Analysis
- max time kernel
84s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 15:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe
- Size 208KB
- Sample261102-s46jpabs31
- SHA256 3051cead7e4461923e123107c609bcb24d27c46d10397196ddecb28085a6f6a5
- MD5 88cda70368a1ad7db62b6730c461c9cf
- SHA1 0d9c3ac0b2aaab4c8fe1eeaf9c526c7a8084fc37
- SHA512 cad946efb8e95251deec48d92c60bc26deea7ac75e5e24e0b6d04e86dfb9f4165d540a9a181fd132f2bf44fe89fab8eb115fe59510cda80de0cafc793bfac242
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFliKL+LOfm4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFliS+LOukEj1
- TLSH T1D1247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2948 SHGD.exe 2692 GCEWLIL.exe 2140 LFCJL.exe 6112 AAM.exe 3764 SDQSBEY.exe 5488 KMS.exe 5888 IMZKWD.exe 856 XCAKDZQ.exe 1792 SPFT.exe 2412 WXMTRR.exe 3024 LSVG.exe 4984 CBXLNBD.exe 3152 EYLFV.exe 4288 FBPB.exe 3012 PZUVQI.exe 6132 THBV.exe 3704 LKF.exe 3044 DLHE.exe 1492 XGLNVV.exe 2328 BOS.exe 3228 FWZVU.exe 4068 LRY.exe 2936 AMHIJW.exe 5404 LFKBKDA.exe 3688 RFS.exe 3720 MBXYDX.exe 4884 VBZ.exe 5992 QOEN.exe 4788 CEKNDVD.exe 3996 JULMK.exe 2332 KPPQPYC.exe 4160 GVVF.exe 4608 BIAOGI.exe 4692 QLJ.exe 5720 UOHOZW.exe 1596 YWOW.exe 5400 NZXAWBA.exe 2680 TNWBBEH.exe 5928 OIBS.exe 4660 XNMCTAS.exe 2916 YQQG.exe 6080 SEUQJQ.exe 4972 NRZZTQX.exe 4996 CHAYAL.exe 5860 SKKD.exe 4064 SPKR.exe 900 KTOVAB.exe 3120 SGPZXQ.exe 120 DZKSXYE.exe 908 WUNNLN.exe 3496 BUVBUQ.exe 3104 PFLAIS.exe 4480 AYH.exe 1436 RGJX.exe 2252 MTNHEF.exe 1920 FWR.exe 1468 IEYLWNG.exe 5552 UXBDWV.exe 4392 LKLV.exe 2488 FXQFWR.exe 2284 FDQTYE.exe 612 CJO.exe 52 GZDQRG.exe 3144 CWAOY.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\EYLFV.exe CBXLNBD.exe File created C:\windows\SysWOW64\EYLFV.exe.bat CBXLNBD.exe File opened for modification C:\windows\SysWOW64\SKKD.exe CHAYAL.exe File created C:\windows\SysWOW64\ABEBHX.exe.bat KGU.exe File created C:\windows\SysWOW64\MQB.exe LVYXLF.exe File created C:\windows\SysWOW64\AJWKU.exe.bat KTNLNNH.exe File opened for modification C:\windows\SysWOW64\KPPQPYC.exe JULMK.exe File created C:\windows\SysWOW64\WUNNLN.exe.bat DZKSXYE.exe File created C:\windows\SysWOW64\FDQTYE.exe FXQFWR.exe File created C:\windows\SysWOW64\FVGBZM.exe FIONX.exe File created C:\windows\SysWOW64\EXPSU.exe UAB.exe File created C:\windows\SysWOW64\NUQ.exe NRMOXNK.exe File opened for modification C:\windows\SysWOW64\NZXAWBA.exe YWOW.exe File created C:\windows\SysWOW64\SKKD.exe CHAYAL.exe File opened for modification C:\windows\SysWOW64\ABEBHX.exe KGU.exe File created C:\windows\SysWOW64\FITL.exe.bat KUOBVLV.exe File opened for modification C:\windows\SysWOW64\SHGD.exe 2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\SDQSBEY.exe AAM.exe File opened for modification C:\windows\SysWOW64\AMHIJW.exe LRY.exe File opened for modification C:\windows\SysWOW64\FVGBZM.exe FIONX.exe File opened for modification C:\windows\SysWOW64\MQB.exe LVYXLF.exe File created C:\windows\SysWOW64\FITL.exe KUOBVLV.exe File opened for modification C:\windows\SysWOW64\FITL.exe KUOBVLV.exe File created C:\windows\SysWOW64\MBXYDX.exe RFS.exe File created C:\windows\SysWOW64\MBXYDX.exe.bat RFS.exe File opened for modification C:\windows\SysWOW64\FXQFWR.exe LKLV.exe File opened for modification C:\windows\SysWOW64\FDQTYE.exe FXQFWR.exe File opened for modification C:\windows\SysWOW64\EXPSU.exe UAB.exe File created