Analysis
- max time kernel
75s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 12:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_a8a6a9369e7b43f700391df97ecce788_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-01_a8a6a9369e7b43f700391df97ecce788_elex_emotet_stop.exe
- Size 208KB
- Sample261102-pkgjnsb12l
- SHA256 e473f268b88bfb0f8211dcac55dc3d5ab333b76f0029e514911e6c24cd822423
- MD5 a8a6a9369e7b43f700391df97ecce788
- SHA1 a4e94e58aa587a73f5887feb17a1000142e45af3
- SHA512 86dd44053b550d9e05dba363ea939cc6ed850e95999ff6c5e0375fa6dba8b388675e2ecfeeb21727d163523659f53fae584eca5f10202dc006dc9ee53e908485
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOfS4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LO6kEj1
- TLSH T1FE247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2372 YYWCZ.exe 3004 KWZCI.exe 4768 IMKFVR.exe 4920 LUTBC.exe 1724 IVVDOH.exe 5592 EANTE.exe 1840 SVZM.exe 4568 GTZXM.exe 3456 OHLE.exe 2780 WMQL.exe 4776 EADZ.exe 1696 BFNPIBP.exe 2452 JLZVTAS.exe 3732 HWCLBO.exe 6040 LMR.exe 5820 ZHVMU.exe 4608 YSFUCAH.exe 1936 YXKJNH.exe 2532 GLXPXF.exe 3044 FTL.exe 5456 NYQ.exe 1820 BWQFXG.exe 5492 MXFQGZ.exe 4004 LII.exe 2832 GSY.exe 4268 MGK.exe 5660 JGMIUJP.exe 4624 KJPEAZ.exe 4736 MHD.exe 4256 DUOQXM.exe 1768 HXMD.exe 4512 WSVPQSG.exe 5352 PVZL.exe 3972 VGOTFHW.exe 2324 QTTD.exe 1512 DZTOZSU.exe 1148 NXHJHBD.exe 2596 ZQC.exe 1360 DYQCT.exe 5400 MGSPFY.exe 3172 YOZP.exe 4720 RRD.exe 1056 GMMXIB.exe 2692 EXP.exe 3332 OFRSUE.exe 1736 JQHR.exe 5552 CLLMNF.exe 4780 TTNR.exe 4584 AOXEKXN.exe 4708 KMCQ.exe 4320 OPALZZY.exe 3652 TVT.exe 1856 LYWEV.exe 5396 VYYJYP.exe 3388 BYG.exe 3428 VMLGS.exe 4376 HEGZAZ.exe 5652 JZL.exe 3472 HASWT.exe 4764 IVWSZJB.exe 4232 RDYF.exe 2300 ZJL.exe 4112 UTT.exe 5924 PHYUL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\HWCLBO.exe JLZVTAS.exe File created C:\windows\SysWOW64\FTL.exe.bat GLXPXF.exe File created C:\windows\SysWOW64\PVZL.exe.bat WSVPQSG.exe File created C:\windows\SysWOW64\HASWT.exe JZL.exe File opened for modification C:\windows\SysWOW64\HASWT.exe JZL.exe File created C:\windows\SysWOW64\HWCLBO.exe JLZVTAS.exe File created C:\windows\SysWOW64\TTNR.exe.bat CLLMNF.exe File opened for modification C:\windows\SysWOW64\VMLGS.exe BYG.exe File created C:\windows\SysWOW64\MGK.exe.bat GSY.exe File created C:\windows\SysWOW64\DUOQXM.exe MHD.exe File created C:\windows\SysWOW64\AOXEKXN.exe.bat TTNR.exe File created C:\windows\SysWOW64\VYYJYP.exe LYWEV.exe File created C:\windows\SysWOW64\VYYJYP.exe.bat LYWEV.exe File created C:\windows\SysWOW64\HEGZAZ.exe VMLGS.exe File created C:\windows\SysWOW64\YXKJNH.exe.bat YSFUCAH.exe File opened for modification C:\windows\SysWOW64\AOXEKXN.exe TTNR.exe File created C:\windows\SysWOW64\TMQATEX.exe.bat UBF.exe File created C:\windows\SysWOW64\SWRZ.exe.bat YBMHLJP.exe File opened for modification C:\windows\SysWOW64\KMCQ.exe AOXEKXN.exe File created C:\windows\SysWOW64\KMCQ.exe.bat AOXEKXN.exe File opened for modification C:\windows\SysWOW64\DCEWOQM.exe OZVK.exe File opened for modification C:\windows\SysWOW64\GSY.exe LII.exe File opened for modification C:\windows\SysWOW64\JGMIUJP.exe MGK.exe File created C:\windows\SysWOW64\HXMD.exe.bat DUOQXM.exe File created C:\windows\SysWOW64\AOXEKXN.exe TTNR.exe File opened for modification C:\windows\SysWOW64\HEGZAZ.exe VMLGS.exe File created C:\windows\SysWOW64\HASWT.exe.bat JZL.exe File created C:\windows\SysWOW64\PTB.exe.bat TNJRICL.exe File opened for modification C:\windows\SysWOW64\EANTE.exe