Analysis
- max time kernel
86s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 23:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_0c3a6802c6519385c9c06e6cabc846fb_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-28_0c3a6802c6519385c9c06e6cabc846fb_elex_emotet_stop.exe
- Size 208KB
- Sample260728-3mfbaace94
- SHA256 834e9fe61ffb0c8cc1c1c435d79bd972c03e5c281b65844b567b95039886bf36
- MD5 0c3a6802c6519385c9c06e6cabc846fb
- SHA1 ecf104fba767e51e2a04116a4c40ee159b9e6d1b
- SHA512 66f7e1e90a40c13dd85b6b9bf068503354aff28a4708f1f5094fd5d5b973cb6d583bfb51831a3b735b18bea4ab6202c7281ed199de28b9f9ec47b8c5f61ac6de
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5Xb1lldL+LOf54pLthEjQT6j:MlZtbLWIgd1LZ9oECZb1ll5+LORkEj1
- TLSH T10C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3736 GCN.exe 4440 GXF.exe 4976 FQUTPU.exe 4692 WQJQCL.exe 3116 QEQO.exe 480 MJAEX.exe 4896 NMEHCYC.exe 3972 KNO.exe 6028 KISNU.exe 4272 MFXA.exe 5412 QVMINTJ.exe 3836 HWG.exe 3156 PJS.exe 4732 MPL.exe 4020 SCKJ.exe 1740 PIUZM.exe 5892 JDZIXQ.exe 3428 ZTA.exe 3444 QTCN.exe 4580 SRHH.exe 3528 TUTDUHS.exe 5004 RKFGPN.exe 1548 RPFUQAV.exe 908 EANTE.exe 2464 DLQJ.exe 2424 YGVSP.exe 4188 GMHZA.exe 5072 KMJB.exe 1804 HSBQU.exe 4772 LVA.exe 5708 YGQCQ.exe 3716 GLVRT.exe 2368 QJADI.exe 1484 PULTRFY.exe 4152 MUN.exe 5324 OHE.exe 5432 QFSZVD.exe 3360 VGUCZ.exe 1552 XEZW.exe 2616 WOK.exe 3388 VZNUYBZ.exe 6076 TXGXTG.exe 3060 NKFV.exe 3584 VQSC.exe 2544 GIZN.exe 1776 HMD.exe 244 CRXUJ.exe 1360 GZE.exe 548 ZCIYA.exe 2972 SVPJS.exe 1772 FTX.exe 5380 RLSN.exe 2312 IYDFK.exe 3668 CMHPUBA.exe 2676 CZIDV.exe 2684 SURIOA.exe 3592 JVTN.exe 3480 AOW.exe 4116 MWKLN.exe 5016 NTQ.exe 5460 OWUBACA.exe 3352 SEBB.exe 4264 HUCATIL.exe 2112 XPLFE.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\EVIB.exe VVG.exe File created C:\windows\SysWOW64\IXETF.exe.bat WHXTT.exe File opened for modification C:\windows\SysWOW64\XZSYNR.exe OQQSJ.exe File opened for modification C:\windows\SysWOW64\EVCT.exe ANWTBSJ.exe File created C:\windows\SysWOW64\DAHTR.exe JHZIA.exe File created C:\windows\SysWOW64\GCN.exe.bat 2026-07-28_0c3a6802c6519385c9c06e6cabc846fb_elex_emotet_stop.exe File created C:\windows\SysWOW64\VGUCZ.exe QFSZVD.exe File created C:\windows\SysWOW64\OWUBACA.exe NTQ.exe File created C:\windows\SysWOW64\MYVX.exe GYNKHAN.exe File created C:\windows\SysWOW64\SSVPBIH.exe.bat JKT.exe File created C:\windows\SysWOW64\STQXFVZ.exe VOK.exe File created C:\windows\SysWOW64\XZSYNR.exe.bat OQQSJ.exe File created C:\windows\SysWOW64\QVMINTJ.exe MFXA.exe File opened for modification C:\windows\SysWOW64\OWUBACA.exe NTQ.exe File opened for modification C:\windows\SysWOW64\SEBB.exe OWUBACA.exe File opened for modification C:\windows\SysWOW64\ZOHYQS.exe KTX.exe File opened for modification C:\windows\SysWOW64\STQXFVZ.exe VOK.exe File created C:\windows\SysWOW64\STQXFVZ.exe.bat VOK.exe File created C:\windows\SysWOW64\IXETF.exe WHXTT.exe File created C:\windows\SysWOW64\IKSPV.exe AFFIL.exe File created C:\windows\SysWOW64\JDZIXQ.exe.bat PIUZM.exe File created C:\windows\SysWOW64\GYNKHAN.exe.bat XPLFE.exe File created C:\windows\SysWOW64\IKSPV.exe.bat AFFIL.exe File created C:\windows\SysWOW64\JHZIA.exe VCU.exe File created C:\windows\SysWOW64\JHZIA.exe.bat VCU.exe File created C:\windows\SysWOW64\VGUCZ.exe.bat QFSZVD.exe File opened for modification C:\windows\SysWOW64\GYNKHAN.exe XPLFE.exe File created C:\windows\SysWOW64\MYVX.exe.bat GYNKHAN.exe File created C:\windows\SysWOW64\WQJQCL.exe