Analysis
- max time kernel
72s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe
- Size 208KB
- Sample260729-ppwjdsvapb
- SHA256 f2dd72e53f50fabcba82b9e0c1ec8729031d299b644bbe5412cf15c466538165
- MD5 197ab89796fe9518edb9653279feccf0
- SHA1 06f6143eb1041f5ea4efa448ce8b9b284445b87f
- SHA512 c74ad00bd0481d8a26ce5e762ba6a09e333e26ad675a56376e651ddab234ab58877fd3c897d2803ce7ede46977a26452dbe0dfeff112570f5fdf94e3b56809fd
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfB4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOZQEj1
- TLSH T196247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2900 CYNKEKM.exe 1220 KWWAL.exe 5476 IHYQUPS.exe 5880 VSHPISN.exe 3804 ASRRUW.exe 3508 ZDTHU.exe 1720 XTN.exe 2316 UTO.exe 1768 TERUCRX.exe 3548 EWHFLSG.exe 780 SSSGZH.exe 5340 YNE.exe 5764 XYHPO.exe 4112 HDZ.exe 2000 GOKSNRY.exe 3952 DHLURV.exe 3808 NFROGD.exe 3852 APHN.exe 5080 DYQCT.exe 2812 QIZ.exe 2376 FYAAOZ.exe 3592 ZRPLYAZ.exe 4780 OHQ.exe 5676 WUV.exe 4424 NFGZYAF.exe 4700 GYNKHAN.exe 1524 QWBE.exe 3860 STGY.exe 4988 TWKUJH.exe 1176 KXY.exe 1576 MUEUL.exe 4872 NXIP.exe 3256 AVQ.exe 2976 DQH.exe 1052 MRJQQ.exe 5360 NUNLVP.exe 3300 FXRPI.exe 6112 TSCIO.exe 1464 HVLHC.exe 4544 AVA.exe 4960 ZGDIVLF.exe 5324 RBHDAB.exe 1520 JJVJNS.exe 4820 HUYZV.exe 4060 KDHN.exe 5796 FYYPW.exe 944 UOZ.exe 4620 ZTJELCA.exe 3468 XEUUTI.exe 5460 FUVL.exe 5216 AFEKOGH.exe 4312 CDREWPQ.exe 108 ZVTGHT.exe 1628 ZYXKN.exe 4576 YJIAVXW.exe 4572 PROX.exe 5740 DCEWOQM.exe 5712 GKN.exe 5408 IYWU.exe 5228 ULDSUYU.exe 4324 LTS.exe 2996 TZWWRVS.exe 760 MZMPAOA.exe 2252 AXMTCA.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\GOKSNRY.exe.bat HDZ.exe File created C:\windows\SysWOW64\CYNKEKM.exe 2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\ZVTGHT.exe CDREWPQ.exe File created C:\windows\SysWOW64\TZWWRVS.exe.bat LTS.exe File created C:\windows\SysWOW64\FHL.exe VJGTCQ.exe File opened for modification C:\windows\SysWOW64\KVUNY.exe CQIGNK.exe File created C:\windows\SysWOW64\KVUNY.exe.bat CQIGNK.exe File created C:\windows\SysWOW64\VJGTCQ.exe HMGHAFQ.exe File created C:\windows\SysWOW64\JGXD.exe KVUNY.exe File opened for modification C:\windows\SysWOW64\TWKUJH.exe STGY.exe File opened for modification C:\windows\SysWOW64\PROX.exe YJIAVXW.exe File opened for modification C:\windows\SysWOW64\NICR.exe AXMTCA.exe File created C:\windows\SysWOW64\LEDP.exe.bat JGXD.exe File created C:\windows\SysWOW64\ZIFASQT.exe.bat GPPPAPL.exe File created C:\windows\SysWOW64\GYNKHAN.exe NFGZYAF.exe File opened for modification C:\windows\SysWOW64\GYNKHAN.exe NFGZYAF.exe File created C:\windows\SysWOW64\GYNKHAN.exe.bat NFGZYAF.exe File opened for modification C:\windows\SysWOW64\UTO.exe XTN.exe File created C:\windows\SysWOW64\JJVJNS.exe RBHDAB.exe File opened for modification C:\windows\SysWOW64\JJVJNS.exe RBHDAB.exe File created C:\windows\SysWOW64\PJANYAK.exe UYSOKPP.exe File created C:\windows\SysWOW64\QSRP.exe TMYIY.exe File created C:\windows\SysWOW64\LDVPBYM.exe DXRBQAR.exe File opened for modification C:\windows\SysWOW64\VJGTCQ.exe HMGHAFQ.exe File created C:\windows\SysWOW64\FHL.exe.bat VJGTCQ.exe File created C:\windows\SysWOW64\TWKUJH.exe.bat STGY.exe File opened for modification C:\windows\SysWOW64\LEDP.exe JGXD.exe File opened for modification C:\windows\SysWOW64\DCEWOQM.exe PROX.exe File created C:\windows\SysWOW64\KVUNY.exe CQIGNK.exe File created C:\windows\SysWOW64\DCEWOQM.exe.bat PROX.exe File opened for modification