IVVDOH.exe File created C:\windows\SysWOW64\BFNPIBP.exe.bat EADZ.exe File created C:\windows\SysWOW64\NYQ.exe.bat FTL.exe File created C:\windows\SysWOW64\GSY.exe.bat LII.exe File opened for modification C:\windows\SysWOW64\HXMD.exe DUOQXM.exe File created C:\windows\SysWOW64\WSVPQSG.exe HXMD.exe File opened for modification C:\windows\SysWOW64\WSVPQSG.exe HXMD.exe File opened for modification C:\windows\SysWOW64\VYYJYP.exe LYWEV.exe File opened for modification C:\windows\SysWOW64\FTL.exe GLXPXF.exe File created C:\windows\SysWOW64\MGK.exe GSY.exe File created C:\windows\SysWOW64\JGMIUJP.exe MGK.exe File opened for modification C:\windows\SysWOW64\TTNR.exe CLLMNF.exe File created C:\windows\SysWOW64\HEGZAZ.exe.bat VMLGS.exe File created C:\windows\SysWOW64\PTB.exe TNJRICL.exe File created C:\windows\SysWOW64\FTL.exe GLXPXF.exe File created C:\windows\SysWOW64\JGMIUJP.exe.bat MGK.exe File created C:\windows\SysWOW64\PVZL.exe WSVPQSG.exe File created C:\windows\SysWOW64\EANTE.exe IVVDOH.exe File created C:\windows\SysWOW64\EANTE.exe.bat IVVDOH.exe File created C:\windows\SysWOW64\YXKJNH.exe YSFUCAH.exe File opened for modification C:\windows\SysWOW64\YXKJNH.exe YSFUCAH.exe File created C:\windows\SysWOW64\NYQ.exe FTL.exe File created C:\windows\SysWOW64\SWRZ.exe YBMHLJP.exe File opened for modification C:\windows\SysWOW64\BFNPIBP.exe EADZ.exe File opened for modification C:\windows\SysWOW64\MGK.exe GSY.exe File created C:\windows\SysWOW64\TTNR.exe CLLMNF.exe File created C:\windows\SysWOW64\VMLGS.exe BYG.exe File created C:\windows\SysWOW64\VMLGS.exe.bat BYG.exe File created C:\windows\SysWOW64\TRKWZUL.exe.bat YPCY.exe File created C:\windows\SysWOW64\DCEWOQM.exe.bat OZVK.exe File opened for modification C:\windows\SysWOW64\SWRZ.exe YBMHLJP.exe File created C:\windows\SysWOW64\HWCLBO.exe.bat JLZVTAS.exe File created C:\windows\SysWOW64\WSVPQSG.exe.bat HXMD.exe File created C:\windows\SysWOW64\BFNPIBP.exe EADZ.exe File created C:\windows\SysWOW64\GSY.exe LII.exe File opened for modification C:\windows\SysWOW64\DUOQXM.exe MHD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\JLZVTAS.exe BFNPIBP.exe File created C:\windows\system\NXHJHBD.exe DZTOZSU.exe File created C:\windows\MGSPFY.exe.bat DYQCT.exe File created C:\windows\YOZP.exe MGSPFY.exe File opened for modification C:\windows\OFRSUE.exe EXP.exe File created C:\windows\OPALZZY.exe.bat KMCQ.exe File created C:\windows\RDYF.exe.bat IVWSZJB.exe File created C:\windows\JGSFZK.exe ZGQSNNK.exe File created C:\windows\system\LMR.exe.bat HWCLBO.exe File created C:\windows\system\GMMXIB.exe.bat RRD.exe File opened for modification C:\windows\DTXOBKB.exe JGSFZK.exe File created C:\windows\WSC.exe CAM.exe File created C:\windows\system\UBF.exe.bat OBYWBW.exe File created C:\windows\system\TNJRICL.exe.bat LIJDZPI.exe File opened for modification C:\windows\DMO.exe ZWHHIS.exe File created C:\windows\YZTZE.exe.bat DMO.exe File created C:\windows\LII.exe.bat MXFQGZ.exe File created C:\windows\RDYF.exe IVWSZJB.exe File created C:\windows\EDEISV.exe CPZZI.exe File created C:\windows\system\EADZ.exe WMQL.exe File created C:\windows\OFRSUE.exe EXP.exe File created C:\windows\system\CLLMNF.exe.bat JQHR.exe File created C:\windows\system\ZGQSNNK.exe KDHN.exe File created C:\windows\system\FAERY.exe.bat WSC.exe File created C:\windows\system\OBYWBW.exe.bat FAERY.exe File created C:\windows\system\UBF.exe OBYWBW.exe File created C:\windows\system\OZVK.exe.bat TMQATEX.exe File created C:\windows\MXFQGZ.exe.bat