Analysis
- max time kernel
85s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 11:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe
- Size 208KB
- Sample260817-nam32aba38
- SHA256 aafc82640e41c89feaad0aa1ec03e5c6037945ba602ec1490856f310a2328551
- MD5 4998dda3f622c6b2a55f5c8cc631dbf1
- SHA1 67ecacbc54cf0bced15a722a9c78d3e2c0ac1777
- SHA512 36fbb12777be8db9b4b9c502caa6718bd620b1ad4b02b01f0791a0a0366864953117acd348bbadf8809de681c1a18cf54152aaaefc6642edeb40b308439231de
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUWL+LOfs4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUu+LOkkEj1
- TLSH T1C4247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3556 GSQXY.exe 4288 PICGJ.exe 2144 VDOZXUZ.exe 6052 ZTUHJ.exe 5264 FHUIG.exe 2616 SRKHU.exe 5924 IHLYBNV.exe 3364 SFRSIW.exe 6100 FQZR.exe 4560 SOH.exe 5336 HRRHRF.exe 4920 FHE.exe 3548 MXFQGZ.exe 3180 RPPSK.exe 1004 TNU.exe 2832 IIEZKZ.exe 4220 WOEL.exe 5464 LJVPFXQ.exe 5972 LMZLLV.exe 6108 KXCBT.exe 4752 MVIVBJX.exe 260 NYTROZ.exe 5580 YQBK.exe 5144 SEIID.exe 2652 BBNCK.exe 6132 DZTOZSU.exe 720 RKJNG.exe 4172 GSK.exe 4396 OGP.exe 5184 PJBPCFJ.exe 5328 LOLET.exe 5428 PRJ.exe 1464 ZPX.exe 3040 PKGYTX.exe 2536 NVJ.exe 4516 VLKFIY.exe 2496 FJYAQG.exe 4284 WREFCX.exe 5748 FRGKGVP.exe 3416 RHVK.exe 5052 DACVJ.exe 2492 DDGZPE.exe 4984 VDUW.exe 2644 KTVVI.exe 1076 FOAFKQB.exe 5624 HEGZAZ.exe 5124 RCTTHH.exe 3016 PVW.exe 2416 IQAFVDI.exe 3864 JTEB.exe 4624 TRS.exe 2440 WHYDC.exe 5296 RUDNFTD.exe 1868 VCKNR.exe 2980 WFNQ.exe 1624 TFVE.exe 4992 LGXJRBE.exe 1704 PWEJD.exe 2904 JJITNT.exe 4292 KMM.exe 5240 FZRGD.exe 4568 IPYGPCS.exe 4508 SQATTZ.exe 1520 JQCYWEX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\BIBVDX.exe.bat LSS.exe File created C:\windows\SysWOW64\VDOZXUZ.exe.bat PICGJ.exe File opened for modification C:\windows\SysWOW64\IHLYBNV.exe SRKHU.exe File created C:\windows\SysWOW64\WFNQ.exe.bat VCKNR.exe File opened for modification C:\windows\SysWOW64\UPG.exe GEQXT.exe File created C:\windows\SysWOW64\VFXXOX.exe GKN.exe File opened for modification C:\windows\SysWOW64\LHMTNU.exe UYSOKPP.exe File created C:\windows\SysWOW64\GTM.exe WYQRZVL.exe File opened for modification C:\windows\SysWOW64\CPXP.exe EWUHC.exe File created C:\windows\SysWOW64\PICGJ.exe GSQXY.exe File created C:\windows\SysWOW64\IHLYBNV.exe SRKHU.exe File created C:\windows\SysWOW64\KXCBT.exe LMZLLV.exe File created C:\windows\SysWOW64\NYTROZ.exe.bat MVIVBJX.exe File opened for modification C:\windows\SysWOW64\BBNCK.exe SEIID.exe File created C:\windows\SysWOW64\VDUW.exe.bat DDGZPE.exe File opened for modification C:\windows\SysWOW64\FZRGD.exe KMM.exe File created C:\windows\SysWOW64\HKMWSR.exe.bat DUF.exe File created C:\windows\SysWOW64\RPPSK.exe MXFQGZ.exe File created C:\windows\SysWOW64\NYTROZ.exe MVIVBJX.exe File created C:\windows\SysWOW64\NVJ.exe.bat PKGYTX.exe File created C:\windows\SysWOW64\FZRGD.exe KMM.exe File created C:\windows\SysWOW64\LSS.exe HKMWSR.exe File created C:\windows\SysWOW64\LHMTNU.exe UYSOKPP.exe File created C:\windows\SysWOW64\SRKHU.exe FHUIG.exe File created C:\windows\SysWOW64\RPPSK.exe.bat MXFQGZ.exe File created C:\windows\SysWOW64\TNU.exe RPPSK.exe File created C:\windows\SysWOW64\CPXP.exe EWUHC.exe File created C:\windows\SysWOW64\PVW.exe.bat RCTTHH.exe File opened for modification C:\windows\SysWOW64\RPPSK.exe MXFQGZ.exe File created C:\windows\SysWOW64\BBNCK.exe.bat SEIID.exe File created C:\windows\SysWOW64\RHVK.exe FRGKGVP.exe File