Analysis
- max time kernel
110s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/11/2026, 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe
- Size 208KB
- Sample261104-yf5kdaft2l
- SHA256 0a847a99f0306729370efeea7b1c9403576eb2bdc9600e85e1a9a57bd390db9d
- MD5 5b38f653efbbfd3ca0af1915537cd4ab
- SHA1 4977983161abddde90bf59e3bf6224c1b8f74590
- SHA512 12cb4456b79686555ce968b4f04304fccda870d257128b7e46f58230062e6e4b4117d372fe57774aed1cc8bc26f2ed2370f5a3533dfcb4b791d18ad8b2b3055e
- SSDEEP 3072:TLQaL9tbLkRIgd1Lye9yjE2hWAN5XbDlURL+LOfO4pLthEjQT6j:/lZtbLWIgd1LZ9oECZbDlUd+LOmkEj1
- TLSH T172247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3704 HZVOL.exe 5168 AMG.exe 2260 UFW.exe 3500 SFDLR.exe 3200 ATDZTU.exe 5092 FTL.exe 4764 RMGG.exe 4528 LZLPVE.exe 5708 GMQ.exe 5832 AZUIH.exe 3444 TCYLVTK.exe 2880 WQD.exe 1180 OTHRK.exe 1928 LYNORTC.exe 1312 GMRX.exe 5312 REUQK.exe 1268 LSRZMAV.exe 2104 PIGH.exe 1816 VIOVHU.exe 4112 GAJ.exe 920 YBLT.exe 4160 AZQ.exe 4640 GZYB.exe 3484 LZFPBE.exe 2512 LFGDCRQ.exe 1940 XXJ.exe 3480 TDGLR.exe 1820 CQRDH.exe 3816 OJUWPM.exe 3636 OEY.exe 4148 LJDPC.exe 6072 WCGHKB.exe 4152 LHEFRL.exe 1204 XPLFE.exe 3684 LVRCL.exe 5752 TBRQUS.exe 5936 IEAU.exe 1596 ZORS.exe 1308 FPYGOB.exe 3784 QHBZWJD.exe 5736 UPIZI.exe 1000 RVOW.exe 4540 FAUTWM.exe 1028 QTPEFUK.exe 5716 NRUB.exe 4820 TRCP.exe 2604 TECDE.exe 1296 VSHNGKF.exe 5344 KXF.exe 6096 QYNXEW.exe 4268 KLRHPWX.exe 2660 HQXEWGZ.exe 5232 HWP.exe 3104 WRHXIG.exe 848 NCXUQS.exe 4392 ZKE.exe 5604 KDHN.exe 1288 FYMXNS.exe 1156 ODWP.exe 1856 KJCM.exe 4736 WBXFS.exe 1472 FKZ.exe 5864 YCCCDSN.exe 3016 FXLHO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\YIBHT.exe EVXX.exe File opened for modification C:\windows\SysWOW64\ZKE.exe NCXUQS.exe File opened for modification C:\windows\SysWOW64\TFP.exe IMMQIEJ.exe File created C:\windows\SysWOW64\CXV.exe.bat HKRUAD.exe File created C:\windows\SysWOW64\VQTXIPW.exe.bat PQMJ.exe File created C:\windows\SysWOW64\FQI.exe.bat DSPSGZN.exe File created C:\windows\SysWOW64\LYNORTC.exe OTHRK.exe File created C:\windows\SysWOW64\ZKE.exe.bat NCXUQS.exe File created C:\windows\SysWOW64\DGPPPUV.exe GIJSIST.exe File created C:\windows\SysWOW64\DCGKQIE.exe.bat MOWS.exe File created C:\windows\SysWOW64\RJQPYGY.exe.bat SZARYM.exe File created C:\windows\SysWOW64\PIGH.exe LSRZMAV.exe File opened for modification C:\windows\SysWOW64\UPIZI.exe QHBZWJD.exe File created C:\windows\SysWOW64\KXF.exe.bat VSHNGKF.exe File opened for modification C:\windows\SysWOW64\EBLZLX.exe KOGQB.exe File created C:\windows\SysWOW64\VQOZAD.exe.bat TSNXC.exe File created C:\windows\SysWOW64\TFP.exe IMMQIEJ.exe File opened for modification C:\windows\SysWOW64\CWWQQEI.exe OQQSJ.exe File opened for modification C:\windows\SysWOW64\PFPJ.exe USKSVDA.exe File created C:\windows\SysWOW64\CMFCR.exe NWEDTPL.exe File created C:\windows\SysWOW64\EFYRJXX.exe EZYDHK.exe File opened for modification C:\windows\SysWOW64\PQMJ.exe EXJ.exe File created C:\windows\SysWOW64\FTL.exe ATDZTU.exe File created C:\windows\SysWOW64\TECDE.exe.bat TRCP.exe File opened for modification C:\windows\SysWOW64\HGF.exe TFP.exe File created C:\windows\SysWOW64\EVXX.exe.bat CXV.exe File created C:\windows\SysWOW64\XSNXN.exe MZSM.exe File created C:\windows\SysWOW64\VIOVHU.exe.bat PIGH.exe File created C:\windows\SysWOW64\NRUB.exe.bat QTPEFUK.exe File opened for modification C:\windows\SysWOW64\VQTXIPW.exe PQMJ.exe File opened for modification C:\windows\SysWOW64\DCGKQIE.exe MOWS.exe File created C:\windows\SysWOW64\PFPJ.exe.bat