Analysis
- max time kernel
76s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe
- Size 208KB
- Sample260809-ppfg6seq7t
- SHA256 69f1146127a2d9d859633e12253715a2e0381a39d3f29588c27d25cc97c89f0d
- MD5 97d46850349f0e406b96ed1a348e0a16
- SHA1 7006b3c362dfb3d19045f535f84915cff18f7ff8
- SHA512 13665d1b1ed577e77fc5b6b1ddd6390ebcbb1a0666d7c4c66627f72b98930c20b44404a336fc78fd7c64b0e78c7704628b66ba8013bb75f7e79511157ee1638b
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFleKL+LOfQ4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFleS+LOokEj1
- TLSH T1F7247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3436 OLSRQTO.exe 2880 QTU.exe 4308 NJH.exe 3648 RUSST.exe 2672 UHJTMZ.exe 2464 ACN.exe 2728 IIZBDUO.exe 1748 HQOYPDR.exe 6012 ERPBTH.exe 2860 KMB.exe 1356 CMP.exe 4532 VNF.exe 4324 GSEQIPP.exe 2484 OGQWTOL.exe 4648 WLVDDM.exe 1580 FZIKOT.exe 4444 NEMQZ.exe 1404 BAYREGN.exe 3344 NQR.exe 1380 TLD.exe 3012 ZGO.exe 4884 HMTK.exe 4492 URB.exe 4560 OKIHPG.exe 2292 KCSRTCP.exe 3724 PICGJ.exe 3652 HLOC.exe 1800 GWRSXB.exe 6072 QUWMNJ.exe 1196 BMMXWK.exe 5840 AFPNF.exe 2384 QVQFMM.exe 3440 HVEKYDM.exe 572 YDGPC.exe 460 TRXRV.exe 2092 UUBUAJF.exe 1808 NMRFKKN.exe 3628 EXTVTQ.exe 4800 CQWLB.exe 4340 BBHTKKT.exe 2896 YRULS.exe 5836 OME.exe 3116 GPITQ.exe 5204 QMNN.exe 2228 PXY.exe 2128 GIBTPEM.exe 240 QGHG.exe 5660 JYWRO.exe 5604 UMVXL.exe 2812 OEK.exe 1208 IAPRM.exe 3608 YQQ.exe 4180 WFBLGJB.exe 3304 HYE.exe 5384 RWK.exe 4652 BEME.exe 120 LCAYHE.exe 1728 SKBPN.exe 1996 CIGK.exe 2144 RLQOOVI.exe 4772 XYP.exe 5544 JZE.exe 5180 NHLIO.exe 5124 NKPLUHV.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HVEKYDM.exe.bat QVQFMM.exe File created C:\windows\SysWOW64\NMRFKKN.exe.bat UUBUAJF.exe File opened for modification C:\windows\SysWOW64\CQWLB.exe EXTVTQ.exe File created C:\windows\SysWOW64\LWNM.exe.bat EGMUI.exe File opened for modification C:\windows\SysWOW64\URB.exe HMTK.exe File opened for modification C:\windows\SysWOW64\PICGJ.exe KCSRTCP.exe File opened for modification C:\windows\SysWOW64\BMMXWK.exe QUWMNJ.exe File created C:\windows\SysWOW64\JYWRO.exe.bat QGHG.exe File created C:\windows\SysWOW64\BEME.exe RWK.exe File created C:\windows\SysWOW64\RLQOOVI.exe.bat CIGK.exe File created C:\windows\SysWOW64\NKPLUHV.exe NHLIO.exe File created C:\windows\SysWOW64\CBVMR.exe.bat HQNNDJL.exe File opened for modification C:\windows\SysWOW64\HVEKYDM.exe QVQFMM.exe File created C:\windows\SysWOW64\EXTVTQ.exe.bat NMRFKKN.exe File created C:\windows\SysWOW64\WFBLGJB.exe YQQ.exe File created C:\windows\SysWOW64\LCAYHE.exe.bat BEME.exe File opened for modification C:\windows\SysWOW64\OCPHPQT.exe ZMOQIU.exe File opened for modification C:\windows\SysWOW64\KHQ.exe LWNM.exe File opened for modification C:\windows\SysWOW64\ZCAOB.exe KHQ.exe File created C:\windows\SysWOW64\ZCAOB.exe.bat KHQ.exe File created C:\windows\SysWOW64\RUSST.exe NJH.exe File created C:\windows\SysWOW64\WLVDDM.exe.bat OGQWTOL.exe File opened for modification C:\windows\SysWOW64\NQR.exe BAYREGN.exe File created C:\windows\SysWOW64\NQR.exe.bat BAYREGN.exe File created C:\windows\SysWOW64\URB.exe.bat HMTK.exe File opened for modification C:\windows\SysWOW64\YRULS.exe BBHTKKT.exe File created C:\windows\SysWOW64\OEK.exe UMVXL.exe File opened for modification C:\windows\SysWOW64\SKBPN.exe LCAYHE.exe File created C:\windows\SysWOW64\PXY.exe QMNN.exe File created C:\windows\SysWOW64\RUSST.exe.bat NJH.exe File opened for modification C:\windows\SysWOW64\HQOYPDR.exe IIZBDUO.exe File created C:\windows\SysWOW64\BMMXWK.exe QUWMNJ.exe File