Analysis
- max time kernel
93s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-30_dec6cd1fcc580007b53f2382ed6b8daf_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-30_dec6cd1fcc580007b53f2382ed6b8daf_elex_emotet_stop.exe
- Size 208KB
- Sample260831-da3hlscn8x
- SHA256 7fe1c7678a02a5c39d26272b1f88a6442906ddadb9b89abe063b0772a480b349
- MD5 dec6cd1fcc580007b53f2382ed6b8daf
- SHA1 5d42320b7b7a24dec66dc9744456e31ed9da23c6
- SHA512 0d9881517ac1826009f4e2a646dc797d358e3d5df8e0d5c18d549fa25f2529ce94192c57692cc1f29930e2631ae6849595326f3297839504864c38a22cb72869
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfq4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOCQEj1
- TLSH T10C247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3856 NAFPVWQ.exe 5804 LLO.exe 1152 PTDUMQ.exe 3896 QWHPRGK.exe 4572 IZLTFW.exe 3064 SXQN.exe 996 WFXNYW.exe 2960 MVYNF.exe 1584 BQP.exe 4840 QGQIXA.exe 984 LUV.exe 1456 RUDOQ.exe 5044 JXGJWKU.exe 5564 KAKN.exe 2032 TAMSMGY.exe 1352 DYSMU.exe 5464 HOYMGGC.exe 4828 LWFMSR.exe 5976 AMG.exe 4812 CKUGGUO.exe 5392 DNYC.exe 5416 ATQRC.exe 1140 YDTH.exe 4624 ZGWLQK.exe 1532 FHE.exe 3916 ZUJIK.exe 992 EXH.exe 4516 TSQHC.exe 2480 RLTX.exe 3744 RVCRR.exe 3708 BEEECH.exe 3712 SEGJGMG.exe 1264 HZPNR.exe 1148 JXDIY.exe 916 MKARJH.exe 2428 MYAGKUH.exe 4992 ETEB.exe 1084 ZOJ.exe 4416 AJMON.exe 2524 FJUCWCI.exe 2620 PSW.exe 2056 TADPMS.exe 1808 YAK.exe 2284 ZDOZI.exe 5396 UQTILKX.exe 4984 YGZQXU.exe 1656 JZCJF.exe 2240 NHJJR.exe 3320 HUOSCU.exe 4576 KQT.exe 4688 KVTQ.exe 4952 ODAYSZ.exe 2420 JZE.exe 1404 NHLIO.exe 1708 JMRFVTW.exe 4588 UFMYDI.exe 468 RKS.exe 2556 ALUA.exe 1596 LDXLW.exe 5836 DQH.exe 4060 OJCV.exe 3040 UJKJD.exe 6008 JZL.exe 1188 SANO.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\QWHPRGK.exe PTDUMQ.exe File opened for modification C:\windows\SysWOW64\QWHPRGK.exe PTDUMQ.exe File opened for modification C:\windows\SysWOW64\TBWYLAG.exe HITFLT.exe File created C:\windows\SysWOW64\UCDZCL.exe.bat ZPYI.exe File created C:\windows\SysWOW64\QGQIXA.exe BQP.exe File created C:\windows\SysWOW64\JXGJWKU.exe.bat RUDOQ.exe File opened for modification C:\windows\SysWOW64\UFMYDI.exe JMRFVTW.exe File opened for modification C:\windows\SysWOW64\LBZQ.exe LVZ.exe File created C:\windows\SysWOW64\AJMON.exe.bat ZOJ.exe File created C:\windows\SysWOW64\OZDRITB.exe.bat MKCPCW.exe File created C:\windows\SysWOW64\FCTZQMG.exe PHKUX.exe File created C:\windows\SysWOW64\ZPYI.exe FCTZQMG.exe File opened for modification C:\windows\SysWOW64\ZPYI.exe FCTZQMG.exe File created C:\windows\SysWOW64\GUNBA.exe UBSI.exe File created C:\windows\SysWOW64\CKUGGUO.exe AMG.exe File created C:\windows\SysWOW64\HZPNR.exe SEGJGMG.exe File created C:\windows\SysWOW64\NVOV.exe CCL.exe File created C:\windows\SysWOW64\ZGWLQK.exe.bat YDTH.exe File created C:\windows\SysWOW64\COKI.exe.bat LBZQ.exe File created C:\windows\SysWOW64\LLO.exe NAFPVWQ.exe File created C:\windows\SysWOW64\BQP.exe.bat MVYNF.exe File created C:\windows\SysWOW64\HJEON.exe.bat NWZ.exe File created C:\windows\SysWOW64\DQH.exe LDXLW.exe File created C:\windows\SysWOW64\GKXBZC.exe LWSK.exe File opened for modification C:\windows\SysWOW64\COKI.exe LBZQ.exe File opened for modification C:\windows\SysWOW64\SSHMSB.exe GZETR.exe File opened for modification C:\windows\SysWOW64\LLO.exe NAFPVWQ.exe File created C:\windows\SysWOW64\AJMON.exe ZOJ.exe File created C:\windows\SysWOW64\YAK.exe.bat TADPMS.exe File created C:\windows\SysWOW64\LBZQ.exe.bat LVZ.exe File created C:\windows\SysWOW64\EIOX.exe.bat