FQUTPU.exe File created C:\windows\SysWOW64\EANTE.exe RPFUQAV.exe File created C:\windows\SysWOW64\GYNKHAN.exe XPLFE.exe File created C:\windows\SysWOW64\ZOHYQS.exe.bat KTX.exe File created C:\windows\SysWOW64\KBOE.exe.bat ZOHYQS.exe File created C:\windows\SysWOW64\NMEHCYC.exe.bat MJAEX.exe File opened for modification C:\windows\SysWOW64\SRHH.exe QTCN.exe File opened for modification C:\windows\SysWOW64\OHE.exe MUN.exe File created C:\windows\SysWOW64\VZNUYBZ.exe WOK.exe File created C:\windows\SysWOW64\DAHTR.exe.bat JHZIA.exe File created C:\windows\SysWOW64\ZTA.exe.bat JDZIXQ.exe File created C:\windows\SysWOW64\VZNUYBZ.exe.bat WOK.exe File created C:\windows\SysWOW64\OWUBACA.exe.bat NTQ.exe File created C:\windows\SysWOW64\SEBB.exe.bat OWUBACA.exe File opened for modification C:\windows\SysWOW64\JHZIA.exe VCU.exe File opened for modification C:\windows\SysWOW64\WQJQCL.exe FQUTPU.exe File created C:\windows\SysWOW64\ZTA.exe JDZIXQ.exe File created C:\windows\SysWOW64\SRHH.exe QTCN.exe File opened for modification C:\windows\SysWOW64\MYVX.exe GYNKHAN.exe File created C:\windows\SysWOW64\DWZR.exe DQH.exe File opened for modification C:\windows\SysWOW64\IXETF.exe WHXTT.exe File created C:\windows\SysWOW64\WQJQCL.exe.bat FQUTPU.exe File opened for modification C:\windows\SysWOW64\MJAEX.exe QEQO.exe File opened for modification C:\windows\SysWOW64\TUTDUHS.exe SRHH.exe File opened for modification C:\windows\SysWOW64\EANTE.exe RPFUQAV.exe File created C:\windows\SysWOW64\DQH.exe LDXLW.exe File opened for modification C:\windows\SysWOW64\DQH.exe LDXLW.exe File created C:\windows\SysWOW64\DQH.exe.bat LDXLW.exe File created C:\windows\SysWOW64\DWZR.exe.bat DQH.exe File opened for modification C:\windows\SysWOW64\KTX.exe SSVPBIH.exe File created C:\windows\SysWOW64\ZOHYQS.exe KTX.exe File created C:\windows\SysWOW64\EVIB.exe VVG.exe File opened for modification C:\windows\SysWOW64\IKSPV.exe AFFIL.exe File created C:\windows\SysWOW64\EVCT.exe ANWTBSJ.exe File opened for modification C:\windows\SysWOW64\DAHTR.exe JHZIA.exe File opened for modification C:\windows\SysWOW64\NMEHCYC.exe MJAEX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\SXJ.exe SRJDZTO.exe File opened for modification C:\windows\ANWTBSJ.exe IKSPV.exe File opened for modification C:\windows\system\MWKLN.exe AOW.exe File created C:\windows\system\GMWV.exe.bat KBOE.exe File opened for modification C:\windows\system\QRJP.exe QLJ.exe File opened for modification C:\windows\system\DLQJ.exe EANTE.exe File opened for modification C:\windows\system\MEVMA.exe MYVX.exe File created C:\windows\SURIOA.exe.bat CZIDV.exe File created C:\windows\system\WHXTT.exe.bat WBXFS.exe File opened for modification C:\windows\GZE.exe CRXUJ.exe File created C:\windows\ZCIYA.exe.bat GZE.exe File created C:\windows\PJS.exe HWG.exe File created C:\windows\system\PULTRFY.exe QJADI.exe File opened for modification C:\windows\KISNU.exe KNO.exe File created C:\windows\system\PIUZM.exe SCKJ.exe File opened for modification C:\windows\system\QFSZVD.exe OHE.exe File opened for modification C:\windows\system\CMHPUBA.exe IYDFK.exe File created C:\windows\CCIU.exe.bat FWK.exe File created C:\windows\ANWTBSJ.exe IKSPV.exe File created C:\windows\PJS.exe.bat HWG.exe File opened for modification C:\windows\QLJ.exe EVCT.exe File opened for modification C:\windows\system\WHXTT.exe WBXFS.exe File created C:\windows\IKQQZNC.exe FXLHO.exe File created C:\windows\system\QRJP.exe QLJ.exe File