created C:\windows\SysWOW64\BMMXWK.exe.bat QUWMNJ.exe File created C:\windows\SysWOW64\EXTVTQ.exe NMRFKKN.exe File created C:\windows\SysWOW64\OEK.exe.bat UMVXL.exe File opened for modification C:\windows\SysWOW64\NKPLUHV.exe NHLIO.exe File created C:\windows\SysWOW64\WLVDDM.exe OGQWTOL.exe File opened for modification C:\windows\SysWOW64\WLVDDM.exe OGQWTOL.exe File created C:\windows\SysWOW64\HVEKYDM.exe QVQFMM.exe File created C:\windows\SysWOW64\NMRFKKN.exe UUBUAJF.exe File opened for modification C:\windows\SysWOW64\EXTVTQ.exe NMRFKKN.exe File opened for modification C:\windows\SysWOW64\OEK.exe UMVXL.exe File opened for modification C:\windows\SysWOW64\WFBLGJB.exe YQQ.exe File created C:\windows\SysWOW64\LWNM.exe EGMUI.exe File created C:\windows\SysWOW64\PICGJ.exe KCSRTCP.exe File created C:\windows\SysWOW64\QVQFMM.exe.bat AFPNF.exe File created C:\windows\SysWOW64\IAPRM.exe OEK.exe File created C:\windows\SysWOW64\SKBPN.exe LCAYHE.exe File created C:\windows\SysWOW64\RLQOOVI.exe CIGK.exe File opened for modification C:\windows\SysWOW64\RLQOOVI.exe CIGK.exe File created C:\windows\SysWOW64\CBVMR.exe HQNNDJL.exe File opened for modification C:\windows\SysWOW64\CBVMR.exe HQNNDJL.exe File created C:\windows\SysWOW64\BAYREGN.exe NEMQZ.exe File created C:\windows\SysWOW64\GPITQ.exe.bat OME.exe File created C:\windows\SysWOW64\WFBLGJB.exe.bat YQQ.exe File opened for modification C:\windows\SysWOW64\BEME.exe RWK.exe File created C:\windows\SysWOW64\NKPLUHV.exe.bat NHLIO.exe File opened for modification C:\windows\SysWOW64\LWNM.exe EGMUI.exe File created C:\windows\SysWOW64\ZCAOB.exe KHQ.exe File opened for modification C:\windows\SysWOW64\NAAA.exe ZCAOB.exe File created C:\windows\SysWOW64\NJH.exe QTU.exe File created C:\windows\SysWOW64\HQOYPDR.exe.bat IIZBDUO.exe File opened for modification C:\windows\SysWOW64\GWRSXB.exe HLOC.exe File created C:\windows\SysWOW64\YDGPC.exe.bat HVEKYDM.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\GSEQIPP.exe.bat VNF.exe File created C:\windows\system\NEMQZ.exe.bat FZIKOT.exe File opened for modification C:\windows\ZGO.exe TLD.exe File created C:\windows\HLOC.exe PICGJ.exe File created C:\windows\HYE.exe WFBLGJB.exe File created C:\windows\system\OLSRQTO.exe.bat 2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe File opened for modification C:\windows\ACN.exe UHJTMZ.exe File created C:\windows\system\BBHTKKT.exe.bat CQWLB.exe File opened for modification C:\windows\QGHG.exe GIBTPEM.exe File created C:\windows\NHLIO.exe.bat JZE.exe File created C:\windows\EZJG.exe CBVMR.exe File created C:\windows\IKQQZNC.exe.bat NAAA.exe File created C:\windows\system\XOEWI.exe VQQCB.exe File opened for modification C:\windows\KCSRTCP.exe OKIHPG.exe File opened for modification C:\windows\HLOC.exe PICGJ.exe File created C:\windows\JDOM.exe.bat FYDXI.exe File opened for modification C:\windows\system\CMP.exe KMB.exe File created C:\windows\system\QUWMNJ.exe.bat GWRSXB.exe File created C:\windows\system\ZMOQIU.exe EZJG.exe File created C:\windows\AZBFTF.exe WRUEHMC.exe File created C:\windows\system\MBHXW.exe.bat XOEWI.exe File created C:\windows\KMB.exe.bat ERPBTH.exe File created C:\windows\HLOC.exe.bat PICGJ.exe File opened for modification C:\windows\system\QUWMNJ.exe GWRSXB.exe File opened for modification C:\windows\IIW.exe NNSXYW.exe File created C:\windows\system\IIZBDUO.exe.bat ACN.exe File opened for modification C:\windows\system\AFPNF.exe BMMXWK.exe File created C:\windows\OME.exe.bat YRULS.exe File opened for modification C:\windows\NHLIO.exe