USKSVDA.exe File created C:\windows\SysWOW64\NSG.exe TEBAIM.exe File opened for modification C:\windows\SysWOW64\CMFCR.exe NWEDTPL.exe File created C:\windows\SysWOW64\PQMJ.exe.bat EXJ.exe File opened for modification C:\windows\SysWOW64\WDTM.exe FQI.exe File opened for modification C:\windows\SysWOW64\NRUB.exe QTPEFUK.exe File created C:\windows\SysWOW64\KOGQB.exe GYSIP.exe File created C:\windows\SysWOW64\DGPPPUV.exe.bat GIJSIST.exe File created C:\windows\SysWOW64\HKRUAD.exe.bat ORWBR.exe File created C:\windows\SysWOW64\ZIPZLT.exe XSNXN.exe File opened for modification C:\windows\SysWOW64\VIOVHU.exe PIGH.exe File created C:\windows\SysWOW64\JZHHNO.exe.bat FJB.exe File opened for modification C:\windows\SysWOW64\VQOZAD.exe TSNXC.exe File created C:\windows\SysWOW64\HGF.exe TFP.exe File created C:\windows\SysWOW64\ZIPZLT.exe.bat XSNXN.exe File opened for modification C:\windows\SysWOW64\EQV.exe VQTXIPW.exe File created C:\windows\SysWOW64\KJCM.exe.bat ODWP.exe File created C:\windows\SysWOW64\VQOZAD.exe TSNXC.exe File created C:\windows\SysWOW64\NWEDTPL.exe MTAHF.exe File created C:\windows\SysWOW64\EQV.exe VQTXIPW.exe File created C:\windows\SysWOW64\WDTM.exe.bat FQI.exe File created C:\windows\SysWOW64\NRUB.exe QTPEFUK.exe File created C:\windows\SysWOW64\EQV.exe.bat VQTXIPW.exe File created C:\windows\SysWOW64\LJDPC.exe.bat OEY.exe File created C:\windows\SysWOW64\TECDE.exe TRCP.exe File opened for modification C:\windows\SysWOW64\NVM.exe HVFJVC.exe File created C:\windows\SysWOW64\CWWQQEI.exe.bat OQQSJ.exe File created C:\windows\SysWOW64\EBLZLX.exe.bat KOGQB.exe File created C:\windows\SysWOW64\FISOVJE.exe.bat EFO.exe File created C:\windows\SysWOW64\NWEDTPL.exe.bat MTAHF.exe File created C:\windows\SysWOW64\NSIJZ.exe EFYRJXX.exe File created C:\windows\SysWOW64\ZKE.exe NCXUQS.exe File created C:\windows\SysWOW64\IGF.exe.bat GJMKWTJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\USKSVDA.exe JZHHNO.exe File created C:\windows\system\LLV.exe PFPJ.exe File created C:\windows\system\MDZHY.exe NSIJZ.exe File created C:\windows\AZUIH.exe.bat GMQ.exe File created C:\windows\system\LHEFRL.exe WCGHKB.exe File opened for modification C:\windows\system\LLV.exe PFPJ.exe File opened for modification C:\windows\system\QUGSTE.exe EBLZLX.exe File created C:\windows\VMI.exe.bat YGCXIJ.exe File created C:\windows\HZVOL.exe 2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe File created C:\windows\system\VSHNGKF.exe TECDE.exe File created C:\windows\system\FYMXNS.exe.bat KDHN.exe File created C:\windows\system\USKSVDA.exe.bat JZHHNO.exe File created C:\windows\system\NMDMQKM.exe.bat ELBZNF.exe File opened for modification C:\windows\system\FASQBOS.exe FISOVJE.exe File created C:\windows\OTHRK.exe.bat WQD.exe File opened for modification C:\windows\system\TSNXC.exe NSG.exe File opened for modification C:\windows\system\MDZHY.exe NSIJZ.exe File created C:\windows\GJMKWTJ.exe.bat BIEWFYI.exe File created C:\windows\system\CTU.exe QAZFDDE.exe File created C:\windows\system\ACBWP.exe AXAH.exe File created C:\windows\system\KLRHPWX.exe.bat QYNXEW.exe File created C:\windows\NMNKSO.exe NGNWQ.exe File opened for modification C:\windows\VMI.exe YGCXIJ.exe File created C:\windows\system\FPYGOB.exe.bat ZORS.exe File opened for modification C:\windows\system\NGS.exe FASQBOS.exe File created C:\windows\system\QTPEFUK.exe.bat FAUTWM.exe File created C:\windows\QYNXEW.exe.bat KXF.exe File opened for modification C:\windows\HMLFIR.exe LGFQBH.exe File opened