C:\windows\SysWOW64\JGXD.exe KVUNY.exe File opened for modification C:\windows\SysWOW64\KWWAL.exe CYNKEKM.exe File created C:\windows\SysWOW64\UTO.exe.bat XTN.exe File opened for modification C:\windows\SysWOW64\PJANYAK.exe UYSOKPP.exe File opened for modification C:\windows\SysWOW64\CYNKEKM.exe 2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe File created C:\windows\SysWOW64\DQH.exe AVQ.exe File created C:\windows\SysWOW64\ZTJELCA.exe UOZ.exe File created C:\windows\SysWOW64\ZVTGHT.exe CDREWPQ.exe File opened for modification C:\windows\SysWOW64\QSRP.exe TMYIY.exe File opened for modification C:\windows\SysWOW64\DQH.exe AVQ.exe File created C:\windows\SysWOW64\ZTJELCA.exe.bat UOZ.exe File created C:\windows\SysWOW64\PROX.exe YJIAVXW.exe File created C:\windows\SysWOW64\TZWWRVS.exe LTS.exe File created C:\windows\SysWOW64\ZIFASQT.exe GPPPAPL.exe File opened for modification C:\windows\SysWOW64\ZIFASQT.exe GPPPAPL.exe File opened for modification C:\windows\SysWOW64\TZWWRVS.exe LTS.exe File created C:\windows\SysWOW64\JGXD.exe.bat KVUNY.exe File created C:\windows\SysWOW64\KWWAL.exe CYNKEKM.exe File created C:\windows\SysWOW64\UTO.exe XTN.exe File created C:\windows\SysWOW64\TWKUJH.exe STGY.exe File created C:\windows\SysWOW64\DQH.exe.bat AVQ.exe File created C:\windows\SysWOW64\PROX.exe.bat YJIAVXW.exe File created C:\windows\SysWOW64\NICR.exe AXMTCA.exe File created C:\windows\SysWOW64\NICR.exe.bat AXMTCA.exe File opened for modification C:\windows\SysWOW64\LDVPBYM.exe DXRBQAR.exe File created C:\windows\SysWOW64\VJGTCQ.exe.bat HMGHAFQ.exe File created C:\windows\SysWOW64\ZVTGHT.exe.bat CDREWPQ.exe File created C:\windows\SysWOW64\LDVPBYM.exe.bat DXRBQAR.exe File opened for modification C:\windows\SysWOW64\FHL.exe VJGTCQ.exe File opened for modification C:\windows\SysWOW64\GOKSNRY.exe HDZ.exe File created C:\windows\SysWOW64\CYNKEKM.exe.bat 2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe File created C:\windows\SysWOW64\KWWAL.exe.bat CYNKEKM.exe File created C:\windows\SysWOW64\JJVJNS.exe.bat RBHDAB.exe File created C:\windows\SysWOW64\DCEWOQM.exe PROX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\FUVL.exe XEUUTI.exe File created C:\windows\system\GKN.exe DCEWOQM.exe File created C:\windows\MZMPAOA.exe TZWWRVS.exe File created C:\windows\system\PFZ.exe FHL.exe File created C:\windows\system\KDHN.exe.bat HUYZV.exe File opened for modification C:\windows\XTN.exe ZDTHU.exe File opened for modification C:\windows\XYHPO.exe YNE.exe File opened for modification C:\windows\FYAAOZ.exe QIZ.exe File created C:\windows\system\QWBE.exe GYNKHAN.exe File created C:\windows\system\CDREWPQ.exe AFEKOGH.exe File opened for modification C:\windows\VSHPISN.exe IHYQUPS.exe File opened for modification C:\windows\system\AVQ.exe NXIP.exe File created C:\windows\TSCIO.exe FXRPI.exe File created C:\windows\AVA.exe HVLHC.exe File created C:\windows\system\RBHDAB.exe.bat ZGDIVLF.exe File opened for modification C:\windows\AFEKOGH.exe FUVL.exe File created C:\windows\UYSOKPP.exe.bat EIJXDB.exe File opened for modification C:\windows\ZDTHU.exe ASRRUW.exe File opened for modification C:\windows\APHN.exe NFROGD.exe File created C:\windows\QIZ.exe DYQCT.exe File opened for modification C:\windows\system\FXRPI.exe NUNLVP.exe File created C:\windows\IYWU.exe.bat GKN.exe File created C:\windows\system\ULDSUYU.exe IYWU.exe File opened for modification C:\windows\system\PFZ.exe FHL.exe File created C:\windows\IHYQUPS.exe KWWAL.exe