YIGJGRI.exe File opened for modification C:\windows\SysWOW64\NVOV.exe CCL.exe File opened for modification C:\windows\SysWOW64\FCTZQMG.exe PHKUX.exe File opened for modification C:\windows\SysWOW64\JQFHY.exe JLFSX.exe File created C:\windows\SysWOW64\IZLTFW.exe.bat QWHPRGK.exe File opened for modification C:\windows\SysWOW64\BQP.exe MVYNF.exe File opened for modification C:\windows\SysWOW64\FAPH.exe KMKYWUL.exe File created C:\windows\SysWOW64\SSHMSB.exe.bat GZETR.exe File created C:\windows\SysWOW64\ZUJIK.exe.bat FHE.exe File created C:\windows\SysWOW64\UFMYDI.exe.bat JMRFVTW.exe File opened for modification C:\windows\SysWOW64\KOGQB.exe TBWYLAG.exe File opened for modification C:\windows\SysWOW64\OZDRITB.exe MKCPCW.exe File created C:\windows\SysWOW64\QWHPRGK.exe.bat PTDUMQ.exe File created C:\windows\SysWOW64\JXGJWKU.exe RUDOQ.exe File opened for modification C:\windows\SysWOW64\AJMON.exe ZOJ.exe File opened for modification C:\windows\SysWOW64\LVZ.exe PQBMIK.exe File created C:\windows\SysWOW64\FCTZQMG.exe.bat PHKUX.exe File opened for modification C:\windows\SysWOW64\SVFFC.exe QGDDWB.exe File created C:\windows\SysWOW64\SVFFC.exe.bat QGDDWB.exe File created C:\windows\SysWOW64\WCDPJKL.exe HWGSCA.exe File created C:\windows\SysWOW64\WCDPJKL.exe.bat HWGSCA.exe File created C:\windows\SysWOW64\NVOV.exe.bat CCL.exe File opened for modification C:\windows\SysWOW64\QGQIXA.exe BQP.exe File created C:\windows\SysWOW64\ZGWLQK.exe YDTH.exe File opened for modification C:\windows\SysWOW64\HJEON.exe NWZ.exe File created C:\windows\SysWOW64\EIOX.exe YIGJGRI.exe File created C:\windows\SysWOW64\GKXBZC.exe.bat LWSK.exe File created C:\windows\SysWOW64\UJKJD.exe.bat OJCV.exe File opened for modification C:\windows\SysWOW64\WCDPJKL.exe HWGSCA.exe File created C:\windows\SysWOW64\PDSGAFY.exe SFUJL.exe File created C:\windows\SysWOW64\LWSK.exe GWLWGIS.exe File opened for modification C:\windows\SysWOW64\CKUGGUO.exe AMG.exe File created C:\windows\SysWOW64\QGQIXA.exe.bat BQP.exe File created C:\windows\SysWOW64\CKUGGUO.exe.bat AMG.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\DNYC.exe CKUGGUO.exe File created C:\windows\system\FJUCWCI.exe AJMON.exe File created C:\windows\system\PQBMIK.exe PFTLVG.exe File created C:\windows\system\SPKR.exe.bat OZDRITB.exe File opened for modification C:\windows\MYAGKUH.exe MKARJH.exe File opened for modification C:\windows\ETEB.exe MYAGKUH.exe File created C:\windows\OHNBPL.exe.bat COKI.exe File created C:\windows\QSSAH.exe FAPH.exe File created C:\windows\system\YIGJGRI.exe.bat NPL.exe File opened for modification C:\windows\LRAV.exe ZYXKN.exe File opened for modification C:\windows\TSQHC.exe EXH.exe File created C:\windows\BEEECH.exe RVCRR.exe File created C:\windows\JZE.exe ODAYSZ.exe File created C:\windows\system\RKS.exe UFMYDI.exe File created C:\windows\PEESV.exe.bat VRZ.exe File created C:\windows\NAFPVWQ.exe.bat 2026-08-30_dec6cd1fcc580007b53f2382ed6b8daf_elex_emotet_stop.exe File opened for modification C:\windows\LUV.exe QGQIXA.exe File created C:\windows\system\ZYXKN.exe.bat QYVXJLY.exe File opened for modification C:\windows\system\JLFSX.exe DLXF.exe File created C:\windows\LUV.exe QGQIXA.exe File created C:\windows\MYAGKUH.exe MKARJH.exe File created C:\windows\system\JMRFVTW.exe NHLIO.exe File created C:\windows\ALUA.exe.bat RKS.exe File created C:\windows\system\BLVTP.exe QSSAH.exe File created C:\windows\KAKN.exe.bat JXGJWKU.exe File created C:\windows\system\NHJJR.exe.bat JZCJF.exe File created