for modification C:\windows\system\TDGLR.exe XXJ.exe File opened for modification C:\windows\XPLFE.exe LHEFRL.exe File created C:\windows\PUJ.exe.bat DCGKQIE.exe File opened for modification C:\windows\system\LSRZMAV.exe REUQK.exe File created C:\windows\system\XXJ.exe.bat LFGDCRQ.exe File created C:\windows\system\ZORS.exe.bat IEAU.exe File created C:\windows\system\HQXEWGZ.exe KLRHPWX.exe File created C:\windows\system\FJB.exe.bat CWWQQEI.exe File created C:\windows\system\MOWS.exe BWT.exe File created C:\windows\system\SZARYM.exe EBUURCB.exe File created C:\windows\system\TCYLVTK.exe AZUIH.exe File created C:\windows\GZYB.exe.bat AZQ.exe File created C:\windows\system\OEY.exe.bat OJUWPM.exe File opened for modification C:\windows\system\MOWS.exe BWT.exe File opened for modification C:\windows\system\QAZFDDE.exe UDTIWTC.exe File created C:\windows\system\FUQL.exe HUIX.exe File created C:\windows\system\ATDZTU.exe.bat SFDLR.exe File opened for modification C:\windows\system\VSHNGKF.exe TECDE.exe File opened for modification C:\windows\system\YCCCDSN.exe FKZ.exe File created C:\windows\TEBAIM.exe WZDLBKE.exe File created C:\windows\BWT.exe.bat EQV.exe File opened for modification C:\windows\system\GAJ.exe VIOVHU.exe File created C:\windows\system\AZQ.exe.bat YBLT.exe File opened for modification C:\windows\system\QHBZWJD.exe FPYGOB.exe File created C:\windows\TMLA.exe.bat NMDMQKM.exe File created C:\windows\system\NGNWQ.exe.bat HGF.exe File created C:\windows\AXAH.exe RJQPYGY.exe File created C:\windows\system\ATDZTU.exe SFDLR.exe File created C:\windows\system\LHEFRL.exe.bat WCGHKB.exe File created C:\windows\GYSIP.exe LLV.exe File created C:\windows\system\OHNAE.exe IGF.exe File opened for modification C:\windows\LGFQBH.exe CTU.exe File created C:\windows\HZVOL.exe.bat 2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe File opened for modification C:\windows\LFGDCRQ.exe LZFPBE.exe File opened for modification C:\windows\system\FUQL.exe HUIX.exe File created C:\windows\system\TSNXC.exe.bat NSG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5380 cmd.exe 2868 cmd.exe 4064 cmd.exe 1216 cmd.exe 5704 cmd.exe 5984 cmd.exe 3760 cmd.exe 4560 cmd.exe 1728 cmd.exe 4088 cmd.exe 4992 cmd.exe 5012 cmd.exe 2320 cmd.exe 1736 cmd.exe 3700 cmd.exe 2472 cmd.exe 2336 cmd.exe 4624 cmd.exe 2808 cmd.exe 5844 cmd.exe 2756 cmd.exe 2120 cmd.exe 3392 cmd.exe 2860 cmd.exe 3220 cmd.exe 2792 cmd.exe 2080 cmd.exe 4208 cmd.exe 3916 cmd.exe 3852 cmd.exe 4264 cmd.exe 936 cmd.exe 1572 cmd.exe 1208 cmd.exe 3132 cmd.exe 6048 cmd.exe 2856 cmd.exe 3812 cmd.exe 5904 cmd.exe 2952 cmd.exe 1812 cmd.exe 2580 cmd.exe 5720 cmd.exe 5816 cmd.exe 1960 cmd.exe 4652 cmd.exe 5820 cmd.exe 3728 cmd.exe 5040 cmd.exe 3384 cmd.exe 4076 cmd.exe 5284 cmd.exe 5624 cmd.exe 1568 cmd.exe 3356 cmd.exe 5836 cmd.exe 772 cmd.exe 2944 cmd.exe 2236 cmd.exe 2648 cmd.exe 2668 cmd.exe 5896 cmd.exe 4060 cmd.exe 4920 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2880 5700 WerFault.exe 88 2428 3704 WerFault.exe 93 1812 5168 WerFault.exe 99 5836 2260 WerFault.exe 104 5864 3500 WerFault.exe 109 5052 3200 WerFault.exe 114 3492 5092 WerFault.exe 119 5988 4764 WerFault.exe 124 2244 4528 WerFault.exe 129 1416 5708 WerFault.exe 134 5736 5832 WerFault.exe 139 1120 3444 WerFault.exe 144 2064 2880 WerFault.exe 149 5888 1180 WerFault.exe 154 3104 1928 WerFault.exe 159 6012 1312 WerFault.exe 164 996 5312 WerFault.exe 169 3020 1268 WerFault.exe 174 6032 2104 WerFault.exe 179 3576 1816 WerFault.exe 184 4684 4112 WerFault.exe 