Analysis
- max time kernel
87s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe
- Size 208KB
- Sample260821-c4e4qs1eja
- SHA256 e24ff8638a64500adfbeaa245abdbe6ef7a59c01090f4feda1b4a564886f83e7
- MD5 a8b62ff15148f0f588a0e39634d21e53
- SHA1 00ff315b68dbc3aa95978948ae29d9ffbcdcd79b
- SHA512 b7f3c39732402a4cd419d4f49dcd4732cec745d26a8c223e6004e69c33ded1bd0284f37004b04025bbb0a89cea1b9b31fce298db650120edf9c6345f0b3aad15
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfx4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOZQEj1
- TLSH T12F247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4756 GZTDK.exe 6016 LKXS.exe 3236 IKH.exe 5836 SIMPRXI.exe 2008 LLQS.exe 3184 AGAXPHS.exe 4580 ABDSVX.exe 1824 CZR.exe 5600 MXX.exe 4392 WFZM.exe 4296 INFUHE.exe 848 YGQCQ.exe 3116 XQTS.exe 3628 STBRFBP.exe 5752 LWFMSR.exe 4464 UFH.exe 3140 VALVB.exe 2812 KDCAMZD.exe 5760 ATDZTU.exe 3428 SOH.exe 2896 NJMMJ.exe 1172 CEVQCFQ.exe 256 RUWQAS.exe 6096 BSCCQ.exe 2448 FAJ.exe 1924 VQSC.exe 3164 NTV.exe 4916 COFKZR.exe 4640 CUFYBEM.exe 3840 BRQBW.exe 200 QHR.exe 5028 MKARJH.exe 5320 KGZSNKT.exe 4656 KJDWTA.exe 1384 YTTM.exe 712 HUVZKJS.exe 5512 IXZV.exe 904 QCEC.exe 4500 YQQ.exe 4980 GVD.exe 2496 ZOK.exe 3328 QZNQWJT.exe 2536 IEN.exe 3424 CNWZT.exe 3768 KSBG.exe 2344 JDD.exe 6076 MYVX.exe 4212 UEHM.exe 5532 EBNYQC.exe 1972 BCXJU.exe 4108 DACVJ.exe 5060 YXC.exe 920 LITFZC.exe 1352 PYZFM.exe 2844 ZZBSPAG.exe 5768 KPIS.exe 972 UPKYF.exe 5004 NHZJOJ.exe 6100 GKDM.exe 3568 STKMGRJ.exe 5680 SGOTRX.exe 5404 YBOCVTV.exe 3972 CJUCI.exe 3224 AUFS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\BSCCQ.exe RUWQAS.exe File opened for modification C:\windows\SysWOW64\IXZV.exe HUVZKJS.exe File created C:\windows\SysWOW64\IXZV.exe.bat HUVZKJS.exe File created C:\windows\SysWOW64\LNHSU.exe WKXNJGV.exe File opened for modification C:\windows\SysWOW64\GKDM.exe NHZJOJ.exe File created C:\windows\SysWOW64\OUTWFC.exe IULJW.exe File opened for modification C:\windows\SysWOW64\BQUOU.exe HVPF.exe File created C:\windows\SysWOW64\BSCCQ.exe.bat RUWQAS.exe File opened for modification C:\windows\SysWOW64\OUTWFC.exe IULJW.exe File created C:\windows\SysWOW64\WEXZAB.exe.bat HJO.exe File created C:\windows\SysWOW64\APJ.exe LUAXDD.exe File created C:\windows\SysWOW64\EHNMOO.exe.bat YLO.exe File created C:\windows\SysWOW64\UEHM.exe MYVX.exe File created C:\windows\SysWOW64\CJUCI.exe YBOCVTV.exe File created C:\windows\SysWOW64\QCESJ.exe.bat ZBCNFF.exe File created C:\windows\SysWOW64\LITFZC.exe.bat YXC.exe File created C:\windows\SysWOW64\UEHM.exe.bat MYVX.exe File created C:\windows\SysWOW64\INFUHE.exe WFZM.exe File opened for modification C:\windows\SysWOW64\BRQBW.exe CUFYBEM.exe File opened for modification C:\windows\SysWOW64\APJ.exe LUAXDD.exe File opened for modification C:\windows\SysWOW64\BSCCQ.exe RUWQAS.exe File created C:\windows\SysWOW64\HUVZKJS.exe.bat YTTM.exe File created C:\windows\SysWOW64\MYVX.exe.bat JDD.exe File opened for modification C:\windows\SysWOW64\YXC.exe DACVJ.exe File created C:\windows\SysWOW64\HYQ.exe GUNFZT.exe File opened for modification C:\windows\SysWOW64\QCESJ.exe ZBCNFF.exe File opened for modification C:\windows\SysWOW64\LNHSU.exe WKXNJGV.exe File opened for modification C:\windows\SysWOW64\LBGMV.exe BLAAOZ.exe File opened for modification C:\windows\SysWOW64\INFUHE.exe WFZM.exe File created C:\windows\SysWOW64\XQTS.exe.bat YGQCQ.exe