Analysis
- max time kernel
150s - max time network
109s - platform
windows11-21h2_x64 - resource
win11-20250502-en - resource tags
arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system - submitted
11/05/2026, 12:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_5598e768c970a71f6e75f66c42e13ce7_elex_emotet_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_5598e768c970a71f6e75f66c42e13ce7_elex_emotet_stop.exe
Resource
win11-20250502-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-11_5598e768c970a71f6e75f66c42e13ce7_elex_emotet_stop.exe
- Size 282KB
- Sample260511-p7a1eaat8s
- SHA256 cdcd4fb01a7372dcee49ed8e5a65a6007d29a276e702145ba8b52274446c342b
- MD5 5598e768c970a71f6e75f66c42e13ce7
- SHA1 7deb541ca63e601f91f2284ad0bb386bccbedef0
- SHA512 a5b9d0840d945b1726e68d9ff91b410dcf62c8fa1f9efd87134bc6253f2ce150fc1da3d07752483f6e109fc2c269b57611e057cf1c5fb03d47e8eda9af2f9a9d
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOBkEjiPISUOgW9X+hOGzC/:RLWI09QZb6LOBkmZzcukG2/
- TLSH T193549F1776C28273D5A3037209DAC6E9B73ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2812 DWOIS.exe 3896 LXXCZPD.exe 5084 TKKJKNZ.exe 616 BVSC.exe 4880 BIKRZ.exe 2872 DLUGK.exe 5840 ZJSVZ.exe 5492 ETWBET.exe 2368 DJVEI.exe 5564 CUGU.exe 5500 LCIZUY.exe 4736 LNIBID.exe 1400 WFLTQKQ.exe 5612 JQP.exe 4552 GWN.exe 1568 IMO.exe 5028 RZZJ.exe 4384 EKVID.exe 3856 ASPQ.exe 2948 YIW.exe 2252 ETSZ.exe 3612 CIYK.exe 3728 ZOEZQB.exe 4372 ZTWNSO.exe 4548 MEAUX.exe 3988 XCERJM.exe 3328 SPJ.exe 4664 IAH.exe 5408 FGFWI.exe 1004 FQOPO.exe 5792 BWTMDWB.exe 1344 DTNOB.exe 3380 QWRNHK.exe 3316 WHNTU.exe 5004 XKWBE.exe 1356 FQOPGC.exe 2280 WFVSSO.exe 2880 JQRYXFN.exe 4496 SDC.exe 2664 FGGP.exe 1232 RZJIS.exe 3416 WZQVJ.exe 5928 WFIKKP.exe 4604 NDPNWJF.exe 3080 AFLTBAZ.exe 2968 HAIFDC.exe 4908 TQX.exe 5104 NGQH.exe 5504 ARU.exe 2220 XXSD.exe 4360 CAW.exe 5456 BPVMZ.exe 1832 AIDON.exe 3348 XNJDU.exe 400 QJBOY.exe 3592 PBJIE.exe 2644 ORISQ.exe 1836 QPJNW.exe 3296 VSFTBR.exe 684 ICBSG.exe 1500 YXT.exe 2480 LAPCEMW.exe 576 FYQ.exe 5800 LYYSU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ASPQ.exe.bat EKVID.exe File created C:\windows\SysWOW64\FGFWI.exe.bat IAH.exe File created C:\windows\SysWOW64\LYYSU.exe.bat FYQ.exe File created C:\windows\SysWOW64\SMTUC.exe.bat HTQJ.exe File opened for modification C:\windows\SysWOW64\RVEQO.exe PSUJD.exe File opened for modification C:\windows\SysWOW64\FGFWI.exe IAH.exe File created C:\windows\SysWOW64\FGGP.exe.bat SDC.exe File created C:\windows\SysWOW64\HAIFDC.exe.bat AFLTBAZ.exe File created C:\windows\SysWOW64\FML.exe LZGSQS.exe File created C:\windows\SysWOW64\WQM.exe.bat JNQTUXM.exe File opened for modification C:\windows\SysWOW64\WWV.exe JLRS.exe File opened for modification C:\windows\SysWOW64\TGCIDK.exe ELFWCJT.exe File created C:\windows\SysWOW64\WHOYERB.exe.bat EZGHW.exe File created C:\windows\SysWOW64\FGFWI.exe IAH.exe File created C:\windows\SysWOW64\DTNOB.exe.bat BWTMDWB.exe File created C:\windows\SysWOW64\XNJDU.exe.bat AIDON.exe File created C:\windows\SysWOW64\QJBOY.exe XNJDU.exe File created C:\windows\SysWOW64\BSVGP.exe.bat ZFQ.exe File created C:\windows\SysWOW64\TGCIDK.exe.bat ELFWCJT.exe File created C:\windows\SysWOW64\GDIIAX.exe JXKL.exe File created C:\windows\SysWOW64\OVF.exe.bat DYULRDL.exe File created C:\windows\SysWOW64\KZSAYR.exe TZQVU.exe File opened for modification C:\windows\SysWOW64\JNQTUXM.exe NXW.exe File opened for modification C:\windows\SysWOW64\GDIIAX.exe JXKL.exe File created C:\windows\SysWOW64\EKVID.exe.bat RZZJ.exe File created C:\windows\SysWOW64\ICBSG.exe.bat VSFTBR.exe File created C:\windows\SysWOW64\EKBFIXJ.exe.bat NWRM.exe File opened for modification C:\windows\SysWOW64\BSVGP.exe ZFQ.exe File created