JZE.exe File created C:\windows\system\ERPBTH.exe.bat HQOYPDR.exe File created C:\windows\system\CIGK.exe SKBPN.exe File opened for modification C:\windows\system\NNSXYW.exe OCPHPQT.exe File created C:\windows\QTU.exe OLSRQTO.exe File opened for modification C:\windows\FZIKOT.exe WLVDDM.exe File opened for modification C:\windows\HMTK.exe ZGO.exe File opened for modification C:\windows\system\QMNN.exe GPITQ.exe File created C:\windows\TLD.exe.bat NQR.exe File created C:\windows\OME.exe YRULS.exe File created C:\windows\QGHG.exe GIBTPEM.exe File created C:\windows\YQQ.exe.bat IAPRM.exe File opened for modification C:\windows\XYP.exe RLQOOVI.exe File opened for modification C:\windows\EZJG.exe CBVMR.exe File created C:\windows\system\NNSXYW.exe OCPHPQT.exe File created C:\windows\system\NNSXYW.exe.bat OCPHPQT.exe File created C:\windows\system\CMP.exe KMB.exe File created C:\windows\FZIKOT.exe.bat WLVDDM.exe File created C:\windows\system\TRXRV.exe YDGPC.exe File opened for modification C:\windows\system\CIGK.exe SKBPN.exe File created C:\windows\GYQJVB.exe IIW.exe File created C:\windows\system\ABUFSHR.exe.bat ONNHNF.exe File opened for modification C:\windows\IKQQZNC.exe NAAA.exe File created C:\windows\system\XOEWI.exe.bat VQQCB.exe File created C:\windows\TLD.exe NQR.exe File created C:\windows\system\QUWMNJ.exe GWRSXB.exe File created C:\windows\system\QMNN.exe GPITQ.exe File created C:\windows\EZJG.exe.bat CBVMR.exe File opened for modification C:\windows\system\HBTFA.exe GYQJVB.exe File created C:\windows\system\OLSRQTO.exe 2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe File opened for modification C:\windows\system\OLSRQTO.exe 2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe File created C:\windows\system\UHJTMZ.exe.bat RUSST.exe File created C:\windows\system\IIZBDUO.exe ACN.exe File opened for modification C:\windows\system\XHUYJPE.exe NKPLUHV.exe File created C:\windows\system\UHJTMZ.exe RUSST.exe File opened for modification C:\windows\system\UHJTMZ.exe RUSST.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1916 cmd.exe 3204 cmd.exe 2392 cmd.exe 3064 cmd.exe 3384 cmd.exe 5144 cmd.exe 3052 cmd.exe 5880 cmd.exe 4120 cmd.exe 5432 cmd.exe 2936 cmd.exe 1564 cmd.exe 5784 cmd.exe 6124 cmd.exe 5460 cmd.exe 4092 cmd.exe 5988 cmd.exe 1288 cmd.exe 2432 cmd.exe 4828 cmd.exe 6060 cmd.exe 4156 cmd.exe 4856 cmd.exe 5400 cmd.exe 4468 cmd.exe 1040 cmd.exe 3260 cmd.exe 5148 cmd.exe 2448 cmd.exe 6108 cmd.exe 2920 cmd.exe 1544 cmd.exe 5600 cmd.exe 2348 cmd.exe 2884 cmd.exe 1528 cmd.exe 5864 cmd.exe 1360 cmd.exe 1100 cmd.exe 3872 cmd.exe 5688 cmd.exe 4564 cmd.exe 4832 cmd.exe 4756 cmd.exe 3144 cmd.exe 4484 cmd.exe 2404 cmd.exe 2784 cmd.exe 4972 cmd.exe 2856 cmd.exe 2548 cmd.exe 2076 cmd.exe 1200 cmd.exe 1016 cmd.exe 4284 cmd.exe 5464 cmd.exe 2712 cmd.exe 1452 cmd.exe 3852 cmd.exe 1892 cmd.exe 2272 cmd.exe 5372 cmd.exe 2700 cmd.exe 860 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 1520 4132 WerFault.exe 88 2776 3436 WerFault.exe 93 3484 2880 WerFault.exe 99 260 4308 WerFault.exe 104 5184 3648 WerFault.exe 109 3600 2672 WerFault.exe 114 1288 2464 WerFault.exe 119 1992 2728 WerFault.exe 124 2268 1748 WerFault.exe 129 3688 6012 WerFault.exe 134 860 2860 WerFault.exe 139 5284 1356 WerFault.exe 144 5784 4532 WerFault.exe 149 1888 4324 WerFault.exe 154 1560 2484 WerFault.exe 159 1308 4648 WerFault.exe 164 5184 1580 WerFault.exe 169 3896 4444 WerFault.exe 174 4372 1404 WerFault.exe 179 5456 3344 WerFault.exe 184 3888 1380 WerFault.exe 189 4508 3012 WerFault.exe 194 2448 