BWQFXG.exe File created C:\windows\QTTD.exe VGOTFHW.exe File created C:\windows\QTTD.exe.bat VGOTFHW.exe File created C:\windows\DTXOBKB.exe.bat JGSFZK.exe File created C:\windows\system\FAERY.exe WSC.exe File opened for modification C:\windows\system\FAERY.exe WSC.exe File opened for modification C:\windows\system\UBF.exe OBYWBW.exe File opened for modification C:\windows\system\LMR.exe HWCLBO.exe File created C:\windows\ZQJ.exe.bat EDEISV.exe File opened for modification C:\windows\system\WMQL.exe OHLE.exe File opened for modification C:\windows\YSFUCAH.exe ZHVMU.exe File created C:\windows\YSFUCAH.exe.bat ZHVMU.exe File created C:\windows\system\VGOTFHW.exe PVZL.exe File opened for modification C:\windows\YOZP.exe MGSPFY.exe File created C:\windows\system\ZGQSNNK.exe.bat KDHN.exe File created C:\windows\system\YPCY.exe.bat DTXOBKB.exe File opened for modification C:\windows\EDEISV.exe CPZZI.exe File created C:\windows\OPALZZY.exe KMCQ.exe File created C:\windows\UTT.exe.bat ZJL.exe File opened for modification C:\windows\system\KDHN.exe EPIN.exe File created C:\windows\system\OBYWBW.exe FAERY.exe File opened for modification C:\windows\BWQFXG.exe NYQ.exe File opened for modification C:\windows\system\IVWSZJB.exe HASWT.exe File created C:\windows\DTXOBKB.exe JGSFZK.exe File opened for modification C:\windows\system\OZVK.exe TMQATEX.exe File created C:\windows\system\CPZZI.exe YZTZE.exe File created C:\windows\system\IVVDOH.exe LUTBC.exe File opened for modification C:\windows\system\SVZM.exe EANTE.exe File created C:\windows\ZHVMU.exe.bat LMR.exe File opened for modification C:\windows\system\LYWEV.exe TVT.exe File created C:\windows\system\IVWSZJB.exe HASWT.exe File created C:\windows\DMO.exe ZWHHIS.exe File opened for modification C:\windows\ZQC.exe NXHJHBD.exe File created C:\windows\MGSPFY.exe DYQCT.exe File created C:\windows\UTT.exe ZJL.exe File opened for modification C:\windows\system\PHYUL.exe UTT.exe File opened for modification C:\windows\AZBFTF.exe PHYUL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4888 cmd.exe 1288 cmd.exe 3664 cmd.exe 1800 cmd.exe 1676 cmd.exe 3336 cmd.exe 1620 cmd.exe 2736 cmd.exe 4924 cmd.exe 3132 cmd.exe 5964 cmd.exe 1648 cmd.exe 3452 cmd.exe 1264 cmd.exe 4176 cmd.exe 5300 cmd.exe 6052 cmd.exe 1400 cmd.exe 4724 cmd.exe 1976 cmd.exe 5348 cmd.exe 5336 cmd.exe 2404 cmd.exe 2116 cmd.exe 5044 cmd.exe 2320 cmd.exe 5976 cmd.exe 4836 cmd.exe 4676 cmd.exe 4636 cmd.exe 2764 cmd.exe 2012 cmd.exe 4324 cmd.exe 5864 cmd.exe 2448 cmd.exe 5532 cmd.exe 876 cmd.exe 3484 cmd.exe 3512 cmd.exe 5792 cmd.exe 4212 cmd.exe 4488 cmd.exe 3096 cmd.exe 3920 cmd.exe 4184 cmd.exe 3912 cmd.exe 4220 cmd.exe 4896 cmd.exe 5488 cmd.exe 5816 cmd.exe 3128 cmd.exe 1732 cmd.exe 5284 cmd.exe 4912 cmd.exe 2492 cmd.exe 6096 cmd.exe 3500 cmd.exe 964 cmd.exe 5700 cmd.exe 8 cmd.exe 1224 cmd.exe 5736 cmd.exe 1848 cmd.exe 2044 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4416 4704 WerFault.exe 87 4680 2372 WerFault.exe 93 248 3004 WerFault.exe 99 5596 4768 WerFault.exe 104 4532 4920 WerFault.exe 109 1120 1724 WerFault.exe 114 1076 5592 WerFault.exe 119 1788 1840 WerFault.exe 124 2320 4568 WerFault.exe 129 5936 3456 WerFault.exe 134 5724 2780 WerFault.exe 139 3448 4776 WerFault.exe 144 4528 1696 WerFault.exe 149 5976 2452 WerFault.exe 154 1532 3732 WerFault.exe 159 1356 6040 WerFault.exe 164 8 5820 WerFault.exe 169 4248 4608 WerFault.exe 174 3432 1936 WerFault.exe 179 5996 2532 WerFault.exe 184 3948 3044 WerFault.exe 189 