File created C:\windows\NFGZYAF.exe WUV.exe File created C:\windows\KXY.exe.bat TWKUJH.exe File opened for modification C:\windows\system\XEUUTI.exe ZTJELCA.exe File opened for modification C:\windows\system\AXMTCA.exe MZMPAOA.exe File created C:\windows\CQIGNK.exe.bat PFZ.exe File created C:\windows\WUV.exe.bat OHQ.exe File opened for modification C:\windows\TSCIO.exe FXRPI.exe File opened for modification C:\windows\system\ASRRUW.exe VSHPISN.exe File created C:\windows\ZDTHU.exe.bat ASRRUW.exe File created C:\windows\APHN.exe.bat NFROGD.exe File created C:\windows\system\AVQ.exe NXIP.exe File opened for modification C:\windows\system\ULDSUYU.exe IYWU.exe File created C:\windows\system\AXMTCA.exe MZMPAOA.exe File opened for modification C:\windows\TMYIY.exe PJANYAK.exe File created C:\windows\system\SSSGZH.exe EWHFLSG.exe File opened for modification C:\windows\QIZ.exe DYQCT.exe File opened for modification C:\windows\system\ZRPLYAZ.exe FYAAOZ.exe File created C:\windows\system\NUNLVP.exe MRJQQ.exe File created C:\windows\system\HUYZV.exe JJVJNS.exe File created C:\windows\system\ZYXKN.exe ZVTGHT.exe File opened for modification C:\windows\MZMPAOA.exe TZWWRVS.exe File created C:\windows\XTN.exe.bat ZDTHU.exe File created C:\windows\TERUCRX.exe UTO.exe File created C:\windows\system\SSSGZH.exe.bat EWHFLSG.exe File created C:\windows\HDZ.exe.bat XYHPO.exe File created C:\windows\NFGZYAF.exe.bat WUV.exe File created C:\windows\system\ASRRUW.exe.bat VSHPISN.exe File created C:\windows\XYHPO.exe YNE.exe File opened for modification C:\windows\DYQCT.exe APHN.exe File created C:\windows\system\OHQ.exe ZRPLYAZ.exe File created C:\windows\system\MRJQQ.exe DQH.exe File opened for modification C:\windows\system\MRJQQ.exe DQH.exe File created C:\windows\system\ULDSUYU.exe.bat IYWU.exe File created C:\windows\CQIGNK.exe PFZ.exe File created C:\windows\system\EWHFLSG.exe TERUCRX.exe File opened for modification C:\windows\system\KDHN.exe HUYZV.exe File created C:\windows\AFEKOGH.exe FUVL.exe File created C:\windows\LTS.exe.bat ULDSUYU.exe File created C:\windows\NFROGD.exe DHLURV.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5632 cmd.exe 5164 cmd.exe 4924 cmd.exe 2880 cmd.exe 6040 cmd.exe 468 cmd.exe 700 cmd.exe 1248 cmd.exe 5184 cmd.exe 4624 cmd.exe 2576 cmd.exe 2464 cmd.exe 3164 cmd.exe 5540 cmd.exe 976 cmd.exe 4260 cmd.exe 1732 cmd.exe 4540 cmd.exe 4332 cmd.exe 1484 cmd.exe 2784 cmd.exe 5128 cmd.exe 4244 cmd.exe 2056 cmd.exe 5716 cmd.exe 1600 cmd.exe 432 cmd.exe 1000 cmd.exe 2584 cmd.exe 5444 cmd.exe 724 cmd.exe 984 cmd.exe 1772 cmd.exe 2020 cmd.exe 4056 cmd.exe 1964 cmd.exe 5304 cmd.exe 860 cmd.exe 2496 cmd.exe 1952 cmd.exe 3664 cmd.exe 3936 cmd.exe 684 cmd.exe 5692 cmd.exe 2176 cmd.exe 4492 cmd.exe 4292 cmd.exe 6140 cmd.exe 4980 cmd.exe 2592 cmd.exe 2984 cmd.exe 5224 cmd.exe 524 cmd.exe 2240 cmd.exe 3668 cmd.exe 5556 cmd.exe 6008 cmd.exe 2492 cmd.exe 2980 cmd.exe 4216 cmd.exe 4408 cmd.exe 5744 cmd.exe 5592 cmd.exe 5836 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 4760 5936 WerFault.exe 88 2632 2900 WerFault.exe 93 5036 1220 WerFault.exe 99 3884 5476 WerFault.exe 104 5136 5880 WerFault.exe 109 4804 3804 WerFault.exe 114 1608 3508 WerFault.exe 119 3716 1720 WerFault.exe 124 4520 2316 WerFault.exe 129 2808 1768 WerFault.exe 134 580 3548 WerFault.exe 139 4924 780 WerFault.exe 144 5968 5340 WerFault.exe 149 3612 5764 WerFault.exe 154 2024 4112 WerFault.exe 159 4500 2000 WerFault.exe 164 4236 