C:\windows\system\ODAYSZ.exe KVTQ.exe File created C:\windows\OJCV.exe DQH.exe File created C:\windows\JXSE.exe.bat SSHMSB.exe File created C:\windows\system\RVCRR.exe.bat RLTX.exe File opened for modification C:\windows\system\KVTQ.exe KQT.exe File created C:\windows\system\BLVTP.exe.bat QSSAH.exe File opened for modification C:\windows\system\CCL.exe WCDPJKL.exe File created C:\windows\system\HOYMGGC.exe DYSMU.exe File created C:\windows\system\LWFMSR.exe.bat HOYMGGC.exe File opened for modification C:\windows\YGZQXU.exe UQTILKX.exe File opened for modification C:\windows\system\AVVZAU.exe PDSGAFY.exe File opened for modification C:\windows\system\PHKUX.exe VLF.exe File created C:\windows\SXQN.exe IZLTFW.exe File created C:\windows\system\KQT.exe.bat HUOSCU.exe File created C:\windows\system\KQT.exe HUOSCU.exe File created C:\windows\system\YIGJGRI.exe NPL.exe File created C:\windows\system\JLFSX.exe.bat DLXF.exe File opened for modification C:\windows\VLF.exe OVQO.exe File created C:\windows\NPL.exe SCHHWK.exe File created C:\windows\system\SFUJL.exe.bat JXSE.exe File created C:\windows\PEESV.exe VRZ.exe File created C:\windows\system\DNYC.exe.bat CKUGGUO.exe File created C:\windows\YDTH.exe ATQRC.exe File opened for modification C:\windows\system\RLTX.exe TSQHC.exe File opened for modification C:\windows\JXDIY.exe HZPNR.exe File opened for modification C:\windows\KMKYWUL.exe OHNBPL.exe File created C:\windows\LRAV.exe.bat ZYXKN.exe File created C:\windows\system\RKS.exe.bat UFMYDI.exe File opened for modification C:\windows\PFTLVG.exe SANO.exe File opened for modification C:\windows\ATQRC.exe DNYC.exe File opened for modification C:\windows\system\DLXF.exe UCDZCL.exe File created C:\windows\SFWP.exe XKZGCHK.exe File opened for modification C:\windows\SXQN.exe IZLTFW.exe File opened for modification C:\windows\system\HOYMGGC.exe DYSMU.exe File created C:\windows\UQTILKX.exe.bat ZDOZI.exe File opened for modification C:\windows\system\KQT.exe HUOSCU.exe File opened for modification C:\windows\system\SCHHWK.exe HJEON.exe File opened for modification C:\windows\QGDDWB.exe SFWP.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3444 cmd.exe 5380 cmd.exe 2832 cmd.exe 2696 cmd.exe 256 cmd.exe 5568 cmd.exe 5532 cmd.exe 6120 cmd.exe 3356 cmd.exe 3400 cmd.exe 2872 cmd.exe 2860 cmd.exe 4080 cmd.exe 4148 cmd.exe 5400 cmd.exe 1176 cmd.exe 1144 cmd.exe 5824 cmd.exe 4108 cmd.exe 5412 cmd.exe 5736 cmd.exe 2124 cmd.exe 2684 cmd.exe 5952 cmd.exe 5180 cmd.exe 1704 cmd.exe 4696 cmd.exe 5604 cmd.exe 1100 cmd.exe 2208 cmd.exe 5140 cmd.exe 5424 cmd.exe 1520 cmd.exe 4256 cmd.exe 904 cmd.exe 4568 cmd.exe 1956 cmd.exe 6016 cmd.exe 4628 cmd.exe 5960 cmd.exe 1752 cmd.exe 3736 cmd.exe 4668 cmd.exe 5560 cmd.exe 1368 cmd.exe 4292 cmd.exe 5064 cmd.exe 5572 cmd.exe 6032 cmd.exe 4396 cmd.exe 5556 cmd.exe 5384 cmd.exe 5484 cmd.exe 4860 cmd.exe 2064 cmd.exe 3700 cmd.exe 2172 cmd.exe 596 cmd.exe 4412 cmd.exe 5344 cmd.exe 3136 cmd.exe 5992 cmd.exe 1632 cmd.exe 4844 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 120 3412 WerFault.exe 87 3540 3856 WerFault.exe 93 920 5804 WerFault.exe 99 2496 1152 WerFault.exe 104 572 3896 WerFault.exe 109 1204 4572 WerFault.exe 114 1232 3064 WerFault.exe 119 2356 996 WerFault.exe 124 2464 2960 WerFault.exe 129 828 1584 WerFault.exe 134 1260 4840 WerFault.exe 139 4796 984 WerFault.exe 144 4624 1456 WerFault.exe 149 5776 5044 WerFault.exe 154 3172 5564 WerFault.exe 159 768 2032 WerFault.exe 164 5544 1352 WerFault.exe 169 2240 5464 WerFault.exe 174 5016 4828 