Analysis
- max time kernel
93s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 22:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe
- Size 208KB
- Sample261024-17vklaev7l
- SHA256 5b3accc46bfdc64f29823968e7bc4c4275b0e39c9bc1c56b0f3bcebb6cf8d5b5
- MD5 0a07d9e95fc23054fbd34ce3cebdf38f
- SHA1 c86735afa1ea4deae35ec5b40182bfef8dd8ae69
- SHA512 839928fd1f84829621af4ad3e18f106f559740bb031c880289a0f2a3e857a254987fa683e4dc1c8853fdb44c62a2ca05b3aa855a879d6b44c7effa91af13e100
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xbsl9dL+LOfG4pLthEjQT6j:vlZtbLWIgd1LZ9oECZbsl95+LOekEj1
- TLSH T1D2247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4968 DQGOU.exe 4360 OZGV.exe 3144 MJQLCX.exe 1964 QZXLG.exe 5924 RUBPTFO.exe 1800 PQAQQ.exe 3708 TGHQCBR.exe 6052 FONYP.exe 2528 QGDJY.exe 6128 URB.exe 4676 THMZTK.exe 2872 IXN.exe 1780 DID.exe 3432 WDHS.exe 1164 GBNN.exe 3732 KMLAIIK.exe 5624 ZHVMU.exe 2076 DPBMGNH.exe 5740 CAMCOT.exe 4864 LIOHSYX.exe 3748 PQVHE.exe 4740 BGBPIBH.exe 5388 SREFRP.exe 4344 SUIBE.exe 1648 WCWJJPB.exe 2096 XFAF.exe 3636 QIE.exe 4144 OTHRK.exe 5968 JGMIUJP.exe 3196 YBVMF.exe 5804 PJX.exe 5376 GUIHS.exe 5128 BFQGG.exe 3048 LFSLJP.exe 704 FTX.exe 2888 PQD.exe 1452 ZZFU.exe 3540 OUOYXPT.exe 1540 FCQ.exe 1804 UXAQMI.exe 4976 PKE.exe 3340 YTGE.exe 4536 ITIJLKX.exe 2824 DERIZ.exe 2752 WZVMFLU.exe 2036 QUZV.exe 1720 WUHJYF.exe 692 NVJ.exe 5828 CAPL.exe 3316 YGVAYW.exe 2236 YLNPZJL.exe 3440 BZSY.exe 3384 WMXPM.exe 912 KSCFT.exe 2976 QSKSKNR.exe 5476 LFPC.exe 3372 FAUTWM.exe 2876 CYR.exe 4900 KMS.exe 2544 RHBJYW.exe 2248 UUG.exe 3232 FNJL.exe 1028 QFE.exe 4752 BYHPZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\THMZTK.exe.bat URB.exe File created C:\windows\SysWOW64\DPBMGNH.exe.bat ZHVMU.exe File created C:\windows\SysWOW64\WUHJYF.exe.bat QUZV.exe File created C:\windows\SysWOW64\MJQLCX.exe OZGV.exe File created C:\windows\SysWOW64\URB.exe.bat QGDJY.exe File created C:\windows\SysWOW64\DPBMGNH.exe ZHVMU.exe File opened for modification C:\windows\SysWOW64\GUIHS.exe PJX.exe File opened for modification C:\windows\SysWOW64\PQD.exe FTX.exe File created C:\windows\SysWOW64\YGVAYW.exe.bat CAPL.exe File created C:\windows\SysWOW64\XULAW.exe.bat LEESJDQ.exe File created C:\windows\SysWOW64\ZFSYS.exe.bat ONPG.exe File opened for modification C:\windows\SysWOW64\PKE.exe UXAQMI.exe File opened for modification C:\windows\SysWOW64\BYHPZ.exe QFE.exe File created C:\windows\SysWOW64\FYWQ.exe ZYPCIUL.exe File created C:\windows\SysWOW64\AMJHGLQ.exe.bat FZEYW.exe File created C:\windows\SysWOW64\MBVHPPA.exe SNY.exe File created C:\windows\SysWOW64\CZTYH.exe HMO.exe File created C:\windows\SysWOW64\WDHS.exe DID.exe File opened for modification C:\windows\SysWOW64\YGVAYW.exe CAPL.exe File created C:\windows\SysWOW64\SZTKSX.exe.bat YMOB.exe File opened for modification C:\windows\SysWOW64\KBMBZV.exe KVUNY.exe File created C:\windows\SysWOW64\CZTYH.exe.bat HMO.exe File opened for modification C:\windows\SysWOW64\BFQGG.exe GUIHS.exe File created C:\windows\SysWOW64\BYHPZ.exe.bat QFE.exe File created C:\windows\SysWOW64\PATOCP.exe.bat UNOF.exe File opened for modification C:\windows\SysWOW64\RQYYQ.exe KUZX.exe File created C:\windows\SysWOW64\EAHXF.exe RQYYQ.exe File created C:\windows\SysWOW64\EAHXF.exe.bat RQYYQ.exe File created C:\windows\SysWOW64\TGHQCBR.exe PQAQQ.exe File opened for modification C:\windows\SysWOW64\WDHS.exe DID.exe File created C:\windows\SysWOW64\XFAF.exe.bat WCWJJPB.exe File created C:\windows\SysWOW64\BFQGG.exe