File created C:\windows\SysWOW64\RUWQAS.exe CEVQCFQ.exe File opened for modification C:\windows\SysWOW64\RUWQAS.exe CEVQCFQ.exe File created C:\windows\SysWOW64\IXZV.exe HUVZKJS.exe File opened for modification C:\windows\SysWOW64\CEVQCFQ.exe NJMMJ.exe File opened for modification C:\windows\SysWOW64\JDD.exe KSBG.exe File opened for modification C:\windows\SysWOW64\YNROJ.exe ASSF.exe File created C:\windows\SysWOW64\BRQBW.exe CUFYBEM.exe File created C:\windows\SysWOW64\GZTDK.exe.bat 2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe File created C:\windows\SysWOW64\SIMPRXI.exe.bat IKH.exe File created C:\windows\SysWOW64\IULJW.exe PZHNJK.exe File created C:\windows\SysWOW64\ULYK.exe.bat BQUOU.exe File created C:\windows\SysWOW64\LBGMV.exe.bat BLAAOZ.exe File opened for modification C:\windows\SysWOW64\LKXS.exe GZTDK.exe File created C:\windows\SysWOW64\LITFZC.exe YXC.exe File opened for modification C:\windows\SysWOW64\SGOTRX.exe STKMGRJ.exe File opened for modification C:\windows\SysWOW64\HYQ.exe GUNFZT.exe File created C:\windows\SysWOW64\INFUHE.exe.bat WFZM.exe File created C:\windows\SysWOW64\YXC.exe DACVJ.exe File created C:\windows\SysWOW64\GKDM.exe.bat NHZJOJ.exe File opened for modification C:\windows\SysWOW64\XQTS.exe YGQCQ.exe File opened for modification C:\windows\SysWOW64\STKMGRJ.exe GKDM.exe File created C:\windows\SysWOW64\QCESJ.exe ZBCNFF.exe File opened for modification C:\windows\SysWOW64\HUVZKJS.exe YTTM.exe File created C:\windows\SysWOW64\STKMGRJ.exe GKDM.exe File created C:\windows\SysWOW64\YNROJ.exe.bat ASSF.exe File created C:\windows\SysWOW64\ZIFASQT.exe.bat UHXNB.exe File opened for modification C:\windows\SysWOW64\GZTDK.exe 2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe File created C:\windows\SysWOW64\YXC.exe.bat DACVJ.exe File opened for modification C:\windows\SysWOW64\CJUCI.exe YBOCVTV.exe File created C:\windows\SysWOW64\LBGMV.exe BLAAOZ.exe File created C:\windows\SysWOW64\KJDWTA.exe KGZSNKT.exe File created C:\windows\SysWOW64\CJUCI.exe.bat YBOCVTV.exe File created C:\windows\SysWOW64\BUNBPB.exe ORE.exe File opened for modification C:\windows\SysWOW64\KJDWTA.exe KGZSNKT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\CZR.exe.bat ABDSVX.exe File opened for modification C:\windows\DACVJ.exe BCXJU.exe File opened for modification C:\windows\system\GGKRJ.exe XGI.exe File opened for modification C:\windows\WKXNJGV.exe WEXZAB.exe File created C:\windows\UFH.exe LWFMSR.exe File created C:\windows\system\ATDZTU.exe KDCAMZD.exe File opened for modification C:\windows\system\MKARJH.exe QHR.exe File opened for modification C:\windows\GVD.exe YQQ.exe File created C:\windows\ZOK.exe.bat GVD.exe File created C:\windows\HGBKZUS.exe.bat DDDX.exe File created C:\windows\LOHSEN.exe HGBKZUS.exe File opened for modification C:\windows\XGI.exe CKDCWTR.exe File opened for modification C:\windows\system\STBRFBP.exe XQTS.exe File created C:\windows\system\COFKZR.exe NTV.exe File created C:\windows\system\QHR.exe BRQBW.exe File created C:\windows\YQQ.exe.bat QCEC.exe File created C:\windows\EBNYQC.exe UEHM.exe File created C:\windows\LOHSEN.exe.bat HGBKZUS.exe File created C:\windows\WKXNJGV.exe.bat WEXZAB.exe File opened for modification C:\windows\system\YLO.exe LBGMV.exe File created C:\windows\KDCAMZD.exe.bat VALVB.exe File created C:\windows\EBNYQC.exe.bat UEHM.exe File created C:\windows\HVPF.exe