189 1856 920 WerFault.exe 194 464 4160 WerFault.exe 199 5060 4640 WerFault.exe 204 5232 3484 WerFault.exe 209 3132 2512 WerFault.exe 214 1948 1940 WerFault.exe 219 2568 3480 WerFault.exe 224 6032 1820 WerFault.exe 229 1860 3816 WerFault.exe 234 1348 3636 WerFault.exe 239 6020 4148 WerFault.exe 244 5096 6072 WerFault.exe 249 1472 4152 WerFault.exe 254 5728 1204 WerFault.exe 259 4104 3684 WerFault.exe 264 3608 5752 WerFault.exe 269 4304 5936 WerFault.exe 274 5288 1596 WerFault.exe 279 2320 1308 WerFault.exe 284 4320 3784 WerFault.exe 290 464 5736 WerFault.exe 295 5792 1000 WerFault.exe 300 5844 4540 WerFault.exe 305 1740 1028 WerFault.exe 310 3696 5716 WerFault.exe 315 3448 4820 WerFault.exe 320 704 2604 WerFault.exe 325 1780 1296 WerFault.exe 330 4444 5344 WerFault.exe 335 6020 6096 WerFault.exe 340 1812 4268 WerFault.exe 345 3808 2660 WerFault.exe 350 5984 5232 WerFault.exe 355 4804 3104 WerFault.exe 360 4476 848 WerFault.exe 365 4644 4392 WerFault.exe 370 5284 5604 WerFault.exe 375 4704 1288 WerFault.exe 380 4696 1156 WerFault.exe 385 984 1856 WerFault.exe 390 668 4736 WerFault.exe 395 4344 1472 WerFault.exe 400 1840 5864 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFGDCRQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQRDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZFPBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWEDTPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBRQUS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMLFIR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUQL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NGNWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZIPZLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMDMQKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DSPSGZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVWFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYNXEW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBXFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CXV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAZFDDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QHBZWJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBLZLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TECDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLRHPWX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YIBHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIEWFYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSRZMAV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPYGOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBUURCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYMXNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MTAHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5700 2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe 5700 2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe 3704 HZVOL.exe 3704 HZVOL.exe 5168 AMG.exe 5168 AMG.exe 2260 UFW.exe 2260 UFW.exe 3500 SFDLR.exe 3500 SFDLR.exe 3200 ATDZTU.exe 3200 ATDZTU.exe 5092 FTL.exe 5092 FTL.exe 4764 RMGG.exe 4764 RMGG.exe 4528 LZLPVE.exe 4528 LZLPVE.exe 5708 GMQ.exe 5708 GMQ.exe 5832 AZUIH.exe 5832 AZUIH.exe 3444 TCYLVTK.exe 3444 TCYLVTK.exe 2880 WQD.exe 2880 WQD.exe 1180 OTHRK.exe 1180 OTHRK.exe 1928 LYNORTC.exe 1928 LYNORTC.exe 1312 GMRX.exe 1312 GMRX.exe 5312 REUQK.exe 5312 REUQK.exe 1268 LSRZMAV.exe 1268 LSRZMAV.exe 2104 PIGH.exe 2104 PIGH.exe 1816 VIOVHU.exe 1816 VIOVHU.exe 4112 GAJ.exe 4112 GAJ.exe 920 YBLT.exe 920 YBLT.exe 4160 AZQ.exe 4160 AZQ.exe 4640 GZYB.exe 4640 GZYB.exe 3484 LZFPBE.exe 3484 LZFPBE.exe 2512 LFGDCRQ.exe 2512 LFGDCRQ.exe 1940 XXJ.exe 1940 XXJ.exe 3480 TDGLR.exe 3480 TDGLR.exe 1820 CQRDH.exe 1820 CQRDH.exe 3816 OJUWPM.exe 3816 OJUWPM.exe 3636 OEY.exe 3636 OEY.exe 4148 LJDPC.exe 4148 LJDPC.