Analysis
- max time kernel
135s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 10:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe
- Size 208KB
- Sample260511-mcbbksez8t
- SHA256 049ae540c6df55cdc89cf9f690e2729325c10523734dd02b4fcfca3b5e8e6139
- MD5 63f6a87b7c3a44168c214ef08fd9c869
- SHA1 da39b87215ed94adde87757212bd91b53998675d
- SHA512 f9eb3af5f8906e862a7215ffb3e506e24abe0b02cfbe1f607fae7e5fe87ba2ca99104144f3d51c87323798c3ba7c117184771e6b7c98b6f5a7e59d545e6a807a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfq4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOCQEj6
- TLSH T1F7247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3432 OYABT.exe 4376 PMX.exe 3384 TUMRVU.exe 2696 ZPDAZXX.exe 1708 FPLN.exe 5104 ADQXTZ.exe 876 JLSCWXP.exe 1748 GRYZ.exe 5860 NBGS.exe 4016 NHYH.exe 2404 ICDQDX.exe 1512 GSWTYDX.exe 5568 SKRMYK.exe 4764 OQX.exe 5292 COXVPF.exe 4952 WJC.exe 5112 RWHOC.exe 4256 GRQ.exe 5784 XSSX.exe 1636 SNXHIX.exe 4556 NACYSXI.exe 2316 HOHH.exe 3236 CBMRFW.exe 5560 NTPKNEB.exe 4964 KZMZ.exe 5948 EMRQFN.exe 5100 SXVPK.exe 1548 BKG.exe 1688 OIGSBN.exe 4740 JVK.exe 5652 CWS.exe 5836 CCSB.exe 1200 FPXKH.exe 3940 EZFMVX.exe 5204 OXLGC.exe 5244 QVMA.exe 3492 ULT.exe 880 NGXEA.exe 4052 GHEPJ.exe 4860 QHGUVI.exe 3308 VHOI.exe 3720 ZXUQQV.exe 2912 NAYOV.exe 6092 JGEMCWF.exe 5980 CJIP.exe 4992 RRJHOHD.exe 4412 CJM.exe 1560 SMVEIB.exe 4440 MAA.exe 5416 CQBNZX.exe 2188 TDMFOTL.exe 1720 GBMQQF.exe 4072 BORABFJ.exe 2472 HOYNK.exe 2820 YXNLW.exe 1492 RAQO.exe 3748 GQROI.exe 2880 KYY.exe 1220 QYGCE.exe 5776 KLKLOWP.exe 5916 BWBJNQL.exe 3392 QZSNY.exe 764 NXQKNN.exe 1180 NKQZPSQ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\ICDQDX.exe NHYH.exe File opened for modification C:\windows\SysWOW64\PKFBJVK.exe UPASYV.exe File opened for modification C:\windows\SysWOW64\NWSIZB.exe WYTFV.exe File opened for modification C:\windows\SysWOW64\RHFK.exe MWJEIHL.exe File created C:\windows\SysWOW64\OPVL.exe JPNXWFM.exe File created C:\windows\SysWOW64\OPVL.exe.bat JPNXWFM.exe File created C:\windows\SysWOW64\EMF.exe XRIW.exe File created C:\windows\SysWOW64\KZMZ.exe.bat NTPKNEB.exe File opened for modification C:\windows\SysWOW64\GSWTYDX.exe ICDQDX.exe File created C:\windows\SysWOW64\KYY.exe GQROI.exe File opened for modification C:\windows\SysWOW64\NMRFKKN.exe BECXY.exe File created C:\windows\SysWOW64\WAQXE.exe.bat WVXI.exe File created C:\windows\SysWOW64\EYLFV.exe.bat TGIM.exe File opened for modification C:\windows\SysWOW64\VRN.exe COKI.exe File created C:\windows\SysWOW64\IQKWPAW.exe OPVL.exe File created C:\windows\SysWOW64\OIGSBN.exe.bat BKG.exe File created C:\windows\SysWOW64\CCSB.exe.bat CWS.exe File created C:\windows\SysWOW64\HQKH.exe.bat RVBCHA.exe File created C:\windows\SysWOW64\FQLTUJW.exe VSXY.exe File created C:\windows\SysWOW64\OVET.exe.bat OHE.exe File created C:\windows\SysWOW64\RHFK.exe MWJEIHL.exe File created C:\windows\SysWOW64\MHYQV.exe VRRNJW.exe File created C:\windows\SysWOW64\GBMQQF.exe.bat TDMFOTL.exe File opened for modification C:\windows\SysWOW64\YDC.exe MLZWIRJ.exe File opened for modification C:\windows\SysWOW64\NFRTXFV.exe EFPOU.exe File created C:\windows\SysWOW64\NFRTXFV.exe.bat EFPOU.exe File created C:\windows\SysWOW64\JIJDSH.exe.bat OVET.exe File created C:\windows\SysWOW64\ABOIO.exe JQXKG.exe File created C:\windows\SysWOW64\TDJL.exe EISYMW.exe