4884 WerFault.exe 199 4732 4492 WerFault.exe 204 1680 4560 WerFault.exe 209 5864 2292 WerFault.exe 214 5588 3724 WerFault.exe 219 3872 3652 WerFault.exe 224 1372 1800 WerFault.exe 229 3720 6072 WerFault.exe 234 3608 1196 WerFault.exe 239 4580 5840 WerFault.exe 244 3100 2384 WerFault.exe 249 1160 3440 WerFault.exe 254 5500 572 WerFault.exe 260 4512 460 WerFault.exe 265 3144 2092 WerFault.exe 270 2360 1808 WerFault.exe 275 2888 3628 WerFault.exe 280 2212 4800 WerFault.exe 285 2280 4340 WerFault.exe 290 924 2896 WerFault.exe 295 4856 5836 WerFault.exe 300 4676 3116 WerFault.exe 305 5352 5204 WerFault.exe 310 1672 2228 WerFault.exe 315 3672 2128 WerFault.exe 320 6108 240 WerFault.exe 325 2992 5660 WerFault.exe 330 5976 5604 WerFault.exe 335 1360 2812 WerFault.exe 339 6124 1208 WerFault.exe 345 2936 3608 WerFault.exe 350 5028 4180 WerFault.exe 355 5372 3304 WerFault.exe 360 5900 5384 WerFault.exe 365 5076 4652 WerFault.exe 370 5624 120 WerFault.exe 375 5112 1728 WerFault.exe 380 2704 1996 WerFault.exe 385 4936 2144 WerFault.exe 390 4552 4772 WerFault.exe 395 3524 5544 WerFault.exe 400 5404 5180 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZCAOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NNSXYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBTFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLQOOVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EGMUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMMXWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBHTKKT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUSST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WLVDDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCPHPQT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WRUEHMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABUFSHR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLSRQTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRULS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMNN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYQJVB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONNHNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQQCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYDXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOEWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIZBDUO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUWMNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFBLGJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CIGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HVEKYDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXTVTQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4132 2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe 4132 2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe 3436 OLSRQTO.exe 3436 OLSRQTO.exe 2880 QTU.exe 2880 QTU.exe 4308 NJH.exe 4308 NJH.exe 3648 RUSST.exe 3648 RUSST.exe 2672 UHJTMZ.exe 2672 UHJTMZ.exe 2464 ACN.exe 2464 ACN.exe 2728 IIZBDUO.exe 2728 IIZBDUO.exe 1748 HQOYPDR.exe 1748 HQOYPDR.exe 6012 ERPBTH.exe 6012 ERPBTH.exe 2860 KMB.exe 2860 KMB.exe 1356 CMP.exe 1356 CMP.exe 4532 VNF.exe 4532 VNF.exe 4324 GSEQIPP.exe 4324 GSEQIPP.exe 2484 OGQWTOL.exe 2484 OGQWTOL.exe 4648 WLVDDM.exe 4648 WLVDDM.exe 1580 FZIKOT.exe 1580 FZIKOT.exe 4444 NEMQZ.exe 4444 NEMQZ.exe 1404 BAYREGN.exe 1404 BAYREGN.exe 3344 NQR.exe 3344 NQR.exe 1380 TLD.exe 1380 TLD.exe 3012 ZGO.exe 3012 ZGO.exe 4884 HMTK.exe 4884 HMTK.exe 4492 URB.exe 4492 URB.exe 4560 OKIHPG.exe 4560 OKIHPG.exe 2292 KCSRTCP.exe 2292 KCSRTCP.exe 3724 PICGJ.exe 3724 PICGJ.exe 3652 HLOC.exe 3652 HLOC.exe 1800 GWRSXB.exe 1800 GWRSXB.exe 6072 QUWMNJ.exe 6072 QUWMNJ.exe 1196 BMMXWK.exe 1196 BMMXWK.exe 5840 AFPNF.exe 5840 AFPNF.