Analysis
- max time kernel
100s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 22:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_ccbc534bd1a074be1542b4901de6a660_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-02_ccbc534bd1a074be1542b4901de6a660_elex_emotet_stop.exe
- Size 208KB
- Sample261102-2fs35afx8p
- SHA256 c2751d414d837375421018b6581f22595c70fa55ebc12ca78d720bfb97754787
- MD5 ccbc534bd1a074be1542b4901de6a660
- SHA1 ab26ac6063eac5398e552910e4b367a4b7d94dfe
- SHA512 236ca6e9aef05bf2d7914ce53ac7d1fd8d0c28ef96be4c17c6d5a207b91e3959b810132dcfa78a938013e48a2303e9e9fb6e842d8b3225d3b2a9e6d6c8631e8f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUKL+LOfk4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUS+LOMkEj1
- TLSH T17E247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3232 OHICHYY.exe 1368 AKSQQLB.exe 5652 TNWLWB.exe 4928 XSHB.exe 1408 XYHPO.exe 3812 DYODXLB.exe 2748 FWI.exe 1516 JMWFP.exe 2052 FJUCWCI.exe 5588 YNYG.exe 1768 ENFUTM.exe 5680 ESGAUZN.exe 5960 AYLX.exe 5696 QTVKMW.exe 2064 KGA.exe 5520 CPCY.exe 3020 LPEDLZ.exe 5904 RPD.exe 5968 LKIAF.exe 4544 RLQOOVI.exe 3880 XYP.exe 4352 LJFNHJ.exe 3136 OZMVL.exe 2568 ARHO.exe 2108 CHIIZ.exe 3068 IIQWJZG.exe 5560 TATP.exe 2872 PGR.exe 1448 BYUF.exe 5368 ZZBSPAG.exe 2388 BMGC.exe 5860 WHLLC.exe 1648 QUQVMAY.exe 1912 CNL.exe 1340 HNSBDB.exe 5448 JDUV.exe 4704 HDBJTS.exe 4448 EJZ.exe 2280 RUDNFTD.exe 4888 MHIW.exe 2476 XADPX.exe 3844 DAK.exe 1528 OTNVPKX.exe 6124 JGSFZK.exe 5676 UYVQZ.exe 5332 LMGIPWP.exe 4984 ARDFWYJ.exe 3740 LKG.exe 5984 TPHM.exe 6064 CDREWPQ.exe 2272 NVM.exe 5100 PLNRCTN.exe 4312 VLVF.exe 5964 ZBCNFF.exe 3536 MEYLKFF.exe 4768 WNAQ.exe 3868 LIJDZPI.exe 4556 WAM.exe 4648 NJOA.exe 5376 CGUYAL.exe 2860 YMSNH.exe 2316 VRXKOXX.exe 5348 RXDHVHZ.exe 2080 GUJE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\XKXRXOK.exe.bat DMWPRA.exe File created C:\windows\SysWOW64\ORAYQPP.exe RLCBJ.exe File opened for modification C:\windows\SysWOW64\KUOBVLV.exe OPIEOBT.exe File created C:\windows\SysWOW64\FITL.exe.bat KUOBVLV.exe File opened for modification C:\windows\SysWOW64\GIQP.exe GUY.exe File created C:\windows\SysWOW64\OOTX.exe.bat QNLJNMJ.exe File created C:\windows\SysWOW64\ENFUTM.exe.bat YNYG.exe File created C:\windows\SysWOW64\CPCY.exe KGA.exe File created C:\windows\SysWOW64\LKIAF.exe RPD.exe File created C:\windows\SysWOW64\RLQOOVI.exe.bat LKIAF.exe File created C:\windows\SysWOW64\CHIIZ.exe.bat ARHO.exe File created C:\windows\SysWOW64\UYVQZ.exe JGSFZK.exe File created C:\windows\SysWOW64\KWSO.exe EVLAKZU.exe File created C:\windows\SysWOW64\BNOJBYY.exe.bat FHIMUW.exe File created C:\windows\SysWOW64\ZVILJ.exe XGOIK.exe File created C:\windows\SysWOW64\BYUF.exe.bat PGR.exe File created C:\windows\SysWOW64\NVM.exe CDREWPQ.exe File opened for modification C:\windows\SysWOW64\ZBCNFF.exe VLVF.exe File opened for modification C:\windows\SysWOW64\BNOJBYY.exe FHIMUW.exe File created C:\windows\SysWOW64\GIQP.exe.bat GUY.exe File created C:\windows\SysWOW64\FITL.exe KUOBVLV.exe File created C:\windows\SysWOW64\NJOA.exe.bat WAM.exe File opened for modification C:\windows\SysWOW64\RLQOOVI.exe LKIAF.exe File created C:\windows\SysWOW64\HNSBDB.exe.bat CNL.exe File created C:\windows\SysWOW64\XKXRXOK.exe DMWPRA.exe File created C:\windows\SysWOW64\KUDC.exe ZBI.exe File created C:\windows\SysWOW64\MBGQR.exe.bat MWFC.exe File created C:\windows\SysWOW64\UNTDZ.exe JUQK.exe File created C:\windows\SysWOW64\XGOIK.exe RFHVTSU.exe File created C:\windows\SysWOW64\ENFUTM.exe