File opened for modification C:\windows\SysWOW64\OPVL.exe JPNXWFM.exe File opened for modification C:\windows\SysWOW64\NBGS.exe GRYZ.exe File opened for modification C:\windows\SysWOW64\OQX.exe SKRMYK.exe File created C:\windows\SysWOW64\OQX.exe.bat SKRMYK.exe File created C:\windows\SysWOW64\CWS.exe JVK.exe File created C:\windows\SysWOW64\KLKLOWP.exe QYGCE.exe File created C:\windows\SysWOW64\PKFBJVK.exe UPASYV.exe File opened for modification C:\windows\SysWOW64\EFPOU.exe PKFBJVK.exe File created C:\windows\SysWOW64\WYTFV.exe ABOIO.exe File created C:\windows\SysWOW64\FQLTUJW.exe.bat VSXY.exe File created C:\windows\SysWOW64\OQX.exe SKRMYK.exe File created C:\windows\SysWOW64\SXVPK.exe.bat EMRQFN.exe File opened for modification C:\windows\SysWOW64\OIGSBN.exe BKG.exe File created C:\windows\SysWOW64\CJM.exe.bat RRJHOHD.exe File created C:\windows\SysWOW64\EFPOU.exe PKFBJVK.exe File created C:\windows\SysWOW64\YUB.exe.bat CPV.exe File created C:\windows\SysWOW64\BECXY.exe MBTTNFQ.exe File created C:\windows\SysWOW64\OYABT.exe.bat 2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe File created C:\windows\SysWOW64\EMRQFN.exe KZMZ.exe File opened for modification C:\windows\SysWOW64\JVK.exe OIGSBN.exe File created C:\windows\SysWOW64\GBMQQF.exe TDMFOTL.exe File created C:\windows\SysWOW64\BORABFJ.exe GBMQQF.exe File opened for modification C:\windows\SysWOW64\YXNLW.exe HOYNK.exe File opened for modification C:\windows\SysWOW64\NXQKNN.exe QZSNY.exe File created C:\windows\SysWOW64\OJRBAVS.exe.bat OVZMZIX.exe File created C:\windows\SysWOW64\NBGS.exe GRYZ.exe File opened for modification C:\windows\SysWOW64\EMRQFN.exe KZMZ.exe File opened for modification C:\windows\SysWOW64\ZXUQQV.exe VHOI.exe File opened for modification C:\windows\SysWOW64\GBMQQF.exe TDMFOTL.exe File created C:\windows\SysWOW64\LKATVV.exe ARXJN.exe File created C:\windows\SysWOW64\UPASYV.exe.bat ABWJ.exe File created C:\windows\SysWOW64\EFPOU.exe.bat PKFBJVK.exe File opened for modification C:\windows\SysWOW64\BNMNUXI.exe CCB.exe File created C:\windows\SysWOW64\ICDQDX.exe.bat NHYH.exe File opened for modification C:\windows\SysWOW64\KLKLOWP.exe QYGCE.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\CCB.exe SEW.exe File created C:\windows\system\QIWRN.exe BNMNUXI.exe File created C:\windows\system\TDGLR.exe XXJ.exe File opened for modification C:\windows\UFPZ.exe HUTBO.exe File created C:\windows\VHOI.exe.bat QHGUVI.exe File created C:\windows\NKQZPSQ.exe NXQKNN.exe File opened for modification C:\windows\FJRD.exe ZNSCHC.exe File created C:\windows\system\CCB.exe.bat SEW.exe File created C:\windows\NTQ.exe IQMZ.exe File opened for modification C:\windows\CKYEOH.exe YCS.exe File created C:\windows\IFUDVZ.exe.bat GITBPK.exe File opened for modification C:\windows\GRYZ.exe JLSCWXP.exe File created C:\windows\NTPKNEB.exe CBMRFW.exe File opened for modification C:\windows\YCS.exe LROY.exe File created C:\windows\system\EISYMW.exe.bat CKYEOH.exe File created C:\windows\ZJJNQXT.exe KTIO.exe File created C:\windows\MUOS.exe YRSTA.exe File created C:\windows\NHYH.exe NBGS.exe File opened for modification C:\windows\system\EPYHZUD.exe JMQI.exe File created C:\windows\system\CPV.exe LGTWS.exe File opened for modification C:\windows\MWJEIHL.exe ELALCDW.exe File created C:\windows\system\FPLN.exe.bat ZPDAZXX.exe File opened for modification