RAGAZV.exe File opened for modification C:\windows\BLAAOZ.exe DQBRJ.exe File created C:\windows\system\LLQS.exe SIMPRXI.exe File opened for modification C:\windows\ASSF.exe FFNWUYN.exe File created C:\windows\system\YLO.exe.bat LBGMV.exe File created C:\windows\ABDSVX.exe.bat AGAXPHS.exe File created C:\windows\QZNQWJT.exe ZOK.exe File created C:\windows\system\IEN.exe QZNQWJT.exe File opened for modification C:\windows\system\XKVP.exe TCPHAYU.exe File created C:\windows\system\LWFMSR.exe STBRFBP.exe File created C:\windows\system\LLQS.exe.bat SIMPRXI.exe File opened for modification C:\windows\system\CUFYBEM.exe COFKZR.exe File created C:\windows\PYZFM.exe LITFZC.exe File created C:\windows\system\YLO.exe LBGMV.exe File created C:\windows\UHXNB.exe ZUS.exe File created C:\windows\VALVB.exe UFH.exe File opened for modification C:\windows\ZOK.exe GVD.exe File created C:\windows\system\XKVP.exe.bat TCPHAYU.exe File created C:\windows\YTTM.exe.bat KJDWTA.exe File created C:\windows\QCEC.exe IXZV.exe File opened for modification C:\windows\QZNQWJT.exe ZOK.exe File created C:\windows\system\VCOLZ.exe APJ.exe File opened for modification C:\windows\DQBRJ.exe VCOLZ.exe File created C:\windows\BLAAOZ.exe DQBRJ.exe File created C:\windows\KDCAMZD.exe VALVB.exe File opened for modification C:\windows\SOH.exe ATDZTU.exe File created C:\windows\SOH.exe.bat ATDZTU.exe File opened for modification C:\windows\system\QHR.exe BRQBW.exe File created C:\windows\CNWZT.exe.bat IEN.exe File created C:\windows\ASSF.exe.bat FFNWUYN.exe File created C:\windows\system\CZR.exe ABDSVX.exe File created C:\windows\system\IKH.exe LKXS.exe File created C:\windows\system\AGAXPHS.exe.bat LLQS.exe File created C:\windows\YTTM.exe KJDWTA.exe File created C:\windows\GVD.exe YQQ.exe File created C:\windows\DACVJ.exe.bat BCXJU.exe File created C:\windows\AUFS.exe CJUCI.exe File created C:\windows\ASSF.exe FFNWUYN.exe File created C:\windows\system\CUFYBEM.exe.bat COFKZR.exe File opened for modification C:\windows\AUFS.exe CJUCI.exe File created C:\windows\XEWS.exe LOHSEN.exe File created C:\windows\system\XKVP.exe TCPHAYU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1768 cmd.exe 4912 cmd.exe 5840 cmd.exe 4944 cmd.exe 4592 cmd.exe 1216 cmd.exe 5304 cmd.exe 1032 cmd.exe 4276 cmd.exe 5776 cmd.exe 1400 cmd.exe 2232 cmd.exe 4360 cmd.exe 2704 cmd.exe 3896 cmd.exe 2144 cmd.exe 4940 cmd.exe 3876 cmd.exe 5332 cmd.exe 3416 cmd.exe 1976 cmd.exe 6000 cmd.exe 5464 cmd.exe 4988 cmd.exe 6048 cmd.exe 4952 cmd.exe 4812 cmd.exe 5936 cmd.exe 3900 cmd.exe 5916 cmd.exe 2676 cmd.exe 1044 cmd.exe 4904 cmd.exe 4084 cmd.exe 1888 cmd.exe 4864 cmd.exe 4892 cmd.exe 4768 cmd.exe 2268 cmd.exe 4168 cmd.exe 5624 cmd.exe 4600 cmd.exe 3940 cmd.exe 5528 cmd.exe 1620 cmd.exe 2720 cmd.exe 3340 cmd.exe 1964 cmd.exe 1672 cmd.exe 4104 cmd.exe 2116 cmd.exe 4604 cmd.exe 3808 cmd.exe 4540 cmd.exe 5312 cmd.exe 4348 cmd.exe 5568 cmd.exe 4372 cmd.exe 4136 cmd.exe 1128 cmd.exe 5308 cmd.exe 1004 cmd.exe 2228 cmd.exe 4616 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3940 3360 WerFault.exe 87 4656 4756 WerFault.exe 93 2744 6016 WerFault.exe 99 5928 3236 WerFault.exe 104 5728 5836 WerFault.exe 109 2904 2008 WerFault.exe 114 3788 3184 WerFault.exe 119 1180 4580 WerFault.exe 124 1596 1824 WerFault.exe 129 3468 5600 WerFault.exe 134 5692 4392 WerFault.exe 139 1184 4296 WerFault.exe 144 1400 848 WerFault.exe 