Analysis
- max time kernel
110s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe
- Size 208KB
- Sample261102-e2ascag16r
- SHA256 525ede2db3a534fab74c4f1e623aa35b628f9462e719abf9b0a5d438cbf142a0
- MD5 eb28e47c79fe088ff5e3e17a6f606a5d
- SHA1 1d111ab6038d7d8877d57db9cdf057665b846af6
- SHA512 bf925db873a659fd61a32d9e13a6a6205db05f936c40bf8974bc01b6d76a17b1299ea7a260bad53736c89030862f5065f7c27dfce124ab815e26a92129e386e8
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfu4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOmkEj1
- TLSH T142247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5212 PSC.exe 3292 ZXUQQV.exe 2544 RYWVUAK.exe 5988 LLBE.exe 1944 GYGOOA.exe 2172 ATL.exe 3472 SUNK.exe 1952 GZTZJH.exe 4444 MAA.exe 4768 MFSC.exe 4772 BAKOMBL.exe 2508 YGIDTL.exe 2872 YLIS.exe 2280 KBPAHQ.exe 5880 YHUPOA.exe 2088 VFS.exe 2652 MNUR.exe 3576 KNCFQB.exe 4244 NAH.exe 5432 YTKH.exe 5908 RWNKOG.exe 5856 CPQDOOH.exe 3280 TCBVE.exe 4860 IZZKL.exe 3256 TSCDTB.exe 960 PYH.exe 3284 RVBCHA.exe 3660 DOE.exe 4688 UBOFX.exe 5464 FURYFT.exe 5476 URPVMD.exe 2720 FKSOUKQ.exe 2076 NCB.exe 2528 WDDUMU.exe 704 HVYNU.exe 3368 NWFBDEX.exe 2060 YOIM.exe 568 GHRN.exe 3204 XSHL.exe 5408 DSPZIM.exe 1572 OLSRQTO.exe 2632 ULZFZ.exe 2012 WBT.exe 5708 DECMQX.exe 4324 PMJ.exe 4648 PRJAEC.exe 5336 THQA.exe 4832 EATTQ.exe 4988 BFYQ.exe 5444 MYTJGT.exe 2800 MJCCUX.exe 2452 IOIZBHA.exe 924 KMB.exe 1984 QMJ.exe 4072 SCKJ.exe 5956 YCRXFP.exe 248 AALZM.exe 4188 VOPJWEX.exe 4160 AOXW.exe 5796 PTDUMQ.exe 476 LZBRT.exe 880 LFB.exe 3900 TXK.exe 4040 ZXRMR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\YGIDTL.exe BAKOMBL.exe File created C:\windows\SysWOW64\RWK.exe ETOSRH.exe File created C:\windows\SysWOW64\YNCE.exe PMIRGZ.exe File created C:\windows\SysWOW64\HVFJVC.exe.bat YNCE.exe File created C:\windows\SysWOW64\CPQDOOH.exe RWNKOG.exe File created C:\windows\SysWOW64\KMLAIIK.exe ZTIHAS.exe File created C:\windows\SysWOW64\PMSD.exe.bat GMQ.exe File created C:\windows\SysWOW64\ZNCAI.exe.bat MLYCDP.exe File created C:\windows\SysWOW64\RWK.exe.bat ETOSRH.exe File created C:\windows\SysWOW64\XFAF.exe.bat PMSD.exe File created C:\windows\SysWOW64\WLIX.exe LSF.exe File created C:\windows\SysWOW64\NWFBDEX.exe.bat HVYNU.exe File opened for modification C:\windows\SysWOW64\PMJ.exe DECMQX.exe File opened for modification C:\windows\SysWOW64\PRJAEC.exe PMJ.exe File created C:\windows\SysWOW64\YEDRND.exe BZYBGT.exe File created C:\windows\SysWOW64\ZNCAI.exe MLYCDP.exe File created C:\windows\SysWOW64\NYTROZ.exe ZNPSB.exe File created C:\windows\SysWOW64\HVFJVC.exe YNCE.exe File opened for modification C:\windows\SysWOW64\EOXDV.exe ZOPQ.exe File created C:\windows\SysWOW64\KNCFQB.exe.bat MNUR.exe File created C:\windows\SysWOW64\RWNKOG.exe YTKH.exe File opened for modification C:\windows\SysWOW64\NCB.exe FKSOUKQ.exe File opened for modification C:\windows\SysWOW64\OBNW.exe CIK.exe File created C:\windows\SysWOW64\BLVDPD.exe.bat ZNCAI.exe File created C:\windows\SysWOW64\BPVF.exe.bat BEME.exe File created C:\windows\SysWOW64\FBAQJD.exe.bat CNDH.exe File created C:\windows\SysWOW64\EOXDV.exe ZOPQ.exe File created C:\windows\SysWOW64\PSC.exe 2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe File created C:\windows\SysWOW64\PSC.exe.bat 2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\XRBAW.exe BLVDPD.exe File created C:\windows\SysWOW64\MHYQV.exe.bat BPVF.exe File created C:\windows\SysWOW64\STQXFVZ.exe