYJI.exe File created C:\windows\SysWOW64\PTXSJF.exe.bat HDWTC.exe File created C:\windows\SysWOW64\ZSKQZD.exe.bat HPGU.exe File created C:\windows\SysWOW64\EPLOVZ.exe.bat NHJJR.exe File created C:\windows\SysWOW64\HUAXSV.exe YUYKO.exe File created C:\windows\SysWOW64\MBVHPPA.exe VAB.exe File created C:\windows\SysWOW64\YXNK.exe ZNLUTWL.exe File created C:\windows\SysWOW64\FYCYLOW.exe PIBZEA.exe File created C:\windows\SysWOW64\TRCP.exe.bat NRUB.exe File opened for modification C:\windows\SysWOW64\FPBYCB.exe LCWO.exe File created C:\windows\SysWOW64\VJMGK.exe.bat WQJQCL.exe File opened for modification C:\windows\SysWOW64\MSW.exe CVQH.exe File opened for modification C:\windows\SysWOW64\ZSKQZD.exe HPGU.exe File opened for modification C:\windows\SysWOW64\IVMU.exe TADPMS.exe File opened for modification C:\windows\SysWOW64\DZVVW.exe UQTILKX.exe File opened for modification C:\windows\SysWOW64\PATOCP.exe PVTAT.exe File opened for modification C:\windows\SysWOW64\PTXSJF.exe HDWTC.exe File created C:\windows\SysWOW64\MWHPDWL.exe IGAPQ.exe File created C:\windows\SysWOW64\NDMVQS.exe TPHM.exe File created C:\windows\SysWOW64\NIJDOQ.exe MFXA.exe File created C:\windows\SysWOW64\WIZG.exe EFVLYJI.exe File created C:\windows\SysWOW64\TCCYTAY.exe ZOXPJ.exe File created C:\windows\SysWOW64\DZVVW.exe UQTILKX.exe File opened for modification C:\windows\SysWOW64\PDWLLO.exe ANNU.exe File created C:\windows\SysWOW64\PIBZEA.exe.bat EPLOVZ.exe File created C:\windows\SysWOW64\HPGU.exe IRVRY.exe File created C:\windows\SysWOW64\WNZV.exe WIZG.exe File created C:\windows\SysWOW64\YXNK.exe.bat ZNLUTWL.exe File created C:\windows\SysWOW64\OUYBQD.exe.bat ORMFL.exe File created C:\windows\SysWOW64\MSW.exe.bat CVQH.exe File created C:\windows\SysWOW64\NRUB.exe CYR.exe File created C:\windows\SysWOW64\NRUB.exe.bat CYR.exe File created C:\windows\SysWOW64\WQJQCL.exe JNASNA.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\MLIFWK.exe.bat IVB.exe File created C:\windows\system\XQD.exe WNZV.exe File created C:\windows\system\LBNIHGY.exe.bat GBFUQE.exe File opened for modification C:\windows\LCWO.exe TOM.exe File created C:\windows\system\KYLVQZN.exe.bat GIEV.exe File created C:\windows\system\EFVLYJI.exe.bat OKMY.exe File created C:\windows\system\BYKYFU.exe.bat XQD.exe File created C:\windows\NJBI.exe.bat KOWZIAO.exe File created C:\windows\system\TOM.exe ZBHNRF.exe File created C:\windows\system\UDRKCFN.exe.bat IVLKQ.exe File created C:\windows\system\PHG.exe.bat NJBI.exe File opened for modification C:\windows\system\MLIFWK.exe IVB.exe File opened for modification C:\windows\system\LXPXLM.exe CZB.exe File opened for modification C:\windows\ORMFL.exe ERS.exe File created C:\windows\system\ZBHNRF.exe.bat PTFIO.exe File opened for modification C:\windows\system\VAB.exe PATOCP.exe File created C:\windows\ZOXPJ.exe.bat PQS.exe File created C:\windows\system\OJVZIH.exe KTPZ.exe File created C:\windows\system\NHJJR.exe.bat SUE.exe File created C:\windows\system\CZEUGDQ.exe TRCP.exe File created C:\windows\POGHAGL.exe.bat 2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe File created C:\windows\system\UKTEW.exe LXPXLM.exe File created C:\windows\NDIES.exe XNHEMO.exe File created C:\windows\system\QSP.exe NFXPYGV.exe File opened for modification C:\windows\system\JFQV.exe SFOQIS.exe File opened for modification C:\windows\ETUEVP.exe JFQV.exe File opened for modification C:\windows\POGHAGL.exe 2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe File created C:\windows\IVB.exe YXNK.exe File created C:\windows\QTTD.exe BYKYFU.exe File created C:\windows\system\TUXWTXU.exe VJMGK.exe File created C:\windows\system\YCCCDSN.exe HUAXSV.exe File opened for modification C:\windows\KOWZIAO.exe PBRQX.exe File created C:\windows\VCU.exe BJEAJ.exe File created C:\windows\YHBTTTW.exe VLKKHIG.exe File created C:\windows\HXCFD.exe.bat OUYBQD.exe File created C:\windows\system\OJVZIH.exe.bat KTPZ.exe File opened for modification C:\windows\EHR.exe BMMXWK.exe File opened for modification