created C:\windows\SysWOW64\HEGZAZ.exe.bat FOAFKQB.exe File opened for modification C:\windows\SysWOW64\ZTUHJ.exe VDOZXUZ.exe File created C:\windows\SysWOW64\BBNCK.exe SEIID.exe File created C:\windows\SysWOW64\PRJ.exe LOLET.exe File opened for modification C:\windows\SysWOW64\HEGZAZ.exe FOAFKQB.exe File created C:\windows\SysWOW64\UPG.exe.bat GEQXT.exe File created C:\windows\SysWOW64\GTM.exe.bat WYQRZVL.exe File created C:\windows\SysWOW64\PICGJ.exe.bat GSQXY.exe File created C:\windows\SysWOW64\WOEL.exe.bat IIEZKZ.exe File opened for modification C:\windows\SysWOW64\RHVK.exe FRGKGVP.exe File created C:\windows\SysWOW64\HKMWSR.exe DUF.exe File opened for modification C:\windows\SysWOW64\HKMWSR.exe DUF.exe File created C:\windows\SysWOW64\LSS.exe.bat HKMWSR.exe File opened for modification C:\windows\SysWOW64\GTM.exe WYQRZVL.exe File opened for modification C:\windows\SysWOW64\PICGJ.exe GSQXY.exe File created C:\windows\SysWOW64\WOEL.exe IIEZKZ.exe File created C:\windows\SysWOW64\LGXJRBE.exe.bat TFVE.exe File created C:\windows\SysWOW64\HEGZAZ.exe FOAFKQB.exe File opened for modification C:\windows\SysWOW64\WFNQ.exe VCKNR.exe File created C:\windows\SysWOW64\KMM.exe.bat JJITNT.exe File created C:\windows\SysWOW64\RCTTHH.exe HEGZAZ.exe File created C:\windows\SysWOW64\SRKHU.exe.bat FHUIG.exe File opened for modification C:\windows\SysWOW64\KXCBT.exe LMZLLV.exe File opened for modification C:\windows\SysWOW64\PRJ.exe LOLET.exe File created C:\windows\SysWOW64\NVJ.exe PKGYTX.exe File created C:\windows\SysWOW64\VCKNR.exe RUDNFTD.exe File created C:\windows\SysWOW64\FZRGD.exe.bat KMM.exe File created C:\windows\SysWOW64\BIBVDX.exe LSS.exe File created C:\windows\SysWOW64\ZTUHJ.exe.bat VDOZXUZ.exe File created C:\windows\SysWOW64\IHLYBNV.exe.bat SRKHU.exe File opened for modification C:\windows\SysWOW64\TNU.exe RPPSK.exe File created C:\windows\SysWOW64\VCKNR.exe.bat RUDNFTD.exe File created C:\windows\SysWOW64\UPG.exe GEQXT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\JUVK.exe FJXXLT.exe File opened for modification C:\windows\MDXIBZB.exe XNWJVE.exe File created C:\windows\MXFQGZ.exe.bat FHE.exe File created C:\windows\system\LJVPFXQ.exe WOEL.exe File created C:\windows\LMZLLV.exe LJVPFXQ.exe File created C:\windows\LOLET.exe.bat PJBPCFJ.exe File created C:\windows\ZPX.exe PRJ.exe File opened for modification C:\windows\system\FRGKGVP.exe WREFCX.exe File created C:\windows\FOAFKQB.exe KTVVI.exe File created C:\windows\JUVK.exe.bat FJXXLT.exe File opened for modification C:\windows\OGP.exe GSK.exe File created C:\windows\system\TFVE.exe WFNQ.exe File created C:\windows\system\GKN.exe LXIBTL.exe File created C:\windows\VDY.exe.bat BIBVDX.exe File created C:\windows\system\SPKR.exe XCF.exe File created C:\windows\system\TXNLDB.exe.bat WXEJZXQ.exe File opened for modification C:\windows\system\EBNXN.exe JQFHY.exe File created C:\windows\system\FQZR.exe.bat SFRSIW.exe File created C:\windows\system\PJBPCFJ.exe.bat OGP.exe File created C:\windows\system\RUDNFTD.exe WHYDC.exe File opened for modification C:\windows\system\PWEJD.exe LGXJRBE.exe File opened for modification C:\windows\system\JQCYWEX.exe SQATTZ.exe File opened for modification C:\windows\system\GKN.exe LXIBTL.exe File opened for modification C:\windows\IQAFVDI.exe PVW.exe File created C:\windows\SQATTZ.exe.bat IPYGPCS.exe File opened for modification C:\windows\XCF.exe KWFW.exe File created C:\windows\system\QXGMCRV.exe OCPKQGN.exe File