C:\windows\system\EZFMVX.exe FPXKH.exe File opened for modification C:\windows\ULT.exe QVMA.exe File created C:\windows\GHEPJ.exe NGXEA.exe File created C:\windows\CJIP.exe.bat JGEMCWF.exe File created C:\windows\system\JKI.exe LKATVV.exe File opened for modification C:\windows\system\QIWRN.exe BNMNUXI.exe File opened for modification C:\windows\SKRMYK.exe GSWTYDX.exe File opened for modification C:\windows\system\WJC.exe COXVPF.exe File created C:\windows\system\RRJHOHD.exe CJIP.exe File opened for modification C:\windows\system\DDEBWQ.exe AQZSL.exe File created C:\windows\system\SNXHIX.exe XSSX.exe File created C:\windows\system\OVZMZIX.exe ZAHI.exe File opened for modification C:\windows\GAGFNIP.exe YUB.exe File created C:\windows\SKRMYK.exe GSWTYDX.exe File opened for modification C:\windows\system\SNXHIX.exe XSSX.exe File opened for modification C:\windows\VHOI.exe QHGUVI.exe File created C:\windows\system\ARXJN.exe.bat OJRBAVS.exe File opened for modification C:\windows\system\WVLK.exe NMRFKKN.exe File created C:\windows\CADLHB.exe.bat RIAA.exe File created C:\windows\LROY.exe.bat REJ.exe File opened for modification C:\windows\system\WVXI.exe HASWT.exe File created C:\windows\system\OXLGC.exe EZFMVX.exe File opened for modification C:\windows\BWBJNQL.exe KLKLOWP.exe File opened for modification C:\windows\system\OVZMZIX.exe ZAHI.exe File created C:\windows\XMDD.exe.bat CYGTYBP.exe File created C:\windows\LMZLLV.exe.bat NWSIZB.exe File created C:\windows\system\UDDNQOS.exe.bat IQKWPAW.exe File opened for modification C:\windows\system\JLSCWXP.exe ADQXTZ.exe File opened for modification C:\windows\QVMA.exe OXLGC.exe File created C:\windows\ZAHI.exe.bat XDCN.exe File opened for modification C:\windows\NTQ.exe IQMZ.exe File created C:\windows\DZDVTW.exe.bat ZJJNQXT.exe File created C:\windows\FWB.exe.bat FLS.exe File created C:\windows\system\QXL.exe RHFK.exe File created C:\windows\system\SMVEIB.exe.bat CJM.exe File opened for modification C:\windows\system\RQIOFV.exe NKQZPSQ.exe File created C:\windows\system\UWPRE.exe.bat DDEBWQ.exe File created C:\windows\system\IQMZ.exe.bat VGQ.exe File created C:\windows\system\WVXI.exe.bat HASWT.exe File created C:\windows\system\NACYSXI.exe.bat SNXHIX.exe File created C:\windows\system\JKI.exe.bat LKATVV.exe File created C:\windows\LROY.exe REJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 776 996 WerFault.exe 77 5196 3432 WerFault.exe 82 2852 4376 WerFault.exe 88 5532 3384 WerFault.exe 93 6064 2696 WerFault.exe 98 5976 1708 WerFault.exe 103 580 5104 WerFault.exe 108 4404 876 WerFault.exe 113 4348 1748 WerFault.exe 117 3640 5860 WerFault.exe 123 2352 4016 WerFault.exe 127 3892 2404 WerFault.exe 133 3708 1512 WerFault.exe 138 5140 5568 WerFault.exe 143 4620 4764 WerFault.exe 148 4912 5292 WerFault.exe 153 3200 4952 WerFault.exe 158 2624 5112 WerFault.exe 163 5964 4256 WerFault.exe 168 6064 5784 WerFault.exe 173 5976 1636 WerFault.exe 178 4264 4556 WerFault.exe 183 4072 2316 WerFault.exe 188 5384 3236 WerFault.exe 193 3388 5560 WerFault.exe 197 5968 4964 WerFault.exe 203 3920 5948 WerFault.exe 208 2932 5100 WerFault.exe 213 3576 1548 WerFault.exe 218 3932 1688 WerFault.exe 223 4996 4740 WerFault.exe 228 4932 5652 WerFault.exe 233 1132 5836 WerFault.exe 238 5392 1200 WerFault.exe 243 5992 3940 WerFault.exe 248 1384 5204 WerFault.exe 253 4668 5244 