3952 WerFault.exe 169 3224 3808 WerFault.exe 174 720 3852 WerFault.exe 179 3320 5080 WerFault.exe 184 2492 2812 WerFault.exe 189 5368 2376 WerFault.exe 194 4820 3592 WerFault.exe 199 1936 4780 WerFault.exe 204 716 5676 WerFault.exe 209 4420 4424 WerFault.exe 214 3300 4700 WerFault.exe 219 5012 1524 WerFault.exe 224 3416 3860 WerFault.exe 229 4532 4988 WerFault.exe 234 3536 1176 WerFault.exe 239 2596 1576 WerFault.exe 244 3232 4872 WerFault.exe 249 4900 3256 WerFault.exe 254 728 2976 WerFault.exe 259 1484 1052 WerFault.exe 265 3168 5360 WerFault.exe 270 816 3300 WerFault.exe 275 1716 6112 WerFault.exe 280 4532 1464 WerFault.exe 285 2704 4544 WerFault.exe 290 5556 4960 WerFault.exe 295 848 5324 WerFault.exe 300 2504 1520 WerFault.exe 305 5860 4820 WerFault.exe 310 2288 4060 WerFault.exe 315 4500 5796 WerFault.exe 320 2780 944 WerFault.exe 325 1204 4620 WerFault.exe 330 4840 3468 WerFault.exe 335 1700 5460 WerFault.exe 340 4760 5216 WerFault.exe 345 5208 4312 WerFault.exe 350 2828 108 WerFault.exe 355 3092 1628 WerFault.exe 360 1908 4576 WerFault.exe 365 1128 4572 WerFault.exe 369 2788 5740 WerFault.exe 375 3004 5712 WerFault.exe 380 4680 5408 WerFault.exe 385 940 5228 WerFault.exe 389 708 4324 WerFault.exe 395 1876 2996 WerFault.exe 400 3456 760 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASRRUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYAAOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YJIAVXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZWWRVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYNKHAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUEUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RBHDAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFROGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFEKOGH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXRPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYYPW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXMTCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UYSOKPP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCEWOQM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJANYAK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQIGNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFGZYAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDREWPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NICR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJVJNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKLBQQH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5936 2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe 5936 2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe 2900 CYNKEKM.exe 2900 CYNKEKM.exe 1220 KWWAL.exe 1220 KWWAL.exe 5476 IHYQUPS.exe 5476 IHYQUPS.exe 5880 VSHPISN.exe 5880 VSHPISN.exe 3804 ASRRUW.exe 3804 ASRRUW.exe 3508 ZDTHU.exe 3508 ZDTHU.exe 1720 XTN.exe 1720 XTN.exe 2316 UTO.exe 2316 UTO.exe 1768 TERUCRX.exe 1768 TERUCRX.exe 3548 EWHFLSG.exe 3548 EWHFLSG.exe 780 SSSGZH.exe 780 SSSGZH.exe 5340 YNE.exe 5340 YNE.exe 5764 XYHPO.exe 5764 XYHPO.exe 4112 HDZ.exe 4112 HDZ.exe 2000 GOKSNRY.exe 2000 GOKSNRY.exe 3952 DHLURV.exe 3952 DHLURV.exe 3808 NFROGD.exe 3808 NFROGD.exe 3852 APHN.exe 3852 APHN.exe 5080 DYQCT.exe 5080 DYQCT.exe 2812 QIZ.exe 2812 QIZ.exe 2376 FYAAOZ.exe 2376 FYAAOZ.exe 3592 ZRPLYAZ.exe 3592 ZRPLYAZ.exe 4780 OHQ.exe 4780 OHQ.exe 5676 WUV.exe 5676 WUV.exe 4424 NFGZYAF.exe 4424 NFGZYAF.exe 4700 GYNKHAN.exe 4700 GYNKHAN.exe 1524 QWBE.exe 1524 QWBE.exe 3860 STGY.exe 3860 STGY.exe 4988 TWKUJH.exe 4988 TWKUJH.exe 1176 KXY.exe 1176 KXY.exe 1576 MUEUL.exe 1576 MUEUL.