YNYG.exe File created C:\windows\SysWOW64\LPEDLZ.exe CPCY.exe File created C:\windows\SysWOW64\OZMVL.exe LJFNHJ.exe File created C:\windows\SysWOW64\OZMVL.exe.bat LJFNHJ.exe File created C:\windows\SysWOW64\BQGNM.exe GUJE.exe File created C:\windows\SysWOW64\EWC.exe.bat QTGAUS.exe File opened for modification C:\windows\SysWOW64\ZVILJ.exe XGOIK.exe File created C:\windows\SysWOW64\ZVILJ.exe.bat XGOIK.exe File created C:\windows\SysWOW64\VLSCSS.exe KTPJK.exe File created C:\windows\SysWOW64\ARHO.exe.bat OZMVL.exe File created C:\windows\SysWOW64\ZBCNFF.exe VLVF.exe File opened for modification C:\windows\SysWOW64\WEXZAB.exe OUPX.exe File opened for modification C:\windows\SysWOW64\EIY.exe ECGPPSJ.exe File created C:\windows\SysWOW64\BYUF.exe PGR.exe File opened for modification C:\windows\SysWOW64\UNTDZ.exe JUQK.exe File opened for modification C:\windows\SysWOW64\KUDC.exe ZBI.exe File created C:\windows\SysWOW64\DLK.exe QAGW.exe File created C:\windows\SysWOW64\KUOBVLV.exe OPIEOBT.exe File opened for modification C:\windows\SysWOW64\NVM.exe CDREWPQ.exe File created C:\windows\SysWOW64\NVM.exe.bat CDREWPQ.exe File opened for modification C:\windows\SysWOW64\WAM.exe LIJDZPI.exe File opened for modification C:\windows\SysWOW64\BQGNM.exe GUJE.exe File created C:\windows\SysWOW64\OOTX.exe QNLJNMJ.exe File opened for modification C:\windows\SysWOW64\OHICHYY.exe 2026-11-02_ccbc534bd1a074be1542b4901de6a660_elex_emotet_stop.exe File created C:\windows\SysWOW64\WAM.exe LIJDZPI.exe File opened for modification C:\windows\SysWOW64\MBGQR.exe MWFC.exe File created C:\windows\SysWOW64\JHYFEBL.exe.bat EWC.exe File created C:\windows\SysWOW64\GIQP.exe GUY.exe File created C:\windows\SysWOW64\ORAYQPP.exe.bat RLCBJ.exe File created C:\windows\SysWOW64\BUEEVG.exe.bat ORAYQPP.exe File created C:\windows\SysWOW64\KUOBVLV.exe.bat OPIEOBT.exe File created C:\windows\SysWOW64\NJOA.exe WAM.exe File created C:\windows\SysWOW64\EIY.exe ECGPPSJ.exe File opened for modification C:\windows\SysWOW64\XKXRXOK.exe DMWPRA.exe File created C:\windows\SysWOW64\MFRT.exe.bat BNOJBYY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\FWI.exe.bat DYODXLB.exe File created C:\windows\XYP.exe.bat RLQOOVI.exe File created C:\windows\QNB.exe.bat FVYKLBZ.exe File opened for modification C:\windows\system\SAYIZJA.exe BZWDW.exe File opened for modification C:\windows\LKG.exe ARDFWYJ.exe File opened for modification C:\windows\system\ECGPPSJ.exe WKXNJGV.exe File created C:\windows\system\PGR.exe TATP.exe File opened for modification C:\windows\CNL.exe QUQVMAY.exe File created C:\windows\LKG.exe ARDFWYJ.exe File created C:\windows\system\DMWPRA.exe YMOB.exe File created C:\windows\system\DVVFHY.exe.bat IHQVF.exe File created C:\windows\system\FJUCWCI.exe JMWFP.exe File created C:\windows\system\YNYG.exe FJUCWCI.exe File opened for modification C:\windows\system\TNWLWB.exe AKSQQLB.exe File created C:\windows\system\HDBJTS.exe.bat JDUV.exe File opened for modification C:\windows\system\RUDNFTD.exe EJZ.exe File created C:\windows\system\ECGPPSJ.exe WKXNJGV.exe File created C:\windows\system\YMOB.exe QHW.exe File created C:\windows\QNB.exe FVYKLBZ.exe File created C:\windows\system\FJUCWCI.exe.bat JMWFP.exe File opened for modification C:\windows\system\AYLX.exe ESGAUZN.exe File created C:\windows\BMGC.exe ZZBSPAG.exe File created C:\windows\system\HDBJTS.exe JDUV.exe File created C:\windows\MHIW.exe RUDNFTD.exe File opened for modification C:\windows\system\MEYLKFF.exe ZBCNFF.exe File opened for