GUIHS.exe File opened for modification C:\windows\SysWOW64\NEWFA.exe FYWQ.exe File opened for modification C:\windows\SysWOW64\MBVHPPA.exe SNY.exe File opened for modification C:\windows\SysWOW64\URB.exe QGDJY.exe File created C:\windows\SysWOW64\QIE.exe XFAF.exe File created C:\windows\SysWOW64\WUHJYF.exe QUZV.exe File opened for modification C:\windows\SysWOW64\XULAW.exe LEESJDQ.exe File opened for modification C:\windows\SysWOW64\THMZTK.exe URB.exe File created C:\windows\SysWOW64\ZFSYS.exe ONPG.exe File created C:\windows\SysWOW64\RQYYQ.exe KUZX.exe File created C:\windows\SysWOW64\WCWJJPB.exe.bat SUIBE.exe File created C:\windows\SysWOW64\OUOYXPT.exe.bat ZZFU.exe File created C:\windows\SysWOW64\FNJL.exe.bat UUG.exe File opened for modification C:\windows\SysWOW64\EAHXF.exe RQYYQ.exe File created C:\windows\SysWOW64\RUBPTFO.exe QZXLG.exe File created C:\windows\SysWOW64\GBNN.exe.bat WDHS.exe File opened for modification C:\windows\SysWOW64\QUZV.exe WZVMFLU.exe File created C:\windows\SysWOW64\NVJ.exe WUHJYF.exe File created C:\windows\SysWOW64\SCLFD.exe YPH.exe File opened for modification C:\windows\SysWOW64\QZXLG.exe MJQLCX.exe File created C:\windows\SysWOW64\WDHS.exe.bat DID.exe File created C:\windows\SysWOW64\KMLAIIK.exe GBNN.exe File opened for modification C:\windows\SysWOW64\JGMIUJP.exe OTHRK.exe File opened for modification C:\windows\SysWOW64\AMJHGLQ.exe FZEYW.exe File created C:\windows\SysWOW64\RQYYQ.exe.bat KUZX.exe File opened for modification C:\windows\SysWOW64\FONYP.exe TGHQCBR.exe File created C:\windows\SysWOW64\AMJHGLQ.exe FZEYW.exe File created C:\windows\SysWOW64\PATOCP.exe UNOF.exe File created C:\windows\SysWOW64\SCLFD.exe.bat YPH.exe File created C:\windows\SysWOW64\THMZTK.exe URB.exe File created C:\windows\SysWOW64\PQD.exe FTX.exe File opened for modification C:\windows\SysWOW64\WUHJYF.exe QUZV.exe File created C:\windows\SysWOW64\MBVHPPA.exe.bat SNY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\UUG.exe RHBJYW.exe File opened for modification C:\windows\system\XKVP.exe TCPHAYU.exe File opened for modification C:\windows\system\UXAQMI.exe FCQ.exe File created C:\windows\QSKSKNR.exe.bat KSCFT.exe File created C:\windows\JAS.exe.bat TFJEE.exe File opened for modification C:\windows\HRV.exe HWRRUA.exe File created C:\windows\WMXPM.exe BZSY.exe File created C:\windows\OZGV.exe.bat DQGOU.exe File opened for modification C:\windows\system\LIOHSYX.exe CAMCOT.exe File opened for modification C:\windows\PTKP.exe EAHXF.exe File opened for modification C:\windows\system\PFZ.exe SZTKSX.exe File created C:\windows\YPH.exe ORBBL.exe File created C:\windows\XTWXWR.exe XNWJVE.exe File created C:\windows\system\YBVMF.exe.bat JGMIUJP.exe File created C:\windows\system\ZZFU.exe.bat PQD.exe File created C:\windows\system\WZVMFLU.exe DERIZ.exe File created C:\windows\system\GUGE.exe.bat CMAE.exe File created C:\windows\system\LIOHSYX.exe CAMCOT.exe File created C:\windows\system\XKVP.exe TCPHAYU.exe File created C:\windows\ZYPCIUL.exe.bat BYHPZ.exe File created C:\windows\PQAQQ.exe.bat RUBPTFO.exe File created C:\windows\system\LFSLJP.exe.bat BFQGG.exe File created C:\windows\CAPL.exe NVJ.exe File created C:\windows\WXJRLPA.exe WRRD.exe File opened for modification C:\windows\ZHVMU.exe KMLAIIK.exe File created C:\windows\QFE.exe FNJL.exe File opened for modification C:\windows\ZYPCIUL.exe BYHPZ.exe File created C:\windows\DQGOU.exe.bat 2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe File created C:\windows\DID.exe.bat IXN.exe File created C:\windows\system\YBVMF.exe JGMIUJP.exe File created C:\windows\ITIJLKX.exe YTGE.exe File opened for modification C:\windows\KMS.exe CYR.exe File created C:\windows\system\NUSJDBG.exe.bat HUKWU.exe File created C:\windows\PTKP.exe.bat EAHXF.exe File created C:\windows\system\SGPZXQ.exe.bat PTKP.exe File created C:\windows\HIDD.exe PFZ.exe File created C:\windows\system\ZYXKN.exe.bat DTZ.exe File opened for modification C:\windows\BGBPIBH.exe PQVHE.exe File created C:\windows\OZGV.exe DQGOU.exe File opened for modification C:\windows\RHBJYW.exe KMS.exe File opened for modification C:\windows\QBZ.exe ZQJ.exe File opened for modification C:\windows\system\YMOB.exe MUL.exe File created C:\windows\XNWJVE.exe.bat WSSFPOL.exe File created C:\windows\system\UXAQMI.exe.bat FCQ.exe File created C:\windows\RHBJYW.exe KMS.exe File created C:\windows\system\ONPG.exe GUGE.exe File opened for modification C:\windows\WQHSR.exe XTWXWR.exe File created C:\windows\PQAQQ.exe RUBPTFO.exe File created C:\windows\system\PQVHE.exe.bat LIOHSYX.exe File created C:\windows\QFE.exe.bat FNJL.exe File created C:\windows\system\CYR.exe.bat FAUTWM.exe File opened for modification C:\windows\system\ZYXKN.exe DTZ.exe File created C:\windows\system\HUKWU.exe.bat ZOKH.exe File opened for modification C:\windows\system\NUSJDBG.exe HUKWU.exe File created C:\windows\HIDD.exe.bat PFZ.exe File created C:\windows\BGBPIBH.exe.bat PQVHE.exe File created C:\windows\ITIJLKX.exe.bat YTGE.exe File created C:\windows\FAUTWM.exe.bat LFPC.exe File opened for modification C:\windows\system\FFAMB.exe ZFSYS.exe File opened for modification C:\windows\system\WSSFPOL.exe SCLFD.exe File opened for modification C:\windows\system\YBVMF.exe JGMIUJP.exe File opened for modification C:\windows\system\KSCFT.exe WMXPM.exe File opened for modification C:\windows\QSKSKNR.exe KSCFT.exe File created C:\windows\system\UNOF.exe ECQHSD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3716 cmd.exe 720 cmd.exe 5936 cmd.exe 3064 cmd.exe 4496 cmd.exe 4904 cmd.exe 3560 cmd.exe 788 cmd.exe 4964 cmd.exe 5172 cmd.exe 2724 cmd.exe 5864 cmd.exe 2692 cmd.exe 6044 cmd.exe 3112 cmd.exe 1184 cmd.exe 4464 cmd.exe 2224 cmd.exe 4908 cmd.exe 6000 cmd.exe 1664 cmd.exe 2380 cmd.exe 1304 cmd.exe 1088 cmd.exe 4972 cmd.exe 6112 cmd.exe 2664 cmd.exe 2676 cmd.exe 5064 cmd.exe 4932 cmd.exe 4264 cmd.exe 5668 cmd.exe 3428 cmd.exe 5700 cmd.exe 4376 cmd.exe 932 cmd.exe 5144 cmd.exe 2404 cmd.exe 4888 cmd.exe 4180 cmd.exe 4736 cmd.exe 5516 cmd.exe 5112 cmd.exe 2128 cmd.exe 6036 cmd.exe 2920 cmd.exe 2200 cmd.exe 3252 cmd.exe 4492 cmd.exe 3504 cmd.exe 2852 cmd.exe 4352 cmd.exe 260 cmd.exe 2196 cmd.exe 5512 cmd.exe 2684 cmd.exe 4772 cmd.exe 5176 cmd.exe 1668 cmd.exe 1824 cmd.exe 5760 cmd.exe 5360 cmd.exe 4296 cmd.exe 4356 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1304 4896 WerFault.exe 87 5816 4968 WerFault.exe 93 3432 4360 WerFault.exe 99 1140 3144 WerFault.exe 104 1448 1964 WerFault.exe 109 6060 5924 WerFault.exe 114 3152 1800 WerFault.exe 119 5240 3708 WerFault.exe 124 4472 6052 WerFault.exe 129 936 2528 WerFault.exe 134 2864 6128 WerFault.exe 139 3440 4676 WerFault.exe 144 252 2872 WerFault.exe 149 764 1780 WerFault.exe 154 3476 3432 WerFault.exe 159 4948 1164 WerFault.exe 164 1816 3732 WerFault.exe 169 3152 5624 WerFault.exe 174 5928 2076 WerFault.exe 179 2684 5740 WerFault.exe 184 2740 4864 WerFault.exe 189 3340 3748 WerFault.exe 194 4704 4740 