created C:\windows\system\GXF.exe.bat GCN.exe File created C:\windows\HWG.exe.bat QVMINTJ.exe File created C:\windows\SCKJ.exe.bat MPL.exe File created C:\windows\system\DLQJ.exe.bat EANTE.exe File opened for modification C:\windows\TDT.exe IKQQZNC.exe File created C:\windows\OQQSJ.exe.bat TDT.exe File created C:\windows\RQSB.exe.bat AFTL.exe File created C:\windows\RPFUQAV.exe RKFGPN.exe File opened for modification C:\windows\QJADI.exe GLVRT.exe File created C:\windows\system\CRXUJ.exe HMD.exe File opened for modification C:\windows\RPFUQAV.exe RKFGPN.exe File opened for modification C:\windows\system\PULTRFY.exe QJADI.exe File created C:\windows\system\MWKLN.exe AOW.exe File opened for modification C:\windows\system\NKFV.exe TXGXTG.exe File created C:\windows\ZCIYA.exe GZE.exe File opened for modification C:\windows\HMD.exe GIZN.exe File opened for modification C:\windows\NTQ.exe MWKLN.exe File opened for modification C:\windows\system\PIUZM.exe SCKJ.exe File opened for modification C:\windows\system\LVA.exe HSBQU.exe File created C:\windows\system\CMHPUBA.exe IYDFK.exe File created C:\windows\TDT.exe.bat IKQQZNC.exe File opened for modification C:\windows\VCU.exe APPCIQE.exe File created C:\windows\system\MWKLN.exe.bat AOW.exe File created C:\windows\system\MEVMA.exe.bat MYVX.exe File opened for modification C:\windows\JKT.exe SXJ.exe File created C:\windows\QEQO.exe.bat WQJQCL.exe File opened for modification C:\windows\RKFGPN.exe TUTDUHS.exe File created C:\windows\system\VVG.exe DMEJS.exe File opened for modification C:\windows\OQQSJ.exe TDT.exe File created C:\windows\system\AFFIL.exe OMCQ.exe File opened for modification C:\windows\system\AFFIL.exe OMCQ.exe File created C:\windows\system\WOK.exe.bat XEZW.exe File opened for modification C:\windows\system\TXGXTG.exe VZNUYBZ.exe File created C:\windows\system\DLQJ.exe EANTE.exe File opened for modification C:\windows\KMJB.exe GMHZA.exe File opened for modification C:\windows\XPLFE.exe HUCATIL.exe File created C:\windows\ANWTBSJ.exe.bat IKSPV.exe File created C:\windows\KMJB.exe.bat GMHZA.exe File created C:\windows\HSBQU.exe KMJB.exe File opened for modification C:\windows\HSBQU.exe KMJB.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 796 cmd.exe 2200 cmd.exe 5768 cmd.exe 3780 cmd.exe 4484 cmd.exe 616 cmd.exe 5060 cmd.exe 120 cmd.exe 4392 cmd.exe 3832 cmd.exe 5140 cmd.exe 1424 cmd.exe 2848 cmd.exe 4160 cmd.exe 3564 cmd.exe 5312 cmd.exe 3708 cmd.exe 2636 cmd.exe 2064 cmd.exe 3032 cmd.exe 6048 cmd.exe 3792 cmd.exe 4144 cmd.exe 5676 cmd.exe 4572 cmd.exe 5732 cmd.exe 1236 cmd.exe 688 cmd.exe 2992 cmd.exe 5080 cmd.exe 5920 cmd.exe 2740 cmd.exe 2816 cmd.exe 720 cmd.exe 1184 cmd.exe 1072 cmd.exe 2596 cmd.exe 5580 cmd.exe 4876 cmd.exe 4336 cmd.exe 1668 cmd.exe 2416 cmd.exe 5796 cmd.exe 2472 cmd.exe 5424 cmd.exe 6044 cmd.exe 760 cmd.exe 4276 cmd.exe 3312 cmd.exe 3076 cmd.exe 4724 cmd.exe 4736 cmd.exe 3448 cmd.exe 5724 cmd.exe 5208 cmd.exe 5884 cmd.exe 4528 cmd.exe 2536 cmd.exe 6036 cmd.exe 1300 cmd.exe 4616 cmd.exe 4292 cmd.exe 5820 cmd.exe 3624 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1048 3772 WerFault.exe 87 2072 3736 WerFault.exe 93 5176 4440 WerFault.exe 99 3992 4976 WerFault.exe 104 4752 4692 WerFault.exe 109 5788 3116 WerFault.exe 114 2872 480 WerFault.exe 119 1152 4896 WerFault.exe 124 3988 3972 WerFault.exe 129 1480 6028 WerFault.exe 134 3980 4272 WerFault.exe 139 1244 5412 WerFault.exe 144 4324 3836 WerFault.exe 149 892 3156 WerFault.exe 154 