VOK.exe File created C:\windows\SysWOW64\ZXUQQV.exe PSC.exe File opened for modification C:\windows\SysWOW64\SUNK.exe ATL.exe File created C:\windows\SysWOW64\YGIDTL.exe BAKOMBL.exe File created C:\windows\SysWOW64\KHAJ.exe.bat NJUMOZF.exe File created C:\windows\SysWOW64\PWCKGFV.exe YJRSRI.exe File opened for modification C:\windows\SysWOW64\CPQDOOH.exe RWNKOG.exe File created C:\windows\SysWOW64\NCB.exe.bat FKSOUKQ.exe File created C:\windows\SysWOW64\ZKE.exe ORJC.exe File created C:\windows\SysWOW64\ZXUQQV.exe.bat PSC.exe File created C:\windows\SysWOW64\RWNKOG.exe.bat YTKH.exe File created C:\windows\SysWOW64\OBNW.exe.bat CIK.exe File created C:\windows\SysWOW64\HVEKYDM.exe.bat MIZBO.exe File created C:\windows\SysWOW64\BEME.exe.bat RWK.exe File created C:\windows\SysWOW64\KNCFQB.exe MNUR.exe File created C:\windows\SysWOW64\OBNW.exe CIK.exe File created C:\windows\SysWOW64\BLVDPD.exe ZNCAI.exe File created C:\windows\SysWOW64\UMI.exe XPC.exe File opened for modification C:\windows\SysWOW64\ZKE.exe ORJC.exe File created C:\windows\SysWOW64\DOE.exe.bat RVBCHA.exe File created C:\windows\SysWOW64\NWFBDEX.exe HVYNU.exe File created C:\windows\SysWOW64\MYTJGT.exe BFYQ.exe File created C:\windows\SysWOW64\FBAQJD.exe CNDH.exe File created C:\windows\SysWOW64\KIJ.exe.bat HVFJVC.exe File created C:\windows\SysWOW64\GZTZJH.exe SUNK.exe File opened for modification C:\windows\SysWOW64\GZTZJH.exe SUNK.exe File created C:\windows\SysWOW64\PRJAEC.exe.bat PMJ.exe File opened for modification C:\windows\SysWOW64\PMSD.exe GMQ.exe File created C:\windows\SysWOW64\ZNPSB.exe UMI.exe File opened for modification C:\windows\SysWOW64\ZNPSB.exe UMI.exe File created C:\windows\SysWOW64\NYTROZ.exe.bat ZNPSB.exe File opened for modification C:\windows\SysWOW64\PWCKGFV.exe YJRSRI.exe File created C:\windows\SysWOW64\PMSD.exe GMQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\XPC.exe GEM.exe File opened for modification C:\windows\system\OGVUAAV.exe MIUSULN.exe File opened for modification C:\windows\JZBC.exe KHAJ.exe File created C:\windows\XATJWX.exe.bat MHYQV.exe File created C:\windows\NAH.exe.bat KNCFQB.exe File created C:\windows\IZZKL.exe.bat TCBVE.exe File created C:\windows\CIK.exe.bat UQB.exe File created C:\windows\system\AGQWM.exe.bat DBK.exe File opened for modification C:\windows\GMQ.exe EOWEZHE.exe File created C:\windows\system\MIUSULN.exe.bat NYTROZ.exe File created C:\windows\XATJWX.exe MHYQV.exe File opened for modification C:\windows\system\QRFR.exe ZGG.exe File created C:\windows\system\AALZM.exe YCRXFP.exe File opened for modification C:\windows\system\AOXW.exe VOPJWEX.exe File created C:\windows\UKJOCNH.exe.bat YEDRND.exe File opened for modification C:\windows\EBNYQC.exe WREFCX.exe File created C:\windows\YJRSRI.exe.bat WLYYK.exe File created C:\windows\GEQXT.exe EOXDV.exe File created C:\windows\system\MAA.exe GZTZJH.exe File created C:\windows\ZJRXQKE.exe KMLAIIK.exe File opened for modification C:\windows\system\ZGG.exe UFZGDG.exe File created C:\windows\system\GXZZH.exe.bat GEQXT.exe File created C:\windows\system\GYGOOA.exe.bat LLBE.exe File created C:\windows\VFS.exe.bat YHUPOA.exe File opened for modification C:\windows\KVPPQEQ.exe KDHN.exe File created C:\windows\KMB.exe IOIZBHA.exe File created C:\windows\RYWVUAK.exe.bat ZXUQQV.exe File opened for modification C:\windows\RVBCHA.exe PYH.exe File created C:\windows\system\DECMQX.exe