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4132 2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe 4132 2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe 3436 OLSRQTO.exe 3436 OLSRQTO.exe 2880 QTU.exe 2880 QTU.exe 4308 NJH.exe 4308 NJH.exe 3648 RUSST.exe 3648 RUSST.exe 2672 UHJTMZ.exe 2672 UHJTMZ.exe 2464 ACN.exe 2464 ACN.exe 2728 IIZBDUO.exe 2728 IIZBDUO.exe 1748 HQOYPDR.exe 1748 HQOYPDR.exe 6012 ERPBTH.exe 6012 ERPBTH.exe 2860 KMB.exe 2860 KMB.exe 1356 CMP.exe 1356 CMP.exe 4532 VNF.exe 4532 VNF.exe 4324 GSEQIPP.exe 4324 GSEQIPP.exe 2484 OGQWTOL.exe 2484 OGQWTOL.exe 4648 WLVDDM.exe 4648 WLVDDM.exe 1580 FZIKOT.exe 1580 FZIKOT.exe 4444 NEMQZ.exe 4444 NEMQZ.exe 1404 BAYREGN.exe 1404 BAYREGN.exe 3344 NQR.exe 3344 NQR.exe 1380 TLD.exe 1380 TLD.exe 3012 ZGO.exe 3012 ZGO.exe 4884 HMTK.exe 4884 HMTK.exe 4492 URB.exe 4492 URB.exe 4560 OKIHPG.exe 4560 OKIHPG.exe 2292 KCSRTCP.exe 2292 KCSRTCP.exe 3724 PICGJ.exe 3724 PICGJ.exe 3652 HLOC.exe 3652 HLOC.exe 1800 GWRSXB.exe 1800 GWRSXB.exe 6072 QUWMNJ.exe 6072 QUWMNJ.exe 1196 BMMXWK.exe 1196 BMMXWK.exe 5840 AFPNF.exe 5840 AFPNF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4132 wrote to memory of 2884 4132 2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe 89 PID 2884 wrote to memory of 3436 2884 cmd.exe 93 PID 3436 wrote to memory of 1028 3436 OLSRQTO.exe 95 PID 1028 wrote to memory of 2880 1028 cmd.exe 99 PID 2880 wrote to memory of 1916 2880 QTU.exe 100 PID 1916 wrote to memory of 4308 1916 cmd.exe 104 PID 4308 wrote to memory of 5280 4308 NJH.exe 105 PID 5280 wrote to memory of 3648 5280 cmd.exe 109 PID 3648 wrote to memory of 5932 3648 RUSST.exe 110 PID 5932 wrote to memory of 2672 5932 cmd.exe 114 PID 2672 wrote to memory of 3260 2672 UHJTMZ.exe 115 PID 3260 wrote to memory of 2464 3260 cmd.exe 119 PID 2464 wrote to memory of 5912 2464 ACN.exe 120 PID 5912 wrote to memory of 2728 5912 cmd.exe 124 PID 2728 wrote to memory of 5056 2728 IIZBDUO.exe 125 PID 5056 wrote to memory of 1748 5056 cmd.exe 129 PID 1748 wrote to memory of 1528 1748 HQOYPDR.exe 130 PID 1528 wrote to memory of 6012 1528 cmd.exe 134 PID 6012 wrote to memory of 5136 6012 ERPBTH.exe 135 PID 5136 wrote to memory of 2860 5136 cmd.exe 139 PID 2860 wrote to memory of 2148 2860 KMB.exe 140 PID 2148 wrote to memory of 1356 2148 cmd.exe 144 PID 1356 wrote to memory of 4840 1356 CMP.exe 145 PID 4840 wrote to memory of 4532 4840 cmd.exe 149 PID 4532 wrote to memory of 3844 4532 VNF.exe 150 PID 3844 wrote to memory of 4324 3844 cmd.exe 154 PID 4324 wrote to memory of 2024 4324 GSEQIPP.exe 155 PID 2024 wrote to memory of 2484 2024 cmd.exe 159 PID 2484 wrote to memory of 2412 2484 OGQWTOL.exe 160 PID 2412 wrote to memory of 4648 2412 cmd.exe 164 PID 4648 wrote to memory of 2272 4648 WLVDDM.exe 165 PID 2272 wrote to memory of 1580 2272 cmd.exe 169 PID 1580 wrote to memory of 3636 1580 FZIKOT.exe 170 PID 3636 wrote to memory of 4444 3636 cmd.exe 174 PID 4444 wrote to memory of 2404 4444 NEMQZ.exe 175 PID 2404 wrote to memory of 1404 2404 cmd.exe 179 PID 1404 wrote to memory of 4740 1404 BAYREGN.exe 180 PID 4740 wrote to memory of 3344 4740 cmd.exe 184 PID 3344 wrote to memory of 4828 3344 NQR.exe 185 PID 4828 wrote to memory of 1380 4828 cmd.exe 189 PID 1380 wrote to memory of 3392 1380 TLD.exe 190 PID 3392 wrote to memory of 3012 3392 cmd.exe 194 PID 3012 wrote to memory of 2000 3012 ZGO.exe 195 PID 