WerFault.exe 199 4860 5388 WerFault.exe 204 1280 4344 WerFault.exe 209 3724 1648 WerFault.exe 214 1860 2096 WerFault.exe 219 5852 3636 WerFault.exe 224 2856 4144 WerFault.exe 229 5928 5968 WerFault.exe 234 2684 3196 WerFault.exe 239 2180 5804 WerFault.exe 244 4596 5376 WerFault.exe 249 2436 5128 WerFault.exe 254 1456 3048 WerFault.exe 259 2540 704 WerFault.exe 264 3444 2888 WerFault.exe 269 4532 1452 WerFault.exe 275 5240 3540 WerFault.exe 280 4472 1540 WerFault.exe 285 4488 1804 WerFault.exe 290 5004 4976 WerFault.exe 295 4580 3340 WerFault.exe 300 688 4536 WerFault.exe 305 1384 2824 WerFault.exe 310 2332 2752 WerFault.exe 315 1764 2036 WerFault.exe 320 3792 1720 WerFault.exe 325 4384 692 WerFault.exe 330 5040 5828 WerFault.exe 335 936 3316 WerFault.exe 340 4836 2236 WerFault.exe 345 3232 3440 WerFault.exe 350 6096 3384 WerFault.exe 355 5064 912 WerFault.exe 360 1248 2976 WerFault.exe 365 1968 5476 WerFault.exe 370 2896 3372 WerFault.exe 375 6020 2876 WerFault.exe 380 4324 4900 WerFault.exe 385 2664 2544 WerFault.exe 390 5036 2248 WerFault.exe 395 1140 3232 WerFault.exe 400 1488 1028 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NUSJDBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PATOCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JGMIUJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YGVAYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQVHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQHSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUBPTFO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBVMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGPZXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFSLJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBVHPPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQYYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORBBL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BGBPIBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SUIBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCLFD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSSFPOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGHQCBR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFQGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QRJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKVP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GUIHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4896 2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe 4896 2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe 4968 DQGOU.exe 4968 DQGOU.exe 4360 OZGV.exe 4360 OZGV.exe 3144 MJQLCX.exe 3144 MJQLCX.exe 1964 QZXLG.exe 1964 QZXLG.exe 5924 RUBPTFO.exe 5924 RUBPTFO.exe 1800 PQAQQ.exe 1800 PQAQQ.exe 3708 TGHQCBR.exe 3708 TGHQCBR.exe 6052 FONYP.exe 6052 FONYP.exe 2528 QGDJY.exe 2528 QGDJY.exe 6128 URB.exe 6128 URB.exe 4676 THMZTK.exe 4676 THMZTK.exe 2872 IXN.exe 2872 IXN.exe 1780 DID.exe 1780 DID.exe 3432 WDHS.exe 3432 WDHS.exe 1164 GBNN.exe 1164 GBNN.exe 3732 KMLAIIK.exe 3732 KMLAIIK.exe 5624 ZHVMU.exe 5624 ZHVMU.exe 2076 DPBMGNH.exe 2076 DPBMGNH.exe 5740 CAMCOT.exe 5740 CAMCOT.exe 4864 LIOHSYX.exe 4864 LIOHSYX.exe 3748 PQVHE.exe 3748 PQVHE.exe 4740 BGBPIBH.exe 4740 BGBPIBH.exe 5388 SREFRP.exe 5388 SREFRP.exe 4344 SUIBE.exe 4344 SUIBE.exe 1648 WCWJJPB.exe 1648 WCWJJPB.exe 2096 XFAF.exe 2096 XFAF.exe 3636 QIE.exe 3636 QIE.exe 4144 OTHRK.exe 4144 OTHRK.exe 5968 JGMIUJP.exe 5968 JGMIUJP.exe 3196 YBVMF.exe 3196 YBVMF.exe 5804 PJX.exe 5804 PJX.