WBT.exe File created C:\windows\NBAE.exe CJX.exe File created C:\windows\WHLLC.exe KPIS.exe File created C:\windows\system\KFJIRCL.exe WHLLC.exe File created C:\windows\WLYYK.exe.bat YLR.exe File created C:\windows\system\MAA.exe.bat GZTZJH.exe File created C:\windows\YTKH.exe NAH.exe File created C:\windows\system\TXK.exe.bat LFB.exe File created C:\windows\DBK.exe.bat HVEKYDM.exe File created C:\windows\UFZGDG.exe XATJWX.exe File created C:\windows\system\VOK.exe KVPPQEQ.exe File created C:\windows\GEQXT.exe.bat EOXDV.exe File created C:\windows\WDDUMU.exe NCB.exe File opened for modification C:\windows\WDDUMU.exe NCB.exe File created C:\windows\system\AGQWM.exe DBK.exe File opened for modification C:\windows\system\KFJIRCL.exe WHLLC.exe File opened for modification C:\windows\system\DECMQX.exe WBT.exe File opened for modification C:\windows\YTKH.exe NAH.exe File opened for modification C:\windows\KMB.exe IOIZBHA.exe File created C:\windows\ZJRXQKE.exe.bat KMLAIIK.exe File created C:\windows\QCUDH.exe VPX.exe File created C:\windows\system\PYH.exe.bat TSCDTB.exe File opened for modification C:\windows\system\WXMTRR.exe KFJIRCL.exe File opened for modification C:\windows\QCUDH.exe VPX.exe File created C:\windows\UDMWXG.exe.bat LXCEH.exe File opened for modification C:\windows\system\OLSRQTO.exe DSPZIM.exe File created C:\windows\KMB.exe.bat IOIZBHA.exe File created C:\windows\QMJ.exe.bat KMB.exe File created C:\windows\SCKJ.exe.bat QMJ.exe File opened for modification C:\windows\system\AALZM.exe YCRXFP.exe File opened for modification C:\windows\XATJWX.exe MHYQV.exe File created C:\windows\YCRXFP.exe SCKJ.exe File opened for modification C:\windows\system\PTDUMQ.exe AOXW.exe File created C:\windows\system\LFB.exe.bat LZBRT.exe File created C:\windows\ZXRMR.exe.bat TXK.exe File created C:\windows\system\ZGG.exe UFZGDG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1132 cmd.exe 2196 cmd.exe 2572 cmd.exe 2688 cmd.exe 4852 cmd.exe 1688 cmd.exe 2376 cmd.exe 3404 cmd.exe 4780 cmd.exe 1116 cmd.exe 3456 cmd.exe 2596 cmd.exe 4908 cmd.exe 1816 cmd.exe 2812 cmd.exe 5148 cmd.exe 5608 cmd.exe 4956 cmd.exe 2080 cmd.exe 4344 cmd.exe 2788 cmd.exe 2732 cmd.exe 2996 cmd.exe 4064 cmd.exe 4392 cmd.exe 5872 cmd.exe 2104 cmd.exe 2608 cmd.exe 5652 cmd.exe 4120 cmd.exe 4548 cmd.exe 1488 cmd.exe 1732 cmd.exe 4896 cmd.exe 5960 cmd.exe 4268 cmd.exe 5984 cmd.exe 2560 cmd.exe 2736 cmd.exe 5924 cmd.exe 2940 cmd.exe 5628 cmd.exe 3384 cmd.exe 4868 cmd.exe 2296 cmd.exe 1208 cmd.exe 5664 cmd.exe 1332 cmd.exe 3252 cmd.exe 2664 cmd.exe 5376 cmd.exe 1412 cmd.exe 996 cmd.exe 1060 cmd.exe 5928 cmd.exe 2116 cmd.exe 408 cmd.exe 5700 cmd.exe 3180 cmd.exe 900 cmd.exe 2992 cmd.exe 3720 cmd.exe 1924 cmd.exe 1092 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2312 3176 WerFault.exe 88 1476 5212 WerFault.exe 93 3256 3292 WerFault.exe 99 1264 2544 WerFault.exe 104 4188 5988 WerFault.exe 109 3016 1944 WerFault.exe 114 4128 2172 WerFault.exe 119 4464 3472 WerFault.exe 124 2012 1952 WerFault.exe 129 4936 4444 WerFault.exe 134 4932 4768 WerFault.exe 139 6040 4772 WerFault.exe 144 1116 2508 WerFault.exe 149 4648 2872 WerFault.exe 154 960 2280 WerFault.exe 159 4480 5880 WerFault.exe 164 3464 2088 WerFault.exe 169 5960 2652 WerFault.exe 174 3028 3576 WerFault.exe 179 3776 4244 WerFault.exe 184 4544 5432 WerFault.exe 189 4676 5908 WerFault.exe 194 1476 5856 WerFault.exe 199 4928 3280 WerFault.exe 204 620 