WerFault.exe 258 500 3492 WerFault.exe 263 1252 880 WerFault.exe 268 2272 4052 WerFault.exe 272 1420 4860 WerFault.exe 278 1696 3308 WerFault.exe 283 1404 3720 WerFault.exe 287 5504 2912 WerFault.exe 293 1216 6092 WerFault.exe 298 5088 5980 WerFault.exe 303 3540 4992 WerFault.exe 308 5988 4412 WerFault.exe 313 5184 1560 WerFault.exe 317 6076 4440 WerFault.exe 323 1304 5416 WerFault.exe 328 1516 2188 WerFault.exe 333 2476 1720 WerFault.exe 338 2212 4072 WerFault.exe 343 3388 2472 WerFault.exe 348 2520 2820 WerFault.exe 353 5268 1492 WerFault.exe 358 1764 3748 WerFault.exe 363 4480 2880 WerFault.exe 368 4620 1220 WerFault.exe 373 5196 5776 WerFault.exe 378 1132 5916 WerFault.exe 383 6056 3392 WerFault.exe 388 3844 764 WerFault.exe 393 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKFBJVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWSIZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNZBXRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBTTNFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDMFOTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HASWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAQXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language COKI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OPVL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIGSBN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKATVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELALCDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKRMYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RQIOFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFPOU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CADLHB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDDNQOS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLSCWXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADQXTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICDQDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPXEWNR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMTOSCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 996 2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe 996 2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe 3432 OYABT.exe 3432 OYABT.exe 4376 PMX.exe 4376 PMX.exe 3384 TUMRVU.exe 3384 TUMRVU.exe 2696 ZPDAZXX.exe 2696 ZPDAZXX.exe 1708 FPLN.exe 1708 FPLN.exe 5104 ADQXTZ.exe 5104 ADQXTZ.exe 876 JLSCWXP.exe 876 JLSCWXP.exe 1748 GRYZ.exe 1748 GRYZ.exe 5860 NBGS.exe 5860 NBGS.exe 4016 NHYH.exe 4016 NHYH.exe 2404 ICDQDX.exe 2404 ICDQDX.exe 1512 GSWTYDX.exe 1512 GSWTYDX.exe 5568 SKRMYK.exe 5568 SKRMYK.exe 4764 OQX.exe 4764 OQX.exe 5292 COXVPF.exe 5292 COXVPF.exe 4952 WJC.exe 4952 WJC.exe 5112 RWHOC.exe 5112 RWHOC.exe 4256 GRQ.exe 4256 GRQ.exe 5784 XSSX.exe 5784 XSSX.exe 1636 SNXHIX.exe 1636 SNXHIX.exe 4556 NACYSXI.exe 4556 NACYSXI.exe 2316 HOHH.exe 2316 HOHH.exe 3236 CBMRFW.exe 3236 CBMRFW.exe 5560 NTPKNEB.exe 5560 NTPKNEB.exe 4964 KZMZ.exe 4964 KZMZ.exe 5948 EMRQFN.exe 5948 EMRQFN.exe 5100 SXVPK.exe 5100 SXVPK.exe 1548 BKG.exe 1548 BKG.exe 1688 OIGSBN.exe 1688 OIGSBN.exe 4740 JVK.exe 4740 JVK.exe 5652 CWS.exe 5652 CWS.