modification C:\windows\system\YMOB.exe QHW.exe File created C:\windows\system\YMCT.exe QGKE.exe File created C:\windows\UOALNIL.exe OOTX.exe File created C:\windows\ODFV.exe.bat DLK.exe File created C:\windows\QGKE.exe QNB.exe File created C:\windows\system\KOLVRQT.exe ZVILJ.exe File created C:\windows\ZVDNB.exe EIY.exe File opened for modification C:\windows\EVLAKZU.exe ZVDNB.exe File opened for modification C:\windows\MDXIBZB.exe QYZ.exe File opened for modification C:\windows\XNMCTAS.exe BQGNM.exe File created C:\windows\EVLAKZU.exe ZVDNB.exe File opened for modification C:\windows\system\DMWPRA.exe YMOB.exe File opened for modification C:\windows\RLCBJ.exe TLU.exe File created C:\windows\system\TATP.exe IIQWJZG.exe File created C:\windows\QGKE.exe.bat QNB.exe File created C:\windows\system\ZBI.exe TBB.exe File created C:\windows\XYHPO.exe XSHB.exe File created C:\windows\system\JDUV.exe.bat HNSBDB.exe File created C:\windows\system\QYZ.exe DVVFHY.exe File created C:\windows\system\KOLVRQT.exe.bat ZVILJ.exe File created C:\windows\system\DYODXLB.exe.bat XYHPO.exe File created C:\windows\system\RPD.exe LPEDLZ.exe File created C:\windows\EJZ.exe.bat HDBJTS.exe File opened for modification C:\windows\PLNRCTN.exe NVM.exe File created C:\windows\MWFC.exe MDXIBZB.exe File created C:\windows\system\TBB.exe.bat RDZUUQI.exe File opened for modification C:\windows\EUYG.exe TBVNHNP.exe File opened for modification C:\windows\system\WNAQ.exe MEYLKFF.exe File opened for modification C:\windows\system\CEJKQT.exe WCNDL.exe File opened for modification C:\windows\system\OPIEOBT.exe GEADA.exe File created C:\windows\system\RUDNFTD.exe EJZ.exe File created C:\windows\system\GUY.exe YKPZXC.exe File opened for modification C:\windows\system\AKSQQLB.exe OHICHYY.exe File opened for modification C:\windows\system\QTVKMW.exe AYLX.exe File created C:\windows\system\IIQWJZG.exe CHIIZ.exe File created C:\windows\VLVF.exe PLNRCTN.exe File created C:\windows\system\MEYLKFF.exe ZBCNFF.exe File opened for modification C:\windows\WCNDL.exe AWIGE.exe File created C:\windows\system\CDREWPQ.exe TPHM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2880 cmd.exe 4884 cmd.exe 1404 cmd.exe 3580 cmd.exe 4272 cmd.exe 4332 cmd.exe 824 cmd.exe 724 cmd.exe 1996 cmd.exe 5184 cmd.exe 2520 cmd.exe 4660 cmd.exe 2256 cmd.exe 5324 cmd.exe 2212 cmd.exe 244 cmd.exe 1036 cmd.exe 1972 cmd.exe 4368 cmd.exe 5076 cmd.exe 3968 cmd.exe 1764 cmd.exe 4952 cmd.exe 552 cmd.exe 5160 cmd.exe 2704 cmd.exe 2292 cmd.exe 5932 cmd.exe 4424 cmd.exe 4916 cmd.exe 4516 cmd.exe 6000 cmd.exe 3148 cmd.exe 2772 cmd.exe 5928 cmd.exe 760 cmd.exe 708 cmd.exe 6020 cmd.exe 2600 cmd.exe 4700 cmd.exe 2044 cmd.exe 5972 cmd.exe 5796 cmd.exe 4404 cmd.exe 1308 cmd.exe 948 cmd.exe 2852 cmd.exe 6140 cmd.exe 5888 cmd.exe 1500 cmd.exe 2464 cmd.exe 4988 cmd.exe 5004 cmd.exe 436 cmd.exe 6024 cmd.exe 2020 cmd.exe 2448 cmd.exe 996 cmd.exe 2868 cmd.exe 1664 cmd.exe 4024 cmd.exe 1296 cmd.exe 4644 cmd.exe 1232 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3456 4176 WerFault.exe 87 1824 3232 WerFault.exe 92 3844 1368 WerFault.exe 99 1680 5652 WerFault.exe 104 1500 4928 WerFault.exe 109 760 1408 WerFault.exe 114 3020 3812 WerFault.exe 119 3116 2748 WerFault.exe 124 4520 1516 WerFault.exe 129 1416 2052 WerFault.exe 134 1572 5588 WerFault.exe 139 3548 1768 WerFault.exe 144 3636 5680 WerFault.exe 149 3968 5960 WerFault.exe 154 1432 5696 WerFault.exe 159 1484 2064 WerFault.exe 164 2848 5520 WerFault.exe 169 4588 3020 WerFault.exe 174 2576 