149 6032 3116 WerFault.exe 154 5220 3628 WerFault.exe 159 3552 5752 WerFault.exe 164 3400 4464 WerFault.exe 169 1876 3140 WerFault.exe 174 5468 2812 WerFault.exe 179 3872 5760 WerFault.exe 184 4588 3428 WerFault.exe 189 5404 2896 WerFault.exe 194 240 1172 WerFault.exe 199 4624 256 WerFault.exe 204 5444 6096 WerFault.exe 209 3656 2448 WerFault.exe 214 5744 1924 WerFault.exe 219 904 3164 WerFault.exe 224 4716 4916 WerFault.exe 229 6100 4640 WerFault.exe 234 3632 3840 WerFault.exe 239 5692 200 WerFault.exe 244 1336 5028 WerFault.exe 249 5672 5320 WerFault.exe 254 6044 4656 WerFault.exe 259 4268 1384 WerFault.exe 264 6060 712 WerFault.exe 269 1128 5512 WerFault.exe 275 2600 904 WerFault.exe 280 5036 4500 WerFault.exe 285 3632 4980 WerFault.exe 290 1628 2496 WerFault.exe 295 5328 3328 WerFault.exe 300 472 2536 WerFault.exe 305 1948 3424 WerFault.exe 310 4548 3768 WerFault.exe 315 5848 2344 WerFault.exe 320 1492 6076 WerFault.exe 325 4748 4212 WerFault.exe 330 5036 5532 WerFault.exe 335 3880 1972 WerFault.exe 340 1636 4108 WerFault.exe 345 5472 5060 WerFault.exe 350 2940 920 WerFault.exe 355 3224 1352 WerFault.exe 360 3608 2844 WerFault.exe 365 5020 5768 WerFault.exe 370 4716 972 WerFault.exe 375 2112 5004 WerFault.exe 380 5168 6100 WerFault.exe 385 4376 3568 WerFault.exe 390 4560 5680 WerFault.exe 395 2096 5404 WerFault.exe 400 2804 3972 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJUCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EHNMOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KJDWTA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PYZFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XEWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNROJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AGAXPHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DACVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNWZT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INFUHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUTWFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IULJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBCNFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZUS.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3360 2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe 3360 2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe 4756 GZTDK.exe 4756 GZTDK.exe 6016 LKXS.exe 6016 LKXS.exe 3236 IKH.exe 3236 IKH.exe 5836 SIMPRXI.exe 5836 SIMPRXI.exe 2008 LLQS.exe 2008 LLQS.exe 3184 AGAXPHS.exe 3184 AGAXPHS.exe 4580 ABDSVX.exe 4580 ABDSVX.exe 1824 CZR.exe 1824 CZR.exe 5600 MXX.exe 5600 MXX.exe 4392 WFZM.exe 4392 WFZM.exe 4296 INFUHE.exe 4296 INFUHE.exe 848 YGQCQ.exe 848 YGQCQ.exe 3116 XQTS.exe 3116 XQTS.exe 3628 STBRFBP.exe 3628 STBRFBP.exe 5752 LWFMSR.exe 5752 LWFMSR.exe 4464 UFH.exe 4464 UFH.exe 3140 VALVB.exe 3140 VALVB.exe 2812 KDCAMZD.exe 2812 KDCAMZD.exe 5760 ATDZTU.exe 5760 ATDZTU.exe 3428 SOH.exe 3428 SOH.exe 2896 NJMMJ.exe 2896 NJMMJ.exe 1172 CEVQCFQ.exe 1172 CEVQCFQ.exe 256 RUWQAS.exe 256 RUWQAS.exe 6096 BSCCQ.exe 6096 BSCCQ.exe 2448 FAJ.exe 2448 FAJ.exe 1924 VQSC.exe 1924 VQSC.exe 3164 NTV.exe 3164 NTV.exe 4916 COFKZR.exe 4916 COFKZR.exe 4640 CUFYBEM.exe 4640 CUFYBEM.exe 3840 BRQBW.exe 3840 BRQBW.exe 200 QHR.exe 200 QHR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3360 2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe 3360 