Analysis
- max time kernel
90s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 06:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-07_18a7179a130b3111860bf3035227cb73_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-09-07_18a7179a130b3111860bf3035227cb73_elex_emotet_stop.exe
- Size 208KB
- Sample260909-g4zwcssfkb
- SHA256 6b64ddafaeef7897eea0f03bdef4fa8b32be7f1130f6bbc9d883f07935b01dc3
- MD5 18a7179a130b3111860bf3035227cb73
- SHA1 c0628b9a0274241e3e869950944658ba25bc71a2
- SHA512 d263d1dd26909f6ee9770d2cb6e9971565873188f30b0a0389fe16e275884a41ceed902ba7bf323c69ec73881b5b1bbf3abbb0788a7d875bac9029d371728d0d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlUKL+LOfs4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlUS+LO0kEj1
- TLSH T13F247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4108 DCVQQWM.exe 412 GSQXY.exe 3356 GNAIH.exe 1864 PWCVTK.exe 1960 TEJV.exe 5828 EWMOF.exe 1488 KWUBOMR.exe 6088 BFW.exe 4800 WSBQC.exe 5784 QFFZMJE.exe 6100 GAPMX.exe 1256 EWO.exe 4216 QEVMO.exe 1112 NECAXTS.exe 5404 ZUJIK.exe 5468 HKK.exe 6052 YKMN.exe 2436 NNVRFRF.exe 5600 ZGY.exe 5188 IGAPQ.exe 5568 JJQLFO.exe 6028 OKY.exe 1892 PNCUB.exe 5704 IIGY.exe 3324 CDLHR.exe 2608 FQPRBNP.exe 2744 TWNOIXJ.exe 440 QTTD.exe 3492 QHTR.exe 4588 NFROGD.exe 6092 HAW.exe 2848 SSZR.exe 5596 KYJJG.exe 4856 ETOSRH.exe 4916 PMR.exe 3024 BEME.exe 4352 MXPWI.exe 3300 DCAOXI.exe 1248 UNQEXC.exe 2700 OIV.exe 1972 UICBQ.exe 2876 PWHTAWF.exe 5776 AOK.exe 1048 PJUQUY.exe 5700 PPUEVDP.exe 3460 MUSTCN.exe 5420 FYDXI.exe 6040 ZLAHSDP.exe 1868 WQGEZNJ.exe 2536 QEL.exe 5900 CWOGS.exe 3352 TKYYHYB.exe 3484 ECTR.exe 5640 KCBE.exe 4600 VVEPZ.exe 4128 QIJHJPW.exe 700 MOPW.exe 2524 XGKOY.exe 2000 ZWL.exe 2348 OCRGM.exe 3384 UCQBVHZ.exe 4616 FVTMDOG.exe 4784 QNW.exe 3332 IAHXTS.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\IIGY.exe PNCUB.exe File created C:\windows\SysWOW64\MUSTCN.exe PPUEVDP.exe File created C:\windows\SysWOW64\HJO.exe KEIXIWP.exe File opened for modification C:\windows\SysWOW64\NJVIYI.exe HJO.exe File created C:\windows\SysWOW64\JJP.exe MDJALL.exe File created C:\windows\SysWOW64\QEL.exe WQGEZNJ.exe File created C:\windows\SysWOW64\PEOY.exe.bat JJP.exe File created C:\windows\SysWOW64\QEVMO.exe.bat EWO.exe File created C:\windows\SysWOW64\TWNOIXJ.exe FQPRBNP.exe File opened for modification C:\windows\SysWOW64\MOPW.exe QIJHJPW.exe File created C:\windows\SysWOW64\PRVUM.exe VEQL.exe File opened for modification C:\windows\SysWOW64\EWO.exe GAPMX.exe File created C:\windows\SysWOW64\JJQLFO.exe.bat IGAPQ.exe File created C:\windows\SysWOW64\IIGY.exe.bat PNCUB.exe File created C:\windows\SysWOW64\VVEPZ.exe KCBE.exe File created C:\windows\SysWOW64\EIY.exe.bat VIWQNZC.exe File opened for modification C:\windows\SysWOW64\YKMN.exe HKK.exe File created C:\windows\SysWOW64\MOPW.exe.bat QIJHJPW.exe File opened for modification C:\windows\SysWOW64\QNW.exe FVTMDOG.exe File created C:\windows\SysWOW64\BEME.exe PMR.exe File created C:\windows\SysWOW64\JJP.exe.bat MDJALL.exe File created C:\windows\SysWOW64\PRVUM.exe.bat VEQL.exe File created C:\windows\SysWOW64\DCVQQWM.exe.bat 2026-09-07_18a7179a130b3111860bf3035227cb73_elex_emotet_stop.exe File created C:\windows\SysWOW64\PMR.exe.bat ETOSRH.exe File opened for modification C:\windows\SysWOW64\QEL.exe WQGEZNJ.exe File created C:\windows\SysWOW64\KRTIZ.exe.bat PEOY.exe File opened for modification C:\windows\SysWOW64\FACOCS.exe KFXF.exe File created C:\windows\SysWOW64\JJQLFO.exe IGAPQ.exe File opened for modification C:\windows\SysWOW64\BEME.exe