4860 WerFault.exe 209 2060 3256 WerFault.exe 214 4440 960 WerFault.exe 219 1244 3284 WerFault.exe 224 5408 3660 WerFault.exe 229 3024 4688 WerFault.exe 234 5868 5464 WerFault.exe 239 1072 5476 WerFault.exe 244 5140 2720 WerFault.exe 249 5800 2076 WerFault.exe 254 4228 2528 WerFault.exe 259 5756 704 WerFault.exe 264 3128 3368 WerFault.exe 269 1596 2060 WerFault.exe 274 3464 568 WerFault.exe 279 760 3204 WerFault.exe 284 5960 5408 WerFault.exe 289 2820 1572 WerFault.exe 295 4052 2632 WerFault.exe 300 4676 2012 WerFault.exe 305 4072 5708 WerFault.exe 310 6024 4324 WerFault.exe 315 3920 4648 WerFault.exe 320 4592 5336 WerFault.exe 325 3016 4832 WerFault.exe 330 5980 4988 WerFault.exe 335 3932 5444 WerFault.exe 340 5332 2800 WerFault.exe 345 2084 2452 WerFault.exe 350 4040 924 WerFault.exe 355 3084 1984 WerFault.exe 360 6024 4072 WerFault.exe 365 1896 5956 WerFault.exe 370 1356 248 WerFault.exe 375 2868 4188 WerFault.exe 380 3872 4160 WerFault.exe 385 3932 5796 WerFault.exe 390 5076 476 WerFault.exe 395 2836 880 WerFault.exe 400 1732 3900 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVYNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOIM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBNYQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPQDOOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLSRQTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJUMOZF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZBC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJRSRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMIRGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAKOMBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWNKOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZBRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNCFQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZXUQQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MAA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOWEZHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVBCHA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDMWXG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVT.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3176 2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe 3176 2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe 5212 PSC.exe 5212 PSC.exe 3292 ZXUQQV.exe 3292 ZXUQQV.exe 2544 RYWVUAK.exe 2544 RYWVUAK.exe 5988 LLBE.exe 5988 LLBE.exe 1944 GYGOOA.exe 1944 GYGOOA.exe 2172 ATL.exe 2172 ATL.exe 3472 SUNK.exe 3472 SUNK.exe 1952 GZTZJH.exe 1952 GZTZJH.exe 4444 MAA.exe 4444 MAA.exe 4768 MFSC.exe 4768 MFSC.exe 4772 BAKOMBL.exe 4772 BAKOMBL.exe 2508 YGIDTL.exe 2508 YGIDTL.exe 2872 YLIS.exe 2872 YLIS.exe 2280 KBPAHQ.exe 2280 KBPAHQ.exe 5880 YHUPOA.exe 5880 YHUPOA.exe 2088 VFS.exe 2088 VFS.exe 2652 MNUR.exe 2652 MNUR.exe 3576 KNCFQB.exe 3576 KNCFQB.exe 4244 NAH.exe 4244 NAH.exe 5432 YTKH.exe 5432 YTKH.exe 5908 RWNKOG.exe 5908 RWNKOG.exe 5856 CPQDOOH.exe 5856 CPQDOOH.exe 3280 TCBVE.exe 3280 TCBVE.exe 4860 IZZKL.exe 4860 IZZKL.exe 3256 TSCDTB.exe 3256 TSCDTB.exe 960 PYH.exe 960 PYH.exe 3284 RVBCHA.exe 3284 RVBCHA.exe 3660 DOE.exe 3660 DOE.exe 4688 UBOFX.exe 4688 UBOFX.exe 5464 FURYFT.exe 5464 FURYFT.exe 5476 URPVMD.exe 5476 URPVMD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3176 2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe 3176 2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe 5212 PSC.exe 5212 