2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe 4756 GZTDK.exe 4756 GZTDK.exe 6016 LKXS.exe 6016 LKXS.exe 3236 IKH.exe 3236 IKH.exe 5836 SIMPRXI.exe 5836 SIMPRXI.exe 2008 LLQS.exe 2008 LLQS.exe 3184 AGAXPHS.exe 3184 AGAXPHS.exe 4580 ABDSVX.exe 4580 ABDSVX.exe 1824 CZR.exe 1824 CZR.exe 5600 MXX.exe 5600 MXX.exe 4392 WFZM.exe 4392 WFZM.exe 4296 INFUHE.exe 4296 INFUHE.exe 848 YGQCQ.exe 848 YGQCQ.exe 3116 XQTS.exe 3116 XQTS.exe 3628 STBRFBP.exe 3628 STBRFBP.exe 5752 LWFMSR.exe 5752 LWFMSR.exe 4464 UFH.exe 4464 UFH.exe 3140 VALVB.exe 3140 VALVB.exe 2812 KDCAMZD.exe 2812 KDCAMZD.exe 5760 ATDZTU.exe 5760 ATDZTU.exe 3428 SOH.exe 3428 SOH.exe 2896 NJMMJ.exe 2896 NJMMJ.exe 1172 CEVQCFQ.exe 1172 CEVQCFQ.exe 256 RUWQAS.exe 256 RUWQAS.exe 6096 BSCCQ.exe 6096 BSCCQ.exe 2448 FAJ.exe 2448 FAJ.exe 1924 VQSC.exe 1924 VQSC.exe 3164 NTV.exe 3164 NTV.exe 4916 COFKZR.exe 4916 COFKZR.exe 4640 CUFYBEM.exe 4640 CUFYBEM.exe 3840 BRQBW.exe 3840 BRQBW.exe 200 QHR.exe 200 QHR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3360 wrote to memory of 2424 3360 2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe 89 PID 2424 wrote to memory of 4756 2424 cmd.exe 93 PID 4756 wrote to memory of 2440 4756 GZTDK.exe 95 PID 2440 wrote to memory of 6016 2440 cmd.exe 99 PID 6016 wrote to memory of 2052 6016 LKXS.exe 100 PID 2052 wrote to memory of 3236 2052 cmd.exe 104 PID 3236 wrote to memory of 5956 3236 IKH.exe 105 PID 5956 wrote to memory of 5836 5956 cmd.exe 109 PID 5836 wrote to memory of 4696 5836 SIMPRXI.exe 110 PID 4696 wrote to memory of 2008 4696 cmd.exe 114 PID 2008 wrote to memory of 3324 2008 LLQS.exe 115 PID 3324 wrote to memory of 3184 3324 cmd.exe 119 PID 3184 wrote to memory of 2268 3184 AGAXPHS.exe 120 PID 2268 wrote to memory of 4580 2268 cmd.exe 124 PID 4580 wrote to memory of 1480 4580 ABDSVX.exe 125 PID 1480 wrote to memory of 1824 1480 cmd.exe 129 PID 1824 wrote to memory of 6000 1824 CZR.exe 130 PID 6000 wrote to memory of 5600 6000 cmd.exe 134 PID 5600 wrote to memory of 5076 5600 MXX.exe 135 PID 5076 wrote to memory of 4392 5076 cmd.exe 139 PID 4392 wrote to memory of 1216 4392 WFZM.exe 140 PID 1216 wrote to memory of 4296 1216 cmd.exe 144 PID 4296 wrote to memory of 2884 4296 INFUHE.exe 145 PID 2884 wrote to memory of 848 2884 cmd.exe 149 PID 848 wrote to memory of 3016 848 YGQCQ.exe 150 PID 3016 wrote to memory of 3116 3016 cmd.exe 154 PID 3116 wrote to memory of 2704 3116 XQTS.exe 155 PID 2704 wrote to memory of 3628 2704 cmd.exe 159 PID 3628 wrote to memory of 1904 3628 STBRFBP.exe 160 PID 1904 wrote to memory of 5752 1904 cmd.exe 164 PID 5752 wrote to memory of 4168 5752 LWFMSR.exe 165 PID 4168 wrote to memory of 4464 4168 cmd.exe 169 PID 4464 wrote to memory of 1708 4464 UFH.exe 170 PID 1708 wrote to memory of 3140 1708 cmd.exe 174 PID 3140 wrote to memory of 3980 3140 VALVB.exe 175 PID 3980 wrote to memory of 2812 3980 cmd.exe 179 PID 2812 wrote to memory of 5464 2812 KDCAMZD.exe 180 PID 5464 wrote to memory of 5760 5464 cmd.exe 184 PID 5760 wrote to memory of 3348 5760 ATDZTU.exe 185 PID 3348 wrote to memory of 3428 3348 cmd.exe 189 PID 3428 wrote to memory of 5944 3428 SOH.exe 190 PID 5944 wrote to memory of 2896 5944 cmd.exe 194 PID 2896 wrote to memory of 3120 2896 NJMMJ.exe 195 PID 3120 wrote to memory of 1172 3120 cmd.exe 199 PID 1172 wrote to memory of 6104 1172 CEVQCFQ.exe 200 PID 6104 wrote to memory of 256 6104 cmd.exe 204 PID 256 wrote