PMR.exe File opened for modification C:\windows\SysWOW64\DCAOXI.exe MXPWI.exe File created C:\windows\SysWOW64\MUSTCN.exe.bat PPUEVDP.exe File opened for modification C:\windows\SysWOW64\ZWL.exe XGKOY.exe File opened for modification C:\windows\SysWOW64\MAOGO.exe MUOS.exe File created C:\windows\SysWOW64\QCAQMIA.exe.bat IRRPY.exe File opened for modification C:\windows\SysWOW64\OCFK.exe PRVUM.exe File opened for modification C:\windows\SysWOW64\JJQLFO.exe IGAPQ.exe File opened for modification C:\windows\SysWOW64\AOK.exe PWHTAWF.exe File created C:\windows\SysWOW64\RKOB.exe FRL.exe File created C:\windows\SysWOW64\EWMOF.exe.bat TEJV.exe File opened for modification C:\windows\SysWOW64\TWNOIXJ.exe FQPRBNP.exe File opened for modification C:\windows\SysWOW64\PMR.exe ETOSRH.exe File created C:\windows\SysWOW64\BEME.exe.bat PMR.exe File created C:\windows\SysWOW64\TKYYHYB.exe.bat CWOGS.exe File created C:\windows\SysWOW64\LEOZLH.exe ZLLGD.exe File created C:\windows\SysWOW64\DVOGZ.exe.bat OAETG.exe File created C:\windows\SysWOW64\EWO.exe GAPMX.exe File created C:\windows\SysWOW64\CWOGS.exe.bat QEL.exe File opened for modification C:\windows\SysWOW64\GNXFH.exe RKOB.exe File created C:\windows\SysWOW64\HJO.exe.bat KEIXIWP.exe File created C:\windows\SysWOW64\DCAOXI.exe MXPWI.exe File opened for modification C:\windows\SysWOW64\PPUEVDP.exe PJUQUY.exe File opened for modification C:\windows\SysWOW64\CWOGS.exe QEL.exe File opened for modification C:\windows\SysWOW64\QCAQMIA.exe IRRPY.exe File created C:\windows\SysWOW64\NTHAA.exe GNN.exe File opened for modification C:\windows\SysWOW64\KRTIZ.exe PEOY.exe File created C:\windows\SysWOW64\OCFK.exe PRVUM.exe File created C:\windows\SysWOW64\TWNOIXJ.exe.bat FQPRBNP.exe File opened for modification C:\windows\SysWOW64\PRVUM.exe VEQL.exe File created C:\windows\SysWOW64\VVEPZ.exe.bat KCBE.exe File opened for modification C:\windows\SysWOW64\OTIN.exe BIAOGI.exe File created C:\windows\SysWOW64\RKOB.exe.bat FRL.exe File created C:\windows\SysWOW64\KRTIZ.exe PEOY.exe File opened for modification C:\windows\SysWOW64\VVEPZ.exe KCBE.exe File created C:\windows\SysWOW64\LEOZLH.exe.bat ZLLGD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\GNAIH.exe GSQXY.exe File created C:\windows\PWCVTK.exe GNAIH.exe File created C:\windows\FRL.exe.bat LEOZLH.exe File opened for modification C:\windows\system\QQDOY.exe CKDCWTR.exe File opened for modification C:\windows\BFW.exe KWUBOMR.exe File opened for modification C:\windows\system\CDLHR.exe IIGY.exe File created C:\windows\FRL.exe LEOZLH.exe File created C:\windows\system\MGTDP.exe OGMPGFN.exe File created C:\windows\system\GNN.exe PFLAIS.exe File created C:\windows\RPG.exe.bat GWLWGIS.exe File created C:\windows\KCBE.exe ECTR.exe File created C:\windows\system\KWUBOMR.exe EWMOF.exe File created C:\windows\system\NNVRFRF.exe YKMN.exe File created C:\windows\NFROGD.exe QHTR.exe File opened for modification C:\windows\system\MXPWI.exe BEME.exe File created C:\windows\NFROGD.exe.bat QHTR.exe File created C:\windows\system\UNQEXC.exe.bat DCAOXI.exe File opened for modification C:\windows\system\GTQNZHD.exe MGTDP.exe File created C:\windows\system\IRRPY.exe GTQNZHD.exe File opened for modification C:\windows\system\JJITNT.exe EGMUI.exe File created C:\windows\GNAIH.exe GSQXY.exe File created C:\windows\system\JJITNT.exe.bat EGMUI.exe File created C:\windows\system\ZLLGD.exe OTIN.exe File opened for modification C:\windows\FZWELV.exe NML.exe File opened for modification C:\windows\system\PSB.exe KRTIZ.exe