WerFault.exe 179 5488 5976 WerFault.exe 184 5124 4812 WerFault.exe 189 4132 5392 WerFault.exe 194 588 5416 WerFault.exe 199 5036 1140 WerFault.exe 204 1952 4624 WerFault.exe 209 4808 1532 WerFault.exe 214 1812 3916 WerFault.exe 219 2948 992 WerFault.exe 224 1416 4516 WerFault.exe 229 3128 2480 WerFault.exe 234 4636 3744 WerFault.exe 239 2920 3708 WerFault.exe 244 5936 3712 WerFault.exe 249 2648 1264 WerFault.exe 254 1980 1148 WerFault.exe 259 4452 916 WerFault.exe 264 792 2428 WerFault.exe 269 4396 4992 WerFault.exe 274 780 1084 WerFault.exe 280 3772 4416 WerFault.exe 285 5292 2524 WerFault.exe 290 2328 2620 WerFault.exe 295 5172 2056 WerFault.exe 300 4296 1808 WerFault.exe 305 2840 2284 WerFault.exe 310 1028 5396 WerFault.exe 315 1576 4984 WerFault.exe 320 3472 1656 WerFault.exe 325 4048 2240 WerFault.exe 330 4696 3320 WerFault.exe 335 2980 4576 WerFault.exe 340 5736 4688 WerFault.exe 345 5036 4952 WerFault.exe 350 3100 2420 WerFault.exe 355 2664 1404 WerFault.exe 360 2216 1708 WerFault.exe 365 1496 4588 WerFault.exe 370 4436 468 WerFault.exe 375 2836 2556 WerFault.exe 380 4124 1596 WerFault.exe 385 3836 5836 WerFault.exe 390 1636 4060 WerFault.exe 395 4736 3040 WerFault.exe 400 2484 6008 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HJEON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ETEB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UJKJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFUJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCDZCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DLXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QWHPRGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCTZQMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZLTFW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGWLQK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VLF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZPNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPYI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLFSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EIOX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODAYSZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMRFVTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVCRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUOSCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFMYDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWGSCA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YWMTLSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LWSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCDPJKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TADPMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3412 2026-08-30_dec6cd1fcc580007b53f2382ed6b8daf_elex_emotet_stop.exe 3412 2026-08-30_dec6cd1fcc580007b53f2382ed6b8daf_elex_emotet_stop.exe 3856 NAFPVWQ.exe 3856 NAFPVWQ.exe 5804 LLO.exe 5804 LLO.exe 1152 PTDUMQ.exe 1152 PTDUMQ.exe 3896 QWHPRGK.exe 3896 QWHPRGK.exe 4572 IZLTFW.exe 4572 IZLTFW.exe 3064 SXQN.exe 3064 SXQN.exe 996 WFXNYW.exe 996 WFXNYW.exe 2960 MVYNF.exe 2960 MVYNF.exe 1584 BQP.exe 1584 BQP.exe 4840 QGQIXA.exe 4840 QGQIXA.exe 984 LUV.exe 984 LUV.exe 1456 RUDOQ.exe 1456 RUDOQ.exe 5044 JXGJWKU.exe 5044 JXGJWKU.exe 5564 KAKN.exe 5564 KAKN.exe 2032 TAMSMGY.exe 2032 TAMSMGY.exe 1352 DYSMU.exe 1352 DYSMU.exe 5464 HOYMGGC.exe 5464 HOYMGGC.exe 4828 LWFMSR.exe 4828 LWFMSR.exe 5976 AMG.exe 5976 AMG.exe 4812 CKUGGUO.exe 4812 CKUGGUO.exe 5392 DNYC.exe 5392 DNYC.exe 5416 ATQRC.exe 5416 ATQRC.exe 1140 YDTH.exe 1140 YDTH.exe 4624 ZGWLQK.exe 4624 ZGWLQK.exe 1532 FHE.exe 1532 FHE.exe 3916 ZUJIK.exe 3916 ZUJIK.exe 992 EXH.exe 992 EXH.exe 4516 TSQHC.exe 4516 TSQHC.exe 2480 RLTX.exe 2480 RLTX.exe 3744 RVCRR.exe 3744 RVCRR.exe 3708 BEEECH.exe 3708 BEEECH.