C:\windows\TADPMS.exe YNYG.exe File opened for modification C:\windows\IVB.exe YXNK.exe File created C:\windows\IVB.exe.bat YXNK.exe File created C:\windows\system\OKMY.exe MWHPDWL.exe File created C:\windows\system\OKMY.exe.bat MWHPDWL.exe File created C:\windows\DCIX.exe CZEUGDQ.exe File opened for modification C:\windows\system\PHG.exe NJBI.exe File opened for modification C:\windows\system\DYPCTKM.exe QSP.exe File opened for modification C:\windows\GJF.exe POGHAGL.exe File created C:\windows\system\ERS.exe UTEG.exe File created C:\windows\system\GBFUQE.exe FYCYLOW.exe File created C:\windows\POGHAGL.exe 2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe File created C:\windows\GJF.exe POGHAGL.exe File opened for modification C:\windows\system\ERS.exe UTEG.exe File opened for modification C:\windows\QTTD.exe BYKYFU.exe File created C:\windows\system\QIMI.exe IVMU.exe File created C:\windows\IJBE.exe ETUEVP.exe File created C:\windows\system\XFQHVB.exe DSLP.exe File created C:\windows\system\XZSY.exe.bat TRLYMAC.exe File created C:\windows\system\CYR.exe NDIES.exe File created C:\windows\system\VFCX.exe.bat FPBYCB.exe File created C:\windows\system\YCCCDSN.exe.bat HUAXSV.exe File opened for modification C:\windows\MPL.exe ZEU.exe File created C:\windows\system\TRLYMAC.exe.bat UGI.exe File created C:\windows\LCWO.exe TOM.exe File created C:\windows\system\NIGTON.exe.bat VFCX.exe File created C:\windows\system\JFQV.exe.bat SFOQIS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4320 cmd.exe 4664 cmd.exe 4492 cmd.exe 1756 cmd.exe 3484 cmd.exe 5116 cmd.exe 1896 cmd.exe 5860 cmd.exe 5156 cmd.exe 5864 cmd.exe 4700 cmd.exe 3032 cmd.exe 2532 cmd.exe 1440 cmd.exe 5392 cmd.exe 4904 cmd.exe 4720 cmd.exe 1952 cmd.exe 756 cmd.exe 4180 cmd.exe 4116 cmd.exe 460 cmd.exe 5708 cmd.exe 1224 cmd.exe 4496 cmd.exe 4996 cmd.exe 4836 cmd.exe 4312 cmd.exe 4716 cmd.exe 3864 cmd.exe 2460 cmd.exe 5892 cmd.exe 4564 cmd.exe 204 cmd.exe 1892 cmd.exe 2212 cmd.exe 4756 cmd.exe 5152 cmd.exe 1560 cmd.exe 2876 cmd.exe 2068 cmd.exe 1516 cmd.exe 4824 cmd.exe 5924 cmd.exe 4952 cmd.exe 4712 cmd.exe 1848 cmd.exe 3828 cmd.exe 812 cmd.exe 404 cmd.exe 5668 cmd.exe 3964 cmd.exe 4580 cmd.exe 1424 cmd.exe 3296 cmd.exe 4448 cmd.exe 2080 cmd.exe 2560 cmd.exe 504 cmd.exe 3656 cmd.exe 2232 cmd.exe 4740 cmd.exe 4948 cmd.exe 856 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4300 4192 WerFault.exe 87 4296 4636 WerFault.exe 92 4228 1988 WerFault.exe 99 3656 596 WerFault.exe 104 1340 5980 WerFault.exe 109 1728 4544 WerFault.exe 114 5040 5440 WerFault.exe 119 1080 4960 WerFault.exe 124 4160 4328 WerFault.exe 129 2780 2964 WerFault.exe 134 4760 6088 WerFault.exe 139 5168 1264 WerFault.exe 144 5060 3344 WerFault.exe 149 5596 5628 WerFault.exe 154 1692 4524 WerFault.exe 159 5784 124 WerFault.exe 164 5812 916 WerFault.exe 169 5824 432 WerFault.exe 174 1244 1464 WerFault.exe 179 4496 1240 WerFault.exe 184 3040 3652 WerFault.exe 189 2968 5540 WerFault.exe 194 1968 4460 WerFault.exe 199 4396 2440 WerFault.exe 204 972 4512 WerFault.exe 209 52 4300 WerFault.exe 214 1972 3328 WerFault.exe 219 5196 4744 WerFault.exe 224 1324 3780 WerFault.exe 229 2004 4688 WerFault.exe 234 956 5376 WerFault.exe 239 3380 1736 WerFault.exe 244 2840 4108 WerFault.exe 249 3556 3216 WerFault.exe 254 2608 1320 WerFault.exe 259 2276 3336 WerFault.exe 264 856 5280 WerFault.exe 269 3964 6056 WerFault.exe 274 2268 1140 WerFault.exe 279 3520 4776 WerFault.exe 284 5304 2480 WerFault.exe 289 3244 3176 WerFault.exe 294 4904 2300 WerFault.exe 299 3324 1808 WerFault.exe 304 5668 1944 WerFault.exe 309 5640 4644 WerFault.exe 314 3224 1496 WerFault.exe 319 2624 4800 WerFault.exe 324 3820 4276 WerFault.exe 329 2552 5676 WerFault.exe 334 3248 4908 WerFault.exe 339 3688 5092 WerFault.exe 344 2248 3460 WerFault.exe 349 3256 2820 WerFault.exe 354 4676 6064 WerFault.exe 359 4532 3560 WerFault.exe 364 5752 5072 WerFault.exe 369 5188 5780 WerFault.exe 374 4656 3476 WerFault.exe 379 3520 2976 WerFault.exe 384 4436 776 WerFault.exe 389 2836 3368 WerFault.exe 