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 996 2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe 996 2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe 3432 OYABT.exe 3432 OYABT.exe 4376 PMX.exe 4376 PMX.exe 3384 TUMRVU.exe 3384 TUMRVU.exe 2696 ZPDAZXX.exe 2696 ZPDAZXX.exe 1708 FPLN.exe 1708 FPLN.exe 5104 ADQXTZ.exe 5104 ADQXTZ.exe 876 JLSCWXP.exe 876 JLSCWXP.exe 1748 GRYZ.exe 1748 GRYZ.exe 5860 NBGS.exe 5860 NBGS.exe 4016 NHYH.exe 4016 NHYH.exe 2404 ICDQDX.exe 2404 ICDQDX.exe 1512 GSWTYDX.exe 1512 GSWTYDX.exe 5568 SKRMYK.exe 5568 SKRMYK.exe 4764 OQX.exe 4764 OQX.exe 5292 COXVPF.exe 5292 COXVPF.exe 4952 WJC.exe 4952 WJC.exe 5112 RWHOC.exe 5112 RWHOC.exe 4256 GRQ.exe 4256 GRQ.exe 5784 XSSX.exe 5784 XSSX.exe 1636 SNXHIX.exe 1636 SNXHIX.exe 4556 NACYSXI.exe 4556 NACYSXI.exe 2316 HOHH.exe 2316 HOHH.exe 3236 CBMRFW.exe 3236 CBMRFW.exe 5560 NTPKNEB.exe 5560 NTPKNEB.exe 4964 KZMZ.exe 4964 KZMZ.exe 5948 EMRQFN.exe 5948 EMRQFN.exe 5100 SXVPK.exe 5100 SXVPK.exe 1548 BKG.exe 1548 BKG.exe 1688 OIGSBN.exe 1688 OIGSBN.exe 4740 JVK.exe 4740 JVK.exe 5652 CWS.exe 5652 CWS.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 996 wrote to memory of 4228 996 2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe 78 PID 4228 wrote to memory of 3432 4228 cmd.exe 82 PID 3432 wrote to memory of 4944 3432 OYABT.exe 84 PID 4944 wrote to memory of 4376 4944 cmd.exe 88 PID 4376 wrote to memory of 5276 4376 PMX.exe 89 PID 5276 wrote to memory of 3384 5276 cmd.exe 93 PID 3384 wrote to memory of 1376 3384 TUMRVU.exe 94 PID 1376 wrote to memory of 2696 1376 cmd.exe 98 PID 2696 wrote to memory of 5260 2696 ZPDAZXX.exe 99 PID 5260 wrote to memory of 1708 5260 cmd.exe 103 PID 1708 wrote to memory of 3100 1708 FPLN.exe 104 PID 3100 wrote to memory of 5104 3100 cmd.exe 108 PID 5104 wrote to memory of 3976 5104 ADQXTZ.exe 109 PID 3976 wrote to memory of 876 3976 cmd.exe 113 PID 876 wrote to memory of 1100 876 JLSCWXP.exe 114 PID 1100 wrote to memory of 1748 1100 cmd.exe 117 PID 1748 wrote to memory of 5552 1748 GRYZ.exe 119 PID 5552 wrote to memory of 5860 5552 cmd.exe 123 PID 5860 wrote to memory of 1700 5860 NBGS.exe 124 PID 1700 wrote to memory of 4016 1700 cmd.exe 127 PID 4016 wrote to memory of 2400 4016 NHYH.exe 129 PID 2400 wrote to memory of 2404 2400 cmd.exe 133 PID 2404 wrote to memory of 5272 2404 ICDQDX.exe 134 PID 5272 wrote to memory of 1512 5272 cmd.exe 138 PID 1512 wrote to memory of 2564 1512 GSWTYDX.exe 139 PID 2564 wrote to memory of 5568 2564 cmd.exe 143 PID 5568 wrote to memory of 2588 5568 SKRMYK.exe 144 PID 2588 wrote to memory of 4764 2588 cmd.exe 148 PID 4764 wrote to memory of 1108 4764 OQX.exe 149 PID 1108 wrote to memory of 5292 1108 cmd.exe 153 PID 5292 wrote to memory of 3780 5292 COXVPF.exe 154 PID 3780 wrote to memory of 4952 3780 cmd.exe 158 PID 4952 wrote to memory of 5108 4952 WJC.exe 159 PID 5108 wrote to memory of 5112 5108 cmd.exe 163 PID 5112 wrote to memory of 5468 5112 RWHOC.exe 164 PID 5468 wrote to memory of 4256 5468 cmd.exe 168 PID 4256 wrote to memory of 5804 4256 GRQ.exe 169 PID 5804 wrote to memory of 5784 5804 cmd.exe 173 PID 5784 wrote to memory of 5528 5784 XSSX.exe 174 PID 5528 wrote to memory of 1636 5528 cmd.exe 178 PID 1636 wrote to memory of 3612 1636 SNXHIX.exe 179 PID 3612 wrote to memory of 4556 3612 cmd.exe 183 PID 4556 wrote to memory of 5812 4556 NACYSXI.exe 184 PID 5812 wrote to memory of 2316 5812 cmd.exe 188 PID 2316 wrote to memory of 5544 2316 HOHH.exe 189 PID 5544 wrote to memory of 3236 5544 cmd.exe 193 PID 3236 wrote to memory of 2260 3236 CBMRFW.exe 194 PID 2260 wrote to memory of 