C:\windows\SysWOW64\ABEBHX.exe KGU.exe File created C:\windows\SysWOW64\SDQSBEY.exe AAM.exe File opened for modification C:\windows\SysWOW64\VBZ.exe MBXYDX.exe File created C:\windows\SysWOW64\FDQTYE.exe.bat FXQFWR.exe File created C:\windows\SysWOW64\UQQG.exe.bat FVGBZM.exe File opened for modification C:\windows\SysWOW64\LPB.exe CGZW.exe File created C:\windows\SysWOW64\AJWKU.exe KTNLNNH.exe File created C:\windows\SysWOW64\AMHIJW.exe LRY.exe File created C:\windows\SysWOW64\FVGBZM.exe.bat FIONX.exe File created C:\windows\SysWOW64\HTU.exe UQQG.exe File created C:\windows\SysWOW64\RYWNQD.exe NVX.exe File created C:\windows\SysWOW64\YWOW.exe.bat UOHOZW.exe File created C:\windows\SysWOW64\RFS.exe.bat LFKBKDA.exe File created C:\windows\SysWOW64\FXQFWR.exe.bat LKLV.exe File opened for modification C:\windows\SysWOW64\NUQ.exe NRMOXNK.exe File opened for modification C:\windows\SysWOW64\HTU.exe UQQG.exe File created C:\windows\SysWOW64\RFS.exe LFKBKDA.exe File opened for modification C:\windows\SysWOW64\MBXYDX.exe RFS.exe File created C:\windows\SysWOW64\JULMK.exe CEKNDVD.exe File opened for modification C:\windows\SysWOW64\YWOW.exe UOHOZW.exe File created C:\windows\SysWOW64\NZXAWBA.exe YWOW.exe File created C:\windows\SysWOW64\NZXAWBA.exe.bat YWOW.exe File created C:\windows\SysWOW64\SKKD.exe.bat CHAYAL.exe File created C:\windows\SysWOW64\SHGD.exe.bat 2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe File created C:\windows\SysWOW64\KPPQPYC.exe.bat JULMK.exe File created C:\windows\SysWOW64\BUVBUQ.exe WUNNLN.exe File created C:\windows\SysWOW64\EXPSU.exe.bat UAB.exe File opened for modification C:\windows\SysWOW64\KUOBVLV.exe MFV.exe File opened for modification C:\windows\SysWOW64\RYWNQD.exe NVX.exe File created C:\windows\SysWOW64\RYWNQD.exe.bat NVX.exe File created C:\windows\SysWOW64\VBZ.exe.bat MBXYDX.exe File created C:\windows\SysWOW64\UQQG.exe FVGBZM.exe File opened for modification C:\windows\SysWOW64\UQQG.exe FVGBZM.exe File created C:\windows\SysWOW64\MQB.exe.bat LVYXLF.exe File opened for modification C:\windows\SysWOW64\AJWKU.exe KTNLNNH.exe File created C:\windows\SysWOW64\KUOBVLV.exe.bat MFV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\BIAOGI.exe.bat GVVF.exe File opened for modification C:\windows\system\NRZZTQX.exe SEUQJQ.exe File opened for modification C:\windows\FWR.exe MTNHEF.exe File opened for modification C:\windows\KMS.exe SDQSBEY.exe File opened for modification C:\windows\system\FBPB.exe EYLFV.exe File created C:\windows\THBV.exe.bat PZUVQI.exe File created C:\windows\system\CHAYAL.exe.bat NRZZTQX.exe File created C:\windows\MTNHEF.exe RGJX.exe File created C:\windows\CGZW.exe.bat HTU.exe File created C:\windows\LUHUIFB.exe ABEBHX.exe File created C:\windows\MFV.exe.bat ERD.exe File created C:\windows\system\SPKR.exe SKKD.exe File created C:\windows\system\RGJX.exe AYH.exe File created C:\windows\FIONX.exe UPLU.exe File created C:\windows\SDI.exe.bat QFH.exe File opened for modification C:\windows\SWN.exe HDKMYGQ.exe File created C:\windows\system\FUXH.exe FRTEW.exe File created C:\windows\KTNLNNH.exe MDC.exe File created C:\windows\system\UOHOZW.exe.bat QLJ.exe File opened for modification C:\windows\system\PFLAIS.exe BUVBUQ.exe File created C:\windows\LKLV.exe.bat UXBDWV.exe File created C:\windows\GZDQRG.exe.bat CJO.exe File created C:\windows\IUYYSFQ.exe.bat LPB.exe File opened for