394 2656 5972 WerFault.exe 399 4204 5908 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRVRY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XQNHWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFVLYJI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHJJR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TADPMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IJBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DZVVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDMVQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBRQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJMGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPGU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFOQIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNASNA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYLVQZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSKQZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDWLLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TOM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIBZEA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBFUQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4192 2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe 4192 2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe 4636 POGHAGL.exe 4636 POGHAGL.exe 1988 GJF.exe 1988 GJF.exe 596 XSHL.exe 596 XSHL.exe 5980 KUQC.exe 5980 KUQC.exe 4544 JNASNA.exe 4544 JNASNA.exe 5440 WQJQCL.exe 5440 WQJQCL.exe 4960 VJMGK.exe 4960 VJMGK.exe 4328 TUXWTXU.exe 4328 TUXWTXU.exe 2964 CZB.exe 2964 CZB.exe 6088 LXPXLM.exe 6088 LXPXLM.exe 1264 UKTEW.exe 1264 UKTEW.exe 3344 MFXA.exe 3344 MFXA.exe 5628 NIJDOQ.exe 5628 NIJDOQ.exe 4524 FMN.exe 4524 FMN.exe 124 ZEU.exe 124 ZEU.exe 916 MPL.exe 916 MPL.exe 432 ZNLUTWL.exe 432 ZNLUTWL.exe 1464 YXNK.exe 1464 YXNK.exe 1240 IVB.exe 1240 IVB.exe 3652 MLIFWK.exe 3652 MLIFWK.exe 5540 VLKKHIG.exe 5540 VLKKHIG.exe 4460 YHBTTTW.exe 4460 YHBTTTW.exe 2440 ZCFPYR.exe 2440 ZCFPYR.exe 4512 DSLP.exe 4512 DSLP.exe 4300 XFQHVB.exe 4300 XFQHVB.exe 3328 HDWTC.exe 3328 HDWTC.exe 4744 PTXSJF.exe 4744 PTXSJF.exe 3780 UTEG.exe 3780 UTEG.exe 4688 ERS.exe 4688 ERS.exe 5376 ORMFL.exe 5376 ORMFL.exe 1736 OUYBQD.exe 1736 OUYBQD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4192 2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe 4192 2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe 4636 POGHAGL.exe 4636 POGHAGL.exe 1988 GJF.exe 1988 GJF.exe 596 XSHL.exe 596 XSHL.exe 5980 KUQC.exe 5980 KUQC.exe 4544 JNASNA.exe 4544 JNASNA.exe 5440 WQJQCL.exe 5440 WQJQCL.exe 4960 VJMGK.exe 4960 VJMGK.exe 4328 TUXWTXU.exe 4328 TUXWTXU.exe 2964 CZB.exe 2964 CZB.exe 6088 LXPXLM.exe 6088 LXPXLM.exe 1264 UKTEW.exe 1264 UKTEW.exe 3344 MFXA.exe 3344 MFXA.exe 5628 NIJDOQ.exe 5628 NIJDOQ.exe 4524 FMN.exe 4524 FMN.exe 124 ZEU.exe 124 ZEU.exe 916 MPL.exe 916 MPL.exe 432 ZNLUTWL.exe 432 ZNLUTWL.exe 1464 YXNK.exe 1464 YXNK.exe 1240 IVB.exe 1240 IVB.exe 3652 MLIFWK.exe 3652 MLIFWK.exe 5540 VLKKHIG.exe 5540 VLKKHIG.exe 4460 YHBTTTW.exe 4460 YHBTTTW.exe 2440 ZCFPYR.exe 2440 ZCFPYR.exe 4512 DSLP.exe 4512 DSLP.exe 4300 XFQHVB.exe 4300 XFQHVB.exe 3328 HDWTC.exe 3328 HDWTC.exe 4744 PTXSJF.exe 4744 PTXSJF.exe 3780 UTEG.exe 3780 UTEG.exe 4688 ERS.exe 4688 ERS.exe 5376 ORMFL.exe 5376 ORMFL.exe 1736 OUYBQD.exe 1736 OUYBQD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4192 wrote to memory of 4664 4192 2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe 89 PID 4664 wrote to memory of 4636 4664 cmd.exe 92 PID 4636 wrote to memory of 4468 4636 POGHAGL.exe 95 PID 4468 wrote to memory of 1988 4468 cmd.exe 99 PID 1988 wrote to memory of 3596 1988 GJF.exe 100 PID 3596 wrote to memory of 596 3596 cmd.exe 104 PID 596 wrote to memory of 204 596 XSHL.exe 105 PID 204 wrote to memory of 5980 204 cmd.exe 109 PID 5980 wrote to memory of 1172 5980 KUQC.exe 110 PID 1172 wrote to memory of 4544 1172 cmd.exe 114 PID 4544 wrote to memory of 5852 4544 JNASNA.exe 115 PID 5852 wrote to memory of 5440 5852 cmd.exe 119 PID 5440 wrote to