5560 2260 cmd.exe 197 PID 5560 wrote to memory of 1160 5560 NTPKNEB.exe 199 PID 1160 wrote to memory of 4964 1160 cmd.exe 203 PID 4964 wrote to memory of 3756 4964 KZMZ.exe 204 PID 3756 wrote to memory of 5948 3756 cmd.exe 208 PID 5948 wrote to memory of 5324 5948 EMRQFN.exe 209 PID 5324 wrote to memory of 5100 5324 cmd.exe 213 PID 5100 wrote to memory of 1752 5100 SXVPK.exe 214 PID 1752 wrote to memory of 1548 1752 cmd.exe 218 PID 1548 wrote to memory of 4156 1548 BKG.exe 219 PID 4156 wrote to memory of 1688 4156 cmd.exe 223 PID 1688 wrote to memory of 4708 1688 OIGSBN.exe 224 PID 4708 wrote to memory of 4740 4708 cmd.exe 228 PID 4740 wrote to memory of 3436 4740 JVK.exe 229 PID 3436 wrote to memory of 5652 3436 cmd.exe 233 PID 5652 wrote to memory of 1288 5652 CWS.exe 234 PID 1288 wrote to memory of 5836 1288 cmd.exe 238
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_63f6a87b7c3a44168c214ef08fd9c869_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OYABT.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\SysWOW64\OYABT.exeC:\windows\system32\OYABT.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PMX.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\windows\system\PMX.exeC:\windows\system\PMX.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TUMRVU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\windows\TUMRVU.exeC:\windows\TUMRVU.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZPDAZXX.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\windows\ZPDAZXX.exeC:\windows\ZPDAZXX.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FPLN.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\windows\system\FPLN.exeC:\windows\system\FPLN.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADQXTZ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\windows\ADQXTZ.exeC:\windows\ADQXTZ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JLSCWXP.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\windows\system\JLSCWXP.exeC:\windows\system\JLSCWXP.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRYZ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\GRYZ.exeC:\windows\GRYZ.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NBGS.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\SysWOW64\NBGS.exeC:\windows\system32\NBGS.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHYH.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\windows\NHYH.exeC:\windows\NHYH.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ICDQDX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\windows\SysWOW64\ICDQDX.exeC:\windows\system32\ICDQDX.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSWTYDX.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\windows\SysWOW64\GSWTYDX.exeC:\windows\system32\GSWTYDX.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SKRMYK.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\windows\SKRMYK.exeC:\windows\SKRMYK.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQX.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\windows\SysWOW64\OQX.exeC:\windows\system32\OQX.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\COXVPF.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\windows\COXVPF.exeC:\windows\COXVPF.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WJC.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\windows\system\WJC.exeC:\windows\system\WJC.