2000 wrote to memory of 4884 2000 cmd.exe 199 PID 4884 wrote to memory of 2452 4884 HMTK.exe 200 PID 2452 wrote to memory of 4492 2452 cmd.exe 204 PID 4492 wrote to memory of 5688 4492 URB.exe 205 PID 5688 wrote to memory of 4560 5688 cmd.exe 209 PID 4560 wrote to memory of 3204 4560 OKIHPG.exe 210 PID 3204 wrote to memory of 2292 3204 cmd.exe 214 PID 2292 wrote to memory of 6092 2292 KCSRTCP.exe 215 PID 6092 wrote to memory of 3724 6092 cmd.exe 219 PID 3724 wrote to memory of 3160 3724 PICGJ.exe 220 PID 3160 wrote to memory of 3652 3160 cmd.exe 224 PID 3652 wrote to memory of 4396 3652 HLOC.exe 225 PID 4396 wrote to memory of 1800 4396 cmd.exe 229 PID 1800 wrote to memory of 4116 1800 GWRSXB.exe 230 PID 4116 wrote to memory of 6072 4116 cmd.exe 234 PID 6072 wrote to memory of 1452 6072 QUWMNJ.exe 235 PID 1452 wrote to memory of 1196 1452 cmd.exe 239 PID 1196 wrote to memory of 1300 1196 BMMXWK.exe 240 PID 1300 wrote to memory of 5840 1300 cmd.exe 244 PID 5840 wrote to memory of 5260 5840 AFPNF.exe 245 PID 5260 wrote to memory of 2384 5260 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_97d46850349f0e406b96ed1a348e0a16_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OLSRQTO.exe.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\windows\system\OLSRQTO.exeC:\windows\system\OLSRQTO.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTU.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\windows\QTU.exeC:\windows\QTU.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJH.exe.bat" "6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\windows\SysWOW64\NJH.exeC:\windows\system32\NJH.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUSST.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\windows\SysWOW64\RUSST.exeC:\windows\system32\RUSST.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UHJTMZ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\system\UHJTMZ.exeC:\windows\system\UHJTMZ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACN.exe.bat" "12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\windows\ACN.exeC:\windows\ACN.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IIZBDUO.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\system\IIZBDUO.exeC:\windows\system\IIZBDUO.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HQOYPDR.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\windows\SysWOW64\HQOYPDR.exeC:\windows\system32\HQOYPDR.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ERPBTH.exe.bat" "18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\windows\system\ERPBTH.exeC:\windows\system\ERPBTH.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMB.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\windows\KMB.exeC:\windows\KMB.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CMP.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\system\CMP.exeC:\windows\system\CMP.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNF.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\system\VNF.exeC:\windows\system\VNF.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSEQIPP.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\windows\GSEQIPP.exeC:\windows\GSEQIPP.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGQWTOL.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\windows\system\OGQWTOL.exeC:\windows\system\OGQWTOL.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WLVDDM.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\SysWOW64\WLVDDM.exeC:\windows\system32\WLVDDM.