1680 5456 WerFault.exe 194 4836 1820 WerFault.exe 199 4896 5492 WerFault.exe 204 5072 4004 WerFault.exe 209 3256 2832 WerFault.exe 214 4912 4268 WerFault.exe 219 5512 5660 WerFault.exe 224 4552 4624 WerFault.exe 229 4216 4736 WerFault.exe 234 4872 4256 WerFault.exe 239 1108 1768 WerFault.exe 244 936 4512 WerFault.exe 249 4196 5352 WerFault.exe 254 3332 3972 WerFault.exe 259 5896 2324 WerFault.exe 265 3436 1512 WerFault.exe 270 5004 1148 WerFault.exe 275 1204 2596 WerFault.exe 280 1028 1360 WerFault.exe 285 4572 5400 WerFault.exe 290 3620 3172 WerFault.exe 295 4576 4720 WerFault.exe 300 3680 1056 WerFault.exe 305 2872 2692 WerFault.exe 310 4212 3332 WerFault.exe 315 4292 1736 WerFault.exe 320 5004 5552 WerFault.exe 325 1100 4780 WerFault.exe 330 1520 4584 WerFault.exe 335 4572 4708 WerFault.exe 340 2432 4320 WerFault.exe 345 1276 3652 WerFault.exe 350 1876 1856 WerFault.exe 355 2492 5396 WerFault.exe 360 3536 3388 WerFault.exe 365 2172 3428 WerFault.exe 370 3692 4376 WerFault.exe 375 1976 5652 WerFault.exe 379 1568 3472 WerFault.exe 385 5860 4764 WerFault.exe 390 2612 4232 WerFault.exe 395 472 2300 WerFault.exe 400 4912 4112 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HASWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDYF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OBYWBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWHHIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YSFUCAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OPALZZY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-01_a8a6a9369e7b43f700391df97ecce788_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAERY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTZXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MHD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YYWCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGMIUJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCEWOQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIJDZPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EANTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KDHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXFQGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWZCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLZVTAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWCLBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VYYJYP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMKFVR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFNPIBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TVT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4704 2026-11-01_a8a6a9369e7b43f700391df97ecce788_elex_emotet_stop.exe 4704 2026-11-01_a8a6a9369e7b43f700391df97ecce788_elex_emotet_stop.exe 2372 YYWCZ.exe 2372 YYWCZ.exe 3004 KWZCI.exe 3004 KWZCI.exe 4768 IMKFVR.exe 4768 IMKFVR.exe 4920 LUTBC.exe 4920 LUTBC.exe 1724 IVVDOH.exe 1724 IVVDOH.exe 5592 EANTE.exe 5592 EANTE.exe 1840 SVZM.exe 1840 SVZM.exe 4568 GTZXM.exe 4568 GTZXM.exe 3456 OHLE.exe 3456 OHLE.exe 2780 WMQL.exe 2780 WMQL.exe 4776 EADZ.exe 4776 EADZ.exe 1696 BFNPIBP.exe 1696 BFNPIBP.exe 2452 JLZVTAS.exe 2452 JLZVTAS.exe 3732 HWCLBO.exe 3732 HWCLBO.exe 6040 LMR.exe 6040 LMR.exe 5820 ZHVMU.exe 5820 ZHVMU.exe 4608 YSFUCAH.exe 4608 YSFUCAH.exe 1936 YXKJNH.exe 1936 YXKJNH.exe 2532 GLXPXF.exe 2532 GLXPXF.exe 3044 FTL.exe 3044 FTL.exe 5456 NYQ.exe 5456 NYQ.exe 1820 BWQFXG.exe 1820 BWQFXG.exe 5492 MXFQGZ.exe 5492 MXFQGZ.exe 4004 LII.exe 4004 LII.exe 2832 GSY.exe 2832 GSY.exe 4268 MGK.exe 4268 MGK.exe 5660 JGMIUJP.exe 5660 JGMIUJP.exe 4624 KJPEAZ.exe 4624 KJPEAZ.exe 4736 MHD.exe 4736 MHD.exe 4256 DUOQXM.exe 4256 DUOQXM.exe 1768 HXMD.exe 1768 HXMD.