created C:\windows\system\LJVPFXQ.exe.bat WOEL.exe File created C:\windows\RKJNG.exe DZTOZSU.exe File created C:\windows\GEQXT.exe ARZX.exe File created C:\windows\YQBK.exe.bat NYTROZ.exe File created C:\windows\GSK.exe.bat RKJNG.exe File created C:\windows\KTVVI.exe VDUW.exe File created C:\windows\WHYDC.exe.bat TRS.exe File created C:\windows\system\PWEJD.exe.bat LGXJRBE.exe File created C:\windows\system\LXIBTL.exe.bat UPG.exe File created C:\windows\system\WYQRZVL.exe SPKR.exe File created C:\windows\system\MPZCO.exe.bat CPXP.exe File created C:\windows\GSQXY.exe.bat 2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe File created C:\windows\TRS.exe.bat JTEB.exe File created C:\windows\NGIY.exe JQCYWEX.exe File created C:\windows\OGP.exe.bat GSK.exe File created C:\windows\FHE.exe HRRHRF.exe File opened for modification C:\windows\YQBK.exe NYTROZ.exe File opened for modification C:\windows\GSK.exe RKJNG.exe File opened for modification C:\windows\system\DDGZPE.exe DACVJ.exe File opened for modification C:\windows\system\IPYGPCS.exe FZRGD.exe File opened for modification C:\windows\VDY.exe BIBVDX.exe File opened for modification C:\windows\system\QXGMCRV.exe OCPKQGN.exe File created C:\windows\FHUIG.exe.bat ZTUHJ.exe File created C:\windows\system\JTEB.exe.bat IQAFVDI.exe File opened for modification C:\windows\TRS.exe JTEB.exe File created C:\windows\system\EBNXN.exe JQFHY.exe File opened for modification C:\windows\system\PIRCKF.exe QXGMCRV.exe File created C:\windows\SOH.exe FQZR.exe File opened for modification C:\windows\system\HRRHRF.exe SOH.exe File created C:\windows\system\JQCYWEX.exe SQATTZ.exe File created C:\windows\UYSOKPP.exe ZLNFAP.exe File created C:\windows\XNWJVE.exe.bat PIRCKF.exe File created C:\windows\SOH.exe.bat FQZR.exe File created C:\windows\LOLET.exe PJBPCFJ.exe File opened for modification C:\windows\DACVJ.exe RHVK.exe File created C:\windows\system\ARZX.exe.bat NGIY.exe File opened for modification C:\windows\system\TXNLDB.exe WXEJZXQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4088 cmd.exe 4080 cmd.exe 4612 cmd.exe 4300 cmd.exe 3212 cmd.exe 1816 cmd.exe 3524 cmd.exe 2232 cmd.exe 4276 cmd.exe 5012 cmd.exe 3372 cmd.exe 3588 cmd.exe 3876 cmd.exe 4584 cmd.exe 1748 cmd.exe 2900 cmd.exe 4100 cmd.exe 5988 cmd.exe 4660 cmd.exe 1088 cmd.exe 4316 cmd.exe 3464 cmd.exe 5740 cmd.exe 2128 cmd.exe 6120 cmd.exe 2080 cmd.exe 4064 cmd.exe 4528 cmd.exe 5048 cmd.exe 5944 cmd.exe 4640 cmd.exe 2648 cmd.exe 996 cmd.exe 3672 cmd.exe 1484 cmd.exe 2956 cmd.exe 2336 cmd.exe 6072 cmd.exe 2432 cmd.exe 5216 cmd.exe 828 cmd.exe 2428 cmd.exe 1788 cmd.exe 484 cmd.exe 1488 cmd.exe 3148 cmd.exe 4780 cmd.exe 4544 cmd.exe 1760 cmd.exe 1692 cmd.exe 2212 cmd.exe 5448 cmd.exe 1268 cmd.exe 3000 cmd.exe 4388 cmd.exe 2720 cmd.exe 264 cmd.exe 4580 cmd.exe 2868 cmd.exe 3408 cmd.exe 4820 cmd.exe 2856 cmd.exe 6000 cmd.exe 4720 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3336 1776 WerFault.exe 88 1692 3556 WerFault.exe 93 4264 4288 WerFault.exe 99 3372 2144 WerFault.exe 104 1772 6052 WerFault.exe 109 2040 5264 WerFault.exe 114 4280 2616 WerFault.exe 119 2628 5924 WerFault.exe 124 5532 3364 WerFault.exe 129 1364 6100 WerFault.exe 134 4820 4560 WerFault.exe 139 3316 5336 WerFault.exe 144 4464 4920 WerFault.exe 149 4264 3548 WerFault.exe 154 2648 3180 WerFault.exe 159 6060 1004 WerFault.exe 164 4672 2832 WerFault.exe 169 1740 4220 WerFault.exe 174 5784 5464 WerFault.exe 179 3644 5972 WerFault.exe 