File opened for modification C:\windows\HAW.exe NFROGD.exe File created C:\windows\system\MXPWI.exe BEME.exe File opened for modification C:\windows\system\BIAOGI.exe MAZXIUV.exe File created C:\windows\system\FQPRBNP.exe CDLHR.exe File opened for modification C:\windows\QTTD.exe TWNOIXJ.exe File created C:\windows\system\OIV.exe.bat UNQEXC.exe File created C:\windows\system\QIJHJPW.exe.bat VVEPZ.exe File created C:\windows\GNAIH.exe.bat GSQXY.exe File created C:\windows\GAPMX.exe QFFZMJE.exe File opened for modification C:\windows\system\DODKZBW.exe JTHBP.exe File created C:\windows\system\FVTMDOG.exe UCQBVHZ.exe File created C:\windows\EGMUI.exe IAHXTS.exe File created C:\windows\system\PPQV.exe EWN.exe File created C:\windows\system\PHG.exe.bat DODKZBW.exe File created C:\windows\OAETG.exe FACOCS.exe File opened for modification C:\windows\system\NNVRFRF.exe YKMN.exe File created C:\windows\system\OGMPGFN.exe EIY.exe File created C:\windows\HAW.exe.bat NFROGD.exe File created C:\windows\system\WQGEZNJ.exe ZLAHSDP.exe File created C:\windows\system\WXPL.exe AAJ.exe File opened for modification C:\windows\system\IRRPY.exe GTQNZHD.exe File created C:\windows\system\HKK.exe.bat ZUJIK.exe File created C:\windows\ZGY.exe.bat NNVRFRF.exe File opened for modification C:\windows\ETOSRH.exe KYJJG.exe File created C:\windows\system\BIAOGI.exe.bat MAZXIUV.exe File opened for modification C:\windows\VEQL.exe DVOGZ.exe File created C:\windows\ETOSRH.exe.bat KYJJG.exe File created C:\windows\ZLAHSDP.exe.bat FYDXI.exe File created C:\windows\RPG.exe GWLWGIS.exe File created C:\windows\system\UCQBVHZ.exe OCRGM.exe File opened for modification C:\windows\EGMUI.exe IAHXTS.exe File opened for modification C:\windows\system\PFLAIS.exe USHQY.exe File created C:\windows\PNCUB.exe.bat OKY.exe File created C:\windows\system\UNQEXC.exe DCAOXI.exe File created C:\windows\ZGY.exe NNVRFRF.exe File created C:\windows\system\FVTMDOG.exe.bat UCQBVHZ.exe File created C:\windows\IFUDVZ.exe.bat MAOGO.exe File created C:\windows\system\UICBQ.exe.bat OIV.exe File created C:\windows\system\IAHXTS.exe QNW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6108 cmd.exe 1388 cmd.exe 2968 cmd.exe 1932 cmd.exe 5212 cmd.exe 5504 cmd.exe 260 cmd.exe 6032 cmd.exe 468 cmd.exe 2808 cmd.exe 1192 cmd.exe 2884 cmd.exe 2768 cmd.exe 576 cmd.exe 4328 cmd.exe 3048 cmd.exe 2020 cmd.exe 4532 cmd.exe 2276 cmd.exe 2508 cmd.exe 2100 cmd.exe 4312 cmd.exe 4492 cmd.exe 2984 cmd.exe 3428 cmd.exe 2616 cmd.exe 3388 cmd.exe 5436 cmd.exe 4116 cmd.exe 3160 cmd.exe 2828 cmd.exe 5984 cmd.exe 4376 cmd.exe 2036 cmd.exe 4208 cmd.exe 3488 cmd.exe 2908 cmd.exe 3188 cmd.exe 1996 cmd.exe 2704 cmd.exe 2472 cmd.exe 1436 cmd.exe 5672 cmd.exe 6116 cmd.exe 5656 cmd.exe 4748 cmd.exe 1348 cmd.exe 5804 cmd.exe 4268 cmd.exe 2960 cmd.exe 3320 cmd.exe 5004 cmd.exe 5856 cmd.exe 5228 cmd.exe 5912 cmd.exe 4640 cmd.exe 476 cmd.exe 1884 cmd.exe 1576 cmd.exe 4308 cmd.exe 4244 cmd.exe 556 cmd.exe 4180 cmd.exe 1804 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 3472 4788 WerFault.exe 88 4816 4108 WerFault.exe 93 2412 412 WerFault.exe 99 4764 3356 WerFault.exe 104 1044 1864 WerFault.exe 109 3076 1960 WerFault.exe 114 1784 5828 WerFault.exe 119 5696 1488 WerFault.exe 124 3232 6088 WerFault.exe 129 904 4800 WerFault.exe 134 5416 5784 WerFault.exe 139 4748 6100 WerFault.exe 144 948 1256 WerFault.exe 149 2984 4216 WerFault.exe 154 5304 1112 WerFault.exe 159 4764 5404 WerFault.exe 164 3404 5468 WerFault.exe 169 2408 6052 WerFault.exe 174 4964 2436 WerFault.exe 