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4896 2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe 4896 2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe 4968 DQGOU.exe 4968 DQGOU.exe 4360 OZGV.exe 4360 OZGV.exe 3144 MJQLCX.exe 3144 MJQLCX.exe 1964 QZXLG.exe 1964 QZXLG.exe 5924 RUBPTFO.exe 5924 RUBPTFO.exe 1800 PQAQQ.exe 1800 PQAQQ.exe 3708 TGHQCBR.exe 3708 TGHQCBR.exe 6052 FONYP.exe 6052 FONYP.exe 2528 QGDJY.exe 2528 QGDJY.exe 6128 URB.exe 6128 URB.exe 4676 THMZTK.exe 4676 THMZTK.exe 2872 IXN.exe 2872 IXN.exe 1780 DID.exe 1780 DID.exe 3432 WDHS.exe 3432 WDHS.exe 1164 GBNN.exe 1164 GBNN.exe 3732 KMLAIIK.exe 3732 KMLAIIK.exe 5624 ZHVMU.exe 5624 ZHVMU.exe 2076 DPBMGNH.exe 2076 DPBMGNH.exe 5740 CAMCOT.exe 5740 CAMCOT.exe 4864 LIOHSYX.exe 4864 LIOHSYX.exe 3748 PQVHE.exe 3748 PQVHE.exe 4740 BGBPIBH.exe 4740 BGBPIBH.exe 5388 SREFRP.exe 5388 SREFRP.exe 4344 SUIBE.exe 4344 SUIBE.exe 1648 WCWJJPB.exe 1648 WCWJJPB.exe 2096 XFAF.exe 2096 XFAF.exe 3636 QIE.exe 3636 QIE.exe 4144 OTHRK.exe 4144 OTHRK.exe 5968 JGMIUJP.exe 5968 JGMIUJP.exe 3196 YBVMF.exe 3196 YBVMF.exe 5804 PJX.exe 5804 PJX.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4896 wrote to memory of 1132 4896 2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe 89 PID 1132 wrote to memory of 4968 1132 cmd.exe 93 PID 4968 wrote to memory of 2572 4968 DQGOU.exe 95 PID 2572 wrote to memory of 4360 2572 cmd.exe 99 PID 4360 wrote to memory of 4356 4360 OZGV.exe 100 PID 4356 wrote to memory of 3144 4356 cmd.exe 104 PID 3144 wrote to memory of 992 3144 MJQLCX.exe 105 PID 992 wrote to memory of 1964 992 cmd.exe 109 PID 1964 wrote to memory of 3504 1964 QZXLG.exe 110 PID 3504 wrote to memory of 5924 3504 cmd.exe 114 PID 5924 wrote to memory of 4336 5924 RUBPTFO.exe 115 PID 4336 wrote to memory of 1800 4336 cmd.exe 119 PID 1800 wrote to memory of 5264 1800 PQAQQ.exe 120 PID 5264 wrote to memory of 3708 5264 cmd.exe 124 PID 3708 wrote to memory of 2724 3708 TGHQCBR.exe 125 PID 2724 wrote to memory of 6052 2724 cmd.exe 129 PID 6052 wrote to memory of 2852 6052 FONYP.exe 130 PID 2852 wrote to memory of 2528 2852 cmd.exe 134 PID 2528 wrote to memory of 3512 2528 QGDJY.exe 135 PID 3512 wrote to memory of 6128 3512 cmd.exe 139 PID 6128 wrote to memory of 5936 6128 URB.exe 140 PID 5936 wrote to memory of 4676 5936 cmd.exe 144 PID 4676 wrote to memory of 5084 4676 THMZTK.exe 145 PID 5084 wrote to memory of 2872 5084 cmd.exe 149 PID 2872 wrote to memory of 2732 2872 IXN.exe 150 PID 2732 wrote to memory of 1780 2732 cmd.exe 154 PID 1780 wrote to memory of 5024 1780 DID.exe 155 PID 5024 wrote to memory of 3432 5024 cmd.exe 159 PID 3432 wrote to memory of 5696 3432 WDHS.exe 160 PID 5696 wrote to memory of 1164 5696 cmd.exe 164 PID 1164 wrote to memory of 4464 1164 GBNN.exe 165 PID 4464 wrote to memory of 3732 4464 cmd.exe 169 PID 3732 wrote to memory of 5864 3732 KMLAIIK.exe 170 PID 5864 wrote to memory of 5624 5864 cmd.exe 174 PID 5624 wrote to memory of 4800 5624 ZHVMU.exe 175 PID 4800 wrote to memory of 2076 4800 cmd.exe 179 PID 2076 wrote to memory of 2924 2076 DPBMGNH.exe 180 PID 2924 wrote to memory of 5740 2924 cmd.exe 184 PID 5740 wrote to memory of 4652 5740 CAMCOT.exe 185 PID 4652 wrote to memory of 4864 4652 cmd.exe 189 PID 4864 wrote to memory of 4456 4864 LIOHSYX.exe 190 PID 4456 wrote to memory of 3748 4456 cmd.exe 194 PID 3748 wrote to memory of 4972 3748 PQVHE.exe 195 PID 4972 wrote to memory of 4740 4972 cmd.exe 199 PID 4740 wrote to memory of 2224 4740 BGBPIBH.exe 