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RWHOC.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\windows\SysWOW64\RWHOC.exeC:\windows\system32\RWHOC.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRQ.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\windows\GRQ.exeC:\windows\GRQ.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSSX.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\windows\system\XSSX.exeC:\windows\system\XSSX.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SNXHIX.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\windows\system\SNXHIX.exeC:\windows\system\SNXHIX.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NACYSXI.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\system\NACYSXI.exeC:\windows\system\NACYSXI.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOHH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\windows\SysWOW64\HOHH.exeC:\windows\system32\HOHH.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CBMRFW.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\SysWOW64\CBMRFW.exeC:\windows\system32\CBMRFW.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NTPKNEB.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\NTPKNEB.exeC:\windows\NTPKNEB.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZMZ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\windows\SysWOW64\KZMZ.exeC:\windows\system32\KZMZ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EMRQFN.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\windows\SysWOW64\EMRQFN.exeC:\windows\system32\EMRQFN.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SXVPK.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\windows\SysWOW64\SXVPK.exeC:\windows\system32\SXVPK.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKG.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\windows\BKG.exeC:\windows\BKG.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIGSBN.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\windows\SysWOW64\OIGSBN.exeC:\windows\system32\OIGSBN.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JVK.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\windows\SysWOW64\JVK.exeC:\windows\system32\JVK.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWS.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\windows\SysWOW64\CWS.exeC:\windows\system32\CWS.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CCSB.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\SysWOW64\CCSB.exeC:\windows\system32\CCSB.exe65⤵
- Executes dropped EXE
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPXKH.exe.bat" "66⤵PID:4828
-
C:\windows\SysWOW64\FPXKH.exeC:\windows\system32\FPXKH.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZFMVX.exe.bat" "68⤵PID:2248
-
C:\windows\system\EZFMVX.exeC:\windows\system\EZFMVX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXLGC.exe.bat" "70⤵PID:6072
-
C:\windows\system\OXLGC.exeC:\windows\system\OXLGC.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVMA.exe.bat" "72⤵PID:3968
-
C:\windows\QVMA.exeC:\windows\QVMA.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ULT.exe.bat" "74⤵PID:4036
-
C:\windows\ULT.exeC:\windows\ULT.exe75⤵
- Executes dropped EXE
PID:3492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NGXEA.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4372 -