modification C:\windows\system\KDO.exe KYO.exe File created C:\windows\system\LSVG.exe.bat WXMTRR.exe File opened for modification C:\windows\TNWBBEH.exe NZXAWBA.exe File opened for modification C:\windows\FIONX.exe UPLU.exe File opened for modification C:\windows\IUYYSFQ.exe LPB.exe File created C:\windows\HDKMYGQ.exe HYSYXT.exe File created C:\windows\system\WXMTRR.exe SPFT.exe File opened for modification C:\windows\GVVF.exe KPPQPYC.exe File created C:\windows\KTOVAB.exe.bat SPKR.exe File created C:\windows\IMZKWD.exe.bat KMS.exe File created C:\windows\UXBDWV.exe.bat IEYLWNG.exe File created C:\windows\GZDQRG.exe CJO.exe File created C:\windows\system\SCIDGTK.exe MCAQX.exe File created C:\windows\SPFT.exe.bat XCAKDZQ.exe File created C:\windows\CKBCHV.exe.bat CWAOY.exe File created C:\windows\system\MCAQX.exe PBTCO.exe File created C:\windows\UPHMNIE.exe.bat FUXH.exe File created C:\windows\MDC.exe.bat MQB.exe File created C:\windows\system\FBPB.exe.bat EYLFV.exe File created C:\windows\system\BOS.exe.bat XGLNVV.exe File created C:\windows\IEYLWNG.exe FWR.exe File created C:\windows\LVYXLF.exe NUQ.exe File created C:\windows\LVYXLF.exe.bat NUQ.exe File created C:\windows\system\FBPB.exe EYLFV.exe File created C:\windows\CEKNDVD.exe QOEN.exe File opened for modification C:\windows\system\CWAOY.exe GZDQRG.exe File created C:\windows\DZKSXYE.exe.bat SGPZXQ.exe File opened for modification C:\windows\LKLV.exe UXBDWV.exe File opened for modification C:\windows\system\SGPZXQ.exe KTOVAB.exe File created C:\windows\ERD.exe AJWKU.exe File created C:\windows\SMIKJ.exe.bat MMA.exe File created C:\windows\FWR.exe MTNHEF.exe File opened for modification C:\windows\system\FWZVU.exe BOS.exe File created C:\windows\LFKBKDA.exe AMHIJW.exe File opened for modification C:\windows\system\UOHOZW.exe QLJ.exe File opened for modification C:\windows\system\SPKR.exe SKKD.exe File created C:\windows\DZKSXYE.exe SGPZXQ.exe File opened for modification C:\windows\HDKMYGQ.exe HYSYXT.exe File created C:\windows\SWN.exe.bat HDKMYGQ.exe File created C:\windows\system\KDO.exe KYO.exe File opened for modification C:\windows\GZDQRG.exe CJO.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2112 cmd.exe 456 cmd.exe 2384 cmd.exe 2808 cmd.exe 6140 cmd.exe 5164 cmd.exe 3232 cmd.exe 3332 cmd.exe 5756 cmd.exe 3268 cmd.exe 1576 cmd.exe 2672 cmd.exe 5876 cmd.exe 2564 cmd.exe 1564 cmd.exe 3520 cmd.exe 1528 cmd.exe 5896 cmd.exe 1676 cmd.exe 1804 cmd.exe 1456 cmd.exe 2592 cmd.exe 3204 cmd.exe 5168 cmd.exe 1688 cmd.exe 2016 cmd.exe 6096 cmd.exe 3548 cmd.exe 4920 cmd.exe 2784 cmd.exe 4460 cmd.exe 2468 cmd.exe 4688 cmd.exe 3788 cmd.exe 2268 cmd.exe 4720 cmd.exe 2504 cmd.exe 1148 cmd.exe 3364 cmd.exe 5072 cmd.exe 5560 cmd.exe 4164 cmd.exe 2620 cmd.exe 4328 cmd.exe 2568 cmd.exe 6076 cmd.exe 5376 cmd.exe 4296 cmd.exe 2512 cmd.exe 2964 cmd.exe 5252 cmd.exe 4176 cmd.exe 2664 cmd.exe 1712 cmd.exe 4216 cmd.exe 4172 cmd.exe 1400 cmd.exe 4292 cmd.exe 2872 cmd.exe 1604 cmd.exe 4020 cmd.exe 2908 cmd.exe 3360 cmd.exe 1028 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4620 2580 WerFault.exe 86 4588 2948 WerFault.exe 92 1292 2692 WerFault.exe 98 5860 2140 WerFault.exe 103 3204 6112 WerFault.exe 108 4420 3764 WerFault.exe 113 5588 5488 WerFault.exe 118 4712 5888 WerFault.exe 123 1128 856 WerFault.exe 128 4460 1792 WerFault.exe 133 1152 2412 WerFault.exe 138 4608 3024 WerFault.exe 