179 4980 5600 WerFault.exe 184 3384 5188 WerFault.exe 189 2820 5568 WerFault.exe 194 4500 6028 WerFault.exe 199 5700 1892 WerFault.exe 204 6120 5704 WerFault.exe 209 3212 3324 WerFault.exe 214 5996 2608 WerFault.exe 219 4576 2744 WerFault.exe 224 4464 440 WerFault.exe 229 5412 3492 WerFault.exe 234 5812 4588 WerFault.exe 239 3152 6092 WerFault.exe 244 4676 2848 WerFault.exe 249 2344 5596 WerFault.exe 254 4640 4856 WerFault.exe 259 4144 4916 WerFault.exe 264 2532 3024 WerFault.exe 269 5436 4352 WerFault.exe 274 676 3300 WerFault.exe 279 1872 1248 WerFault.exe 284 4376 2700 WerFault.exe 289 4848 1972 WerFault.exe 294 4648 2876 WerFault.exe 299 4500 5776 WerFault.exe 304 476 1048 WerFault.exe 309 3464 5700 WerFault.exe 314 2768 3460 WerFault.exe 319 4504 5420 WerFault.exe 324 2652 6040 WerFault.exe 329 2348 1868 WerFault.exe 334 3896 2536 WerFault.exe 339 1216 5900 WerFault.exe 344 1192 3352 WerFault.exe 349 724 3484 WerFault.exe 354 3220 5640 WerFault.exe 359 2632 4600 WerFault.exe 364 4304 4128 WerFault.exe 369 1600 700 WerFault.exe 374 5732 2524 WerFault.exe 379 676 2000 WerFault.exe 384 4840 2348 WerFault.exe 389 3468 3384 WerFault.exe 394 2324 4616 WerFault.exe 399 2756 4784 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSQXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NML.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZWL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LEOZLH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KCBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAHXTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIYJOTR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYJJG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MXPWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZLLGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWMOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BIAOGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWNOIXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCRGM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RKOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QQDOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NECAXTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IIGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGKOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXPL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCVQQWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JJITNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCAQMIA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4788 2026-09-07_18a7179a130b3111860bf3035227cb73_elex_emotet_stop.exe 4788 2026-09-07_18a7179a130b3111860bf3035227cb73_elex_emotet_stop.exe 4108 DCVQQWM.exe 4108 DCVQQWM.exe 412 GSQXY.exe 412 GSQXY.exe 3356 GNAIH.exe 3356 GNAIH.exe 1864 PWCVTK.exe 1864 PWCVTK.exe 1960 TEJV.exe 1960 TEJV.exe 5828 EWMOF.exe 5828 EWMOF.exe 1488 KWUBOMR.exe 1488 KWUBOMR.exe 6088 BFW.exe 6088 BFW.exe 4800 WSBQC.exe 4800 WSBQC.exe 5784 QFFZMJE.exe 5784 QFFZMJE.exe 6100 GAPMX.exe 6100 GAPMX.exe 1256 EWO.exe 1256 EWO.exe 4216 QEVMO.exe 4216 QEVMO.exe 1112 NECAXTS.exe 1112 NECAXTS.exe 5404 ZUJIK.exe 5404 ZUJIK.exe 5468 HKK.exe 5468 HKK.exe 6052 YKMN.exe 6052 YKMN.exe 2436 NNVRFRF.exe 2436 NNVRFRF.exe 5600 ZGY.exe 5600 ZGY.exe 5188 IGAPQ.exe 5188 IGAPQ.exe 5568 JJQLFO.exe 5568 JJQLFO.exe 6028 OKY.exe 6028 OKY.exe 1892 PNCUB.exe 1892 PNCUB.exe 5704 IIGY.exe 5704 IIGY.exe 3324 CDLHR.exe 3324 CDLHR.exe 2608 FQPRBNP.exe 2608 FQPRBNP.exe 2744 TWNOIXJ.exe 2744 TWNOIXJ.exe 440 QTTD.exe 440 QTTD.exe 3492 QHTR.exe 3492 QHTR.exe 4588 NFROGD.exe 4588 NFROGD.exe 6092 HAW.exe 6092 HAW.