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3412 2026-08-30_dec6cd1fcc580007b53f2382ed6b8daf_elex_emotet_stop.exe 3412 2026-08-30_dec6cd1fcc580007b53f2382ed6b8daf_elex_emotet_stop.exe 3856 NAFPVWQ.exe 3856 NAFPVWQ.exe 5804 LLO.exe 5804 LLO.exe 1152 PTDUMQ.exe 1152 PTDUMQ.exe 3896 QWHPRGK.exe 3896 QWHPRGK.exe 4572 IZLTFW.exe 4572 IZLTFW.exe 3064 SXQN.exe 3064 SXQN.exe 996 WFXNYW.exe 996 WFXNYW.exe 2960 MVYNF.exe 2960 MVYNF.exe 1584 BQP.exe 1584 BQP.exe 4840 QGQIXA.exe 4840 QGQIXA.exe 984 LUV.exe 984 LUV.exe 1456 RUDOQ.exe 1456 RUDOQ.exe 5044 JXGJWKU.exe 5044 JXGJWKU.exe 5564 KAKN.exe 5564 KAKN.exe 2032 TAMSMGY.exe 2032 TAMSMGY.exe 1352 DYSMU.exe 1352 DYSMU.exe 5464 HOYMGGC.exe 5464 HOYMGGC.exe 4828 LWFMSR.exe 4828 LWFMSR.exe 5976 AMG.exe 5976 AMG.exe 4812 CKUGGUO.exe 4812 CKUGGUO.exe 5392 DNYC.exe 5392 DNYC.exe 5416 ATQRC.exe 5416 ATQRC.exe 1140 YDTH.exe 1140 YDTH.exe 4624 ZGWLQK.exe 4624 ZGWLQK.exe 1532 FHE.exe 1532 FHE.exe 3916 ZUJIK.exe 3916 ZUJIK.exe 992 EXH.exe 992 EXH.exe 4516 TSQHC.exe 4516 TSQHC.exe 2480 RLTX.exe 2480 RLTX.exe 3744 RVCRR.exe 3744 RVCRR.exe 3708 BEEECH.exe 3708 BEEECH.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 4364 3412 2026-08-30_dec6cd1fcc580007b53f2382ed6b8daf_elex_emotet_stop.exe 89 PID 4364 wrote to memory of 3856 4364 cmd.exe 93 PID 3856 wrote to memory of 2300 3856 NAFPVWQ.exe 95 PID 2300 wrote to memory of 5804 2300 cmd.exe 99 PID 5804 wrote to memory of 2704 5804 LLO.exe 100 PID 2704 wrote to memory of 1152 2704 cmd.exe 104 PID 1152 wrote to memory of 2540 1152 PTDUMQ.exe 105 PID 2540 wrote to memory of 3896 2540 cmd.exe 109 PID 3896 wrote to memory of 2708 3896 QWHPRGK.exe 110 PID 2708 wrote to memory of 4572 2708 cmd.exe 114 PID 4572 wrote to memory of 6016 4572 IZLTFW.exe 115 PID 6016 wrote to memory of 3064 6016 cmd.exe 119 PID 3064 wrote to memory of 1660 3064 SXQN.exe 120 PID 1660 wrote to memory of 996 1660 cmd.exe 124 PID 996 wrote to memory of 2660 996 WFXNYW.exe 125 PID 2660 wrote to memory of 2960 2660 cmd.exe 129 PID 2960 wrote to memory of 5140 2960 MVYNF.exe 130 PID 5140 wrote to memory of 1584 5140 cmd.exe 134 PID 1584 wrote to memory of 3384 1584 BQP.exe 135 PID 3384 wrote to memory of 4840 3384 cmd.exe 139 PID 4840 wrote to memory of 1076 4840 QGQIXA.exe 140 PID 1076 wrote to memory of 984 1076 cmd.exe 144 PID 984 wrote to memory of 4844 984 LUV.exe 145 PID 4844 wrote to memory of 1456 4844 cmd.exe 149 PID 1456 wrote to memory of 248 1456 RUDOQ.exe 150 PID 248 wrote to memory of 5044 248 cmd.exe 154 PID 5044 wrote to memory of 1632 5044 JXGJWKU.exe 155 PID 1632 wrote to memory of 5564 1632 cmd.exe 159 PID 5564 wrote to memory of 5884 5564 KAKN.exe 160 PID 5884 wrote to memory of 2032 5884 cmd.exe 164 PID 2032 wrote to memory of 3356 2032 TAMSMGY.exe 165 PID 3356 wrote to memory of 1352 3356 cmd.exe 169 PID 1352 wrote to memory of 1180 1352 DYSMU.exe 170 PID 1180 wrote to memory of 5464 1180 cmd.exe 174 PID 5464 wrote to memory of 3400 5464 HOYMGGC.exe 175 PID 3400 wrote to memory of 4828 3400 cmd.exe 179 PID 4828 wrote to memory of 3392 4828 LWFMSR.exe 180 PID 3392 wrote to memory of 5976 3392 cmd.exe 184 PID 5976 wrote to memory of 2652 5976 AMG.exe 185 PID 2652 wrote to memory of 4812 2652 cmd.exe 189 PID 4812 wrote to memory of 1780 4812 CKUGGUO.exe 190 