184 5160 6108 WerFault.exe 189 5840 4752 WerFault.exe 194 3336 260 WerFault.exe 199 1868 5580 WerFault.exe 204 5804 5144 WerFault.exe 209 1772 2652 WerFault.exe 214 6032 6132 WerFault.exe 219 3900 720 WerFault.exe 224 3524 4172 WerFault.exe 229 2500 4396 WerFault.exe 234 3600 5184 WerFault.exe 239 3024 5328 WerFault.exe 244 5896 5428 WerFault.exe 249 2824 1464 WerFault.exe 254 1076 3040 WerFault.exe 259 5280 2536 WerFault.exe 264 2544 4516 WerFault.exe 269 1132 2496 WerFault.exe 274 4244 4284 WerFault.exe 279 3820 5748 WerFault.exe 284 5892 3416 WerFault.exe 289 5088 5052 WerFault.exe 294 4908 2492 WerFault.exe 299 204 4984 WerFault.exe 304 2956 2644 WerFault.exe 309 3532 1076 WerFault.exe 314 2204 5624 WerFault.exe 319 4144 5124 WerFault.exe 324 4852 3016 WerFault.exe 329 3820 2416 WerFault.exe 334 4332 3864 WerFault.exe 339 4644 4624 WerFault.exe 344 1116 2440 WerFault.exe 349 4508 5296 WerFault.exe 354 4368 1868 WerFault.exe 359 1336 2980 WerFault.exe 364 4532 1624 WerFault.exe 369 5104 4992 WerFault.exe 374 4860 1704 WerFault.exe 379 4268 2904 WerFault.exe 384 3516 4292 WerFault.exe 389 5948 5240 WerFault.exe 394 3460 4568 WerFault.exe 399 4536 4508 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQATTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZTUHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDGZPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEGZAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXIBTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXFQGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQAFVDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GEQXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VCKNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIBVDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKJNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGXJRBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJITNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLKFIY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWEJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXEJZXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJVPFXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LOLET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWUHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFRSIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1776 2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe 1776 2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe 3556 GSQXY.exe 3556 GSQXY.exe 4288 PICGJ.exe 4288 PICGJ.exe 2144 VDOZXUZ.exe 2144 VDOZXUZ.exe 6052 ZTUHJ.exe 6052 ZTUHJ.exe 5264 FHUIG.exe 5264 FHUIG.exe 2616 SRKHU.exe 2616 SRKHU.exe 5924 IHLYBNV.exe 5924 IHLYBNV.exe 3364 SFRSIW.exe 3364 SFRSIW.exe 6100 FQZR.exe 6100 FQZR.exe 4560 SOH.exe 4560 SOH.exe 5336 HRRHRF.exe 5336 HRRHRF.exe 4920 FHE.exe 4920 FHE.exe 3548 MXFQGZ.exe 3548 MXFQGZ.exe 3180 RPPSK.exe 3180 RPPSK.exe 1004 TNU.exe 1004 TNU.exe 2832 IIEZKZ.exe 2832 IIEZKZ.exe 4220 WOEL.exe 4220 WOEL.exe 5464 LJVPFXQ.exe 5464 LJVPFXQ.exe 5972 LMZLLV.exe 5972 LMZLLV.exe 6108 KXCBT.exe 6108 KXCBT.exe 4752 MVIVBJX.exe 4752 MVIVBJX.exe 260 NYTROZ.exe 260 NYTROZ.exe 5580 YQBK.exe 5580 YQBK.exe 5144 SEIID.exe 5144 SEIID.exe 2652 BBNCK.exe 2652 BBNCK.exe 6132 DZTOZSU.exe 6132 DZTOZSU.exe 720 RKJNG.exe 720 RKJNG.exe 4172 GSK.exe 4172 GSK.exe 4396 OGP.exe 4396 OGP.exe 5184 PJBPCFJ.exe 5184 PJBPCFJ.exe 5328 LOLET.exe 5328 LOLET.