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4788 2026-09-07_18a7179a130b3111860bf3035227cb73_elex_emotet_stop.exe 4788 2026-09-07_18a7179a130b3111860bf3035227cb73_elex_emotet_stop.exe 4108 DCVQQWM.exe 4108 DCVQQWM.exe 412 GSQXY.exe 412 GSQXY.exe 3356 GNAIH.exe 3356 GNAIH.exe 1864 PWCVTK.exe 1864 PWCVTK.exe 1960 TEJV.exe 1960 TEJV.exe 5828 EWMOF.exe 5828 EWMOF.exe 1488 KWUBOMR.exe 1488 KWUBOMR.exe 6088 BFW.exe 6088 BFW.exe 4800 WSBQC.exe 4800 WSBQC.exe 5784 QFFZMJE.exe 5784 QFFZMJE.exe 6100 GAPMX.exe 6100 GAPMX.exe 1256 EWO.exe 1256 EWO.exe 4216 QEVMO.exe 4216 QEVMO.exe 1112 NECAXTS.exe 1112 NECAXTS.exe 5404 ZUJIK.exe 5404 ZUJIK.exe 5468 HKK.exe 5468 HKK.exe 6052 YKMN.exe 6052 YKMN.exe 2436 NNVRFRF.exe 2436 NNVRFRF.exe 5600 ZGY.exe 5600 ZGY.exe 5188 IGAPQ.exe 5188 IGAPQ.exe 5568 JJQLFO.exe 5568 JJQLFO.exe 6028 OKY.exe 6028 OKY.exe 1892 PNCUB.exe 1892 PNCUB.exe 5704 IIGY.exe 5704 IIGY.exe 3324 CDLHR.exe 3324 CDLHR.exe 2608 FQPRBNP.exe 2608 FQPRBNP.exe 2744 TWNOIXJ.exe 2744 TWNOIXJ.exe 440 QTTD.exe 440 QTTD.exe 3492 QHTR.exe 3492 QHTR.exe 4588 NFROGD.exe 4588 NFROGD.exe 6092 HAW.exe 6092 HAW.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 1968 4788 2026-09-07_18a7179a130b3111860bf3035227cb73_elex_emotet_stop.exe 89 PID 1968 wrote to memory of 4108 1968 cmd.exe 93 PID 4108 wrote to memory of 3160 4108 DCVQQWM.exe 95 PID 3160 wrote to memory of 412 3160 cmd.exe 99 PID 412 wrote to memory of 4268 412 GSQXY.exe 100 PID 4268 wrote to memory of 3356 4268 cmd.exe 104 PID 3356 wrote to memory of 3408 3356 GNAIH.exe 105 PID 3408 wrote to memory of 1864 3408 cmd.exe 109 PID 1864 wrote to memory of 2424 1864 PWCVTK.exe 110 PID 2424 wrote to memory of 1960 2424 cmd.exe 114 PID 1960 wrote to memory of 5884 1960 TEJV.exe 115 PID 5884 wrote to memory of 5828 5884 cmd.exe 119 PID 5828 wrote to memory of 2828 5828 EWMOF.exe 120 PID 2828 wrote to memory of 1488 2828 cmd.exe 124 PID 1488 wrote to memory of 468 1488 KWUBOMR.exe 125 PID 468 wrote to memory of 6088 468 cmd.exe 129 PID 6088 wrote to memory of 1696 6088 BFW.exe 130 PID 1696 wrote to memory of 4800 1696 cmd.exe 134 PID 4800 wrote to memory of 3368 4800 WSBQC.exe 135 PID 3368 wrote to memory of 5784 3368 cmd.exe 139 PID 5784 wrote to memory of 4244 5784 QFFZMJE.exe 140 PID 4244 wrote to memory of 6100 4244 cmd.exe 144 PID 6100 wrote to memory of 1992 6100 GAPMX.exe 145 PID 1992 wrote to memory of 1256 1992 cmd.exe 149 PID 1256 wrote to memory of 6108 1256 EWO.exe 150 PID 6108 wrote to memory of 4216 6108 cmd.exe 154 PID 4216 wrote to memory of 3136 4216 QEVMO.exe 155 PID 3136 wrote to memory of 1112 3136 cmd.exe 159 PID 1112 wrote to memory of 4112 1112 NECAXTS.exe 160 PID 4112 wrote to memory of 5404 4112 cmd.exe 164 PID 5404 wrote to memory of 3864 5404 ZUJIK.exe 165 PID 3864 wrote to memory of 5468 3864 cmd.exe 169 PID 5468 wrote to memory of 1956 5468 HKK.exe 170 PID 1956 wrote to memory of 6052 1956 cmd.exe 174 PID 6052 wrote to memory of 2416 6052 YKMN.exe 175 PID 2416 wrote to memory of 2436 2416 cmd.exe 179 PID 2436 wrote to memory of 5312 2436 NNVRFRF.exe 180 PID 5312 wrote to memory of 5600 5312 cmd.exe 184 PID 5600 wrote to memory of 3824 5600 ZGY.exe 185 PID 3824 wrote to memory of 5188 3824 cmd.exe 189 PID 5188 wrote to memory of 3628 5188 IGAPQ.exe 190 PID 3628 wrote to memory of 5568 3628 cmd.exe 194 PID 5568 wrote to memory of 4660 5568 JJQLFO.exe 195 PID 4660 wrote to memory of 6028 4660 cmd.exe 199 PID 6028 wrote to