Analysis
- max time kernel
112s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe
- Size 208KB
- Sample261110-wt2drshf98
- SHA256 7bf318341c6f36d78f0ee04f462940cba25603e0b1f48daf119eb7deaaab8962
- MD5 5f71febc9b5768c89dce0e09465be8b5
- SHA1 8a4362ec09d3ea7860cad21915f5f447dc5c98c0
- SHA512 0727f5b62dcfe3bd269a4dfc87c187aafcefec997e3dbadc5913b2cf8660b434c5f95fba09641cbfd3f28d70801e27d8f87eeee7d3c8448e4833b02f5952734a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlldL+LOf24pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFll5+LOOkEj1
- TLSH T18F247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2616 MWHPDWL.exe 2568 GUIHS.exe 5128 VPR.exe 4928 DDKA.exe 856 AACQ.exe 5208 AOCEE.exe 2292 MWJEIHL.exe 4140 FZMIVX.exe 4608 KZUVFZV.exe 4252 WSX.exe 4832 OVBKSXM.exe 5844 GVD.exe 1224 PJNPMZ.exe 6124 LOLET.exe 692 PRJ.exe 5964 MXPWI.exe 1936 JUVLP.exe 5336 WFDKD.exe 3536 WLEZE.exe 2192 CLLMNF.exe 5376 YQJJCPE.exe 3016 TEOT.exe 2288 PJUQUY.exe 1464 KXY.exe 3068 VPBSEFZ.exe 1920 SVZH.exe 2576 GAFEA.exe 3464 DYLBH.exe 4356 DLDQJO.exe 1368 JML.exe 5360 AMNJ.exe 3448 PSSGKX.exe 2416 LXY.exe 5308 GKDM.exe 236 CQBJ.exe 1244 XDGTTI.exe 1992 IWJETYU.exe 2632 QGRFHCI.exe 3640 HRIDHWE.exe 1268 GKQWU.exe 3884 MKYSE.exe 2296 YDTDMK.exe 2696 ABUFSHR.exe 3812 UOZ.exe 1492 AOHCLB.exe 1308 XUEZS.exe 2256 RHJJDLY.exe 2364 CAM.exe 1752 ZFSYS.exe 3144 KYNJSJ.exe 3944 VQQCB.exe 4564 QEVLLQB.exe 1676 WEDZU.exe 3932 RRHQES.exe 1324 AAJ.exe 1980 RFUOX.exe 592 MAZXIUV.exe 5588 MGR.exe 2376 TQZ.exe 4600 FJCY.exe 5860 TOIVEC.exe 1956 QUGSTE.exe 2976 UCNSG.exe 1260 FUQL.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\QEVLLQB.exe.bat VQQCB.exe File created C:\windows\SysWOW64\HWC.exe.bat HET.exe File opened for modification C:\windows\SysWOW64\FJX.exe LWTNYSN.exe File opened for modification C:\windows\SysWOW64\FLRQQ.exe GSJ.exe File created C:\windows\SysWOW64\JWFSJQ.exe.bat UBWN.exe File opened for modification C:\windows\SysWOW64\MWHPDWL.exe 2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe File created C:\windows\SysWOW64\GUIHS.exe MWHPDWL.exe File created C:\windows\SysWOW64\GUIHS.exe.bat MWHPDWL.exe File created C:\windows\SysWOW64\WSX.exe KZUVFZV.exe File created C:\windows\SysWOW64\HRIDHWE.exe.bat QGRFHCI.exe File created C:\windows\SysWOW64\ZFSYS.exe CAM.exe File opened for modification C:\windows\SysWOW64\ZNREODW.exe OVW.exe File opened for modification C:\windows\SysWOW64\WSX.exe KZUVFZV.exe File opened for modification C:\windows\SysWOW64\CTKS.exe FWM.exe File created C:\windows\SysWOW64\AHEPJKP.exe.bat JWFSJQ.exe File created C:\windows\SysWOW64\ZZMR.exe.bat AHEPJKP.exe File opened for modification C:\windows\SysWOW64\QEZR.exe SERD.exe File created C:\windows\SysWOW64\GSJ.exe JND.exe File created C:\windows\SysWOW64\FZMIVX.exe MWJEIHL.exe File created C:\windows\SysWOW64\PRJ.exe.bat LOLET.exe File opened for modification C:\windows\SysWOW64\IWJETYU.exe XDGTTI.exe File opened for modification C:\windows\SysWOW64\RRHQES.exe WEDZU.exe File created C:\windows\SysWOW64\WNA.exe NAQZHRE.exe File created C:\windows\SysWOW64\OLQWREI.exe OGYIPZ.exe File created C:\windows\SysWOW64\QRT.exe ILTZTGV.exe File opened for modification C:\windows\SysWOW64\RXDWIF.exe RRCHH.exe File opened for modification C:\windows\SysWOW64\GAFEA.exe SVZH.exe File opened for modification C:\windows\SysWOW64\HRIDHWE.exe QGRFHCI.exe File created C:\windows\SysWOW64\YDTDMK.exe MKYSE.exe File opened for modification C:\windows\SysWOW64\CVEL.exe HIZCPUO.exe File created