5904 WerFault.exe 179 1352 5968 WerFault.exe 184 2752 4544 WerFault.exe 189 3004 3880 WerFault.exe 194 2312 4352 WerFault.exe 199 5100 3136 WerFault.exe 204 5516 2568 WerFault.exe 209 2592 2108 WerFault.exe 214 3348 3068 WerFault.exe 219 2308 5560 WerFault.exe 224 5732 2872 WerFault.exe 229 4252 1448 WerFault.exe 234 5972 5368 WerFault.exe 239 4032 2388 WerFault.exe 244 5376 5860 WerFault.exe 249 1964 1648 WerFault.exe 254 996 1912 WerFault.exe 259 1484 1340 WerFault.exe 264 6052 5448 WerFault.exe 269 3932 4704 WerFault.exe 274 1104 4448 WerFault.exe 278 2256 2280 WerFault.exe 284 1412 4888 WerFault.exe 290 3436 2476 WerFault.exe 295 4024 3844 WerFault.exe 300 692 1528 WerFault.exe 305 2500 6124 WerFault.exe 310 5176 5676 WerFault.exe 315 4592 5332 WerFault.exe 320 4112 4984 WerFault.exe 325 1192 3740 WerFault.exe 330 5364 5984 WerFault.exe 335 4032 6064 WerFault.exe 340 2988 2272 WerFault.exe 345 5108 5100 WerFault.exe 350 2368 4312 WerFault.exe 355 3348 5964 WerFault.exe 360 5256 3536 WerFault.exe 365 5328 4768 WerFault.exe 370 5292 3868 WerFault.exe 375 1268 4556 WerFault.exe 380 3688 4648 WerFault.exe 385 4464 5376 WerFault.exe 390 2712 2860 WerFault.exe 395 5884 2316 WerFault.exe 400 4520 5348 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENFUTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUDNFTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKIAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNMCTAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJUCWCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BZWDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YMOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZHCLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRXKOXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPEDLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUQVMAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORAYQPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZMVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YMCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVYKLBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DUIWISJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPQIHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKCLRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFHVTSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGUYAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUEEVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBGQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARHO.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4176 2026-11-02_ccbc534bd1a074be1542b4901de6a660_elex_emotet_stop.exe 4176 2026-11-02_ccbc534bd1a074be1542b4901de6a660_elex_emotet_stop.exe 3232 OHICHYY.exe 3232 OHICHYY.exe 1368 AKSQQLB.exe 1368 AKSQQLB.exe 5652 TNWLWB.exe 5652 TNWLWB.exe 4928 XSHB.exe 4928 XSHB.exe 1408 XYHPO.exe 1408 XYHPO.exe 3812 DYODXLB.exe 3812 DYODXLB.exe 2748 FWI.exe 2748 FWI.exe 1516 JMWFP.exe 1516 JMWFP.exe 2052 FJUCWCI.exe 2052 FJUCWCI.exe 5588 YNYG.exe 5588 YNYG.exe 1768 ENFUTM.exe 1768 ENFUTM.exe 5680 ESGAUZN.exe 5680 ESGAUZN.exe 5960 AYLX.exe 5960 AYLX.exe 5696 QTVKMW.exe 5696 QTVKMW.exe 2064 KGA.exe 2064 KGA.exe 5520 CPCY.exe 5520 CPCY.exe 3020 LPEDLZ.exe 3020 LPEDLZ.exe 5904 RPD.exe 5904 RPD.exe 5968 LKIAF.exe 5968 LKIAF.exe 4544 RLQOOVI.exe 4544 RLQOOVI.exe 3880 XYP.exe 3880 XYP.exe 4352 LJFNHJ.exe 4352 LJFNHJ.exe 3136 OZMVL.exe 3136 OZMVL.exe 2568 ARHO.exe 2568 ARHO.exe 2108 CHIIZ.exe 2108 CHIIZ.exe 3068 IIQWJZG.exe 3068 