memory of 4080 6028 OKY.exe 200 PID 4080 wrote to memory of 1892 4080 cmd.exe 204 PID 1892 wrote to memory of 4156 1892 PNCUB.exe 205 PID 4156 wrote to memory of 5704 4156 cmd.exe 209 PID 5704 wrote to memory of 3412 5704 IIGY.exe 210 PID 3412 wrote to memory of 3324 3412 cmd.exe 214 PID 3324 wrote to memory of 5984 3324 CDLHR.exe 215 PID 5984 wrote to memory of 2608 5984 cmd.exe 219 PID 2608 wrote to memory of 4552 2608 FQPRBNP.exe 220 PID 4552 wrote to memory of 2744 4552 cmd.exe 224 PID 2744 wrote to memory of 6068 2744 TWNOIXJ.exe 225 PID 6068 wrote to memory of 440 6068 cmd.exe 229 PID 440 wrote to memory of 2116 440 QTTD.exe 230 PID 2116 wrote to memory of 3492 2116 cmd.exe 234 PID 3492 wrote to memory of 2444 3492 QHTR.exe 235 PID 2444 wrote to memory of 4588 2444 cmd.exe 239 PID 4588 wrote to memory of 6076 4588 NFROGD.exe 240 PID 6076 wrote to memory of 6092 6076 cmd.exe 244 PID 6092 wrote to memory of 4388 6092 HAW.exe 245 PID 4388 wrote to memory of 2848 4388 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_18a7179a130b3111860bf3035227cb73_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_18a7179a130b3111860bf3035227cb73_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCVQQWM.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\SysWOW64\DCVQQWM.exeC:\windows\system32\DCVQQWM.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSQXY.exe.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\windows\GSQXY.exeC:\windows\GSQXY.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GNAIH.exe.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\windows\GNAIH.exeC:\windows\GNAIH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWCVTK.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\PWCVTK.exeC:\windows\PWCVTK.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TEJV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\windows\system\TEJV.exeC:\windows\system\TEJV.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWMOF.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\windows\SysWOW64\EWMOF.exeC:\windows\system32\EWMOF.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWUBOMR.exe.bat" "14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\windows\system\KWUBOMR.exeC:\windows\system\KWUBOMR.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BFW.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:468 -
C:\windows\BFW.exeC:\windows\BFW.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSBQC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\windows\WSBQC.exeC:\windows\WSBQC.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFFZMJE.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\windows\system\QFFZMJE.exeC:\windows\system\QFFZMJE.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GAPMX.exe.bat" "22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\windows\GAPMX.exeC:\windows\GAPMX.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWO.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\windows\SysWOW64\EWO.exeC:\windows\system32\EWO.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEVMO.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\windows\SysWOW64\QEVMO.exeC:\windows\system32\QEVMO.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NECAXTS.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\windows\SysWOW64\NECAXTS.exeC:\windows\system32\NECAXTS.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZUJIK.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\windows\SysWOW64\ZUJIK.exeC:\windows\system32\ZUJIK.