C:\windows\SysWOW64\WSX.exe.bat KZUVFZV.exe File created C:\windows\SysWOW64\YDTDMK.exe.bat MKYSE.exe File created C:\windows\SysWOW64\WNA.exe.bat NAQZHRE.exe File opened for modification C:\windows\SysWOW64\OLQWREI.exe OGYIPZ.exe File created C:\windows\SysWOW64\QRT.exe.bat ILTZTGV.exe File created C:\windows\SysWOW64\JRQ.exe.bat YZNN.exe File opened for modification C:\windows\SysWOW64\ZFSYS.exe CAM.exe File created C:\windows\SysWOW64\UBWN.exe.bat ZNREODW.exe File opened for modification C:\windows\SysWOW64\RRCHH.exe VMFKAQ.exe File created C:\windows\SysWOW64\QEZR.exe SERD.exe File created C:\windows\SysWOW64\KRTIZ.exe YZQPYQ.exe File created C:\windows\SysWOW64\MYXM.exe CDGAFF.exe File created C:\windows\SysWOW64\JRQ.exe YZNN.exe File opened for modification C:\windows\SysWOW64\BWPYD.exe BLPWX.exe File created C:\windows\SysWOW64\BWPYD.exe.bat BLPWX.exe File created C:\windows\SysWOW64\UBWN.exe ZNREODW.exe File created C:\windows\SysWOW64\FJX.exe LWTNYSN.exe File opened for modification C:\windows\SysWOW64\GSJ.exe JND.exe File opened for modification C:\windows\SysWOW64\VPR.exe GUIHS.exe File created C:\windows\SysWOW64\DDKA.exe.bat VPR.exe File opened for modification C:\windows\SysWOW64\WEDZU.exe QEVLLQB.exe File created C:\windows\SysWOW64\IGF.exe SWP.exe File created C:\windows\SysWOW64\WPWJHN.exe WXOPTB.exe File created C:\windows\SysWOW64\FJX.exe.bat LWTNYSN.exe File created C:\windows\SysWOW64\FLRQQ.exe GSJ.exe File created C:\windows\SysWOW64\RRHQES.exe WEDZU.exe File created C:\windows\SysWOW64\ILTZTGV.exe CLLLK.exe File opened for modification C:\windows\SysWOW64\IGF.exe SWP.exe File created C:\windows\SysWOW64\QEZR.exe.bat SERD.exe File opened for modification C:\windows\SysWOW64\GUIHS.exe MWHPDWL.exe File opened for modification C:\windows\SysWOW64\GKDM.exe LXY.exe File created C:\windows\SysWOW64\QEVLLQB.exe VQQCB.exe File created C:\windows\SysWOW64\CTKS.exe.bat FWM.exe File created C:\windows\SysWOW64\CVEL.exe HIZCPUO.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\JUVLP.exe.bat MXPWI.exe File created C:\windows\HET.exe.bat OLQWREI.exe File created C:\windows\system\UDJK.exe.bat SFI.exe File created C:\windows\KNSNJSF.exe.bat KHRYIF.exe File created C:\windows\CDGAFF.exe ZIBR.exe File created C:\windows\system\MPFCGQ.exe.bat SSEAIT.exe File created C:\windows\AACQ.exe.bat DDKA.exe File created C:\windows\system\CLLMNF.exe.bat WLEZE.exe File created C:\windows\KXY.exe PJUQUY.exe File opened for modification C:\windows\PSSGKX.exe AMNJ.exe File created C:\windows\TQZ.exe.bat MGR.exe File created C:\windows\system\WPCRBF.exe KWZYS.exe File created C:\windows\system\RYPEPL.exe WKKU.exe File opened for modification C:\windows\WFDKD.exe JUVLP.exe File created C:\windows\PSSGKX.exe.bat AMNJ.exe File created C:\windows\system\FUQL.exe.bat UCNSG.exe File opened for modification C:\windows\system\TTYO.exe WNA.exe File opened for modification C:\windows\ELBZNF.exe TTYO.exe File created C:\windows\TDVPG.exe.bat NDV.exe File created C:\windows\system\THOS.exe CUDIQP.exe File created C:\windows\system\AOCEE.exe.bat AACQ.exe File opened for modification C:\windows\system\DYLBH.exe GAFEA.exe File created C:\windows\LXY.exe.bat PSSGKX.exe File opened for modification C:\windows\system\QGRFHCI.exe IWJETYU.exe File created C:\windows\XUEZS.exe.bat AOHCLB.exe File created C:\windows\CAM.exe RHJJDLY.exe File created C:\windows\system\HIZCPUO.exe WPWJHN.exe File created C:\windows\PBBMN.exe.bat TDVPG.exe File created C:\windows\system\WLEZE.exe