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5936 2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe 5936 2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe 2900 CYNKEKM.exe 2900 CYNKEKM.exe 1220 KWWAL.exe 1220 KWWAL.exe 5476 IHYQUPS.exe 5476 IHYQUPS.exe 5880 VSHPISN.exe 5880 VSHPISN.exe 3804 ASRRUW.exe 3804 ASRRUW.exe 3508 ZDTHU.exe 3508 ZDTHU.exe 1720 XTN.exe 1720 XTN.exe 2316 UTO.exe 2316 UTO.exe 1768 TERUCRX.exe 1768 TERUCRX.exe 3548 EWHFLSG.exe 3548 EWHFLSG.exe 780 SSSGZH.exe 780 SSSGZH.exe 5340 YNE.exe 5340 YNE.exe 5764 XYHPO.exe 5764 XYHPO.exe 4112 HDZ.exe 4112 HDZ.exe 2000 GOKSNRY.exe 2000 GOKSNRY.exe 3952 DHLURV.exe 3952 DHLURV.exe 3808 NFROGD.exe 3808 NFROGD.exe 3852 APHN.exe 3852 APHN.exe 5080 DYQCT.exe 5080 DYQCT.exe 2812 QIZ.exe 2812 QIZ.exe 2376 FYAAOZ.exe 2376 FYAAOZ.exe 3592 ZRPLYAZ.exe 3592 ZRPLYAZ.exe 4780 OHQ.exe 4780 OHQ.exe 5676 WUV.exe 5676 WUV.exe 4424 NFGZYAF.exe 4424 NFGZYAF.exe 4700 GYNKHAN.exe 4700 GYNKHAN.exe 1524 QWBE.exe 1524 QWBE.exe 3860 STGY.exe 3860 STGY.exe 4988 TWKUJH.exe 4988 TWKUJH.exe 1176 KXY.exe 1176 KXY.exe 1576 MUEUL.exe 1576 MUEUL.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5936 wrote to memory of 6092 5936 2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe 89 PID 6092 wrote to memory of 2900 6092 cmd.exe 93 PID 2900 wrote to memory of 5128 2900 CYNKEKM.exe 95 PID 5128 wrote to memory of 1220 5128 cmd.exe 99 PID 1220 wrote to memory of 2984 1220 KWWAL.exe 100 PID 2984 wrote to memory of 5476 2984 cmd.exe 104 PID 5476 wrote to memory of 5380 5476 IHYQUPS.exe 105 PID 5380 wrote to memory of 5880 5380 cmd.exe 109 PID 5880 wrote to memory of 2284 5880 VSHPISN.exe 110 PID 2284 wrote to memory of 3804 2284 cmd.exe 114 PID 3804 wrote to memory of 5600 3804 ASRRUW.exe 115 PID 5600 wrote to memory of 3508 5600 cmd.exe 119 PID 3508 wrote to memory of 3160 3508 ZDTHU.exe 120 PID 3160 wrote to memory of 1720 3160 cmd.exe 124 PID 1720 wrote to memory of 4752 1720 XTN.exe 125 PID 4752 wrote to memory of 2316 4752 cmd.exe 129 PID 2316 wrote to memory of 6008 2316 UTO.exe 130 PID 6008 wrote to memory of 1768 6008 cmd.exe 134 PID 1768 wrote to memory of 1376 1768 TERUCRX.exe 135 PID 1376 wrote to memory of 3548 1376 cmd.exe 139 PID 3548 wrote to memory of 5224 3548 EWHFLSG.exe 140 PID 5224 wrote to memory of 780 5224 cmd.exe 144 PID 780 wrote to memory of 684 780 SSSGZH.exe 145 PID 684 wrote to memory of 5340 684 cmd.exe 149 PID 5340 wrote to memory of 5632 5340 YNE.exe 150 PID 5632 wrote to memory of 5764 5632 cmd.exe 154 PID 5764 wrote to memory of 2844 5764 XYHPO.exe 155 PID 2844 wrote to memory of 4112 2844 cmd.exe 159 PID 4112 wrote to memory of 3476 4112 HDZ.exe 160 PID 3476 wrote to memory of 2000 3476 cmd.exe 164 PID 2000 wrote to memory of 1972 2000 GOKSNRY.exe 165 PID 1972 wrote to memory of 3952 1972 cmd.exe 169 PID 3952 wrote to memory of 4504 3952 DHLURV.exe 170 PID 4504 wrote to memory of 3808 4504 cmd.exe 174 PID 3808 wrote to memory of 572 3808 NFROGD.exe 175 PID 572 wrote to memory of 3852 572 cmd.exe 179 PID 3852 wrote to memory of 524 3852 APHN.exe 180 PID 524 wrote to memory of 5080 524 cmd.exe 184 PID 5080 wrote to memory of 1856 5080 DYQCT.exe 185 PID 1856 wrote to memory of 2812 1856 cmd.exe 189 PID 2812 wrote to memory of 5864 2812 QIZ.exe 190 PID 5864 wrote to memory of 2376 5864 cmd.exe 194 PID 2376 