143 4196 4984 WerFault.exe 148 548 3152 WerFault.exe 153 4348 4288 WerFault.exe 158 3324 3012 WerFault.exe 163 2560 6132 WerFault.exe 168 4940 3704 WerFault.exe 173 4904 3044 WerFault.exe 178 4084 1492 WerFault.exe 183 4160 2328 WerFault.exe 188 3196 3228 WerFault.exe 193 5472 4068 WerFault.exe 198 1708 2936 WerFault.exe 203 820 5404 WerFault.exe 208 2968 3688 WerFault.exe 213 4056 3720 WerFault.exe 218 6104 4884 WerFault.exe 223 4940 5992 WerFault.exe 228 2576 4788 WerFault.exe 233 4292 3996 WerFault.exe 238 828 2332 WerFault.exe 243 3196 4160 WerFault.exe 248 2536 4608 WerFault.exe 253 1236 4692 WerFault.exe 258 2176 5720 WerFault.exe 263 2212 1596 WerFault.exe 268 2732 5400 WerFault.exe 273 2504 2680 WerFault.exe 278 4112 5928 WerFault.exe 284 3208 4660 WerFault.exe 289 5348 2916 WerFault.exe 294 5824 6080 WerFault.exe 299 2380 4972 WerFault.exe 304 3080 4996 WerFault.exe 309 3944 5860 WerFault.exe 314 2988 4064 WerFault.exe 319 2584 900 WerFault.exe 324 4968 3120 WerFault.exe 329 4564 120 WerFault.exe 334 4544 908 WerFault.exe 339 3828 3496 WerFault.exe 344 936 3104 WerFault.exe 349 2380 4480 WerFault.exe 354 1332 1436 WerFault.exe 359 4132 2252 WerFault.exe 364 4604 1920 WerFault.exe 369 1540 1468 WerFault.exe 374 2504 5552 WerFault.exe 379 3904 4392 WerFault.exe 384 1156 2488 WerFault.exe 389 4960 2284 WerFault.exe 394 5140 612 WerFault.exe 399 2992 52 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUNNLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LVYXLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPHMNIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXQFWR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CGZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTNLNNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDKMYGQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXPSU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NZXAWBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYLFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKBCHV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSVG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NRMOXNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFLAIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAZPFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JULMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XNMCTAS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2580 2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe 2580 2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe 2948 SHGD.exe 2948 SHGD.exe 2692 GCEWLIL.exe 2692 GCEWLIL.exe 2140 LFCJL.exe 2140 LFCJL.exe 6112 AAM.exe 6112 AAM.exe 3764 SDQSBEY.exe 3764 SDQSBEY.exe 5488 KMS.exe 5488 KMS.exe 5888 IMZKWD.exe 5888 IMZKWD.exe 856 XCAKDZQ.exe 856 XCAKDZQ.exe 1792 SPFT.exe 1792 SPFT.exe 2412 WXMTRR.exe 2412 WXMTRR.exe 3024 LSVG.exe 3024 LSVG.exe 4984 CBXLNBD.exe 4984 CBXLNBD.exe 3152 EYLFV.exe 3152 EYLFV.exe 4288 FBPB.exe 4288 FBPB.exe 3012 PZUVQI.exe 3012 PZUVQI.exe 6132 THBV.exe 6132 THBV.exe 3704 LKF.exe 3704 LKF.exe 3044 DLHE.exe 3044 DLHE.exe 1492 XGLNVV.exe 1492 XGLNVV.exe 2328 BOS.exe 2328 BOS.exe 3228 FWZVU.exe 3228 FWZVU.exe 4068 LRY.exe 4068 LRY.exe 2936 AMHIJW.exe 2936 AMHIJW.exe 5404 LFKBKDA.exe 5404 LFKBKDA.exe 3688 RFS.exe 3688 RFS.exe 3720 MBXYDX.exe 3720 MBXYDX.exe 4884 VBZ.exe 4884 VBZ.exe 5992 QOEN.exe 5992 QOEN.exe 4788 CEKNDVD.exe 4788 