PID 1780 wrote to memory of 5392 1780 cmd.exe 194 PID 5392 wrote to memory of 5484 5392 DNYC.exe 195 PID 5484 wrote to memory of 5416 5484 cmd.exe 199 PID 5416 wrote to memory of 5328 5416 ATQRC.exe 200 PID 5328 wrote to memory of 1140 5328 cmd.exe 204 PID 1140 wrote to memory of 2968 1140 YDTH.exe 205 PID 2968 wrote to memory of 4624 2968 cmd.exe 209 PID 4624 wrote to memory of 4092 4624 ZGWLQK.exe 210 PID 4092 wrote to memory of 1532 4092 cmd.exe 214 PID 1532 wrote to memory of 2552 1532 FHE.exe 215 PID 2552 wrote to memory of 3916 2552 cmd.exe 219 PID 3916 wrote to memory of 2768 3916 ZUJIK.exe 220 PID 2768 wrote to memory of 992 2768 cmd.exe 224 PID 992 wrote to memory of 5260 992 EXH.exe 225 PID 5260 wrote to memory of 4516 5260 cmd.exe 229 PID 4516 wrote to memory of 2448 4516 TSQHC.exe 230 PID 2448 wrote to memory of 2480 2448 cmd.exe 234 PID 2480 wrote to memory of 596 2480 RLTX.exe 235 PID 596 wrote to memory of 3744 596 cmd.exe 239 PID 3744 wrote to memory of 1124 3744 RVCRR.exe 240 PID 1124 wrote to memory of 3708 1124 cmd.exe 244 PID 3708 wrote to memory of 2460 3708 BEEECH.exe 245 PID 2460 wrote to memory of 3712 2460 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_dec6cd1fcc580007b53f2382ed6b8daf_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-30_dec6cd1fcc580007b53f2382ed6b8daf_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAFPVWQ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\windows\NAFPVWQ.exeC:\windows\NAFPVWQ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLO.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\windows\SysWOW64\LLO.exeC:\windows\system32\LLO.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTDUMQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\windows\system\PTDUMQ.exeC:\windows\system\PTDUMQ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QWHPRGK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\windows\SysWOW64\QWHPRGK.exeC:\windows\system32\QWHPRGK.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZLTFW.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\windows\SysWOW64\IZLTFW.exeC:\windows\system32\IZLTFW.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SXQN.exe.bat" "12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\windows\SXQN.exeC:\windows\SXQN.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFXNYW.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\windows\WFXNYW.exeC:\windows\WFXNYW.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MVYNF.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\windows\MVYNF.exeC:\windows\MVYNF.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BQP.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\windows\SysWOW64\BQP.exeC:\windows\system32\BQP.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGQIXA.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\windows\SysWOW64\QGQIXA.exeC:\windows\system32\QGQIXA.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUV.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\windows\LUV.exeC:\windows\LUV.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RUDOQ.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\windows\RUDOQ.exeC:\windows\RUDOQ.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXGJWKU.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:248 -