wrote to memory of 4348 2376 FYAAOZ.exe 195 PID 4348 wrote to memory of 3592 4348 cmd.exe 199 PID 3592 wrote to memory of 5508 3592 ZRPLYAZ.exe 200 PID 5508 wrote to memory of 4780 5508 cmd.exe 204 PID 4780 wrote to memory of 2464 4780 OHQ.exe 205 PID 2464 wrote to memory of 5676 2464 cmd.exe 209 PID 5676 wrote to memory of 920 5676 WUV.exe 210 PID 920 wrote to memory of 4424 920 cmd.exe 214 PID 4424 wrote to memory of 1508 4424 NFGZYAF.exe 215 PID 1508 wrote to memory of 4700 1508 cmd.exe 219 PID 4700 wrote to memory of 4056 4700 GYNKHAN.exe 220 PID 4056 wrote to memory of 1524 4056 cmd.exe 224 PID 1524 wrote to memory of 432 1524 QWBE.exe 225 PID 432 wrote to memory of 3860 432 cmd.exe 229 PID 3860 wrote to memory of 3164 3860 STGY.exe 230 PID 3164 wrote to memory of 4988 3164 cmd.exe 234 PID 4988 wrote to memory of 5752 4988 TWKUJH.exe 235 PID 5752 wrote to memory of 1176 5752 cmd.exe 239 PID 1176 wrote to memory of 2240 1176 KXY.exe 240 PID 2240 wrote to memory of 1576 2240 cmd.exe 244 PID 1576 wrote to memory of 2808 1576 MUEUL.exe 245 PID 2808 wrote to memory of 4872 2808 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_197ab89796fe9518edb9653279feccf0_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CYNKEKM.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\windows\SysWOW64\CYNKEKM.exeC:\windows\system32\CYNKEKM.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWWAL.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\windows\SysWOW64\KWWAL.exeC:\windows\system32\KWWAL.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHYQUPS.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\windows\IHYQUPS.exeC:\windows\IHYQUPS.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSHPISN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\windows\VSHPISN.exeC:\windows\VSHPISN.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASRRUW.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\windows\system\ASRRUW.exeC:\windows\system\ASRRUW.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDTHU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\windows\ZDTHU.exeC:\windows\ZDTHU.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTN.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\XTN.exeC:\windows\XTN.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTO.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\windows\SysWOW64\UTO.exeC:\windows\system32\UTO.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TERUCRX.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\windows\TERUCRX.exeC:\windows\TERUCRX.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EWHFLSG.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\windows\system\EWHFLSG.exeC:\windows\system\EWHFLSG.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSSGZH.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\windows\system\SSSGZH.exeC:\windows\system\SSSGZH.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YNE.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:684 -