IIQWJZG.exe 5560 TATP.exe 5560 TATP.exe 2872 PGR.exe 2872 PGR.exe 1448 BYUF.exe 1448 BYUF.exe 5368 ZZBSPAG.exe 5368 ZZBSPAG.exe 2388 BMGC.exe 2388 BMGC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4176 2026-11-02_ccbc534bd1a074be1542b4901de6a660_elex_emotet_stop.exe 4176 2026-11-02_ccbc534bd1a074be1542b4901de6a660_elex_emotet_stop.exe 3232 OHICHYY.exe 3232 OHICHYY.exe 1368 AKSQQLB.exe 1368 AKSQQLB.exe 5652 TNWLWB.exe 5652 TNWLWB.exe 4928 XSHB.exe 4928 XSHB.exe 1408 XYHPO.exe 1408 XYHPO.exe 3812 DYODXLB.exe 3812 DYODXLB.exe 2748 FWI.exe 2748 FWI.exe 1516 JMWFP.exe 1516 JMWFP.exe 2052 FJUCWCI.exe 2052 FJUCWCI.exe 5588 YNYG.exe 5588 YNYG.exe 1768 ENFUTM.exe 1768 ENFUTM.exe 5680 ESGAUZN.exe 5680 ESGAUZN.exe 5960 AYLX.exe 5960 AYLX.exe 5696 QTVKMW.exe 5696 QTVKMW.exe 2064 KGA.exe 2064 KGA.exe 5520 CPCY.exe 5520 CPCY.exe 3020 LPEDLZ.exe 3020 LPEDLZ.exe 5904 RPD.exe 5904 RPD.exe 5968 LKIAF.exe 5968 LKIAF.exe 4544 RLQOOVI.exe 4544 RLQOOVI.exe 3880 XYP.exe 3880 XYP.exe 4352 LJFNHJ.exe 4352 LJFNHJ.exe 3136 OZMVL.exe 3136 OZMVL.exe 2568 ARHO.exe 2568 ARHO.exe 2108 CHIIZ.exe 2108 CHIIZ.exe 3068 IIQWJZG.exe 3068 IIQWJZG.exe 5560 TATP.exe 5560 TATP.exe 2872 PGR.exe 2872 PGR.exe 1448 BYUF.exe 1448 BYUF.exe 5368 ZZBSPAG.exe 5368 ZZBSPAG.exe 2388 BMGC.exe 2388 BMGC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4176 wrote to memory of 5160 4176 2026-11-02_ccbc534bd1a074be1542b4901de6a660_elex_emotet_stop.exe 89 PID 5160 wrote to memory of 3232 5160 cmd.exe 92 PID 3232 wrote to memory of 4880 3232 OHICHYY.exe 95 PID 4880 wrote to memory of 1368 4880 cmd.exe 99 PID 1368 wrote to memory of 4780 1368 AKSQQLB.exe 100 PID 4780 wrote to memory of 5652 4780 cmd.exe 104 PID 5652 wrote to memory of 1300 5652 TNWLWB.exe 105 PID 1300 wrote to memory of 4928 1300 cmd.exe 109 PID 4928 wrote to memory of 4404 4928 XSHB.exe 110 PID 4404 wrote to memory of 1408 4404 cmd.exe 114 PID 1408 wrote to memory of 4560 1408 XYHPO.exe 115 PID 4560 wrote to memory of 3812 4560 cmd.exe 119 PID 3812 wrote to memory of 2772 3812 DYODXLB.exe 120 PID 2772 wrote to memory of 2748 2772 cmd.exe 124 PID 2748 wrote to memory of 6036 2748 FWI.exe 125 PID 6036 wrote to memory of 1516 6036 cmd.exe 129 PID 1516 wrote to memory of 1308 1516 JMWFP.exe 130 PID 1308 wrote to memory of 2052 1308 cmd.exe 134 PID 2052 wrote to memory of 1664 2052 FJUCWCI.exe 135 PID 1664 wrote to memory of 5588 1664 cmd.exe 139 PID 5588 wrote to memory of 5776 5588 YNYG.exe 140 PID 5776 wrote to memory of 1768 5776 cmd.exe 144 PID 1768 wrote to memory of 4980 1768 ENFUTM.exe 145 PID 4980 wrote to memory of 5680 4980 cmd.exe 149 PID 5680 wrote to memory of 3764 5680 ESGAUZN.exe 150 PID 3764 wrote to memory of 5960 3764 cmd.exe 154 PID 5960 wrote to memory of 4012 5960 AYLX.exe 155 PID 4012 wrote to memory of 5696 4012 cmd.exe 159 PID 5696 wrote to memory of 1120 5696 QTVKMW.exe 160 PID 1120 wrote to memory of 2064 1120 cmd.exe 164 PID 2064 wrote to memory of 5928 2064 KGA.exe 165 PID 5928 wrote to memory of 5520 5928 cmd.exe 169 PID 5520 wrote to memory of 4612 5520 CPCY.exe 170 PID 4612 wrote to memory of 3020 4612 cmd.exe 174 PID 3020 wrote to memory of 2896 3020 LPEDLZ.exe 175 PID 2896 wrote to memory of 5904 2896 cmd.exe 179 PID 5904 wrote to memory of 5612 5904 RPD.exe 180 PID 5612 wrote to memory of 5968 5612 cmd.exe 184 PID 5968 wrote to memory of 1996 5968 LKIAF.exe 185 PID 1996 wrote to memory of 4544 1996 cmd.exe 189 PID 4544 wrote to memory of 4988 4544 RLQOOVI.exe 190 PID 4988 wrote to memory of 3880 4988 