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZIKOT.exe.bat" "32⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\windows\FZIKOT.exeC:\windows\FZIKOT.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NEMQZ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\windows\system\NEMQZ.exeC:\windows\system\NEMQZ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAYREGN.exe.bat" "36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\windows\SysWOW64\BAYREGN.exeC:\windows\system32\BAYREGN.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NQR.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\SysWOW64\NQR.exeC:\windows\system32\NQR.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TLD.exe.bat" "40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\TLD.exeC:\windows\TLD.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGO.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\windows\ZGO.exeC:\windows\ZGO.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMTK.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\windows\HMTK.exeC:\windows\HMTK.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\SysWOW64\URB.exeC:\windows\system32\URB.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKIHPG.exe.bat" "48⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\windows\system\OKIHPG.exeC:\windows\system\OKIHPG.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCSRTCP.exe.bat" "50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\KCSRTCP.exeC:\windows\KCSRTCP.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PICGJ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\windows\SysWOW64\PICGJ.exeC:\windows\system32\PICGJ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLOC.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\HLOC.exeC:\windows\HLOC.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWRSXB.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\windows\SysWOW64\GWRSXB.exeC:\windows\system32\GWRSXB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUWMNJ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\windows\system\QUWMNJ.exeC:\windows\system\QUWMNJ.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMMXWK.exe.bat" "60⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\windows\SysWOW64\BMMXWK.exeC:\windows\system32\BMMXWK.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AFPNF.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\system\AFPNF.exeC:\windows\system\AFPNF.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QVQFMM.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\SysWOW64\QVQFMM.exeC:\windows\system32\QVQFMM.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVEKYDM.exe.bat" "66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4564 -
C:\windows\SysWOW64\HVEKYDM.exeC:\windows\system32\HVEKYDM.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDGPC.exe.bat" "68⤵PID:2600
-
C:\windows\SysWOW64\YDGPC.exeC:\windows\system32\YDGPC.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRXRV.exe.bat" "70⤵
- Executes a command shell one-liner
PID:6060 -
C:\windows\system\TRXRV.exeC:\windows\system\TRXRV.exe71⤵
- Executes dropped EXE
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UUBUAJF.exe.bat" "72⤵
- Executes a command shell one-liner
PID:3852 -
C:\windows\system\UUBUAJF.exeC:\windows\system\UUBUAJF.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMRFKKN.exe.bat" "74⤵PID:3820
-
C:\windows\SysWOW64\NMRFKKN.exeC:\windows\system32\NMRFKKN.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EXTVTQ.exe.bat" "76⤵PID:4604
-