C:\windows\system\YNE.exeC:\windows\system\YNE.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYHPO.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\XYHPO.exeC:\windows\XYHPO.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HDZ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\HDZ.exeC:\windows\HDZ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GOKSNRY.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\SysWOW64\GOKSNRY.exeC:\windows\system32\GOKSNRY.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHLURV.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\windows\DHLURV.exeC:\windows\DHLURV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFROGD.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\windows\NFROGD.exeC:\windows\NFROGD.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APHN.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\windows\APHN.exeC:\windows\APHN.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:524 -
C:\windows\DYQCT.exeC:\windows\DYQCT.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QIZ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\windows\QIZ.exeC:\windows\QIZ.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYAAOZ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\FYAAOZ.exeC:\windows\FYAAOZ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRPLYAZ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\windows\system\ZRPLYAZ.exeC:\windows\system\ZRPLYAZ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHQ.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\system\OHQ.exeC:\windows\system\OHQ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUV.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\windows\WUV.exeC:\windows\WUV.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYNKHAN.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\windows\SysWOW64\GYNKHAN.exeC:\windows\system32\GYNKHAN.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWBE.exe.bat" "54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\windows\system\QWBE.exeC:\windows\system\QWBE.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STGY.exe.bat" "56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432 -
C:\windows\system\STGY.exeC:\windows\system\STGY.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWKUJH.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\windows\SysWOW64\TWKUJH.exeC:\windows\system32\TWKUJH.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXY.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\KXY.exeC:\windows\KXY.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MUEUL.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\windows\system\MUEUL.exeC:\windows\system\MUEUL.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXIP.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\windows\system\NXIP.exeC:\windows\system\NXIP.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVQ.exe.bat" "66⤵PID:4280
-
C:\windows\system\AVQ.exeC:\windows\system\AVQ.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQH.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:3700 -
C:\windows\SysWOW64\DQH.exeC:\windows\system32\DQH.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MRJQQ.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4244 -
C:\windows\system\MRJQQ.exeC:\windows\system\MRJQQ.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NUNLVP.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:984 -
C:\windows\system\NUNLVP.exeC:\windows\system\NUNLVP.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FXRPI.exe.bat" "74⤵PID:2336
-
C:\windows\system\FXRPI.exeC:\windows\system\FXRPI.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSCIO.exe.bat" "76⤵PID:3044
-
C:\windows\TSCIO.exeC:\windows\TSCIO.exe77⤵
- Executes dropped EXE
PID:6112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HVLHC.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:5548 -