PSC.exe 3292 ZXUQQV.exe 3292 ZXUQQV.exe 2544 RYWVUAK.exe 2544 RYWVUAK.exe 5988 LLBE.exe 5988 LLBE.exe 1944 GYGOOA.exe 1944 GYGOOA.exe 2172 ATL.exe 2172 ATL.exe 3472 SUNK.exe 3472 SUNK.exe 1952 GZTZJH.exe 1952 GZTZJH.exe 4444 MAA.exe 4444 MAA.exe 4768 MFSC.exe 4768 MFSC.exe 4772 BAKOMBL.exe 4772 BAKOMBL.exe 2508 YGIDTL.exe 2508 YGIDTL.exe 2872 YLIS.exe 2872 YLIS.exe 2280 KBPAHQ.exe 2280 KBPAHQ.exe 5880 YHUPOA.exe 5880 YHUPOA.exe 2088 VFS.exe 2088 VFS.exe 2652 MNUR.exe 2652 MNUR.exe 3576 KNCFQB.exe 3576 KNCFQB.exe 4244 NAH.exe 4244 NAH.exe 5432 YTKH.exe 5432 YTKH.exe 5908 RWNKOG.exe 5908 RWNKOG.exe 5856 CPQDOOH.exe 5856 CPQDOOH.exe 3280 TCBVE.exe 3280 TCBVE.exe 4860 IZZKL.exe 4860 IZZKL.exe 3256 TSCDTB.exe 3256 TSCDTB.exe 960 PYH.exe 960 PYH.exe 3284 RVBCHA.exe 3284 RVBCHA.exe 3660 DOE.exe 3660 DOE.exe 4688 UBOFX.exe 4688 UBOFX.exe 5464 FURYFT.exe 5464 FURYFT.exe 5476 URPVMD.exe 5476 URPVMD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3176 wrote to memory of 3372 3176 2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe 89 PID 3372 wrote to memory of 5212 3372 cmd.exe 93 PID 5212 wrote to memory of 2952 5212 PSC.exe 95 PID 2952 wrote to memory of 3292 2952 cmd.exe 99 PID 3292 wrote to memory of 2044 3292 ZXUQQV.exe 100 PID 2044 wrote to memory of 2544 2044 cmd.exe 104 PID 2544 wrote to memory of 2608 2544 RYWVUAK.exe 105 PID 2608 wrote to memory of 5988 2608 cmd.exe 109 PID 5988 wrote to memory of 2736 5988 LLBE.exe 110 PID 2736 wrote to memory of 1944 2736 cmd.exe 114 PID 1944 wrote to memory of 4656 1944 GYGOOA.exe 115 PID 4656 wrote to memory of 2172 4656 cmd.exe 119 PID 2172 wrote to memory of 4388 2172 ATL.exe 120 PID 4388 wrote to memory of 3472 4388 cmd.exe 124 PID 3472 wrote to memory of 2540 3472 SUNK.exe 125 PID 2540 wrote to memory of 1952 2540 cmd.exe 129 PID 1952 wrote to memory of 4124 1952 GZTZJH.exe 130 PID 4124 wrote to memory of 4444 4124 cmd.exe 134 PID 4444 wrote to memory of 5652 4444 MAA.exe 135 PID 5652 wrote to memory of 4768 5652 cmd.exe 139 PID 4768 wrote to memory of 5812 4768 MFSC.exe 140 PID 5812 wrote to memory of 4772 5812 cmd.exe 144 PID 4772 wrote to memory of 2032 4772 BAKOMBL.exe 145 PID 2032 wrote to memory of 2508 2032 cmd.exe 149 PID 2508 wrote to memory of 1368 2508 YGIDTL.exe 150 PID 1368 wrote to memory of 2872 1368 cmd.exe 154 PID 2872 wrote to memory of 2668 2872 YLIS.exe 155 PID 2668 wrote to memory of 2280 2668 cmd.exe 159 PID 2280 wrote to memory of 2052 2280 KBPAHQ.exe 160 PID 2052 wrote to memory of 5880 2052 cmd.exe 164 PID 5880 wrote to memory of 5904 5880 YHUPOA.exe 165 PID 5904 wrote to memory of 2088 5904 cmd.exe 169 PID 2088 wrote to memory of 4520 2088 VFS.exe 170 PID 4520 wrote to memory of 2652 4520 cmd.exe 174 PID 2652 wrote to memory of 5064 2652 MNUR.exe 175 PID 5064 wrote to memory of 3576 5064 cmd.exe 179 PID 3576 wrote to memory of 3340 3576 KNCFQB.exe 180 PID 3340 wrote to memory of 4244 3340 cmd.exe 184 PID 4244 wrote to memory of 2200 4244 NAH.exe 185 PID 2200 wrote to memory of 5432 2200 cmd.exe 189 PID 5432 wrote to memory of 1980 5432 YTKH.exe 190 PID 1980 wrote to memory of 5908 1980 cmd.exe 194 PID 5908 wrote to memory of 3456 5908 RWNKOG.exe 195 PID 3456 wrote to memory of 5856 3456 cmd.exe 199 PID 5856 wrote to memory of 4140 5856 CPQDOOH.exe 200 PID 4140 wrote to memory of 3280 4140 cmd.exe 204 PID 3280 wrote to memory of 4532 3280 TCBVE.exe 205 PID 4532 wrote to memory of 4860 4532 