CEKNDVD.exe 3996 JULMK.exe 3996 JULMK.exe 2332 KPPQPYC.exe 2332 KPPQPYC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2580 2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe 2580 2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe 2948 SHGD.exe 2948 SHGD.exe 2692 GCEWLIL.exe 2692 GCEWLIL.exe 2140 LFCJL.exe 2140 LFCJL.exe 6112 AAM.exe 6112 AAM.exe 3764 SDQSBEY.exe 3764 SDQSBEY.exe 5488 KMS.exe 5488 KMS.exe 5888 IMZKWD.exe 5888 IMZKWD.exe 856 XCAKDZQ.exe 856 XCAKDZQ.exe 1792 SPFT.exe 1792 SPFT.exe 2412 WXMTRR.exe 2412 WXMTRR.exe 3024 LSVG.exe 3024 LSVG.exe 4984 CBXLNBD.exe 4984 CBXLNBD.exe 3152 EYLFV.exe 3152 EYLFV.exe 4288 FBPB.exe 4288 FBPB.exe 3012 PZUVQI.exe 3012 PZUVQI.exe 6132 THBV.exe 6132 THBV.exe 3704 LKF.exe 3704 LKF.exe 3044 DLHE.exe 3044 DLHE.exe 1492 XGLNVV.exe 1492 XGLNVV.exe 2328 BOS.exe 2328 BOS.exe 3228 FWZVU.exe 3228 FWZVU.exe 4068 LRY.exe 4068 LRY.exe 2936 AMHIJW.exe 2936 AMHIJW.exe 5404 LFKBKDA.exe 5404 LFKBKDA.exe 3688 RFS.exe 3688 RFS.exe 3720 MBXYDX.exe 3720 MBXYDX.exe 4884 VBZ.exe 4884 VBZ.exe 5992 QOEN.exe 5992 QOEN.exe 4788 CEKNDVD.exe 4788 CEKNDVD.exe 3996 JULMK.exe 3996 JULMK.exe 2332 KPPQPYC.exe 2332 KPPQPYC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2580 wrote to memory of 1600 2580 2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe 88 PID 1600 wrote to memory of 2948 1600 cmd.exe 92 PID 2948 wrote to memory of 5164 2948 SHGD.exe 94 PID 5164 wrote to memory of 2692 5164 cmd.exe 98 PID 2692 wrote to memory of 1148 2692 GCEWLIL.exe 99 PID 1148 wrote to memory of 2140 1148 cmd.exe 103 PID 2140 wrote to memory of 3364 2140 LFCJL.exe 104 PID 3364 wrote to memory of 6112 3364 cmd.exe 108 PID 6112 wrote to memory of 5852 6112 AAM.exe 109 PID 5852 wrote to memory of 3764 5852 cmd.exe 113 PID 3764 wrote to memory of 5168 3764 SDQSBEY.exe 114 PID 5168 wrote to memory of 5488 5168 cmd.exe 118 PID 5488 wrote to memory of 5256 5488 KMS.exe 119 PID 5256 wrote to memory of 5888 5256 cmd.exe 123 PID 5888 wrote to memory of 1264 5888 IMZKWD.exe 124 PID 1264 wrote to memory of 856 1264 cmd.exe 128 PID 856 wrote to memory of 5724 856 XCAKDZQ.exe 129 PID 5724 wrote to memory of 1792 5724 cmd.exe 133 PID 1792 wrote to memory of 5876 1792 SPFT.exe 134 PID 5876 wrote to memory of 2412 5876 cmd.exe 138 PID 2412 wrote to memory of 4184 2412 WXMTRR.exe 139 PID 4184 wrote to memory of 3024 4184 cmd.exe 143 PID 3024 wrote to memory of 1804 3024 LSVG.exe 144 PID 1804 wrote to memory of 4984 1804 cmd.exe 148 PID 4984 wrote to memory of 2952 4984 CBXLNBD.exe 149 PID 2952 wrote to memory of 3152 2952 cmd.exe 153 PID 3152 wrote to memory of 1688 3152 EYLFV.exe 154 PID 1688 wrote to memory of 4288 1688 cmd.exe 158 PID 4288 wrote to memory of 1456 4288 FBPB.exe 159 PID 1456 wrote to memory of 3012 1456 cmd.exe 163 PID 3012 wrote to memory of 1528 3012 PZUVQI.exe 164 PID 1528 wrote to memory of 6132 1528 cmd.exe 168 PID 6132 wrote to memory of 2888 6132 THBV.exe 169 PID 2888 wrote to memory of 3704 2888 cmd.exe 173 PID 3704 wrote to memory of 2872 3704 LKF.exe 174 PID 2872 wrote to memory of 3044 2872 cmd.exe 178 PID 3044 wrote to memory of 5728 3044 DLHE.exe 179 PID 5728 wrote to memory of 1492 5728 cmd.exe 183 PID 1492 wrote to memory of 1968 1492 XGLNVV.exe 184 PID 1968 wrote to memory of 2328 1968 cmd.exe 188 PID 2328 wrote to memory of 1604 2328 BOS.exe 189 PID 1604 wrote to memory of 3228 1604 cmd.exe 