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1776 2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe 1776 2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe 3556 GSQXY.exe 3556 GSQXY.exe 4288 PICGJ.exe 4288 PICGJ.exe 2144 VDOZXUZ.exe 2144 VDOZXUZ.exe 6052 ZTUHJ.exe 6052 ZTUHJ.exe 5264 FHUIG.exe 5264 FHUIG.exe 2616 SRKHU.exe 2616 SRKHU.exe 5924 IHLYBNV.exe 5924 IHLYBNV.exe 3364 SFRSIW.exe 3364 SFRSIW.exe 6100 FQZR.exe 6100 FQZR.exe 4560 SOH.exe 4560 SOH.exe 5336 HRRHRF.exe 5336 HRRHRF.exe 4920 FHE.exe 4920 FHE.exe 3548 MXFQGZ.exe 3548 MXFQGZ.exe 3180 RPPSK.exe 3180 RPPSK.exe 1004 TNU.exe 1004 TNU.exe 2832 IIEZKZ.exe 2832 IIEZKZ.exe 4220 WOEL.exe 4220 WOEL.exe 5464 LJVPFXQ.exe 5464 LJVPFXQ.exe 5972 LMZLLV.exe 5972 LMZLLV.exe 6108 KXCBT.exe 6108 KXCBT.exe 4752 MVIVBJX.exe 4752 MVIVBJX.exe 260 NYTROZ.exe 260 NYTROZ.exe 5580 YQBK.exe 5580 YQBK.exe 5144 SEIID.exe 5144 SEIID.exe 2652 BBNCK.exe 2652 BBNCK.exe 6132 DZTOZSU.exe 6132 DZTOZSU.exe 720 RKJNG.exe 720 RKJNG.exe 4172 GSK.exe 4172 GSK.exe 4396 OGP.exe 4396 OGP.exe 5184 PJBPCFJ.exe 5184 PJBPCFJ.exe 5328 LOLET.exe 5328 LOLET.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 4384 1776 2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe 89 PID 4384 wrote to memory of 3556 4384 cmd.exe 93 PID 3556 wrote to memory of 300 3556 GSQXY.exe 95 PID 300 wrote to memory of 4288 300 cmd.exe 99 PID 4288 wrote to memory of 484 4288 PICGJ.exe 100 PID 484 wrote to memory of 2144 484 cmd.exe 104 PID 2144 wrote to memory of 5392 2144 VDOZXUZ.exe 105 PID 5392 wrote to memory of 6052 5392 cmd.exe 109 PID 6052 wrote to memory of 1168 6052 ZTUHJ.exe 110 PID 1168 wrote to memory of 5264 1168 cmd.exe 114 PID 5264 wrote to memory of 4064 5264 FHUIG.exe 115 PID 4064 wrote to memory of 2616 4064 cmd.exe 119 PID 2616 wrote to memory of 1908 2616 SRKHU.exe 120 PID 1908 wrote to memory of 5924 1908 cmd.exe 124 PID 5924 wrote to memory of 3064 5924 IHLYBNV.exe 125 PID 3064 wrote to memory of 3364 3064 cmd.exe 129 PID 3364 wrote to memory of 4528 3364 SFRSIW.exe 130 PID 4528 wrote to memory of 6100 4528 cmd.exe 134 PID 6100 wrote to memory of 4088 6100 FQZR.exe 135 PID 4088 wrote to memory of 4560 4088 cmd.exe 139 PID 4560 wrote to memory of 996 4560 SOH.exe 140 PID 996 wrote to memory of 5336 996 cmd.exe 144 PID 5336 wrote to memory of 2444 5336 HRRHRF.exe 145 PID 2444 wrote to memory of 4920 2444 cmd.exe 149 PID 4920 wrote to memory of 5448 4920 FHE.exe 150 PID 5448 wrote to memory of 3548 5448 cmd.exe 154 PID 3548 wrote to memory of 2228 3548 MXFQGZ.exe 155 PID 2228 wrote to memory of 3180 2228 cmd.exe 159 PID 3180 wrote to memory of 6096 3180 RPPSK.exe 160 PID 6096 wrote to memory of 1004 6096 cmd.exe 164 PID 1004 wrote to memory of 3188 1004 TNU.exe 165 PID 3188 wrote to memory of 2832 3188 cmd.exe 169 PID 2832 wrote to memory of 2040 2832 IIEZKZ.exe 170 PID 2040 wrote to memory of 4220 2040 cmd.exe 174 PID 4220 wrote to memory of 2272 4220 WOEL.exe 175 PID 2272 wrote to memory of 5464 2272 cmd.exe 179 PID 5464 wrote to memory of 4100 5464 LJVPFXQ.exe 180 PID 4100 wrote to memory of 5972 4100 cmd.exe 184 PID 5972 wrote to memory of 5756 5972 LMZLLV.exe 185 PID 5756 wrote to memory of 6108 5756 cmd.exe 189 PID 6108 wrote to memory of 3032 6108 KXCBT.exe 190 PID 3032 wrote to memory of 4752 3032 cmd.exe 194 PID 4752 wrote to memory of 4080 4752 MVIVBJX.exe 195 PID 4080 wrote to memory of 260 4080 cmd.exe 199 PID 260 wrote to memory of 1268 260 NYTROZ.exe 200 PID 1268 wrote to memory of 5580 1268 