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKK.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\system\HKK.exeC:\windows\system\HKK.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YKMN.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\windows\SysWOW64\YKMN.exeC:\windows\system32\YKMN.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NNVRFRF.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\windows\system\NNVRFRF.exeC:\windows\system\NNVRFRF.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGY.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\windows\ZGY.exeC:\windows\ZGY.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IGAPQ.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\windows\system\IGAPQ.exeC:\windows\system\IGAPQ.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJQLFO.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\SysWOW64\JJQLFO.exeC:\windows\system32\JJQLFO.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKY.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\windows\system\OKY.exeC:\windows\system\OKY.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PNCUB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\windows\PNCUB.exeC:\windows\PNCUB.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IIGY.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\windows\SysWOW64\IIGY.exeC:\windows\system32\IIGY.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDLHR.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\system\CDLHR.exeC:\windows\system\CDLHR.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQPRBNP.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\windows\system\FQPRBNP.exeC:\windows\system\FQPRBNP.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWNOIXJ.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\windows\SysWOW64\TWNOIXJ.exeC:\windows\system32\TWNOIXJ.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTTD.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\QTTD.exeC:\windows\QTTD.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QHTR.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\windows\system\QHTR.exeC:\windows\system\QHTR.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFROGD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\NFROGD.exeC:\windows\NFROGD.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAW.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\windows\HAW.exeC:\windows\HAW.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSZR.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\windows\SSZR.exeC:\windows\SSZR.exe65⤵
- Executes dropped EXE
PID:2848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYJJG.exe.bat" "66⤵PID:5260
-
C:\windows\system\KYJJG.exeC:\windows\system\KYJJG.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ETOSRH.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1940 -
C:\windows\ETOSRH.exeC:\windows\ETOSRH.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMR.exe.bat" "70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1388 -
C:\windows\SysWOW64\PMR.exeC:\windows\system32\PMR.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BEME.exe.bat" "72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2020 -
C:\windows\SysWOW64\BEME.exeC:\windows\system32\BEME.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXPWI.exe.bat" "74⤵PID:2888
-
C:\windows\system\MXPWI.exeC:\windows\system\MXPWI.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCAOXI.exe.bat" "76⤵PID:4656
-