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5700 2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe 5700 2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe 3704 HZVOL.exe 3704 HZVOL.exe 5168 AMG.exe 5168 AMG.exe 2260 UFW.exe 2260 UFW.exe 3500 SFDLR.exe 3500 SFDLR.exe 3200 ATDZTU.exe 3200 ATDZTU.exe 5092 FTL.exe 5092 FTL.exe 4764 RMGG.exe 4764 RMGG.exe 4528 LZLPVE.exe 4528 LZLPVE.exe 5708 GMQ.exe 5708 GMQ.exe 5832 AZUIH.exe 5832 AZUIH.exe 3444 TCYLVTK.exe 3444 TCYLVTK.exe 2880 WQD.exe 2880 WQD.exe 1180 OTHRK.exe 1180 OTHRK.exe 1928 LYNORTC.exe 1928 LYNORTC.exe 1312 GMRX.exe 1312 GMRX.exe 5312 REUQK.exe 5312 REUQK.exe 1268 LSRZMAV.exe 1268 LSRZMAV.exe 2104 PIGH.exe 2104 PIGH.exe 1816 VIOVHU.exe 1816 VIOVHU.exe 4112 GAJ.exe 4112 GAJ.exe 920 YBLT.exe 920 YBLT.exe 4160 AZQ.exe 4160 AZQ.exe 4640 GZYB.exe 4640 GZYB.exe 3484 LZFPBE.exe 3484 LZFPBE.exe 2512 LFGDCRQ.exe 2512 LFGDCRQ.exe 1940 XXJ.exe 1940 XXJ.exe 3480 TDGLR.exe 3480 TDGLR.exe 1820 CQRDH.exe 1820 CQRDH.exe 3816 OJUWPM.exe 3816 OJUWPM.exe 3636 OEY.exe 3636 OEY.exe 4148 LJDPC.exe 4148 LJDPC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5700 wrote to memory of 6136 5700 2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe 89 PID 6136 wrote to memory of 3704 6136 cmd.exe 93 PID 3704 wrote to memory of 2952 3704 HZVOL.exe 95 PID 2952 wrote to memory of 5168 2952 cmd.exe 99 PID 5168 wrote to memory of 4524 5168 AMG.exe 100 PID 4524 wrote to memory of 2260 4524 cmd.exe 104 PID 2260 wrote to memory of 1960 2260 UFW.exe 105 PID 1960 wrote to memory of 3500 1960 cmd.exe 109 PID 3500 wrote to memory of 2860 3500 SFDLR.exe 110 PID 2860 wrote to memory of 3200 2860 cmd.exe 114 PID 3200 wrote to memory of 1248 3200 ATDZTU.exe 115 PID 1248 wrote to memory of 5092 1248 cmd.exe 119 PID 5092 wrote to memory of 3184 5092 FTL.exe 120 PID 3184 wrote to memory of 4764 3184 cmd.exe 124 PID 4764 wrote to memory of 4680 4764 RMGG.exe 125 PID 4680 wrote to memory of 4528 4680 cmd.exe 129 PID 4528 wrote to memory of 3788 4528 LZLPVE.exe 130 PID 3788 wrote to memory of 5708 3788 cmd.exe 134 PID 5708 wrote to memory of 4116 5708 GMQ.exe 135 PID 4116 wrote to memory of 5832 4116 cmd.exe 139 PID 5832 wrote to memory of 4352 5832 AZUIH.exe 140 PID 4352 wrote to memory of 3444 4352 cmd.exe 144 PID 3444 wrote to memory of 936 3444 TCYLVTK.exe 145 PID 936 wrote to memory of 2880 936 cmd.exe 149 PID 2880 wrote to memory of 4560 2880 WQD.exe 150 PID 4560 wrote to memory of 1180 4560 cmd.exe 154 PID 1180 wrote to memory of 4508 1180 OTHRK.exe 155 PID 4508 wrote to memory of 1928 4508 cmd.exe 159 PID 1928 wrote to memory of 4652 1928 LYNORTC.exe 160 PID 4652 wrote to memory of 1312 4652 cmd.exe 164 PID 1312 wrote to memory of 4612 1312 GMRX.exe 165 PID 4612 wrote to memory of 5312 4612 cmd.exe 169 PID 5312 wrote to memory of 5820 5312 REUQK.exe 170 PID 5820 wrote to memory of 1268 5820 cmd.exe 174 PID 1268 wrote to memory of 2764 1268 LSRZMAV.exe 175 PID 2764 wrote to memory of 2104 2764 cmd.exe 179 PID 2104 wrote to memory of 2692 2104 PIGH.exe 180 PID 2692 wrote to memory of 1816 2692 cmd.exe 184 PID 1816 wrote to memory of 4260 1816 VIOVHU.exe 185 PID 4260 wrote to memory of 4112 4260 cmd.exe 189 PID 4112 wrote to memory of 5624 4112 GAJ.exe 190 PID 