C:\windows\SysWOW64\JXGJWKU.exeC:\windows\system32\JXGJWKU.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KAKN.exe.bat" "28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\windows\KAKN.exeC:\windows\KAKN.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TAMSMGY.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\TAMSMGY.exeC:\windows\TAMSMGY.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYSMU.exe.bat" "32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\windows\system\DYSMU.exeC:\windows\system\DYSMU.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOYMGGC.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\windows\system\HOYMGGC.exeC:\windows\system\HOYMGGC.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LWFMSR.exe.bat" "36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\windows\system\LWFMSR.exeC:\windows\system\LWFMSR.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMG.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\system\AMG.exeC:\windows\system\AMG.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CKUGGUO.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\windows\SysWOW64\CKUGGUO.exeC:\windows\system32\CKUGGUO.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNYC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\windows\system\DNYC.exeC:\windows\system\DNYC.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATQRC.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\ATQRC.exeC:\windows\ATQRC.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\windows\YDTH.exeC:\windows\YDTH.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZGWLQK.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\windows\SysWOW64\ZGWLQK.exeC:\windows\system32\ZGWLQK.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHE.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\FHE.exeC:\windows\FHE.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZUJIK.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\windows\SysWOW64\ZUJIK.exeC:\windows\system32\ZUJIK.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EXH.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\windows\EXH.exeC:\windows\EXH.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TSQHC.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\TSQHC.exeC:\windows\TSQHC.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RVCRR.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:596 -
C:\windows\system\RVCRR.exeC:\windows\system\RVCRR.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEEECH.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\windows\BEEECH.exeC:\windows\BEEECH.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SEGJGMG.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\windows\system\SEGJGMG.exeC:\windows\system\SEGJGMG.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HZPNR.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:908 -
C:\windows\SysWOW64\HZPNR.exeC:\windows\system32\HZPNR.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JXDIY.exe.bat" "68⤵PID:2468
-
C:\windows\JXDIY.exeC:\windows\JXDIY.exe69⤵
- Executes dropped EXE
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKARJH.exe.bat" "70⤵PID:4544
-
C:\windows\system\MKARJH.exeC:\windows\system\MKARJH.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYAGKUH.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4292 -
C:\windows\MYAGKUH.exeC:\windows\MYAGKUH.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ETEB.exe.bat" "74⤵PID:3044
-
C:\windows\ETEB.exeC:\windows\ETEB.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOJ.exe.bat" "76⤵
- Executes a command shell one-liner
PID:4080 -