WFDKD.exe File opened for modification C:\windows\UCNSG.exe QUGSTE.exe File created C:\windows\NBMB.exe TOHSREU.exe File created C:\windows\ZIBR.exe.bat KNSNJSF.exe File created C:\windows\system\BLPWX.exe.bat QSME.exe File created C:\windows\KZUVFZV.exe.bat FZMIVX.exe File created C:\windows\system\DYLBH.exe GAFEA.exe File created C:\windows\TQZ.exe MGR.exe File opened for modification C:\windows\FWM.exe UDJK.exe File created C:\windows\MWJEIHL.exe AOCEE.exe File created C:\windows\HET.exe OLQWREI.exe File created C:\windows\OFG.exe GAN.exe File created C:\windows\IQNCZ.exe IKNO.exe File created C:\windows\system\BLPWX.exe QSME.exe File created C:\windows\system\TEOT.exe.bat YQJJCPE.exe File created C:\windows\system\DLDQJO.exe.bat DYLBH.exe File opened for modification C:\windows\XUEZS.exe AOHCLB.exe File created C:\windows\VQQCB.exe KYNJSJ.exe File created C:\windows\NAQZHRE.exe FUQL.exe File opened for modification C:\windows\system\IHI.exe XPFTJYF.exe File created C:\windows\GAN.exe CKZAP.exe File opened for modification C:\windows\ZIBR.exe KNSNJSF.exe File created C:\windows\system\CQBJ.exe.bat GKDM.exe File created C:\windows\XDGTTI.exe.bat CQBJ.exe File opened for modification C:\windows\system\UOZ.exe ABUFSHR.exe File created C:\windows\system\CKZAP.exe HWC.exe File opened for modification C:\windows\system\IYWZSOV.exe FLRQQ.exe File created C:\windows\GVD.exe OVBKSXM.exe File created C:\windows\VPBSEFZ.exe.bat KXY.exe File opened for modification C:\windows\system\MAZXIUV.exe RFUOX.exe File opened for modification C:\windows\MGR.exe MAZXIUV.exe File created C:\windows\system\SFI.exe DAKLPJ.exe File opened for modification C:\windows\system\YZQPYQ.exe CTKS.exe File created C:\windows\system\HIZCPUO.exe.bat WPWJHN.exe File opened for modification C:\windows\system\YZNN.exe ELIERGZ.exe File opened for modification C:\windows\system\RHJJDLY.exe XUEZS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2124 cmd.exe 2712 cmd.exe 3496 cmd.exe 5912 cmd.exe 1300 cmd.exe 6052 cmd.exe 5396 cmd.exe 2352 cmd.exe 4728 cmd.exe 5500 cmd.exe 2928 cmd.exe 824 cmd.exe 1312 cmd.exe 4676 cmd.exe 3172 cmd.exe 5908 cmd.exe 2508 cmd.exe 6000 cmd.exe 4944 cmd.exe 2700 cmd.exe 1796 cmd.exe 1908 cmd.exe 4868 cmd.exe 4808 cmd.exe 4836 cmd.exe 2748 cmd.exe 4708 cmd.exe 2144 cmd.exe 1672 cmd.exe 4732 cmd.exe 4212 cmd.exe 5696 cmd.exe 3040 cmd.exe 5612 cmd.exe 5224 cmd.exe 4012 cmd.exe 4428 cmd.exe 1120 cmd.exe 3840 cmd.exe 4596 cmd.exe 4916 cmd.exe 708 cmd.exe 1648 cmd.exe 2800 cmd.exe 5948 cmd.exe 4460 cmd.exe 1200 cmd.exe 2460 cmd.exe 4444 cmd.exe 4664 cmd.exe 1036 cmd.exe 3012 cmd.exe 4000 cmd.exe 4556 cmd.exe 2612 cmd.exe 5388 cmd.exe 4780 cmd.exe 3820 cmd.exe 4672 cmd.exe 2580 cmd.exe 4396 cmd.exe 3916 cmd.exe 4588 cmd.exe 3028 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4672 2644 WerFault.exe 88 3952 2616 WerFault.exe 93 4556 2568 WerFault.exe 99 4004 5128 WerFault.exe 104 3756 4928 WerFault.exe 109 1956 856 WerFault.exe 114 5448 5208 WerFault.exe 119 5796 2292 WerFault.exe 125 592 4140 WerFault.exe 130 4544 4608 WerFault.exe 135 5224 4252 WerFault.exe 140 2380 4832 WerFault.exe 145 1116 5844 WerFault.exe 150 5684 1224 WerFault.exe 155 760 6124 WerFault.exe 160 260 692 WerFault.exe 165 628 5964 WerFault.exe 170 4216 1936 WerFault.exe 175 4432 5336 WerFault.exe 180 2460 3536 WerFault.exe 185 1908 2192 WerFault.exe 190 5072 5376 WerFault.exe 195 4004 3016 WerFault.exe 200 4932 2288 WerFault.exe 205 5768 1464 WerFault.exe 210 5004 3068 