cmd.exe 194 PID 3880 wrote to memory of 4832 3880 XYP.exe 195 PID 4832 wrote to memory of 4352 4832 cmd.exe 199 PID 4352 wrote to memory of 1372 4352 LJFNHJ.exe 200 PID 1372 wrote to memory of 3136 1372 cmd.exe 204 PID 3136 wrote to memory of 1164 3136 OZMVL.exe 205 PID 1164 wrote to memory of 2568 1164 cmd.exe 209 PID 2568 wrote to memory of 3756 2568 ARHO.exe 210 PID 3756 wrote to memory of 2108 3756 cmd.exe 214 PID 2108 wrote to memory of 760 2108 CHIIZ.exe 215 PID 760 wrote to memory of 3068 760 cmd.exe 219 PID 3068 wrote to memory of 200 3068 IIQWJZG.exe 220 PID 200 wrote to memory of 5560 200 cmd.exe 224 PID 5560 wrote to memory of 5004 5560 TATP.exe 225 PID 5004 wrote to memory of 2872 5004 cmd.exe 229 PID 2872 wrote to memory of 3656 2872 PGR.exe 230 PID 3656 wrote to memory of 1448 3656 cmd.exe 234 PID 1448 wrote to memory of 5468 1448 BYUF.exe 235 PID 5468 wrote to memory of 5368 5468 cmd.exe 239 PID 5368 wrote to memory of 2704 5368 ZZBSPAG.exe 240 PID 2704 wrote to memory of 2388 2704 cmd.exe 244 PID 2388 wrote to memory of 4368 2388 BMGC.exe 245 PID 4368 wrote to memory of 5860 4368 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_ccbc534bd1a074be1542b4901de6a660_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_ccbc534bd1a074be1542b4901de6a660_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHICHYY.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\windows\SysWOW64\OHICHYY.exeC:\windows\system32\OHICHYY.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AKSQQLB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\system\AKSQQLB.exeC:\windows\system\AKSQQLB.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TNWLWB.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\system\TNWLWB.exeC:\windows\system\TNWLWB.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSHB.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\SysWOW64\XSHB.exeC:\windows\system32\XSHB.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYODXLB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\system\DYODXLB.exeC:\windows\system\DYODXLB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWI.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\FWI.exeC:\windows\FWI.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMWFP.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\JMWFP.exeC:\windows\JMWFP.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJUCWCI.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\windows\system\FJUCWCI.exeC:\windows\system\FJUCWCI.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNYG.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\windows\system\YNYG.exeC:\windows\system\YNYG.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENFUTM.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\windows\SysWOW64\ENFUTM.exeC:\windows\system32\ENFUTM.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ESGAUZN.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\windows\system\ESGAUZN.exeC:\windows\system\ESGAUZN.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYLX.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\system\AYLX.exeC:\windows\system\AYLX.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTVKMW.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\windows\system\QTVKMW.exeC:\windows\system\QTVKMW.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGA.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\windows\KGA.exeC:\windows\KGA.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CPCY.