193 PID 3228 wrote to memory of 4328 3228 FWZVU.exe 194 PID 4328 wrote to memory of 4068 4328 cmd.exe 198 PID 4068 wrote to memory of 4104 4068 LRY.exe 199 PID 4104 wrote to memory of 2936 4104 cmd.exe 203 PID 2936 wrote to memory of 4356 2936 AMHIJW.exe 204 PID 4356 wrote to memory of 5404 4356 cmd.exe 208 PID 5404 wrote to memory of 5660 5404 LFKBKDA.exe 209 PID 5660 wrote to memory of 3688 5660 cmd.exe 213 PID 3688 wrote to memory of 3220 3688 RFS.exe 214 PID 3220 wrote to memory of 3720 3220 cmd.exe 218 PID 3720 wrote to memory of 4408 3720 MBXYDX.exe 219 PID 4408 wrote to memory of 4884 4408 cmd.exe 223 PID 4884 wrote to memory of 5840 4884 VBZ.exe 224 PID 5840 wrote to memory of 5992 5840 cmd.exe 228 PID 5992 wrote to memory of 1608 5992 QOEN.exe 229 PID 1608 wrote to memory of 4788 1608 cmd.exe 233 PID 4788 wrote to memory of 3360 4788 CEKNDVD.exe 234 PID 3360 wrote to memory of 3996 3360 cmd.exe 238 PID 3996 wrote to memory of 2568 3996 JULMK.exe 239 PID 2568 wrote to memory of 2332 2568 cmd.exe 243 PID 2332 wrote to memory of 1336 2332 KPPQPYC.exe 244 PID 1336 wrote to memory of 4160 1336 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_88cda70368a1ad7db62b6730c461c9cf_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHGD.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\windows\SysWOW64\SHGD.exeC:\windows\system32\SHGD.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFCJL.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\system\LFCJL.exeC:\windows\system\LFCJL.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AAM.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\windows\AAM.exeC:\windows\AAM.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDQSBEY.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\windows\SysWOW64\SDQSBEY.exeC:\windows\system32\SDQSBEY.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMS.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\windows\KMS.exeC:\windows\KMS.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMZKWD.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\windows\IMZKWD.exeC:\windows\IMZKWD.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XCAKDZQ.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\windows\system\XCAKDZQ.exeC:\windows\system\XCAKDZQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SPFT.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\windows\SPFT.exeC:\windows\SPFT.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXMTRR.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\windows\system\WXMTRR.exeC:\windows\system\WXMTRR.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSVG.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\windows\system\LSVG.exeC:\windows\system\LSVG.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CBXLNBD.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\windows\CBXLNBD.exeC:\windows\CBXLNBD.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EYLFV.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\SysWOW64\EYLFV.exeC:\windows\system32\EYLFV.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FBPB.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\windows\system\FBPB.exeC:\windows\system\FBPB.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PZUVQI.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\windows\system\PZUVQI.exeC:\windows\system\PZUVQI.