WerFault.exe 215 5616 1920 WerFault.exe 220 3564 2576 WerFault.exe 225 4296 3464 WerFault.exe 230 5876 4356 WerFault.exe 235 3840 1368 WerFault.exe 240 3160 5360 WerFault.exe 245 2452 3448 WerFault.exe 250 2696 2416 WerFault.exe 255 2940 5308 WerFault.exe 260 1764 236 WerFault.exe 265 5704 1244 WerFault.exe 270 5272 1992 WerFault.exe 275 3500 2632 WerFault.exe 280 1752 3640 WerFault.exe 285 3228 1268 WerFault.exe 291 4404 3884 WerFault.exe 296 4856 2296 WerFault.exe 301 5256 2696 WerFault.exe 306 1180 3812 WerFault.exe 311 1324 1492 WerFault.exe 316 1000 1308 WerFault.exe 321 3484 2256 WerFault.exe 326 5984 2364 WerFault.exe 331 4716 1752 WerFault.exe 336 1480 3144 WerFault.exe 341 5808 3944 WerFault.exe 346 3828 4564 WerFault.exe 351 4596 1676 WerFault.exe 356 628 3932 WerFault.exe 361 2412 1324 WerFault.exe 366 4116 1980 WerFault.exe 371 5952 592 WerFault.exe 376 4676 5588 WerFault.exe 381 3636 2376 WerFault.exe 386 2844 4600 WerFault.exe 391 5300 5860 WerFault.exe 396 5004 1956 WerFault.exe 401 4660 2976 WerFault.exe 406 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KNSNJSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLRQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDKA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHJJDLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CLLLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGAOJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLDQJO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABUFSHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OFG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NAQZHRE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIZCPUO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFDKD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYLBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQQCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCNSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PBBMN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AACQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKYSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYNJSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMFKAQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZQPYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNREODW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQNCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVBKSXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUGSTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZEEG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOCEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2644 2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe 2644 2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe 2616 MWHPDWL.exe 2616 MWHPDWL.exe 2568 GUIHS.exe 2568 GUIHS.exe 5128 VPR.exe 5128 VPR.exe 4928 DDKA.exe 4928 DDKA.exe 856 AACQ.exe 856 AACQ.exe 5208 AOCEE.exe 5208 AOCEE.exe 2292 MWJEIHL.exe 2292 MWJEIHL.exe 4140 FZMIVX.exe 4140 FZMIVX.exe 4608 KZUVFZV.exe 4608 KZUVFZV.exe 4252 WSX.exe 4252 WSX.exe 4832 OVBKSXM.exe 4832 OVBKSXM.exe 5844 GVD.exe 5844 GVD.exe 1224 PJNPMZ.exe 1224 PJNPMZ.exe 6124 LOLET.exe 6124 LOLET.exe 692 PRJ.exe 692 PRJ.exe 5964 MXPWI.exe 5964 MXPWI.exe 1936 JUVLP.exe 1936 JUVLP.exe 5336 WFDKD.exe 5336 WFDKD.exe 3536 WLEZE.exe 3536 WLEZE.exe 2192 CLLMNF.exe 2192 CLLMNF.exe 5376 YQJJCPE.exe 5376 YQJJCPE.exe 3016 TEOT.exe 3016 TEOT.exe 2288 PJUQUY.exe 2288 PJUQUY.exe 1464 KXY.exe 1464 KXY.exe 3068 VPBSEFZ.exe 3068 