200 PID 2224 wrote to memory of 5388 2224 cmd.exe 204 PID 5388 wrote to memory of 932 5388 SREFRP.exe 205 PID 932 wrote to memory of 4344 932 cmd.exe 209 PID 4344 wrote to memory of 3064 4344 SUIBE.exe 210 PID 3064 wrote to memory of 1648 3064 cmd.exe 214 PID 1648 wrote to memory of 4108 1648 WCWJJPB.exe 215 PID 4108 wrote to memory of 2096 4108 cmd.exe 219 PID 2096 wrote to memory of 5176 2096 XFAF.exe 220 PID 5176 wrote to memory of 3636 5176 cmd.exe 224 PID 3636 wrote to memory of 2632 3636 QIE.exe 225 PID 2632 wrote to memory of 4144 2632 cmd.exe 229 PID 4144 wrote to memory of 5308 4144 OTHRK.exe 230 PID 5308 wrote to memory of 5968 5308 cmd.exe 234 PID 5968 wrote to memory of 2508 5968 JGMIUJP.exe 235 PID 2508 wrote to memory of 3196 2508 cmd.exe 239 PID 3196 wrote to memory of 3328 3196 YBVMF.exe 240 PID 3328 wrote to memory of 5804 3328 cmd.exe 244 PID 5804 wrote to memory of 2620 5804 PJX.exe 245 PID 2620 wrote to memory of 5376 2620 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0a07d9e95fc23054fbd34ce3cebdf38f_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DQGOU.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\DQGOU.exeC:\windows\DQGOU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZGV.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\OZGV.exeC:\windows\OZGV.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJQLCX.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\windows\SysWOW64\MJQLCX.exeC:\windows\system32\MJQLCX.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QZXLG.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:992 -
C:\windows\SysWOW64\QZXLG.exeC:\windows\system32\QZXLG.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUBPTFO.exe.bat" "10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\windows\SysWOW64\RUBPTFO.exeC:\windows\system32\RUBPTFO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PQAQQ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\windows\PQAQQ.exeC:\windows\PQAQQ.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGHQCBR.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\windows\SysWOW64\TGHQCBR.exeC:\windows\system32\TGHQCBR.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FONYP.exe.bat" "16⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\SysWOW64\FONYP.exeC:\windows\system32\FONYP.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGDJY.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\windows\SysWOW64\QGDJY.exeC:\windows\system32\QGDJY.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URB.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\windows\SysWOW64\URB.exeC:\windows\system32\URB.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THMZTK.exe.bat" "22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\windows\SysWOW64\THMZTK.exeC:\windows\system32\THMZTK.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXN.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\windows\SysWOW64\IXN.exeC:\windows\system32\IXN.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DID.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\DID.exeC:\windows\DID.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDHS.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\SysWOW64\WDHS.exeC:\windows\system32\WDHS.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBNN.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\windows\SysWOW64\GBNN.exeC:\windows\system32\GBNN.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMLAIIK.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\windows\SysWOW64\KMLAIIK.exeC:\windows\system32\KMLAIIK.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZHVMU.exe.bat" "34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\ZHVMU.exeC:\windows\ZHVMU.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPBMGNH.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\windows\SysWOW64\DPBMGNH.exeC:\windows\system32\DPBMGNH.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAMCOT.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\system\CAMCOT.exeC:\windows\system\CAMCOT.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIOHSYX.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\windows\system\LIOHSYX.exeC:\windows\system\LIOHSYX.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQVHE.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\windows\system\PQVHE.exeC:\windows\system\PQVHE.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BGBPIBH.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\windows\BGBPIBH.exeC:\windows\BGBPIBH.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SREFRP.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\windows\SREFRP.exeC:\windows\SREFRP.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUIBE.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:932 -
C:\windows\system\SUIBE.exeC:\windows\system\SUIBE.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCWJJPB.exe.bat" "50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\windows\SysWOW64\WCWJJPB.exeC:\windows\system32\WCWJJPB.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XFAF.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\windows\SysWOW64\XFAF.exeC:\windows\system32\XFAF.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIE.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\SysWOW64\QIE.exeC:\windows\system32\QIE.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTHRK.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\OTHRK.exeC:\windows\OTHRK.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGMIUJP.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\windows\SysWOW64\JGMIUJP.exeC:\windows\system32\JGMIUJP.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YBVMF.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\system\YBVMF.exeC:\windows\system\YBVMF.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PJX.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\windows\system\PJX.exeC:\windows\system\PJX.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GUIHS.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\SysWOW64\GUIHS.exeC:\windows\system32\GUIHS.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFQGG.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4944 -
C:\windows\SysWOW64\BFQGG.exeC:\windows\system32\BFQGG.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFSLJP.exe.bat" "68⤵PID:2524
-
C:\windows\system\LFSLJP.exeC:\windows\system\LFSLJP.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTX.exe.bat" "70⤵PID:1272
-
C:\windows\FTX.exeC:\windows\FTX.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQD.exe.bat" "72⤵PID:4828
-
C:\windows\SysWOW64\PQD.exeC:\windows\system32\PQD.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZFU.exe.bat" "74⤵PID:596
-
C:\windows\system\ZZFU.exeC:\windows\system\ZZFU.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUOYXPT.exe.bat" "76⤵PID:6060
-
C:\windows\SysWOW64\OUOYXPT.exeC:\windows\system32\OUOYXPT.exe77⤵