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4704 2026-11-01_a8a6a9369e7b43f700391df97ecce788_elex_emotet_stop.exe 4704 2026-11-01_a8a6a9369e7b43f700391df97ecce788_elex_emotet_stop.exe 2372 YYWCZ.exe 2372 YYWCZ.exe 3004 KWZCI.exe 3004 KWZCI.exe 4768 IMKFVR.exe 4768 IMKFVR.exe 4920 LUTBC.exe 4920 LUTBC.exe 1724 IVVDOH.exe 1724 IVVDOH.exe 5592 EANTE.exe 5592 EANTE.exe 1840 SVZM.exe 1840 SVZM.exe 4568 GTZXM.exe 4568 GTZXM.exe 3456 OHLE.exe 3456 OHLE.exe 2780 WMQL.exe 2780 WMQL.exe 4776 EADZ.exe 4776 EADZ.exe 1696 BFNPIBP.exe 1696 BFNPIBP.exe 2452 JLZVTAS.exe 2452 JLZVTAS.exe 3732 HWCLBO.exe 3732 HWCLBO.exe 6040 LMR.exe 6040 LMR.exe 5820 ZHVMU.exe 5820 ZHVMU.exe 4608 YSFUCAH.exe 4608 YSFUCAH.exe 1936 YXKJNH.exe 1936 YXKJNH.exe 2532 GLXPXF.exe 2532 GLXPXF.exe 3044 FTL.exe 3044 FTL.exe 5456 NYQ.exe 5456 NYQ.exe 1820 BWQFXG.exe 1820 BWQFXG.exe 5492 MXFQGZ.exe 5492 MXFQGZ.exe 4004 LII.exe 4004 LII.exe 2832 GSY.exe 2832 GSY.exe 4268 MGK.exe 4268 MGK.exe 5660 JGMIUJP.exe 5660 JGMIUJP.exe 4624 KJPEAZ.exe 4624 KJPEAZ.exe 4736 MHD.exe 4736 MHD.exe 4256 DUOQXM.exe 4256 DUOQXM.exe 1768 HXMD.exe 1768 HXMD.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4704 wrote to memory of 5300 4704 2026-11-01_a8a6a9369e7b43f700391df97ecce788_elex_emotet_stop.exe 89 PID 5300 wrote to memory of 2372 5300 cmd.exe 93 PID 2372 wrote to memory of 5992 2372 YYWCZ.exe 95 PID 5992 wrote to memory of 3004 5992 cmd.exe 99 PID 3004 wrote to memory of 2520 3004 KWZCI.exe 100 PID 2520 wrote to memory of 4768 2520 cmd.exe 104 PID 4768 wrote to memory of 1460 4768 IMKFVR.exe 105 PID 1460 wrote to memory of 4920 1460 cmd.exe 109 PID 4920 wrote to memory of 5700 4920 LUTBC.exe 110 PID 5700 wrote to memory of 1724 5700 cmd.exe 114 PID 1724 wrote to memory of 2352 1724 IVVDOH.exe 115 PID 2352 wrote to memory of 5592 2352 cmd.exe 119 PID 5592 wrote to memory of 4880 5592 EANTE.exe 120 PID 4880 wrote to memory of 1840 4880 cmd.exe 124 PID 1840 wrote to memory of 2616 1840 SVZM.exe 125 PID 2616 wrote to memory of 4568 2616 cmd.exe 129 PID 4568 wrote to memory of 1524 4568 GTZXM.exe 130 PID 1524 wrote to memory of 3456 1524 cmd.exe 134 PID 3456 wrote to memory of 4924 3456 OHLE.exe 135 PID 4924 wrote to memory of 2780 4924 cmd.exe 139 PID 2780 wrote to memory of 5348 2780 WMQL.exe 140 PID 5348 wrote to memory of 4776 5348 cmd.exe 144 PID 4776 wrote to memory of 5864 4776 EADZ.exe 145 PID 5864 wrote to memory of 1696 5864 cmd.exe 149 PID 1696 wrote to memory of 3480 1696 BFNPIBP.exe 150 PID 3480 wrote to memory of 2452 3480 cmd.exe 154 PID 2452 wrote to memory of 4888 2452 JLZVTAS.exe 155 PID 4888 wrote to memory of 3732 4888 cmd.exe 159 PID 3732 wrote to memory of 2068 3732 HWCLBO.exe 160 PID 2068 wrote to memory of 6040 2068 cmd.exe 164 PID 6040 wrote to memory of 1396 6040 LMR.exe 165 PID 1396 wrote to memory of 5820 1396 cmd.exe 169 PID 5820 wrote to memory of 704 5820 ZHVMU.exe 170 PID 704 wrote to memory of 4608 704 cmd.exe 174 PID 4608 wrote to memory of 4184 4608 YSFUCAH.exe 175 PID 4184 wrote to memory of 1936 4184 cmd.exe 179 PID 1936 wrote to memory of 3036 1936 YXKJNH.exe 180 PID 3036 wrote to memory of 2532 3036 cmd.exe 184 PID 2532 wrote to memory of 2360 2532 GLXPXF.exe 185 PID 2360 wrote to memory of 3044 2360 cmd.exe 189 PID 3044 wrote to memory of 2320 3044 FTL.exe 190 PID 2320 wrote to memory of 