5624 wrote to memory of 920 5624 cmd.exe 194 PID 920 wrote to memory of 2944 920 YBLT.exe 195 PID 2944 wrote to memory of 4160 2944 cmd.exe 199 PID 4160 wrote to memory of 4716 4160 AZQ.exe 200 PID 4716 wrote to memory of 4640 4716 cmd.exe 204 PID 4640 wrote to memory of 2420 4640 GZYB.exe 205 PID 2420 wrote to memory of 3484 2420 cmd.exe 209 PID 3484 wrote to memory of 2124 3484 LZFPBE.exe 210 PID 2124 wrote to memory of 2512 2124 cmd.exe 214 PID 2512 wrote to memory of 1728 2512 LFGDCRQ.exe 215 PID 1728 wrote to memory of 1940 1728 cmd.exe 219 PID 1940 wrote to memory of 1484 1940 XXJ.exe 220 PID 1484 wrote to memory of 3480 1484 cmd.exe 224 PID 3480 wrote to memory of 5248 3480 TDGLR.exe 225 PID 5248 wrote to memory of 1820 5248 cmd.exe 229 PID 1820 wrote to memory of 2340 1820 CQRDH.exe 230 PID 2340 wrote to memory of 3816 2340 cmd.exe 234 PID 3816 wrote to memory of 5380 3816 OJUWPM.exe 235 PID 5380 wrote to memory of 3636 5380 cmd.exe 239 PID 3636 wrote to memory of 1568 3636 OEY.exe 240 PID 1568 wrote to memory of 4148 1568 cmd.exe 244 PID 4148 wrote to memory of 4088 4148 LJDPC.exe 245 PID 4088 wrote to memory of 6072 4088 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_5b38f653efbbfd3ca0af1915537cd4ab_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZVOL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\windows\HZVOL.exeC:\windows\HZVOL.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMG.exe.bat" "4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\windows\system\AMG.exeC:\windows\system\AMG.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UFW.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\system\UFW.exeC:\windows\system\UFW.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SFDLR.exe.bat" "8⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\windows\system\SFDLR.exeC:\windows\system\SFDLR.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATDZTU.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\windows\system\ATDZTU.exeC:\windows\system\ATDZTU.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FTL.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\SysWOW64\FTL.exeC:\windows\system32\FTL.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RMGG.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\windows\system\RMGG.exeC:\windows\system\RMGG.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LZLPVE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\windows\system\LZLPVE.exeC:\windows\system\LZLPVE.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMQ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\windows\GMQ.exeC:\windows\GMQ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZUIH.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\windows\AZUIH.exeC:\windows\AZUIH.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TCYLVTK.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\windows\system\TCYLVTK.exeC:\windows\system\TCYLVTK.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WQD.exe.bat" "24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:936 -