- Executes dropped EXE
PID:3540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCQ.exe.bat" "78⤵PID:4612
-
C:\windows\SysWOW64\FCQ.exeC:\windows\system32\FCQ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UXAQMI.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1668 -
C:\windows\system\UXAQMI.exeC:\windows\system\UXAQMI.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PKE.exe.bat" "82⤵
- Executes a command shell one-liner
PID:4496 -
C:\windows\SysWOW64\PKE.exeC:\windows\system32\PKE.exe83⤵
- Executes dropped EXE
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YTGE.exe.bat" "84⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6112 -
C:\windows\SysWOW64\YTGE.exeC:\windows\system32\YTGE.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ITIJLKX.exe.bat" "86⤵PID:4960
-
C:\windows\ITIJLKX.exeC:\windows\ITIJLKX.exe87⤵
- Executes dropped EXE
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DERIZ.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4908 -
C:\windows\system\DERIZ.exeC:\windows\system\DERIZ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WZVMFLU.exe.bat" "90⤵
- Executes a command shell one-liner
PID:4352 -
C:\windows\system\WZVMFLU.exeC:\windows\system\WZVMFLU.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QUZV.exe.bat" "92⤵PID:3424
-
C:\windows\SysWOW64\QUZV.exeC:\windows\system32\QUZV.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUHJYF.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4632 -
C:\windows\SysWOW64\WUHJYF.exeC:\windows\system32\WUHJYF.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVJ.exe.bat" "96⤵PID:3844
-
C:\windows\SysWOW64\NVJ.exeC:\windows\system32\NVJ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAPL.exe.bat" "98⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5516 -
C:\windows\CAPL.exeC:\windows\CAPL.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGVAYW.exe.bat" "100⤵
- Executes a command shell one-liner
PID:4376 -
C:\windows\SysWOW64\YGVAYW.exeC:\windows\system32\YGVAYW.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLNPZJL.exe.bat" "102⤵
- Executes a command shell one-liner
PID:5112 -
C:\windows\YLNPZJL.exeC:\windows\YLNPZJL.exe103⤵
- Executes dropped EXE
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BZSY.exe.bat" "104⤵PID:2180
-
C:\windows\BZSY.exeC:\windows\BZSY.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WMXPM.exe.bat" "106⤵PID:5380
-
C:\windows\WMXPM.exeC:\windows\WMXPM.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KSCFT.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2692 -
C:\windows\system\KSCFT.exeC:\windows\system\KSCFT.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QSKSKNR.exe.bat" "110⤵PID:6132
-
C:\windows\QSKSKNR.exeC:\windows\QSKSKNR.exe111⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFPC.exe.bat" "112⤵PID:4508
-
C:\windows\system\LFPC.exeC:\windows\system\LFPC.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FAUTWM.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1124 -
C:\windows\FAUTWM.exeC:\windows\FAUTWM.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYR.exe.bat" "116⤵PID:2552
-
C:\windows\system\CYR.exeC:\windows\system\CYR.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMS.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\windows\KMS.exeC:\windows\KMS.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RHBJYW.exe.bat" "120⤵PID:6140
-
C:\windows\RHBJYW.exeC:\windows\RHBJYW.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-