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\windows\SysWOW64\CPCY.exeC:\windows\system32\CPCY.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LPEDLZ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\SysWOW64\LPEDLZ.exeC:\windows\system32\LPEDLZ.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPD.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\windows\system\RPD.exeC:\windows\system\RPD.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKIAF.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\windows\SysWOW64\LKIAF.exeC:\windows\system32\LKIAF.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLQOOVI.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\windows\SysWOW64\RLQOOVI.exeC:\windows\system32\RLQOOVI.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYP.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\XYP.exeC:\windows\XYP.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJFNHJ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\windows\LJFNHJ.exeC:\windows\LJFNHJ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZMVL.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\windows\SysWOW64\OZMVL.exeC:\windows\system32\OZMVL.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARHO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\windows\SysWOW64\ARHO.exeC:\windows\system32\ARHO.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CHIIZ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\windows\SysWOW64\CHIIZ.exeC:\windows\system32\CHIIZ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIQWJZG.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:760 -
C:\windows\system\IIQWJZG.exeC:\windows\system\IIQWJZG.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TATP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:200 -
C:\windows\system\TATP.exeC:\windows\system\TATP.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGR.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\windows\system\PGR.exeC:\windows\system\PGR.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BYUF.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\windows\SysWOW64\BYUF.exeC:\windows\system32\BYUF.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZBSPAG.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\system\ZZBSPAG.exeC:\windows\system\ZZBSPAG.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMGC.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\BMGC.exeC:\windows\BMGC.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WHLLC.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\windows\WHLLC.exeC:\windows\WHLLC.exe65⤵
- Executes dropped EXE
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUQVMAY.exe.bat" "66⤵PID:1940
-
C:\windows\QUQVMAY.exeC:\windows\QUQVMAY.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNL.exe.bat" "68⤵PID:4604
-
C:\windows\CNL.exeC:\windows\CNL.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HNSBDB.exe.bat" "70⤵PID:5684
-
C:\windows\SysWOW64\HNSBDB.exeC:\windows\system32\HNSBDB.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JDUV.exe.bat" "72⤵
- Executes a command shell one-liner
PID:2600 -
C:\windows\system\JDUV.exeC:\windows\system\JDUV.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HDBJTS.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2292 -
C:\windows\system\HDBJTS.exeC:\windows\system\HDBJTS.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EJZ.exe.bat" "76⤵
- Executes a command shell one-liner
PID:948 -