C:\windows\WQD.exeC:\windows\WQD.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTHRK.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\windows\OTHRK.exeC:\windows\OTHRK.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LYNORTC.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\windows\SysWOW64\LYNORTC.exeC:\windows\system32\LYNORTC.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GMRX.exe.bat" "30⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\GMRX.exeC:\windows\GMRX.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\REUQK.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\SysWOW64\REUQK.exeC:\windows\system32\REUQK.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LSRZMAV.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\windows\system\LSRZMAV.exeC:\windows\system\LSRZMAV.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIGH.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\windows\SysWOW64\PIGH.exeC:\windows\system32\PIGH.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VIOVHU.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\windows\SysWOW64\VIOVHU.exeC:\windows\system32\VIOVHU.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GAJ.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\windows\system\GAJ.exeC:\windows\system\GAJ.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YBLT.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\YBLT.exeC:\windows\YBLT.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AZQ.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\windows\system\AZQ.exeC:\windows\system\AZQ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZYB.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\GZYB.exeC:\windows\GZYB.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LZFPBE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\windows\SysWOW64\LZFPBE.exeC:\windows\system32\LZFPBE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XXJ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\windows\system\XXJ.exeC:\windows\system\XXJ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDGLR.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\system\TDGLR.exeC:\windows\system\TDGLR.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQRDH.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\windows\CQRDH.exeC:\windows\CQRDH.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJUWPM.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\windows\OJUWPM.exeC:\windows\OJUWPM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OEY.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\system\OEY.exeC:\windows\system\OEY.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJDPC.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\windows\SysWOW64\LJDPC.exeC:\windows\system32\LJDPC.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WCGHKB.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\windows\system\WCGHKB.exeC:\windows\system\WCGHKB.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHEFRL.exe.bat" "66⤵PID:5892
-
C:\windows\system\LHEFRL.exeC:\windows\system\LHEFRL.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPLFE.exe.bat" "68⤵PID:4876
-
C:\windows\XPLFE.exeC:\windows\XPLFE.exe69⤵
- Executes dropped EXE
PID:1204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LVRCL.exe.bat" "70⤵PID:5884
-
C:\windows\LVRCL.exeC:\windows\LVRCL.exe71⤵
- Executes dropped EXE
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TBRQUS.exe.bat" "72⤵PID:3920
-
C:\windows\SysWOW64\TBRQUS.exeC:\windows\system32\TBRQUS.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEAU.exe.bat" "74⤵
- Executes a command shell one-liner
PID:2868 -
C:\windows\system\IEAU.exeC:\windows\system\IEAU.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZORS.exe.bat" "76⤵PID:3064
-
C:\windows\system\ZORS.exeC:\windows\system\ZORS.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPYGOB.exe.bat" "78⤵PID:4872
-