4956 4732 WerFault.exe 159 2416 4020 WerFault.exe 164 4456 1740 WerFault.exe 169 4004 5892 WerFault.exe 174 1060 3428 WerFault.exe 179 5848 3444 WerFault.exe 184 2924 4580 WerFault.exe 189 4616 3528 WerFault.exe 194 1668 5004 WerFault.exe 199 1840 1548 WerFault.exe 204 3176 908 WerFault.exe 209 5756 2464 WerFault.exe 214 4840 2424 WerFault.exe 219 3552 4188 WerFault.exe 224 1588 5072 WerFault.exe 229 1940 1804 WerFault.exe 234 5688 4772 WerFault.exe 239 4648 5708 WerFault.exe 244 3056 3716 WerFault.exe 249 4368 2368 WerFault.exe 254 4812 1484 WerFault.exe 259 5928 4152 WerFault.exe 264 920 5324 WerFault.exe 270 1836 5432 WerFault.exe 275 2796 3360 WerFault.exe 280 2904 1552 WerFault.exe 285 3988 2616 WerFault.exe 290 5380 3388 WerFault.exe 295 3980 6076 WerFault.exe 300 4600 3060 WerFault.exe 305 4992 3584 WerFault.exe 310 5176 2544 WerFault.exe 315 1396 1776 WerFault.exe 320 4332 244 WerFault.exe 325 1836 1360 WerFault.exe 330 2092 548 WerFault.exe 335 2472 2972 WerFault.exe 340 1472 1772 WerFault.exe 345 1244 5380 WerFault.exe 350 4300 2312 WerFault.exe 355 4904 3668 WerFault.exe 360 2764 2676 WerFault.exe 365 1824 2684 WerFault.exe 370 1612 3592 WerFault.exe 375 3404 3480 WerFault.exe 380 4532 4116 WerFault.exe 385 3684 5016 WerFault.exe 390 2308 5460 WerFault.exe 395 1352 3352 WerFault.exe 400 3096 4264 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIZN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMWV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIUZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDZIXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSVPBIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKSPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QLJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHZIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMEJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKQQZNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYNKHAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STQXFVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQJQCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTCN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVPJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUCATIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRJDZTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMHPUBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBXFS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VZNUYBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOHYQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3772 2026-07-28_0c3a6802c6519385c9c06e6cabc846fb_elex_emotet_stop.exe 3772 2026-07-28_0c3a6802c6519385c9c06e6cabc846fb_elex_emotet_stop.exe 3736 GCN.exe 3736 GCN.exe 4440 GXF.exe 4440 GXF.exe 4976 FQUTPU.exe 4976 FQUTPU.exe 4692 WQJQCL.exe 4692 WQJQCL.exe 3116 QEQO.exe 3116 QEQO.exe 480 MJAEX.exe 480 MJAEX.exe 4896 NMEHCYC.exe 4896 NMEHCYC.exe 3972 KNO.exe 3972 KNO.exe 6028 KISNU.exe 6028 KISNU.exe 4272 MFXA.exe 4272 MFXA.exe 5412 QVMINTJ.exe 5412 QVMINTJ.exe 3836 HWG.exe 3836 HWG.exe 3156 PJS.exe 3156 PJS.exe 4732 MPL.exe 4732 MPL.exe 4020 SCKJ.exe 4020 SCKJ.exe 1740 PIUZM.exe 1740 PIUZM.exe 5892 JDZIXQ.exe 5892 JDZIXQ.exe 3428 ZTA.exe 3428 ZTA.exe 3444 QTCN.exe 3444 QTCN.exe 4580 SRHH.exe 4580 SRHH.exe 3528 TUTDUHS.exe 3528 TUTDUHS.exe 5004 RKFGPN.exe 5004 RKFGPN.exe 1548 RPFUQAV.exe 1548 RPFUQAV.exe 908 EANTE.exe 908 EANTE.exe 2464 DLQJ.exe 2464 DLQJ.exe 2424 YGVSP.exe 2424 YGVSP.exe 