C:\windows\SysWOW64\EXTVTQ.exeC:\windows\system32\EXTVTQ.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CQWLB.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:1720 -
C:\windows\SysWOW64\CQWLB.exeC:\windows\system32\CQWLB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BBHTKKT.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1892 -
C:\windows\system\BBHTKKT.exeC:\windows\system\BBHTKKT.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YRULS.exe.bat" "82⤵PID:5184
-
C:\windows\SysWOW64\YRULS.exeC:\windows\system32\YRULS.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OME.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3896 -
C:\windows\OME.exeC:\windows\OME.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GPITQ.exe.bat" "86⤵PID:5484
-
C:\windows\SysWOW64\GPITQ.exeC:\windows\system32\GPITQ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMNN.exe.bat" "88⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4832 -
C:\windows\system\QMNN.exeC:\windows\system\QMNN.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PXY.exe.bat" "90⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5148 -
C:\windows\SysWOW64\PXY.exeC:\windows\system32\PXY.exe91⤵
- Executes dropped EXE
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIBTPEM.exe.bat" "92⤵PID:4508
-
C:\windows\system\GIBTPEM.exeC:\windows\system\GIBTPEM.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGHG.exe.bat" "94⤵PID:1240
-
C:\windows\QGHG.exeC:\windows\QGHG.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYWRO.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1752 -
C:\windows\SysWOW64\JYWRO.exeC:\windows\system32\JYWRO.exe97⤵
- Executes dropped EXE
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UMVXL.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4272 -
C:\windows\SysWOW64\UMVXL.exeC:\windows\system32\UMVXL.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEK.exe.bat" "100⤵PID:4208
-
C:\windows\SysWOW64\OEK.exeC:\windows\system32\OEK.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAPRM.exe.bat" "102⤵PID:2064
-
C:\windows\SysWOW64\IAPRM.exeC:\windows\system32\IAPRM.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQQ.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:2736 -
C:\windows\YQQ.exeC:\windows\YQQ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WFBLGJB.exe.bat" "106⤵PID:1056
-
C:\windows\SysWOW64\WFBLGJB.exeC:\windows\system32\WFBLGJB.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYE.exe.bat" "108⤵
- Executes a command shell one-liner
PID:2392 -
C:\windows\HYE.exeC:\windows\HYE.exe109⤵
- Executes dropped EXE
PID:3304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWK.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:5476 -
C:\windows\SysWOW64\RWK.exeC:\windows\system32\RWK.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "112⤵PID:4824
-
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCAYHE.exe.bat" "114⤵PID:5640
-
C:\windows\SysWOW64\LCAYHE.exeC:\windows\system32\LCAYHE.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKBPN.exe.bat" "116⤵
- Executes a command shell one-liner
PID:4756 -
C:\windows\SysWOW64\SKBPN.exeC:\windows\system32\SKBPN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIGK.exe.bat" "118⤵
- Executes a command shell one-liner
PID:3144 -
C:\windows\system\CIGK.exeC:\windows\system\CIGK.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLQOOVI.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2784 -
C:\windows\SysWOW64\RLQOOVI.exeC:\windows\system32\RLQOOVI.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-