C:\windows\system\FPYGOB.exeC:\windows\system\FPYGOB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHBZWJD.exe.bat" "80⤵
- Executes a command shell one-liner
PID:2472 -
C:\windows\system\QHBZWJD.exeC:\windows\system\QHBZWJD.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UPIZI.exe.bat" "82⤵PID:4324
-
C:\windows\SysWOW64\UPIZI.exeC:\windows\system32\UPIZI.exe83⤵
- Executes dropped EXE
PID:5736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RVOW.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2336 -
C:\windows\RVOW.exeC:\windows\RVOW.exe85⤵
- Executes dropped EXE
PID:1000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "86⤵
- Executes a command shell one-liner
PID:4624 -
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTPEFUK.exe.bat" "88⤵PID:3888
-
C:\windows\system\QTPEFUK.exeC:\windows\system\QTPEFUK.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRUB.exe.bat" "90⤵PID:5712
-
C:\windows\SysWOW64\NRUB.exeC:\windows\system32\NRUB.exe91⤵
- Executes dropped EXE
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TRCP.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5920 -
C:\windows\SysWOW64\TRCP.exeC:\windows\system32\TRCP.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TECDE.exe.bat" "94⤵
- Executes a command shell one-liner
PID:3728 -
C:\windows\SysWOW64\TECDE.exeC:\windows\system32\TECDE.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSHNGKF.exe.bat" "96⤵
- Executes a command shell one-liner
PID:2808 -
C:\windows\system\VSHNGKF.exeC:\windows\system\VSHNGKF.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXF.exe.bat" "98⤵PID:2452
-
C:\windows\SysWOW64\KXF.exeC:\windows\system32\KXF.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QYNXEW.exe.bat" "100⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4992 -
C:\windows\QYNXEW.exeC:\windows\QYNXEW.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KLRHPWX.exe.bat" "102⤵PID:2332
-
C:\windows\system\KLRHPWX.exeC:\windows\system\KLRHPWX.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HQXEWGZ.exe.bat" "104⤵PID:4356
-
C:\windows\system\HQXEWGZ.exeC:\windows\system\HQXEWGZ.exe105⤵
- Executes dropped EXE
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HWP.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:4808 -
C:\windows\system\HWP.exeC:\windows\system\HWP.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WRHXIG.exe.bat" "108⤵
- Executes a command shell one-liner
PID:5844 -
C:\windows\system\WRHXIG.exeC:\windows\system\WRHXIG.exe109⤵
- Executes dropped EXE
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NCXUQS.exe.bat" "110⤵PID:4648
-
C:\windows\NCXUQS.exeC:\windows\NCXUQS.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZKE.exe.bat" "112⤵PID:4104
-
C:\windows\SysWOW64\ZKE.exeC:\windows\system32\ZKE.exe113⤵
- Executes dropped EXE
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDHN.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:2224 -
C:\windows\system\KDHN.exeC:\windows\system\KDHN.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FYMXNS.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3664 -
C:\windows\system\FYMXNS.exeC:\windows\system\FYMXNS.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODWP.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4064 -
C:\windows\ODWP.exeC:\windows\ODWP.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJCM.exe.bat" "120⤵PID:3568
-
C:\windows\SysWOW64\KJCM.exeC:\windows\system32\KJCM.exe121⤵
- Executes dropped EXE
PID:1856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-