5456 2320 cmd.exe 194 PID 5456 wrote to memory of 568 5456 NYQ.exe 195 PID 568 wrote to memory of 1820 568 cmd.exe 199 PID 1820 wrote to memory of 4452 1820 BWQFXG.exe 200 PID 4452 wrote to memory of 5492 4452 cmd.exe 204 PID 5492 wrote to memory of 2348 5492 MXFQGZ.exe 205 PID 2348 wrote to memory of 4004 2348 cmd.exe 209 PID 4004 wrote to memory of 876 4004 LII.exe 210 PID 876 wrote to memory of 2832 876 cmd.exe 214 PID 2832 wrote to memory of 1804 2832 GSY.exe 215 PID 1804 wrote to memory of 4268 1804 cmd.exe 219 PID 4268 wrote to memory of 1092 4268 MGK.exe 220 PID 1092 wrote to memory of 5660 1092 cmd.exe 224 PID 5660 wrote to memory of 2244 5660 JGMIUJP.exe 225 PID 2244 wrote to memory of 4624 2244 cmd.exe 229 PID 4624 wrote to memory of 2992 4624 KJPEAZ.exe 230 PID 2992 wrote to memory of 4736 2992 cmd.exe 234 PID 4736 wrote to memory of 3224 4736 MHD.exe 235 PID 3224 wrote to memory of 4256 3224 cmd.exe 239 PID 4256 wrote to memory of 4396 4256 DUOQXM.exe 240 PID 4396 wrote to memory of 1768 4396 cmd.exe 244 PID 1768 wrote to memory of 3996 1768 HXMD.exe 245 PID 3996 wrote to memory of 4512 3996 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_a8a6a9369e7b43f700391df97ecce788_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_a8a6a9369e7b43f700391df97ecce788_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YYWCZ.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\windows\YYWCZ.exeC:\windows\YYWCZ.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWZCI.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\windows\system\KWZCI.exeC:\windows\system\KWZCI.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMKFVR.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\windows\system\IMKFVR.exeC:\windows\system\IMKFVR.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUTBC.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\windows\LUTBC.exeC:\windows\LUTBC.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVVDOH.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\windows\system\IVVDOH.exeC:\windows\system\IVVDOH.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EANTE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\windows\SysWOW64\EANTE.exeC:\windows\system32\EANTE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SVZM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\windows\system\SVZM.exeC:\windows\system\SVZM.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTZXM.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\windows\GTZXM.exeC:\windows\GTZXM.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLE.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\windows\OHLE.exeC:\windows\OHLE.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMQL.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\system\WMQL.exeC:\windows\system\WMQL.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EADZ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\system\EADZ.exeC:\windows\system\EADZ.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFNPIBP.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\SysWOW64\BFNPIBP.exeC:\windows\system32\BFNPIBP.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLZVTAS.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\windows\JLZVTAS.exeC:\windows\JLZVTAS.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWCLBO.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\windows\SysWOW64\HWCLBO.exeC:\windows\system32\HWCLBO.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMR.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\windows\system\LMR.exeC:\windows\system\LMR.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZHVMU.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\windows\ZHVMU.exeC:\windows\ZHVMU.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YSFUCAH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:704 -