4188 GMHZA.exe 4188 GMHZA.exe 5072 KMJB.exe 5072 KMJB.exe 1804 HSBQU.exe 1804 HSBQU.exe 4772 LVA.exe 4772 LVA.exe 5708 YGQCQ.exe 5708 YGQCQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3772 2026-07-28_0c3a6802c6519385c9c06e6cabc846fb_elex_emotet_stop.exe 3772 2026-07-28_0c3a6802c6519385c9c06e6cabc846fb_elex_emotet_stop.exe 3736 GCN.exe 3736 GCN.exe 4440 GXF.exe 4440 GXF.exe 4976 FQUTPU.exe 4976 FQUTPU.exe 4692 WQJQCL.exe 4692 WQJQCL.exe 3116 QEQO.exe 3116 QEQO.exe 480 MJAEX.exe 480 MJAEX.exe 4896 NMEHCYC.exe 4896 NMEHCYC.exe 3972 KNO.exe 3972 KNO.exe 6028 KISNU.exe 6028 KISNU.exe 4272 MFXA.exe 4272 MFXA.exe 5412 QVMINTJ.exe 5412 QVMINTJ.exe 3836 HWG.exe 3836 HWG.exe 3156 PJS.exe 3156 PJS.exe 4732 MPL.exe 4732 MPL.exe 4020 SCKJ.exe 4020 SCKJ.exe 1740 PIUZM.exe 1740 PIUZM.exe 5892 JDZIXQ.exe 5892 JDZIXQ.exe 3428 ZTA.exe 3428 ZTA.exe 3444 QTCN.exe 3444 QTCN.exe 4580 SRHH.exe 4580 SRHH.exe 3528 TUTDUHS.exe 3528 TUTDUHS.exe 5004 RKFGPN.exe 5004 RKFGPN.exe 1548 RPFUQAV.exe 1548 RPFUQAV.exe 908 EANTE.exe 908 EANTE.exe 2464 DLQJ.exe 2464 DLQJ.exe 2424 YGVSP.exe 2424 YGVSP.exe 4188 GMHZA.exe 4188 GMHZA.exe 5072 KMJB.exe 5072 KMJB.exe 1804 HSBQU.exe 1804 HSBQU.exe 4772 LVA.exe 4772 LVA.exe 5708 YGQCQ.exe 5708 YGQCQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3772 wrote to memory of 6044 3772 2026-07-28_0c3a6802c6519385c9c06e6cabc846fb_elex_emotet_stop.exe 89 PID 6044 wrote to memory of 3736 6044 cmd.exe 93 PID 3736 wrote to memory of 2808 3736 GCN.exe 95 PID 2808 wrote to memory of 4440 2808 cmd.exe 99 PID 4440 wrote to memory of 4780 4440 GXF.exe 100 PID 4780 wrote to memory of 4976 4780 cmd.exe 104 PID 4976 wrote to memory of 4112 4976 FQUTPU.exe 105 PID 4112 wrote to memory of 4692 4112 cmd.exe 109 PID 4692 wrote to memory of 5820 4692 WQJQCL.exe 110 PID 5820 wrote to memory of 3116 5820 cmd.exe 114 PID 3116 wrote to memory of 3708 3116 QEQO.exe 115 PID 3708 wrote to memory of 480 3708 cmd.exe 119 PID 480 wrote to memory of 4528 480 MJAEX.exe 120 PID 4528 wrote to memory of 4896 4528 cmd.exe 124 PID 4896 wrote to memory of 4216 4896 NMEHCYC.exe 125 PID 4216 wrote to memory of 3972 4216 cmd.exe 129 PID 3972 wrote to memory of 2492 3972 KNO.exe 130 PID 2492 wrote to memory of 6028 2492 cmd.exe 134 PID 6028 wrote to memory of 3264 6028 KISNU.exe 135 PID 3264 wrote to memory of 4272 3264 cmd.exe 139 PID 4272 wrote to memory of 2636 4272 MFXA.exe 140 PID 2636 wrote to memory of 5412 2636 cmd.exe 144 PID 5412 wrote to memory of 4104 5412 QVMINTJ.exe 145 PID 4104 wrote to memory of 3836 4104 cmd.exe 149 PID 3836 wrote to memory of 1368 3836 HWG.exe 150 PID 1368 wrote to memory of 3156 1368 cmd.exe 154 PID 3156 wrote to memory of 2800 3156 PJS.exe 155 PID 2800 wrote to memory of 4732 2800 cmd.exe 159 PID 4732 wrote to memory of 2356 4732 MPL.exe 160 PID 2356 wrote to memory of 4020 2356 cmd.exe 164 PID 4020 wrote to memory of 2536 4020 SCKJ.exe 165 PID 2536 wrote to memory of 1740 2536 cmd.exe 169 PID 1740 wrote to memory of 1424 1740 PIUZM.exe 170 PID 1424 wrote to memory of 5892 1424 cmd.exe 174 PID 5892 wrote to memory of 2064 5892 JDZIXQ.exe 175 PID 2064 wrote to memory of 3428 2064 cmd.exe 179 PID 3428 wrote to memory of 5676 3428 ZTA.exe 180 PID 5676 wrote to memory of 3444 5676 cmd.exe 184 PID 3444 wrote to memory of 4548 3444 QTCN.exe 185 PID 4548 wrote to memory of 4580 4548 cmd.exe 189 PID 4580 wrote to memory of 4360 4580 SRHH.exe 190 PID 4360 wrote to memory of 3528 4360 cmd.exe 194 PID 3528 wrote to memory