C:\windows\system\NGXEA.exeC:\windows\system\NGXEA.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GHEPJ.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:4320 -
C:\windows\GHEPJ.exeC:\windows\GHEPJ.exe79⤵
- Executes dropped EXE
PID:4052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QHGUVI.exe.bat" "80⤵PID:3244
-
C:\windows\QHGUVI.exeC:\windows\QHGUVI.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHOI.exe.bat" "82⤵PID:756
-
C:\windows\VHOI.exeC:\windows\VHOI.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZXUQQV.exe.bat" "84⤵PID:4560
-
C:\windows\SysWOW64\ZXUQQV.exeC:\windows\system32\ZXUQQV.exe85⤵
- Executes dropped EXE
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NAYOV.exe.bat" "86⤵PID:5320
-
C:\windows\system\NAYOV.exeC:\windows\system\NAYOV.exe87⤵
- Executes dropped EXE
PID:2912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JGEMCWF.exe.bat" "88⤵PID:3912
-
C:\windows\SysWOW64\JGEMCWF.exeC:\windows\system32\JGEMCWF.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJIP.exe.bat" "90⤵PID:5828
-
C:\windows\CJIP.exeC:\windows\CJIP.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RRJHOHD.exe.bat" "92⤵PID:1896
-
C:\windows\system\RRJHOHD.exeC:\windows\system\RRJHOHD.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CJM.exe.bat" "94⤵PID:4960
-
C:\windows\SysWOW64\CJM.exeC:\windows\system32\CJM.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SMVEIB.exe.bat" "96⤵PID:2228
-
C:\windows\system\SMVEIB.exeC:\windows\system\SMVEIB.exe97⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MAA.exe.bat" "98⤵PID:5956
-
C:\windows\system\MAA.exeC:\windows\system\MAA.exe99⤵
- Executes dropped EXE
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CQBNZX.exe.bat" "100⤵PID:3240
-
C:\windows\CQBNZX.exeC:\windows\CQBNZX.exe101⤵
- Executes dropped EXE
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TDMFOTL.exe.bat" "102⤵PID:4616
-
C:\windows\TDMFOTL.exeC:\windows\TDMFOTL.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GBMQQF.exe.bat" "104⤵PID:3848
-
C:\windows\SysWOW64\GBMQQF.exeC:\windows\system32\GBMQQF.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BORABFJ.exe.bat" "106⤵PID:3840
-
C:\windows\SysWOW64\BORABFJ.exeC:\windows\system32\BORABFJ.exe107⤵
- Executes dropped EXE
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOYNK.exe.bat" "108⤵PID:5572
-
C:\windows\SysWOW64\HOYNK.exeC:\windows\system32\HOYNK.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXNLW.exe.bat" "110⤵PID:1084
-
C:\windows\SysWOW64\YXNLW.exeC:\windows\system32\YXNLW.exe111⤵
- Executes dropped EXE
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RAQO.exe.bat" "112⤵PID:104
-
C:\windows\system\RAQO.exeC:\windows\system\RAQO.exe113⤵
- Executes dropped EXE
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GQROI.exe.bat" "114⤵PID:1696
-
C:\windows\GQROI.exeC:\windows\GQROI.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYY.exe.bat" "116⤵PID:5176
-
C:\windows\SysWOW64\KYY.exeC:\windows\system32\KYY.exe117⤵
- Executes dropped EXE
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QYGCE.exe.bat" "118⤵PID:2684
-
C:\windows\system\QYGCE.exeC:\windows\system\QYGCE.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLKLOWP.exe.bat" "120⤵PID:4332
-
C:\windows\SysWOW64\KLKLOWP.exeC:\windows\system32\KLKLOWP.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-