to memory of 1588 256 RUWQAS.exe 205 PID 1588 wrote to memory of 6096 1588 cmd.exe 209 PID 6096 wrote to memory of 1648 6096 BSCCQ.exe 210 PID 1648 wrote to memory of 2448 1648 cmd.exe 214 PID 2448 wrote to memory of 5628 2448 FAJ.exe 215 PID 5628 wrote to memory of 1924 5628 cmd.exe 219 PID 1924 wrote to memory of 5104 1924 VQSC.exe 220 PID 5104 wrote to memory of 3164 5104 cmd.exe 224 PID 3164 wrote to memory of 3392 3164 NTV.exe 225 PID 3392 wrote to memory of 4916 3392 cmd.exe 229 PID 4916 wrote to memory of 1396 4916 COFKZR.exe 230 PID 1396 wrote to memory of 4640 1396 cmd.exe 234 PID 4640 wrote to memory of 1148 4640 CUFYBEM.exe 235 PID 1148 wrote to memory of 3840 1148 cmd.exe 239 PID 3840 wrote to memory of 3896 3840 BRQBW.exe 240 PID 3896 wrote to memory of 200 3896 cmd.exe 244 PID 200 wrote to memory of 3344 200 QHR.exe 245 PID 3344 wrote to memory of 5028 3344 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a8b62ff15148f0f588a0e39634d21e53_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GZTDK.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\windows\SysWOW64\GZTDK.exeC:\windows\system32\GZTDK.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKXS.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\windows\SysWOW64\LKXS.exeC:\windows\system32\LKXS.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IKH.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\windows\system\IKH.exeC:\windows\system\IKH.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SIMPRXI.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\windows\SysWOW64\SIMPRXI.exeC:\windows\system32\SIMPRXI.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLQS.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\windows\system\LLQS.exeC:\windows\system\LLQS.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AGAXPHS.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\windows\system\AGAXPHS.exeC:\windows\system\AGAXPHS.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ABDSVX.exe.bat" "14⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\ABDSVX.exeC:\windows\ABDSVX.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZR.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\windows\system\CZR.exeC:\windows\system\CZR.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXX.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\windows\MXX.exeC:\windows\MXX.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFZM.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\windows\system\WFZM.exeC:\windows\system\WFZM.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\INFUHE.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\windows\SysWOW64\INFUHE.exeC:\windows\system32\INFUHE.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGQCQ.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\windows\YGQCQ.exeC:\windows\YGQCQ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQTS.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\windows\SysWOW64\XQTS.exeC:\windows\system32\XQTS.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STBRFBP.exe.bat" "28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\system\STBRFBP.exeC:\windows\system\STBRFBP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWFMSR.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\windows\system\LWFMSR.exeC:\windows\system\LWFMSR.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UFH.