of 760 3528 TUTDUHS.exe 195 PID 760 wrote to memory of 5004 760 cmd.exe 199 PID 5004 wrote to memory of 1056 5004 RKFGPN.exe 200 PID 1056 wrote to memory of 1548 1056 cmd.exe 204 PID 1548 wrote to memory of 3420 1548 RPFUQAV.exe 205 PID 3420 wrote to memory of 908 3420 cmd.exe 209 PID 908 wrote to memory of 4336 908 EANTE.exe 210 PID 4336 wrote to memory of 2464 4336 cmd.exe 214 PID 2464 wrote to memory of 5792 2464 DLQJ.exe 215 PID 5792 wrote to memory of 2424 5792 cmd.exe 219 PID 2424 wrote to memory of 1356 2424 YGVSP.exe 220 PID 1356 wrote to memory of 4188 1356 cmd.exe 224 PID 4188 wrote to memory of 4572 4188 GMHZA.exe 225 PID 4572 wrote to memory of 5072 4572 cmd.exe 229 PID 5072 wrote to memory of 2236 5072 KMJB.exe 230 PID 2236 wrote to memory of 1804 2236 cmd.exe 234 PID 1804 wrote to memory of 5876 1804 HSBQU.exe 235 PID 5876 wrote to memory of 4772 5876 cmd.exe 239 PID 4772 wrote to memory of 3796 4772 LVA.exe 240 PID 3796 wrote to memory of 5708 3796 cmd.exe 244 PID 5708 wrote to memory of 6036 5708 YGQCQ.exe 245 PID 6036 wrote to memory of 3716 6036 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_0c3a6802c6519385c9c06e6cabc846fb_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_0c3a6802c6519385c9c06e6cabc846fb_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCN.exe.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\windows\SysWOW64\GCN.exeC:\windows\system32\GCN.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXF.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\windows\system\GXF.exeC:\windows\system\GXF.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQUTPU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\system\FQUTPU.exeC:\windows\system\FQUTPU.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WQJQCL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\windows\SysWOW64\WQJQCL.exeC:\windows\system32\WQJQCL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QEQO.exe.bat" "10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\windows\QEQO.exeC:\windows\QEQO.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJAEX.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\windows\SysWOW64\MJAEX.exeC:\windows\system32\MJAEX.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMEHCYC.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\SysWOW64\NMEHCYC.exeC:\windows\system32\NMEHCYC.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KNO.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\KNO.exeC:\windows\KNO.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KISNU.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\windows\KISNU.exeC:\windows\KISNU.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFXA.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\system\MFXA.exeC:\windows\system\MFXA.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVMINTJ.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\windows\SysWOW64\QVMINTJ.exeC:\windows\system32\QVMINTJ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWG.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\HWG.exeC:\windows\HWG.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJS.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\windows\PJS.exeC:\windows\PJS.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MPL.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\MPL.exeC:\windows\MPL.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCKJ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\SCKJ.exeC:\windows\SCKJ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PIUZM.