C:\windows\HVLHC.exeC:\windows\HVLHC.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AVA.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5164 -
C:\windows\AVA.exeC:\windows\AVA.exe81⤵
- Executes dropped EXE
PID:4544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGDIVLF.exe.bat" "82⤵PID:4940
-
C:\windows\ZGDIVLF.exeC:\windows\ZGDIVLF.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RBHDAB.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2928 -
C:\windows\system\RBHDAB.exeC:\windows\system\RBHDAB.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJVJNS.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5540 -
C:\windows\SysWOW64\JJVJNS.exeC:\windows\system32\JJVJNS.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUYZV.exe.bat" "88⤵PID:4340
-
C:\windows\system\HUYZV.exeC:\windows\system\HUYZV.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDHN.exe.bat" "90⤵
- Executes a command shell one-liner
PID:1772 -
C:\windows\system\KDHN.exeC:\windows\system\KDHN.exe91⤵
- Executes dropped EXE
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYYPW.exe.bat" "92⤵PID:1512
-
C:\windows\FYYPW.exeC:\windows\FYYPW.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UOZ.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:2344 -
C:\windows\system\UOZ.exeC:\windows\system\UOZ.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTJELCA.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4292 -
C:\windows\SysWOW64\ZTJELCA.exeC:\windows\system32\ZTJELCA.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XEUUTI.exe.bat" "98⤵PID:6104
-
C:\windows\system\XEUUTI.exeC:\windows\system\XEUUTI.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FUVL.exe.bat" "100⤵PID:3320
-
C:\windows\system\FUVL.exeC:\windows\system\FUVL.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AFEKOGH.exe.bat" "102⤵
- Executes a command shell one-liner
PID:2492 -
C:\windows\AFEKOGH.exeC:\windows\AFEKOGH.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDREWPQ.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3240 -
C:\windows\system\CDREWPQ.exeC:\windows\system\CDREWPQ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZVTGHT.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:1108 -
C:\windows\SysWOW64\ZVTGHT.exeC:\windows\system32\ZVTGHT.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZYXKN.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4844 -
C:\windows\system\ZYXKN.exeC:\windows\system\ZYXKN.exe109⤵
- Executes dropped EXE
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YJIAVXW.exe.bat" "110⤵PID:3036
-
C:\windows\YJIAVXW.exeC:\windows\YJIAVXW.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PROX.exe.bat" "112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1000 -
C:\windows\SysWOW64\PROX.exeC:\windows\system32\PROX.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCEWOQM.exe.bat" "114⤵PID:4956
-
C:\windows\SysWOW64\DCEWOQM.exeC:\windows\system32\DCEWOQM.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKN.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3416 -
C:\windows\system\GKN.exeC:\windows\system\GKN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYWU.exe.bat" "118⤵PID:1716
-
C:\windows\IYWU.exeC:\windows\IYWU.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ULDSUYU.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:976 -
C:\windows\system\ULDSUYU.exeC:\windows\system\ULDSUYU.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-