VPBSEFZ.exe 1920 SVZH.exe 1920 SVZH.exe 2576 GAFEA.exe 2576 GAFEA.exe 3464 DYLBH.exe 3464 DYLBH.exe 4356 DLDQJO.exe 4356 DLDQJO.exe 1368 JML.exe 1368 JML.exe 5360 AMNJ.exe 5360 AMNJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2644 2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe 2644 2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe 2616 MWHPDWL.exe 2616 MWHPDWL.exe 2568 GUIHS.exe 2568 GUIHS.exe 5128 VPR.exe 5128 VPR.exe 4928 DDKA.exe 4928 DDKA.exe 856 AACQ.exe 856 AACQ.exe 5208 AOCEE.exe 5208 AOCEE.exe 2292 MWJEIHL.exe 2292 MWJEIHL.exe 4140 FZMIVX.exe 4140 FZMIVX.exe 4608 KZUVFZV.exe 4608 KZUVFZV.exe 4252 WSX.exe 4252 WSX.exe 4832 OVBKSXM.exe 4832 OVBKSXM.exe 5844 GVD.exe 5844 GVD.exe 1224 PJNPMZ.exe 1224 PJNPMZ.exe 6124 LOLET.exe 6124 LOLET.exe 692 PRJ.exe 692 PRJ.exe 5964 MXPWI.exe 5964 MXPWI.exe 1936 JUVLP.exe 1936 JUVLP.exe 5336 WFDKD.exe 5336 WFDKD.exe 3536 WLEZE.exe 3536 WLEZE.exe 2192 CLLMNF.exe 2192 CLLMNF.exe 5376 YQJJCPE.exe 5376 YQJJCPE.exe 3016 TEOT.exe 3016 TEOT.exe 2288 PJUQUY.exe 2288 PJUQUY.exe 1464 KXY.exe 1464 KXY.exe 3068 VPBSEFZ.exe 3068 VPBSEFZ.exe 1920 SVZH.exe 1920 SVZH.exe 2576 GAFEA.exe 2576 GAFEA.exe 3464 DYLBH.exe 3464 DYLBH.exe 4356 DLDQJO.exe 4356 DLDQJO.exe 1368 JML.exe 1368 JML.exe 5360 AMNJ.exe 5360 AMNJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 1884 2644 2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe 89 PID 1884 wrote to memory of 2616 1884 cmd.exe 93 PID 2616 wrote to memory of 3568 2616 MWHPDWL.exe 95 PID 3568 wrote to memory of 2568 3568 cmd.exe 99 PID 2568 wrote to memory of 5388 2568 GUIHS.exe 100 PID 5388 wrote to memory of 5128 5388 cmd.exe 104 PID 5128 wrote to memory of 3300 5128 VPR.exe 105 PID 3300 wrote to memory of 4928 3300 cmd.exe 109 PID 4928 wrote to memory of 3468 4928 DDKA.exe 110 PID 3468 wrote to memory of 856 3468 cmd.exe 114 PID 856 wrote to memory of 5884 856 AACQ.exe 115 PID 5884 wrote to memory of 5208 5884 cmd.exe 119 PID 5208 wrote to memory of 204 5208 AOCEE.exe 121 PID 204 wrote to memory of 2292 204 cmd.exe 125 PID 2292 wrote to memory of 1328 2292 MWJEIHL.exe 126 PID 1328 wrote to memory of 4140 1328 cmd.exe 130 PID 4140 wrote to memory of 5920 4140 FZMIVX.exe 131 PID 5920 wrote to memory of 4608 5920 cmd.exe 135 PID 4608 wrote to memory of 4292 4608 KZUVFZV.exe 136 PID 4292 wrote to memory of 4252 4292 cmd.exe 140 PID 4252 wrote to memory of 5640 4252 WSX.exe 141 PID 5640 wrote to memory of 4832 5640 cmd.exe 145 PID 4832 wrote to memory of 4780 4832 OVBKSXM.exe 146 PID 4780 wrote to memory of 5844 4780 cmd.exe 150 PID 5844 wrote to memory of 2612 5844 GVD.exe 151 PID 2612 wrote to memory of 1224 2612 cmd.exe 155 PID 1224 wrote to memory of 1172 1224 PJNPMZ.exe 156 PID 1172 wrote to memory of 6124 1172 cmd.exe 160 PID 6124 wrote to memory of 5176 6124 LOLET.exe 161 PID 5176 wrote to memory of 692 5176 cmd.exe 165 PID 692 wrote to memory of 2596 692 PRJ.exe 166 PID 2596 wrote to memory of 5964 2596 cmd.exe 170 PID 5964 wrote to memory of 5560 5964 MXPWI.exe 171 PID 5560 wrote to memory of 1936 5560 cmd.exe 175 PID 1936 wrote to memory of 2428 1936 JUVLP.exe 176 PID 2428 wrote to memory of 5336 2428 cmd.exe 180 PID 5336 wrote to memory of 5732 5336 WFDKD.exe 181 PID 5732 wrote to memory of 3536 5732 cmd.exe 185 PID 3536 wrote to memory of 2124 3536 WLEZE.exe 186 PID 2124 wrote to memory of 2192 2124 cmd.exe 190 PID 2192 wrote to memory of 4988 2192 CLLMNF.exe 191 PID 4988 wrote to memory of 5376 4988 cmd.exe 195 PID 5376 wrote to memory of 