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\windows\system\PIUZM.exeC:\windows\system\PIUZM.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDZIXQ.exe.bat" "34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\windows\SysWOW64\JDZIXQ.exeC:\windows\system32\JDZIXQ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTA.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\windows\SysWOW64\ZTA.exeC:\windows\system32\ZTA.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QTCN.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\system\QTCN.exeC:\windows\system\QTCN.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRHH.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\windows\SysWOW64\SRHH.exeC:\windows\system32\SRHH.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TUTDUHS.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\SysWOW64\TUTDUHS.exeC:\windows\system32\TUTDUHS.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKFGPN.exe.bat" "44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
C:\windows\RKFGPN.exeC:\windows\RKFGPN.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RPFUQAV.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\RPFUQAV.exeC:\windows\RPFUQAV.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EANTE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\windows\SysWOW64\EANTE.exeC:\windows\system32\EANTE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLQJ.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\system\DLQJ.exeC:\windows\system\DLQJ.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGVSP.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\windows\YGVSP.exeC:\windows\YGVSP.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMHZA.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\windows\system\GMHZA.exeC:\windows\system\GMHZA.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMJB.exe.bat" "56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\KMJB.exeC:\windows\KMJB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HSBQU.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\windows\HSBQU.exeC:\windows\HSBQU.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LVA.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\windows\system\LVA.exeC:\windows\system\LVA.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGQCQ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\windows\YGQCQ.exeC:\windows\YGQCQ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLVRT.exe.bat" "64⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\windows\GLVRT.exeC:\windows\GLVRT.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QJADI.exe.bat" "66⤵PID:4512
-
C:\windows\QJADI.exeC:\windows\QJADI.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PULTRFY.exe.bat" "68⤵PID:2772
-
C:\windows\system\PULTRFY.exeC:\windows\system\PULTRFY.exe69⤵
- Executes dropped EXE
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUN.exe.bat" "70⤵PID:2912
-
C:\windows\MUN.exeC:\windows\MUN.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OHE.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3032 -
C:\windows\SysWOW64\OHE.exeC:\windows\system32\OHE.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFSZVD.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3780 -
C:\windows\system\QFSZVD.exeC:\windows\system\QFSZVD.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VGUCZ.exe.bat" "76⤵PID:1780