cmd.exe 204 PID 5580 wrote to memory of 4276 5580 YQBK.exe 205 PID 4276 wrote to memory of 5144 4276 cmd.exe 209 PID 5144 wrote to memory of 5012 5144 SEIID.exe 210 PID 5012 wrote to memory of 2652 5012 cmd.exe 214 PID 2652 wrote to memory of 576 2652 BBNCK.exe 215 PID 576 wrote to memory of 6132 576 cmd.exe 219 PID 6132 wrote to memory of 6072 6132 DZTOZSU.exe 220 PID 6072 wrote to memory of 720 6072 cmd.exe 224 PID 720 wrote to memory of 2772 720 RKJNG.exe 225 PID 2772 wrote to memory of 4172 2772 cmd.exe 229 PID 4172 wrote to memory of 2584 4172 GSK.exe 230 PID 2584 wrote to memory of 4396 2584 cmd.exe 234 PID 4396 wrote to memory of 4196 4396 OGP.exe 235 PID 4196 wrote to memory of 5184 4196 cmd.exe 239 PID 5184 wrote to memory of 5048 5184 PJBPCFJ.exe 240 PID 5048 wrote to memory of 5328 5048 cmd.exe 244 PID 5328 wrote to memory of 5160 5328 LOLET.exe 245 PID 5160 wrote to memory of 5428 5160 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_4998dda3f622c6b2a55f5c8cc631dbf1_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSQXY.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\windows\GSQXY.exeC:\windows\GSQXY.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PICGJ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:300 -
C:\windows\SysWOW64\PICGJ.exeC:\windows\system32\PICGJ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDOZXUZ.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:484 -
C:\windows\SysWOW64\VDOZXUZ.exeC:\windows\system32\VDOZXUZ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZTUHJ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\windows\SysWOW64\ZTUHJ.exeC:\windows\system32\ZTUHJ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHUIG.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\windows\FHUIG.exeC:\windows\FHUIG.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRKHU.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\windows\SysWOW64\SRKHU.exeC:\windows\system32\SRKHU.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IHLYBNV.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\windows\SysWOW64\IHLYBNV.exeC:\windows\system32\IHLYBNV.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFRSIW.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\SFRSIW.exeC:\windows\SFRSIW.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQZR.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\windows\system\FQZR.exeC:\windows\system\FQZR.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOH.exe.bat" "20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\windows\SOH.exeC:\windows\SOH.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HRRHRF.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996 -
C:\windows\system\HRRHRF.exeC:\windows\system\HRRHRF.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\FHE.exeC:\windows\FHE.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXFQGZ.exe.bat" "26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\windows\MXFQGZ.exeC:\windows\MXFQGZ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RPPSK.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\windows\SysWOW64\RPPSK.exeC:\windows\system32\RPPSK.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TNU.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\windows\SysWOW64\TNU.exeC:\windows\system32\TNU.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIEZKZ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\windows\system\IIEZKZ.exeC:\windows\system\IIEZKZ.