2380 5376 YQJJCPE.exe 196 PID 2380 wrote to memory of 3016 2380 cmd.exe 200 PID 3016 wrote to memory of 1116 3016 TEOT.exe 201 PID 1116 wrote to memory of 2288 1116 cmd.exe 205 PID 2288 wrote to memory of 3064 2288 PJUQUY.exe 206 PID 3064 wrote to memory of 1464 3064 cmd.exe 210 PID 1464 wrote to memory of 3948 1464 KXY.exe 211 PID 3948 wrote to memory of 3068 3948 cmd.exe 215 PID 3068 wrote to memory of 4836 3068 VPBSEFZ.exe 216 PID 4836 wrote to memory of 1920 4836 cmd.exe 220 PID 1920 wrote to memory of 4588 1920 SVZH.exe 221 PID 4588 wrote to memory of 2576 4588 cmd.exe 225 PID 2576 wrote to memory of 3260 2576 GAFEA.exe 226 PID 3260 wrote to memory of 3464 3260 cmd.exe 230 PID 3464 wrote to memory of 3028 3464 DYLBH.exe 231 PID 3028 wrote to memory of 4356 3028 cmd.exe 235 PID 4356 wrote to memory of 4544 4356 DLDQJO.exe 236 PID 4544 wrote to memory of 1368 4544 cmd.exe 240 PID 1368 wrote to memory of 4312 1368 JML.exe 241 PID 4312 wrote to memory of 5360 4312 cmd.exe 245 PID 5360 wrote to memory of 2880 5360 AMNJ.exe 246 PID 2880 wrote to memory of 3448 2880 cmd.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_5f71febc9b5768c89dce0e09465be8b5_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MWHPDWL.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\windows\SysWOW64\MWHPDWL.exeC:\windows\system32\MWHPDWL.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GUIHS.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\windows\SysWOW64\GUIHS.exeC:\windows\system32\GUIHS.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPR.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\windows\SysWOW64\VPR.exeC:\windows\system32\VPR.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DDKA.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\windows\SysWOW64\DDKA.exeC:\windows\system32\DDKA.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AACQ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\windows\AACQ.exeC:\windows\AACQ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOCEE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\system\AOCEE.exeC:\windows\system\AOCEE.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWJEIHL.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:204 -
C:\windows\MWJEIHL.exeC:\windows\MWJEIHL.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FZMIVX.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\windows\SysWOW64\FZMIVX.exeC:\windows\system32\FZMIVX.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KZUVFZV.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\windows\KZUVFZV.exeC:\windows\KZUVFZV.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSX.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\windows\SysWOW64\WSX.exeC:\windows\system32\WSX.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVBKSXM.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\windows\OVBKSXM.exeC:\windows\OVBKSXM.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVD.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\GVD.exeC:\windows\GVD.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJNPMZ.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\windows\system\PJNPMZ.exeC:\windows\system\PJNPMZ.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LOLET.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\windows\LOLET.exeC:\windows\LOLET.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\SysWOW64\PRJ.exeC:\windows\system32\PRJ.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXPWI.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\system\MXPWI.exeC:\windows\system\MXPWI.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JUVLP.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\windows\JUVLP.exeC:\windows\JUVLP.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFDKD.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\windows\WFDKD.exeC:\windows\WFDKD.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLEZE.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\windows\system\WLEZE.exeC:\windows\system\WLEZE.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLLMNF.exe.bat" "40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\system\CLLMNF.exeC:\windows\system\CLLMNF.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQJJCPE.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\system\YQJJCPE.exeC:\windows\system\YQJJCPE.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEOT.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\windows\system\TEOT.exeC:\windows\system\TEOT.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJUQUY.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\PJUQUY.exeC:\windows\PJUQUY.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXY.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\KXY.exeC:\windows\KXY.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPBSEFZ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\windows\VPBSEFZ.exeC:\windows\VPBSEFZ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVZH.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\SVZH.exeC:\windows\SVZH.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAFEA.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\windows\SysWOW64\GAFEA.exeC:\windows\system32\GAFEA.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYLBH.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\windows\system\DYLBH.exeC:\windows\system\DYLBH.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLDQJO.exe.bat" "58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\windows\system\DLDQJO.exeC:\windows\system\DLDQJO.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JML.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\JML.exeC:\windows\JML.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AMNJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\SysWOW64\AMNJ.exeC:\windows\system32\AMNJ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSSGKX.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\PSSGKX.exeC:\windows\PSSGKX.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXY.exe.bat" "66⤵PID:5156
-
C:\windows\LXY.exeC:\windows\LXY.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKDM.exe.bat" "68⤵PID:4288
-
C:\windows\SysWOW64\GKDM.exeC:\windows\system32\GKDM.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQBJ.exe.bat" "70⤵
- Executes a command shell one-liner
PID:4916 -
C:\windows\system\CQBJ.exeC:\windows\system\CQBJ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDGTTI.exe.bat" "72⤵PID:1320
-
C:\windows\XDGTTI.exeC:\windows\XDGTTI.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IWJETYU.exe.bat" "74⤵PID:5616
-
C:\windows\SysWOW64\IWJETYU.exeC:\windows\system32\IWJETYU.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGRFHCI.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2508 -
C:\windows\system\QGRFHCI.exeC:\windows\system\QGRFHCI.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRIDHWE.exe.bat" "78⤵
- Executes a command shell one-liner
PID:2748 -