-
C:\windows\SysWOW64\VGUCZ.exeC:\windows\system32\VGUCZ.exe77⤵
- Executes dropped EXE
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XEZW.exe.bat" "78⤵PID:3568
-
C:\windows\XEZW.exeC:\windows\XEZW.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOK.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1236 -
C:\windows\system\WOK.exeC:\windows\system\WOK.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VZNUYBZ.exe.bat" "82⤵
- Executes a command shell one-liner
PID:1300 -
C:\windows\SysWOW64\VZNUYBZ.exeC:\windows\system32\VZNUYBZ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TXGXTG.exe.bat" "84⤵
- Executes a command shell one-liner
PID:3624 -
C:\windows\system\TXGXTG.exeC:\windows\system\TXGXTG.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NKFV.exe.bat" "86⤵PID:824
-
C:\windows\system\NKFV.exeC:\windows\system\NKFV.exe87⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQSC.exe.bat" "88⤵PID:2716
-
C:\windows\system\VQSC.exeC:\windows\system\VQSC.exe89⤵
- Executes dropped EXE
PID:3584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GIZN.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4392 -
C:\windows\GIZN.exeC:\windows\GIZN.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMD.exe.bat" "92⤵PID:260
-
C:\windows\HMD.exeC:\windows\HMD.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CRXUJ.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4484 -
C:\windows\system\CRXUJ.exeC:\windows\system\CRXUJ.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZE.exe.bat" "96⤵PID:3652
-
C:\windows\GZE.exeC:\windows\GZE.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCIYA.exe.bat" "98⤵PID:4372
-
C:\windows\ZCIYA.exeC:\windows\ZCIYA.exe99⤵
- Executes dropped EXE
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVPJS.exe.bat" "100⤵
- Executes a command shell one-liner
PID:688 -
C:\windows\SVPJS.exeC:\windows\SVPJS.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTX.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2904 -
C:\windows\FTX.exeC:\windows\FTX.exe103⤵
- Executes dropped EXE
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLSN.exe.bat" "104⤵PID:3656
-
C:\windows\system\RLSN.exeC:\windows\system\RLSN.exe105⤵
- Executes dropped EXE
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYDFK.exe.bat" "106⤵PID:4648
-
C:\windows\IYDFK.exeC:\windows\IYDFK.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMHPUBA.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1668 -
C:\windows\system\CMHPUBA.exeC:\windows\system\CMHPUBA.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZIDV.exe.bat" "110⤵PID:5248
-
C:\windows\CZIDV.exeC:\windows\CZIDV.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SURIOA.exe.bat" "112⤵
- Executes a command shell one-liner
PID:4276 -
C:\windows\SURIOA.exeC:\windows\SURIOA.exe113⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVTN.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2416 -
C:\windows\JVTN.exeC:\windows\JVTN.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOW.exe.bat" "116⤵
- Executes a command shell one-liner
PID:5796 -
C:\windows\system\AOW.exeC:\windows\system\AOW.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MWKLN.exe.bat" "118⤵PID:5872
-
C:\windows\system\MWKLN.exeC:\windows\system\MWKLN.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTQ.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:616 -
C:\windows\NTQ.exeC:\windows\NTQ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-