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WOEL.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\windows\SysWOW64\WOEL.exeC:\windows\system32\WOEL.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LJVPFXQ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\windows\system\LJVPFXQ.exeC:\windows\system\LJVPFXQ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LMZLLV.exe.bat" "38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\windows\LMZLLV.exeC:\windows\LMZLLV.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KXCBT.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\windows\SysWOW64\KXCBT.exeC:\windows\system32\KXCBT.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVIVBJX.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\windows\system\MVIVBJX.exeC:\windows\system\MVIVBJX.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYTROZ.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\windows\SysWOW64\NYTROZ.exeC:\windows\system32\NYTROZ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQBK.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\windows\YQBK.exeC:\windows\YQBK.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SEIID.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\SEIID.exeC:\windows\SEIID.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBNCK.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\windows\SysWOW64\BBNCK.exeC:\windows\system32\BBNCK.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZTOZSU.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\windows\DZTOZSU.exeC:\windows\DZTOZSU.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RKJNG.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\windows\RKJNG.exeC:\windows\RKJNG.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSK.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\GSK.exeC:\windows\GSK.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OGP.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\OGP.exeC:\windows\OGP.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJBPCFJ.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\windows\system\PJBPCFJ.exeC:\windows\system\PJBPCFJ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LOLET.exe.bat" "62⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\windows\LOLET.exeC:\windows\LOLET.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\windows\SysWOW64\PRJ.exeC:\windows\system32\PRJ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPX.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4612 -
C:\windows\ZPX.exeC:\windows\ZPX.exe67⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKGYTX.exe.bat" "68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3672 -
C:\windows\PKGYTX.exeC:\windows\PKGYTX.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVJ.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5988 -
C:\windows\SysWOW64\NVJ.exeC:\windows\system32\NVJ.exe71⤵
- Executes dropped EXE
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLKFIY.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3056 -
C:\windows\VLKFIY.exeC:\windows\VLKFIY.exe73⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJYAQG.exe.bat" "74⤵
- Executes a command shell one-liner
PID:3372 -
C:\windows\FJYAQG.exeC:\windows\FJYAQG.exe75⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WREFCX.exe.bat" "76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2432 -