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\THBV.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\windows\THBV.exeC:\windows\THBV.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKF.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\windows\LKF.exeC:\windows\LKF.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLHE.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\windows\system\DLHE.exeC:\windows\system\DLHE.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XGLNVV.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\windows\XGLNVV.exeC:\windows\XGLNVV.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BOS.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\system\BOS.exeC:\windows\system\BOS.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FWZVU.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\system\FWZVU.exeC:\windows\system\FWZVU.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LRY.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\system\LRY.exeC:\windows\system\LRY.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMHIJW.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\SysWOW64\AMHIJW.exeC:\windows\system32\AMHIJW.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFKBKDA.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\LFKBKDA.exeC:\windows\LFKBKDA.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFS.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\windows\SysWOW64\RFS.exeC:\windows\system32\RFS.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MBXYDX.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\windows\SysWOW64\MBXYDX.exeC:\windows\system32\MBXYDX.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBZ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\windows\SysWOW64\VBZ.exeC:\windows\system32\VBZ.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QOEN.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\windows\QOEN.exeC:\windows\QOEN.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEKNDVD.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\windows\CEKNDVD.exeC:\windows\CEKNDVD.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JULMK.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\windows\SysWOW64\JULMK.exeC:\windows\system32\JULMK.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KPPQPYC.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\windows\SysWOW64\KPPQPYC.exeC:\windows\system32\KPPQPYC.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVVF.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\windows\GVVF.exeC:\windows\GVVF.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BIAOGI.exe.bat" "66⤵
- Executes a command shell one-liner
PID:5072 -
C:\windows\system\BIAOGI.exeC:\windows\system\BIAOGI.exe67⤵
- Executes dropped EXE
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QLJ.exe.bat" "68⤵PID:5968
-
C:\windows\QLJ.exeC:\windows\QLJ.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOHOZW.exe.bat" "70⤵PID:2548
-
C:\windows\system\UOHOZW.exeC:\windows\system\UOHOZW.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWOW.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:1504 -
C:\windows\SysWOW64\YWOW.exeC:\windows\system32\YWOW.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NZXAWBA.exe.bat" "74⤵
- Executes a command shell one-liner
PID:5252 -