C:\windows\EJZ.exeC:\windows\EJZ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUDNFTD.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:3464 -
C:\windows\system\RUDNFTD.exeC:\windows\system\RUDNFTD.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHIW.exe.bat" "80⤵PID:3500
-
C:\windows\MHIW.exeC:\windows\MHIW.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XADPX.exe.bat" "82⤵
- Executes a command shell one-liner
PID:436 -
C:\windows\SysWOW64\XADPX.exeC:\windows\system32\XADPX.exe83⤵
- Executes dropped EXE
PID:2476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DAK.exe.bat" "84⤵PID:1480
-
C:\windows\DAK.exeC:\windows\DAK.exe85⤵
- Executes dropped EXE
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTNVPKX.exe.bat" "86⤵PID:6016
-
C:\windows\OTNVPKX.exeC:\windows\OTNVPKX.exe87⤵
- Executes dropped EXE
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JGSFZK.exe.bat" "88⤵PID:4968
-
C:\windows\JGSFZK.exeC:\windows\JGSFZK.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UYVQZ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:252 -
C:\windows\SysWOW64\UYVQZ.exeC:\windows\system32\UYVQZ.exe91⤵
- Executes dropped EXE
PID:5676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMGIPWP.exe.bat" "92⤵PID:2220
-
C:\windows\system\LMGIPWP.exeC:\windows\system\LMGIPWP.exe93⤵
- Executes dropped EXE
PID:5332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARDFWYJ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:2852 -
C:\windows\system\ARDFWYJ.exeC:\windows\system\ARDFWYJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKG.exe.bat" "96⤵PID:1000
-
C:\windows\LKG.exeC:\windows\LKG.exe97⤵
- Executes dropped EXE
PID:3740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TPHM.exe.bat" "98⤵PID:3928
-
C:\windows\TPHM.exeC:\windows\TPHM.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDREWPQ.exe.bat" "100⤵
- Executes a command shell one-liner
PID:6024 -
C:\windows\system\CDREWPQ.exeC:\windows\system\CDREWPQ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVM.exe.bat" "102⤵
- Executes a command shell one-liner
PID:2880 -
C:\windows\SysWOW64\NVM.exeC:\windows\system32\NVM.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PLNRCTN.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4700 -
C:\windows\PLNRCTN.exeC:\windows\PLNRCTN.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLVF.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4024 -
C:\windows\VLVF.exeC:\windows\VLVF.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZBCNFF.exe.bat" "108⤵PID:5644
-
C:\windows\SysWOW64\ZBCNFF.exeC:\windows\system32\ZBCNFF.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEYLKFF.exe.bat" "110⤵PID:5956
-
C:\windows\system\MEYLKFF.exeC:\windows\system\MEYLKFF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WNAQ.exe.bat" "112⤵PID:5460
-
C:\windows\system\WNAQ.exeC:\windows\system\WNAQ.exe113⤵
- Executes dropped EXE
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LIJDZPI.exe.bat" "114⤵PID:4388
-
C:\windows\LIJDZPI.exeC:\windows\LIJDZPI.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WAM.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5324 -
C:\windows\SysWOW64\WAM.exeC:\windows\system32\WAM.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJOA.exe.bat" "118⤵PID:4608
-
C:\windows\SysWOW64\NJOA.exeC:\windows\system32\NJOA.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CGUYAL.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5184 -
C:\windows\CGUYAL.exeC:\windows\CGUYAL.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-