memory of 3364 5440 WQJQCL.exe 120 PID 3364 wrote to memory of 4960 3364 cmd.exe 124 PID 4960 wrote to memory of 4648 4960 VJMGK.exe 125 PID 4648 wrote to memory of 4328 4648 cmd.exe 129 PID 4328 wrote to memory of 5256 4328 TUXWTXU.exe 130 PID 5256 wrote to memory of 2964 5256 cmd.exe 134 PID 2964 wrote to memory of 3152 2964 CZB.exe 135 PID 3152 wrote to memory of 6088 3152 cmd.exe 139 PID 6088 wrote to memory of 1652 6088 LXPXLM.exe 140 PID 1652 wrote to memory of 1264 1652 cmd.exe 144 PID 1264 wrote to memory of 5400 1264 UKTEW.exe 145 PID 5400 wrote to memory of 3344 5400 cmd.exe 149 PID 3344 wrote to memory of 4492 3344 MFXA.exe 150 PID 4492 wrote to memory of 5628 4492 cmd.exe 154 PID 5628 wrote to memory of 2936 5628 NIJDOQ.exe 155 PID 2936 wrote to memory of 4524 2936 cmd.exe 159 PID 4524 wrote to memory of 5708 4524 FMN.exe 160 PID 5708 wrote to memory of 124 5708 cmd.exe 164 PID 124 wrote to memory of 3452 124 ZEU.exe 165 PID 3452 wrote to memory of 916 3452 cmd.exe 169 PID 916 wrote to memory of 2856 916 MPL.exe 170 PID 2856 wrote to memory of 432 2856 cmd.exe 174 PID 432 wrote to memory of 5608 432 ZNLUTWL.exe 175 PID 5608 wrote to memory of 1464 5608 cmd.exe 179 PID 1464 wrote to memory of 5040 1464 YXNK.exe 180 PID 5040 wrote to memory of 1240 5040 cmd.exe 184 PID 1240 wrote to memory of 2728 1240 IVB.exe 185 PID 2728 wrote to memory of 3652 2728 cmd.exe 189 PID 3652 wrote to memory of 3144 3652 MLIFWK.exe 190 PID 3144 wrote to memory of 5540 3144 cmd.exe 194 PID 5540 wrote to memory of 796 5540 VLKKHIG.exe 195 PID 796 wrote to memory of 4460 796 cmd.exe 199 PID 4460 wrote to memory of 5392 4460 YHBTTTW.exe 200 PID 5392 wrote to memory of 2440 5392 cmd.exe 204 PID 2440 wrote to memory of 5660 2440 ZCFPYR.exe 205 PID 5660 wrote to memory of 4512 5660 cmd.exe 209 PID 4512 wrote to memory of 4516 4512 DSLP.exe 210 PID 4516 wrote to memory of 4300 4516 cmd.exe 214 PID 4300 wrote to memory of 364 4300 XFQHVB.exe 215 PID 364 wrote to memory of 3328 364 cmd.exe 219 PID 3328 wrote to memory of 1416 3328 HDWTC.exe 220 PID 1416 wrote to memory of 4744 1416 cmd.exe 224 PID 4744 wrote to memory of 5856 4744 PTXSJF.exe 225 PID 5856 wrote to memory of 3780 5856 cmd.exe 229 PID 3780 wrote to memory of 1224 3780 UTEG.exe 230 PID 1224 wrote to memory of 4688 1224 cmd.exe 234 PID 4688 wrote to memory of 4944 4688 ERS.exe 235 PID 4944 wrote to memory of 5376 4944 cmd.exe 239 PID 5376 wrote to memory of 3864 5376 ORMFL.exe 240 PID 3864 wrote to memory of 1736 3864 cmd.exe 244 PID 1736 wrote to memory of 1516 1736 OUYBQD.exe 245 PID 1516 wrote to memory of 4108 1516 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_6bb4781c08e9186f5c9270e6f7af875b_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\POGHAGL.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\POGHAGL.exeC:\windows\POGHAGL.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJF.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\windows\GJF.exeC:\windows\GJF.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSHL.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\windows\system\XSHL.exeC:\windows\system\XSHL.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KUQC.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:204 -
C:\windows\SysWOW64\KUQC.exeC:\windows\system32\KUQC.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JNASNA.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\windows\system\JNASNA.exeC:\windows\system\JNASNA.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQJQCL.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\windows\SysWOW64\WQJQCL.exeC:\windows\system32\WQJQCL.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJMGK.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\SysWOW64\VJMGK.exeC:\windows\system32\VJMGK.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TUXWTXU.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\system\TUXWTXU.exeC:\windows\system\TUXWTXU.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZB.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\windows\system\CZB.exeC:\windows\system\CZB.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXPXLM.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\windows\system\LXPXLM.exeC:\windows\system\LXPXLM.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UKTEW.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\windows\system\UKTEW.exeC:\windows\system\UKTEW.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFXA.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\windows\system\MFXA.exeC:\windows\system\MFXA.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NIJDOQ.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\SysWOW64\NIJDOQ.exeC:\windows\system32\NIJDOQ.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FMN.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\windows\system\FMN.exeC:\windows\system\FMN.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEU.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\windows\system\ZEU.exeC:\windows\system\ZEU.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MPL.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\MPL.exeC:\windows\MPL.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNLUTWL.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\windows\SysWOW64\ZNLUTWL.exeC:\windows\system32\ZNLUTWL.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXNK.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\windows\SysWOW64\YXNK.exeC:\windows\system32\YXNK.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVB.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\windows\IVB.exeC:\windows\IVB.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MLIFWK.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\windows\system\MLIFWK.exeC:\windows\system\MLIFWK.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VLKKHIG.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\windows\SysWOW64\VLKKHIG.exeC:\windows\system32\VLKKHIG.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHBTTTW.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\windows\YHBTTTW.exeC:\windows\YHBTTTW.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCFPYR.exe.bat" "46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\windows\system\ZCFPYR.exeC:\windows\system\ZCFPYR.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DSLP.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\DSLP.exeC:\windows\DSLP.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XFQHVB.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\windows\system\XFQHVB.exeC:\windows\system\XFQHVB.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HDWTC.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:364 -
C:\windows\system\HDWTC.exeC:\windows\system\HDWTC.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PTXSJF.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\windows\SysWOW64\PTXSJF.exeC:\windows\system32\PTXSJF.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTEG.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\system\UTEG.exeC:\windows\system\UTEG.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ERS.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\windows\system\ERS.exeC:\windows\system\ERS.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ORMFL.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\windows\ORMFL.exeC:\windows\ORMFL.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUYBQD.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\SysWOW64\OUYBQD.exeC:\windows\system32\OUYBQD.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HXCFD.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\windows\HXCFD.exeC:\windows\HXCFD.exe65⤵
- Executes dropped EXE
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GIEV.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1892 -
C:\windows\SysWOW64\GIEV.exeC:\windows\system32\GIEV.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYLVQZN.exe.bat" "68⤵PID:2784
-