C:\windows\YSFUCAH.exeC:\windows\YSFUCAH.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXKJNH.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\windows\SysWOW64\YXKJNH.exeC:\windows\system32\YXKJNH.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLXPXF.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\windows\GLXPXF.exeC:\windows\GLXPXF.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\windows\SysWOW64\FTL.exeC:\windows\system32\FTL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYQ.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\windows\SysWOW64\NYQ.exeC:\windows\system32\NYQ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BWQFXG.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:568 -
C:\windows\BWQFXG.exeC:\windows\BWQFXG.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXFQGZ.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\MXFQGZ.exeC:\windows\MXFQGZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LII.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\windows\LII.exeC:\windows\LII.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSY.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:876 -
C:\windows\SysWOW64\GSY.exeC:\windows\system32\GSY.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MGK.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\windows\SysWOW64\MGK.exeC:\windows\system32\MGK.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGMIUJP.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\windows\SysWOW64\JGMIUJP.exeC:\windows\system32\JGMIUJP.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJPEAZ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\windows\system\KJPEAZ.exeC:\windows\system\KJPEAZ.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MHD.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\windows\MHD.exeC:\windows\MHD.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DUOQXM.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\windows\SysWOW64\DUOQXM.exeC:\windows\system32\DUOQXM.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXMD.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\SysWOW64\HXMD.exeC:\windows\system32\HXMD.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSVPQSG.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\windows\SysWOW64\WSVPQSG.exeC:\windows\system32\WSVPQSG.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVZL.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:2056 -
C:\windows\SysWOW64\PVZL.exeC:\windows\system32\PVZL.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VGOTFHW.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3252 -
C:\windows\system\VGOTFHW.exeC:\windows\system\VGOTFHW.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTTD.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3128 -
C:\windows\QTTD.exeC:\windows\QTTD.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZTOZSU.exe.bat" "72⤵PID:4712
-
C:\windows\DZTOZSU.exeC:\windows\DZTOZSU.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXHJHBD.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3888 -