C:\windows\SysWOW64\NZXAWBA.exeC:\windows\system32\NZXAWBA.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TNWBBEH.exe.bat" "76⤵PID:1100
-
C:\windows\TNWBBEH.exeC:\windows\TNWBBEH.exe77⤵
- Executes dropped EXE
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OIBS.exe.bat" "78⤵PID:2560
-
C:\windows\OIBS.exeC:\windows\OIBS.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XNMCTAS.exe.bat" "80⤵PID:4584
-
C:\windows\XNMCTAS.exeC:\windows\XNMCTAS.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQG.exe.bat" "82⤵PID:3156
-
C:\windows\YQQG.exeC:\windows\YQQG.exe83⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEUQJQ.exe.bat" "84⤵
- Executes a command shell one-liner
PID:4292 -
C:\windows\system\SEUQJQ.exeC:\windows\system\SEUQJQ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NRZZTQX.exe.bat" "86⤵PID:4772
-
C:\windows\system\NRZZTQX.exeC:\windows\system\NRZZTQX.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CHAYAL.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5560 -
C:\windows\system\CHAYAL.exeC:\windows\system\CHAYAL.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKKD.exe.bat" "90⤵
- Executes a command shell one-liner
PID:6076 -
C:\windows\SysWOW64\SKKD.exeC:\windows\system32\SKKD.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPKR.exe.bat" "92⤵PID:1440
-
C:\windows\system\SPKR.exeC:\windows\system\SPKR.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTOVAB.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\windows\KTOVAB.exeC:\windows\KTOVAB.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGPZXQ.exe.bat" "96⤵PID:1124
-
C:\windows\system\SGPZXQ.exeC:\windows\system\SGPZXQ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZKSXYE.exe.bat" "98⤵
- Executes a command shell one-liner
PID:4176 -
C:\windows\DZKSXYE.exeC:\windows\DZKSXYE.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUNNLN.exe.bat" "100⤵PID:1752
-
C:\windows\SysWOW64\WUNNLN.exeC:\windows\system32\WUNNLN.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUVBUQ.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:4644 -
C:\windows\SysWOW64\BUVBUQ.exeC:\windows\system32\BUVBUQ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PFLAIS.exe.bat" "104⤵PID:4728
-
C:\windows\system\PFLAIS.exeC:\windows\system\PFLAIS.exe105⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AYH.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2924 -
C:\windows\system\AYH.exeC:\windows\system\AYH.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGJX.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3992 -
C:\windows\system\RGJX.exeC:\windows\system\RGJX.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MTNHEF.exe.bat" "110⤵PID:5360
-
C:\windows\MTNHEF.exeC:\windows\MTNHEF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FWR.exe.bat" "112⤵PID:2176
-
C:\windows\FWR.exeC:\windows\FWR.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IEYLWNG.exe.bat" "114⤵PID:5820
-
C:\windows\IEYLWNG.exeC:\windows\IEYLWNG.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UXBDWV.exe.bat" "116⤵PID:2292
-
C:\windows\UXBDWV.exeC:\windows\UXBDWV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKLV.exe.bat" "118⤵PID:4980
-
C:\windows\LKLV.exeC:\windows\LKLV.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXQFWR.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5896 -
C:\windows\SysWOW64\FXQFWR.exeC:\windows\system32\FXQFWR.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-