cmd.exe 209 PID 4860 wrote to memory of 2168 4860 IZZKL.exe 210 PID 2168 wrote to memory of 3256 2168 cmd.exe 214 PID 3256 wrote to memory of 4120 3256 TSCDTB.exe 215 PID 4120 wrote to memory of 960 4120 cmd.exe 219 PID 960 wrote to memory of 5888 960 PYH.exe 220 PID 5888 wrote to memory of 3284 5888 cmd.exe 224 PID 3284 wrote to memory of 2140 3284 RVBCHA.exe 225 PID 2140 wrote to memory of 3660 2140 cmd.exe 229 PID 3660 wrote to memory of 2712 3660 DOE.exe 230 PID 2712 wrote to memory of 4688 2712 cmd.exe 234 PID 4688 wrote to memory of 4632 4688 UBOFX.exe 235 PID 4632 wrote to memory of 5464 4632 cmd.exe 239 PID 5464 wrote to memory of 4184 5464 FURYFT.exe 240 PID 4184 wrote to memory of 5476 4184 cmd.exe 244 PID 5476 wrote to memory of 5492 5476 URPVMD.exe 245 PID 5492 wrote to memory of 2720 5492 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_eb28e47c79fe088ff5e3e17a6f606a5d_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSC.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\windows\SysWOW64\PSC.exeC:\windows\system32\PSC.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXUQQV.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\SysWOW64\ZXUQQV.exeC:\windows\system32\ZXUQQV.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RYWVUAK.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\windows\RYWVUAK.exeC:\windows\RYWVUAK.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLBE.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\windows\system\LLBE.exeC:\windows\system\LLBE.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYGOOA.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\windows\system\GYGOOA.exeC:\windows\system\GYGOOA.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATL.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\windows\ATL.exeC:\windows\ATL.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUNK.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\windows\SysWOW64\SUNK.exeC:\windows\system32\SUNK.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GZTZJH.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\SysWOW64\GZTZJH.exeC:\windows\system32\GZTZJH.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MAA.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\windows\system\MAA.exeC:\windows\system\MAA.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFSC.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\system\MFSC.exeC:\windows\system\MFSC.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BAKOMBL.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\windows\BAKOMBL.exeC:\windows\BAKOMBL.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGIDTL.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\SysWOW64\YGIDTL.exeC:\windows\system32\YGIDTL.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLIS.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\windows\YLIS.exeC:\windows\YLIS.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KBPAHQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\windows\KBPAHQ.exeC:\windows\KBPAHQ.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHUPOA.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\windows\YHUPOA.exeC:\windows\YHUPOA.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VFS.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\windows\VFS.exeC:\windows\VFS.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MNUR.