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\UFH.exeC:\windows\UFH.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VALVB.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\windows\VALVB.exeC:\windows\VALVB.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KDCAMZD.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\windows\KDCAMZD.exeC:\windows\KDCAMZD.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATDZTU.exe.bat" "38⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\windows\system\ATDZTU.exeC:\windows\system\ATDZTU.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SOH.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\windows\SOH.exeC:\windows\SOH.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJMMJ.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\windows\SysWOW64\NJMMJ.exeC:\windows\system32\NJMMJ.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CEVQCFQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\SysWOW64\CEVQCFQ.exeC:\windows\system32\CEVQCFQ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUWQAS.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\SysWOW64\RUWQAS.exeC:\windows\system32\RUWQAS.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BSCCQ.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\windows\SysWOW64\BSCCQ.exeC:\windows\system32\BSCCQ.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAJ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\windows\system\FAJ.exeC:\windows\system\FAJ.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQSC.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\system\VQSC.exeC:\windows\system\VQSC.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\windows\NTV.exeC:\windows\NTV.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\COFKZR.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\system\COFKZR.exeC:\windows\system\COFKZR.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CUFYBEM.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\windows\system\CUFYBEM.exeC:\windows\system\CUFYBEM.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRQBW.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\windows\SysWOW64\BRQBW.exeC:\windows\system32\BRQBW.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHR.exe.bat" "62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\windows\system\QHR.exeC:\windows\system\QHR.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKARJH.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\windows\system\MKARJH.exeC:\windows\system\MKARJH.exe65⤵
- Executes dropped EXE
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGZSNKT.exe.bat" "66⤵PID:5764
-
C:\windows\SysWOW64\KGZSNKT.exeC:\windows\system32\KGZSNKT.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJDWTA.exe.bat" "68⤵PID:1208
-
C:\windows\SysWOW64\KJDWTA.exeC:\windows\system32\KJDWTA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YTTM.exe.bat" "70⤵PID:4188
-
C:\windows\YTTM.exeC:\windows\YTTM.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUVZKJS.exe.bat" "72⤵PID:2672
-
C:\windows\SysWOW64\HUVZKJS.exeC:\windows\system32\HUVZKJS.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "74⤵PID:4332
-
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QCEC.exe.bat" "76⤵PID:5804
-
C:\windows\QCEC.exeC:\windows\QCEC.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "78⤵PID:5852