C:\windows\WREFCX.exeC:\windows\WREFCX.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FRGKGVP.exe.bat" "78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3408 -
C:\windows\system\FRGKGVP.exeC:\windows\system\FRGKGVP.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHVK.exe.bat" "80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5216 -
C:\windows\SysWOW64\RHVK.exeC:\windows\system32\RHVK.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DACVJ.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5492 -
C:\windows\DACVJ.exeC:\windows\DACVJ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDGZPE.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\windows\system\DDGZPE.exeC:\windows\system\DDGZPE.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VDUW.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\windows\SysWOW64\VDUW.exeC:\windows\system32\VDUW.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KTVVI.exe.bat" "88⤵PID:3632
-
C:\windows\KTVVI.exeC:\windows\KTVVI.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOAFKQB.exe.bat" "90⤵PID:5832
-
C:\windows\FOAFKQB.exeC:\windows\FOAFKQB.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HEGZAZ.exe.bat" "92⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3588 -
C:\windows\SysWOW64\HEGZAZ.exeC:\windows\system32\HEGZAZ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RCTTHH.exe.bat" "94⤵
- Executes a command shell one-liner
PID:1484 -
C:\windows\SysWOW64\RCTTHH.exeC:\windows\system32\RCTTHH.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVW.exe.bat" "96⤵
- Executes a command shell one-liner
PID:3000 -
C:\windows\SysWOW64\PVW.exeC:\windows\system32\PVW.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQAFVDI.exe.bat" "98⤵PID:1208
-
C:\windows\IQAFVDI.exeC:\windows\IQAFVDI.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JTEB.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5524 -
C:\windows\system\JTEB.exeC:\windows\system\JTEB.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TRS.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:200 -
C:\windows\TRS.exeC:\windows\TRS.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WHYDC.exe.bat" "104⤵
- Executes a command shell one-liner
PID:4300 -
C:\windows\WHYDC.exeC:\windows\WHYDC.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUDNFTD.exe.bat" "106⤵PID:5352
-
C:\windows\system\RUDNFTD.exeC:\windows\system\RUDNFTD.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VCKNR.exe.bat" "108⤵PID:3392
-
C:\windows\SysWOW64\VCKNR.exeC:\windows\system32\VCKNR.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFNQ.exe.bat" "110⤵PID:4972
-
C:\windows\SysWOW64\WFNQ.exeC:\windows\system32\WFNQ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFVE.exe.bat" "112⤵PID:3004
-
C:\windows\system\TFVE.exeC:\windows\system\TFVE.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LGXJRBE.exe.bat" "114⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4660 -
C:\windows\SysWOW64\LGXJRBE.exeC:\windows\system32\LGXJRBE.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWEJD.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4068 -
C:\windows\system\PWEJD.exeC:\windows\system\PWEJD.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJITNT.exe.bat" "118⤵PID:3700
-
C:\windows\system\JJITNT.exeC:\windows\system\JJITNT.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMM.exe.bat" "120⤵PID:5616
-
C:\windows\SysWOW64\KMM.exeC:\windows\system32\KMM.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-