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\system\MNUR.exeC:\windows\system\MNUR.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KNCFQB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\windows\SysWOW64\KNCFQB.exeC:\windows\system32\KNCFQB.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAH.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\windows\NAH.exeC:\windows\NAH.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTKH.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\windows\YTKH.exeC:\windows\YTKH.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWNKOG.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\windows\SysWOW64\RWNKOG.exeC:\windows\system32\RWNKOG.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CPQDOOH.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\windows\SysWOW64\CPQDOOH.exeC:\windows\system32\CPQDOOH.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TCBVE.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\windows\TCBVE.exeC:\windows\TCBVE.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZZKL.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\IZZKL.exeC:\windows\IZZKL.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TSCDTB.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\windows\SysWOW64\TSCDTB.exeC:\windows\system32\TSCDTB.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PYH.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\system\PYH.exeC:\windows\system\PYH.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVBCHA.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\windows\RVBCHA.exeC:\windows\RVBCHA.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DOE.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\windows\SysWOW64\DOE.exeC:\windows\system32\DOE.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UBOFX.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\windows\system\UBOFX.exeC:\windows\system\UBOFX.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FURYFT.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\windows\system\FURYFT.exeC:\windows\system\FURYFT.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URPVMD.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\windows\system\URPVMD.exeC:\windows\system\URPVMD.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKSOUKQ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\system\FKSOUKQ.exeC:\windows\system\FKSOUKQ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NCB.exe.bat" "66⤵PID:1516
-
C:\windows\SysWOW64\NCB.exeC:\windows\system32\NCB.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDDUMU.exe.bat" "68⤵PID:1184
-
C:\windows\WDDUMU.exeC:\windows\WDDUMU.exe69⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HVYNU.exe.bat" "70⤵PID:6004
-
C:\windows\system\HVYNU.exeC:\windows\system\HVYNU.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NWFBDEX.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:368 -
C:\windows\SysWOW64\NWFBDEX.exeC:\windows\system32\NWFBDEX.exe73⤵
- Executes dropped EXE
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOIM.exe.bat" "74⤵PID:4920
-
C:\windows\system\YOIM.exeC:\windows\system\YOIM.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHRN.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2116 -
C:\windows\GHRN.exeC:\windows\GHRN.exe77⤵
- Executes dropped EXE
PID:568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSHL.exe.bat" "78⤵PID:4756
-