C:\windows\system\KYLVQZN.exeC:\windows\system\KYLVQZN.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KTPZ.exe.bat" "70⤵PID:3932
-
C:\windows\SysWOW64\KTPZ.exeC:\windows\system32\KTPZ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJVZIH.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2212 -
C:\windows\system\OJVZIH.exeC:\windows\system\OJVZIH.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMMXWK.exe.bat" "74⤵PID:972
-
C:\windows\SysWOW64\BMMXWK.exeC:\windows\system32\BMMXWK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHR.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4740 -
C:\windows\EHR.exeC:\windows\EHR.exe77⤵
- Executes dropped EXE
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CVQH.exe.bat" "78⤵PID:3240
-
C:\windows\system\CVQH.exeC:\windows\system\CVQH.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MSW.exe.bat" "80⤵PID:1380
-
C:\windows\SysWOW64\MSW.exeC:\windows\system32\MSW.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UGI.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4756 -
C:\windows\SysWOW64\UGI.exeC:\windows\system32\UGI.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRLYMAC.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1684 -
C:\windows\system\TRLYMAC.exeC:\windows\system\TRLYMAC.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XZSY.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:4416 -
C:\windows\system\XZSY.exeC:\windows\system\XZSY.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IRVRY.exe.bat" "88⤵
- Executes a command shell one-liner
PID:1756 -
C:\windows\SysWOW64\IRVRY.exeC:\windows\system32\IRVRY.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HPGU.exe.bat" "90⤵PID:2236
-
C:\windows\SysWOW64\HPGU.exeC:\windows\system32\HPGU.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZSKQZD.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:3332 -
C:\windows\SysWOW64\ZSKQZD.exeC:\windows\system32\ZSKQZD.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ANNU.exe.bat" "94⤵PID:4216
-
C:\windows\ANNU.exeC:\windows\ANNU.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PDWLLO.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3484 -
C:\windows\SysWOW64\PDWLLO.exeC:\windows\system32\PDWLLO.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:52 -
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MWHPDWL.exe.bat" "100⤵PID:4556
-
C:\windows\SysWOW64\MWHPDWL.exeC:\windows\system32\MWHPDWL.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKMY.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3408 -
C:\windows\system\OKMY.exeC:\windows\system\OKMY.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFVLYJI.exe.bat" "104⤵PID:4252
-
C:\windows\system\EFVLYJI.exeC:\windows\system\EFVLYJI.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIZG.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3244 -
C:\windows\SysWOW64\WIZG.exeC:\windows\system32\WIZG.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WNZV.exe.bat" "108⤵PID:872
-
C:\windows\SysWOW64\WNZV.exeC:\windows\system32\WNZV.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XQD.exe.bat" "110⤵
- Executes a command shell one-liner
PID:4496 -
C:\windows\system\XQD.exeC:\windows\system\XQD.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYKYFU.exe.bat" "112⤵
- Executes a command shell one-liner
PID:3032 -
C:\windows\system\BYKYFU.exeC:\windows\system\BYKYFU.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTTD.exe.bat" "114⤵PID:788
-
C:\windows\QTTD.exeC:\windows\QTTD.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UERYXA.exe.bat" "116⤵PID:5480
-
C:\windows\system\UERYXA.exeC:\windows\system\UERYXA.exe117⤵
- Executes dropped EXE
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNYG.exe.bat" "118⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5152 -
C:\windows\system\YNYG.exeC:\windows\system\YNYG.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TADPMS.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:6076 -
C:\windows\TADPMS.exeC:\windows\TADPMS.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-