C:\windows\SysWOW64\HRIDHWE.exeC:\windows\system32\HRIDHWE.exe79⤵
- Executes dropped EXE
PID:3640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKQWU.exe.bat" "80⤵
- Executes a command shell one-liner
PID:6000 -
C:\windows\system\GKQWU.exeC:\windows\system\GKQWU.exe81⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MKYSE.exe.bat" "82⤵PID:5972
-
C:\windows\SysWOW64\MKYSE.exeC:\windows\system32\MKYSE.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDTDMK.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4944 -
C:\windows\SysWOW64\YDTDMK.exeC:\windows\system32\YDTDMK.exe85⤵
- Executes dropped EXE
PID:2296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABUFSHR.exe.bat" "86⤵
- Executes a command shell one-liner
PID:2712 -
C:\windows\system\ABUFSHR.exeC:\windows\system\ABUFSHR.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOZ.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3496 -
C:\windows\system\UOZ.exeC:\windows\system\UOZ.exe89⤵
- Executes dropped EXE
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOHCLB.exe.bat" "90⤵PID:3412
-
C:\windows\system\AOHCLB.exeC:\windows\system\AOHCLB.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XUEZS.exe.bat" "92⤵PID:5332
-
C:\windows\XUEZS.exeC:\windows\XUEZS.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHJJDLY.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:3700 -
C:\windows\system\RHJJDLY.exeC:\windows\system\RHJJDLY.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAM.exe.bat" "96⤵
- Executes a command shell one-liner
PID:2460 -
C:\windows\CAM.exeC:\windows\CAM.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZFSYS.exe.bat" "98⤵PID:4748
-
C:\windows\SysWOW64\ZFSYS.exeC:\windows\system32\ZFSYS.exe99⤵
- Executes dropped EXE
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYNJSJ.exe.bat" "100⤵PID:5240
-
C:\windows\SysWOW64\KYNJSJ.exeC:\windows\system32\KYNJSJ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQQCB.exe.bat" "102⤵PID:3008
-
C:\windows\VQQCB.exeC:\windows\VQQCB.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEVLLQB.exe.bat" "104⤵PID:4604
-
C:\windows\SysWOW64\QEVLLQB.exeC:\windows\system32\QEVLLQB.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WEDZU.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4708 -
C:\windows\SysWOW64\WEDZU.exeC:\windows\system32\WEDZU.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRHQES.exe.bat" "108⤵PID:5856
-
C:\windows\SysWOW64\RRHQES.exeC:\windows\system32\RRHQES.exe109⤵
- Executes dropped EXE
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AAJ.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4332 -
C:\windows\system\AAJ.exeC:\windows\system\AAJ.exe111⤵
- Executes dropped EXE
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFUOX.exe.bat" "112⤵PID:2032
-
C:\windows\system\RFUOX.exeC:\windows\system\RFUOX.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MAZXIUV.exe.bat" "114⤵PID:2060
-
C:\windows\system\MAZXIUV.exeC:\windows\system\MAZXIUV.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGR.exe.bat" "116⤵
- Executes a command shell one-liner
PID:3820 -
C:\windows\MGR.exeC:\windows\MGR.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQZ.exe.bat" "118⤵
- Executes a command shell one-liner
PID:4444 -
C:\windows\TQZ.exeC:\windows\TQZ.exe119⤵
- Executes dropped EXE
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJCY.exe.bat" "120⤵PID:4032
-
C:\windows\FJCY.exeC:\windows\FJCY.exe121⤵
- Executes dropped EXE
PID:4600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-