C:\windows\system\XSHL.exeC:\windows\system\XSHL.exe79⤵
- Executes dropped EXE
PID:3204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DSPZIM.exe.bat" "80⤵PID:6112
-
C:\windows\system\DSPZIM.exeC:\windows\system\DSPZIM.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OLSRQTO.exe.bat" "82⤵PID:1880
-
C:\windows\system\OLSRQTO.exeC:\windows\system\OLSRQTO.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ULZFZ.exe.bat" "84⤵
- Executes a command shell one-liner
PID:2596 -
C:\windows\system\ULZFZ.exeC:\windows\system\ULZFZ.exe85⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WBT.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5728 -
C:\windows\system\WBT.exeC:\windows\system\WBT.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DECMQX.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5924 -
C:\windows\system\DECMQX.exeC:\windows\system\DECMQX.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMJ.exe.bat" "90⤵PID:1640
-
C:\windows\SysWOW64\PMJ.exeC:\windows\system32\PMJ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJAEC.exe.bat" "92⤵PID:5896
-
C:\windows\SysWOW64\PRJAEC.exeC:\windows\system32\PRJAEC.exe93⤵
- Executes dropped EXE
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THQA.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:5756 -
C:\windows\THQA.exeC:\windows\THQA.exe95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EATTQ.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4908 -
C:\windows\EATTQ.exeC:\windows\EATTQ.exe97⤵
- Executes dropped EXE
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFYQ.exe.bat" "98⤵PID:832
-
C:\windows\system\BFYQ.exeC:\windows\system\BFYQ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYTJGT.exe.bat" "100⤵PID:1872
-
C:\windows\SysWOW64\MYTJGT.exeC:\windows\system32\MYTJGT.exe101⤵
- Executes dropped EXE
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJCCUX.exe.bat" "102⤵
- Executes a command shell one-liner
PID:408 -
C:\windows\MJCCUX.exeC:\windows\MJCCUX.exe103⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOIZBHA.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5960 -
C:\windows\system\IOIZBHA.exeC:\windows\system\IOIZBHA.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMB.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2940 -
C:\windows\KMB.exeC:\windows\KMB.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMJ.exe.bat" "108⤵PID:5236
-
C:\windows\QMJ.exeC:\windows\QMJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCKJ.exe.bat" "110⤵PID:2612
-
C:\windows\SCKJ.exeC:\windows\SCKJ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCRXFP.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2104 -
C:\windows\YCRXFP.exeC:\windows\YCRXFP.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AALZM.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:2476 -
C:\windows\system\AALZM.exeC:\windows\system\AALZM.exe115⤵
- Executes dropped EXE
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VOPJWEX.exe.bat" "116⤵PID:2972
-
C:\windows\VOPJWEX.exeC:\windows\VOPJWEX.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOXW.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4848 -
C:\windows\system\AOXW.exeC:\windows\system\AOXW.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTDUMQ.exe.bat" "120⤵PID:2472
-
C:\windows\system\PTDUMQ.exeC:\windows\system\PTDUMQ.exe121⤵
- Executes dropped EXE
PID:5796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-