C:\windows\system\NXHJHBD.exeC:\windows\system\NXHJHBD.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQC.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:3272 -
C:\windows\ZQC.exeC:\windows\ZQC.exe77⤵
- Executes dropped EXE
PID:2596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "78⤵PID:1012
-
C:\windows\DYQCT.exeC:\windows\DYQCT.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGSPFY.exe.bat" "80⤵PID:5364
-
C:\windows\MGSPFY.exeC:\windows\MGSPFY.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOZP.exe.bat" "82⤵PID:1868
-
C:\windows\YOZP.exeC:\windows\YOZP.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RRD.exe.bat" "84⤵PID:3892
-
C:\windows\RRD.exeC:\windows\RRD.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMMXIB.exe.bat" "86⤵PID:1960
-
C:\windows\system\GMMXIB.exeC:\windows\system\GMMXIB.exe87⤵
- Executes dropped EXE
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EXP.exe.bat" "88⤵PID:5612
-
C:\windows\system\EXP.exeC:\windows\system\EXP.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OFRSUE.exe.bat" "90⤵PID:4588
-
C:\windows\OFRSUE.exeC:\windows\OFRSUE.exe91⤵
- Executes dropped EXE
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQHR.exe.bat" "92⤵
- Executes a command shell one-liner
PID:5976 -
C:\windows\JQHR.exeC:\windows\JQHR.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLLMNF.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1288 -
C:\windows\system\CLLMNF.exeC:\windows\system\CLLMNF.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTNR.exe.bat" "96⤵PID:5516
-
C:\windows\SysWOW64\TTNR.exeC:\windows\system32\TTNR.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOXEKXN.exe.bat" "98⤵PID:2784
-
C:\windows\SysWOW64\AOXEKXN.exeC:\windows\system32\AOXEKXN.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMCQ.exe.bat" "100⤵PID:5996
-
C:\windows\SysWOW64\KMCQ.exeC:\windows\system32\KMCQ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OPALZZY.exe.bat" "102⤵
- Executes a command shell one-liner
PID:6052 -
C:\windows\OPALZZY.exeC:\windows\OPALZZY.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TVT.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2472 -
C:\windows\system\TVT.exeC:\windows\system\TVT.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYWEV.exe.bat" "106⤵PID:2948
-
C:\windows\system\LYWEV.exeC:\windows\system\LYWEV.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYYJYP.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2764 -
C:\windows\SysWOW64\VYYJYP.exeC:\windows\system32\VYYJYP.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BYG.exe.bat" "110⤵PID:2332
-
C:\windows\system\BYG.exeC:\windows\system\BYG.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMLGS.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:5596 -
C:\windows\SysWOW64\VMLGS.exeC:\windows\system32\VMLGS.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEGZAZ.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2012 -
C:\windows\SysWOW64\HEGZAZ.exeC:\windows\system32\HEGZAZ.exe115⤵
- Executes dropped EXE
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JZL.exe.bat" "116⤵PID:5004
-
C:\windows\system\JZL.exeC:\windows\system\JZL.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HASWT.exe.bat" "118⤵
- Executes a command shell one-liner
PID:1732 -
C:\windows\SysWOW64\HASWT.exeC:\windows\system32\HASWT.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVWSZJB.exe.bat" "120⤵PID:3764
-
C:\windows\system\IVWSZJB.exeC:\windows\system\IVWSZJB.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-