C:\windows\system\ZOJ.exeC:\windows\system\ZOJ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJMON.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\windows\SysWOW64\AJMON.exeC:\windows\system32\AJMON.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FJUCWCI.exe.bat" "80⤵PID:2200
-
C:\windows\system\FJUCWCI.exeC:\windows\system\FJUCWCI.exe81⤵
- Executes dropped EXE
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSW.exe.bat" "82⤵
- Executes a command shell one-liner
PID:2872 -
C:\windows\SysWOW64\PSW.exeC:\windows\system32\PSW.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TADPMS.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5920 -
C:\windows\TADPMS.exeC:\windows\TADPMS.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YAK.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5936 -
C:\windows\SysWOW64\YAK.exeC:\windows\system32\YAK.exe87⤵
- Executes dropped EXE
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDOZI.exe.bat" "88⤵PID:2648
-
C:\windows\ZDOZI.exeC:\windows\ZDOZI.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UQTILKX.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4628 -
C:\windows\UQTILKX.exeC:\windows\UQTILKX.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGZQXU.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5904 -
C:\windows\YGZQXU.exeC:\windows\YGZQXU.exe93⤵
- Executes dropped EXE
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZCJF.exe.bat" "94⤵
- Executes a command shell one-liner
PID:5380 -
C:\windows\JZCJF.exeC:\windows\JZCJF.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NHJJR.exe.bat" "96⤵PID:5272
-
C:\windows\system\NHJJR.exeC:\windows\system\NHJJR.exe97⤵
- Executes dropped EXE
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HUOSCU.exe.bat" "98⤵PID:3108
-
C:\windows\system\HUOSCU.exeC:\windows\system\HUOSCU.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KQT.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4860 -
C:\windows\system\KQT.exeC:\windows\system\KQT.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KVTQ.exe.bat" "102⤵PID:4192
-
C:\windows\system\KVTQ.exeC:\windows\system\KVTQ.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ODAYSZ.exe.bat" "104⤵
- Executes a command shell one-liner
PID:5424 -
C:\windows\system\ODAYSZ.exeC:\windows\system\ODAYSZ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZE.exe.bat" "106⤵
- Executes a command shell one-liner
PID:5064 -
C:\windows\JZE.exeC:\windows\JZE.exe107⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHLIO.exe.bat" "108⤵PID:4580
-
C:\windows\NHLIO.exeC:\windows\NHLIO.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JMRFVTW.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:396 -
C:\windows\system\JMRFVTW.exeC:\windows\system\JMRFVTW.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFMYDI.exe.bat" "112⤵PID:3152
-
C:\windows\SysWOW64\UFMYDI.exeC:\windows\system32\UFMYDI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RKS.exe.bat" "114⤵
- Executes a command shell one-liner
PID:5572 -
C:\windows\system\RKS.exeC:\windows\system\RKS.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ALUA.exe.bat" "116⤵
- Executes a command shell one-liner
PID:1100 -
C:\windows\ALUA.exeC:\windows\ALUA.exe117⤵
- Executes dropped EXE
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LDXLW.exe.bat" "118⤵PID:6064
-
C:\windows\SysWOW64\LDXLW.exeC:\windows\system32\LDXLW.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DQH.exe.bat" "120⤵PID:4100
-
C:\windows\SysWOW64\DQH.exeC:\windows\system32\DQH.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-