C:\windows\SysWOW64\DCAOXI.exeC:\windows\system32\DCAOXI.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNQEXC.exe.bat" "78⤵PID:3728
-
C:\windows\system\UNQEXC.exeC:\windows\system\UNQEXC.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIV.exe.bat" "80⤵PID:2180
-
C:\windows\system\OIV.exeC:\windows\system\OIV.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UICBQ.exe.bat" "82⤵PID:3548
-
C:\windows\system\UICBQ.exeC:\windows\system\UICBQ.exe83⤵
- Executes dropped EXE
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWHTAWF.exe.bat" "84⤵PID:1076
-
C:\windows\system\PWHTAWF.exeC:\windows\system\PWHTAWF.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOK.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5296 -
C:\windows\SysWOW64\AOK.exeC:\windows\system32\AOK.exe87⤵
- Executes dropped EXE
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PJUQUY.exe.bat" "88⤵PID:2060
-
C:\windows\PJUQUY.exeC:\windows\PJUQUY.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPUEVDP.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5080 -
C:\windows\SysWOW64\PPUEVDP.exeC:\windows\system32\PPUEVDP.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUSTCN.exe.bat" "92⤵
- Executes a command shell one-liner
PID:2960 -
C:\windows\SysWOW64\MUSTCN.exeC:\windows\system32\MUSTCN.exe93⤵
- Executes dropped EXE
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "94⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3320 -
C:\windows\FYDXI.exeC:\windows\FYDXI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZLAHSDP.exe.bat" "96⤵
- Executes a command shell one-liner
PID:4532 -
C:\windows\ZLAHSDP.exeC:\windows\ZLAHSDP.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WQGEZNJ.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4792 -
C:\windows\system\WQGEZNJ.exeC:\windows\system\WQGEZNJ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QEL.exe.bat" "100⤵PID:4228
-
C:\windows\SysWOW64\QEL.exeC:\windows\system32\QEL.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWOGS.exe.bat" "102⤵PID:1476
-
C:\windows\SysWOW64\CWOGS.exeC:\windows\system32\CWOGS.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKYYHYB.exe.bat" "104⤵PID:3588
-
C:\windows\SysWOW64\TKYYHYB.exeC:\windows\system32\TKYYHYB.exe105⤵
- Executes dropped EXE
PID:3352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECTR.exe.bat" "106⤵PID:2712
-
C:\windows\ECTR.exeC:\windows\ECTR.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KCBE.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:4288 -
C:\windows\KCBE.exeC:\windows\KCBE.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVEPZ.exe.bat" "110⤵
- Executes a command shell one-liner
PID:2276 -
C:\windows\SysWOW64\VVEPZ.exeC:\windows\system32\VVEPZ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QIJHJPW.exe.bat" "112⤵PID:1140
-
C:\windows\system\QIJHJPW.exeC:\windows\system\QIJHJPW.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOPW.exe.bat" "114⤵PID:2604
-
C:\windows\SysWOW64\MOPW.exeC:\windows\system32\MOPW.exe115⤵
- Executes dropped EXE
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XGKOY.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:6084 -
C:\windows\system\XGKOY.exeC:\windows\system\XGKOY.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZWL.exe.bat" "118⤵PID:3148
-
C:\windows\SysWOW64\ZWL.exeC:\windows\system32\ZWL.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OCRGM.exe.bat" "120⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2968 -
C:\windows\system\OCRGM.exeC:\windows\system\OCRGM.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-