-
C:\windows\YQQ.exeC:\windows\YQQ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVD.exe.bat" "80⤵
- Executes a command shell one-liner
PID:5916 -
C:\windows\GVD.exeC:\windows\GVD.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOK.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3524 -
C:\windows\ZOK.exeC:\windows\ZOK.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QZNQWJT.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5308 -
C:\windows\QZNQWJT.exeC:\windows\QZNQWJT.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IEN.exe.bat" "86⤵
- Executes a command shell one-liner
PID:5304 -
C:\windows\system\IEN.exeC:\windows\system\IEN.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CNWZT.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2640 -
C:\windows\CNWZT.exeC:\windows\CNWZT.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSBG.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4988 -
C:\windows\KSBG.exeC:\windows\KSBG.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDD.exe.bat" "92⤵PID:4272
-
C:\windows\SysWOW64\JDD.exeC:\windows\system32\JDD.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYVX.exe.bat" "94⤵
- Executes a command shell one-liner
PID:4540 -
C:\windows\SysWOW64\MYVX.exeC:\windows\system32\MYVX.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UEHM.exe.bat" "96⤵PID:2904
-
C:\windows\SysWOW64\UEHM.exeC:\windows\system32\UEHM.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EBNYQC.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2200 -
C:\windows\EBNYQC.exeC:\windows\EBNYQC.exe99⤵
- Executes dropped EXE
PID:5532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BCXJU.exe.bat" "100⤵
- Executes a command shell one-liner
PID:5312 -
C:\windows\system\BCXJU.exeC:\windows\system\BCXJU.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DACVJ.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5624 -
C:\windows\DACVJ.exeC:\windows\DACVJ.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXC.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2512 -
C:\windows\SysWOW64\YXC.exeC:\windows\system32\YXC.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LITFZC.exe.bat" "106⤵
- Executes a command shell one-liner
PID:4600 -
C:\windows\SysWOW64\LITFZC.exeC:\windows\system32\LITFZC.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PYZFM.exe.bat" "108⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1032 -
C:\windows\PYZFM.exeC:\windows\PYZFM.exe109⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZBSPAG.exe.bat" "110⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2676 -
C:\windows\system\ZZBSPAG.exeC:\windows\system\ZZBSPAG.exe111⤵
- Executes dropped EXE
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KPIS.exe.bat" "112⤵PID:2960
-
C:\windows\KPIS.exeC:\windows\KPIS.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPKYF.exe.bat" "114⤵PID:480
-
C:\windows\UPKYF.exeC:\windows\UPKYF.exe115⤵
- Executes dropped EXE
PID:972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NHZJOJ.exe.bat" "116⤵
- Executes a command shell one-liner
PID:6048 -
C:\windows\SysWOW64\NHZJOJ.exeC:\windows\system32\NHZJOJ.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKDM.exe.bat" "118⤵PID:4132
-
C:\windows\SysWOW64\GKDM.exeC:\windows\system32\GKDM.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "120⤵PID:1016
-
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-