C:\windows\SysWOW64\DBFT.exe HLLLU.exe File created C:\windows\SysWOW64\WWV.exe JLRS.exe File opened for modification C:\windows\SysWOW64\RRWOSF.exe AGGYTK.exe File opened for modification C:\windows\SysWOW64\OVF.exe DYULRDL.exe File created C:\windows\SysWOW64\CUGU.exe.bat DJVEI.exe File created C:\windows\SysWOW64\LKT.exe.bat NKLRQJ.exe File created C:\windows\SysWOW64\QBBYMX.exe ALUVAD.exe File created C:\windows\SysWOW64\HNFXC.exe.bat ASAKSI.exe File created C:\windows\SysWOW64\VPX.exe TRW.exe File created C:\windows\SysWOW64\CKUGGUO.exe.bat VPX.exe File created C:\windows\SysWOW64\MBTTNFQ.exe FGW.exe File created C:\windows\SysWOW64\RVEQO.exe.bat PSUJD.exe File created C:\windows\SysWOW64\ICBSG.exe VSFTBR.exe File created C:\windows\SysWOW64\AFLTBAZ.exe.bat NDPNWJF.exe File created C:\windows\SysWOW64\BIKRZ.exe BVSC.exe File created C:\windows\SysWOW64\BIKRZ.exe.bat BVSC.exe File created C:\windows\SysWOW64\DJVEI.exe.bat ETWBET.exe File created C:\windows\SysWOW64\LCIZUY.exe CUGU.exe File created C:\windows\SysWOW64\ASPQ.exe EKVID.exe File created C:\windows\SysWOW64\IAH.exe.bat SPJ.exe File opened for modification C:\windows\SysWOW64\CUGU.exe DJVEI.exe File opened for modification C:\windows\SysWOW64\LCIZUY.exe CUGU.exe File opened for modification C:\windows\SysWOW64\JQP.exe WFLTQKQ.exe File created C:\windows\SysWOW64\EKVID.exe RZZJ.exe File opened for modification C:\windows\SysWOW64\FGGP.exe SDC.exe File opened for modification C:\windows\SysWOW64\XNJDU.exe AIDON.exe File created C:\windows\SysWOW64\HNFXC.exe ASAKSI.exe File created C:\windows\SysWOW64\XDO.exe SASH.exe File created C:\windows\SysWOW64\AFLTBAZ.exe NDPNWJF.exe File created C:\windows\SysWOW64\CUGU.exe DJVEI.exe File opened for modification C:\windows\SysWOW64\ASPQ.exe EKVID.exe File created C:\windows\SysWOW64\ZXUQQV.exe.bat YUTBGH.exe File created C:\windows\SysWOW64\VPX.exe.bat TRW.exe File created C:\windows\SysWOW64\QVQFMM.exe CKUGGUO.exe File created C:\windows\SysWOW64\RVEQO.exe PSUJD.exe File created C:\windows\SysWOW64\DULZJEE.exe BFSFDH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\DBX.exe ZTUHJ.exe File created C:\windows\system\YDDOEYJ.exe.bat HVBA.exe File created C:\windows\system\JMXLNO.exe.bat EKBFIXJ.exe File created C:\windows\IEHGABE.exe.bat RRWOSF.exe File created C:\windows\DYULRDL.exe QVQFMM.exe File created C:\windows\system\ZOEZQB.exe CIYK.exe File created C:\windows\system\KDABQKY.exe DID.exe File opened for modification C:\windows\LAPCEMW.exe YXT.exe File created C:\windows\system\ZRYPQ.exe.bat TGCIDK.exe File opened for modification C:\windows\system\EYAWBQB.exe RVEQO.exe File created C:\windows\PKGYTX.exe.bat QUZV.exe File opened for modification C:\windows\system\ZTWNSO.exe ZOEZQB.exe File created C:\windows\PTXLE.exe.bat HNFXC.exe File created C:\windows\system\VELRTN.exe.bat DBLGPI.exe File created C:\windows\PBJIE.exe.bat QJBOY.exe File created C:\windows\AFVRD.exe.bat HCEOZAL.exe File opened for modification C:\windows\system\QYBEWK.exe BSVGP.exe File created C:\windows\system\KECW.exe OOAGIE.exe File created C:\windows\system\TKKJKNZ.exe LXXCZPD.exe File created C:\windows\BTEQUFC.exe.bat QBBYMX.exe File created C:\windows\ELFWCJT.exe OVY.exe File created C:\windows\system\MTCNWS.exe.bat ZRYPQ.exe File opened for modification C:\windows\KNSM.exe XDO.exe File created C:\windows\system\DAMGCC.exe FAJ.exe File created C:\windows\ZTF.exe.bat EYAWBQB.exe File created C:\windows\WZQVJ.exe RZJIS.exe File created C:\windows\AFVRD.exe HCEOZAL.exe File created C:\windows\WFLTQKQ.exe LNIBID.exe File opened for modification C:\windows\FQOPGC.exe XKWBE.exe File opened for modification C:\windows\ELFWCJT.exe OVY.exe File opened for modification C:\windows\NVHAA.exe NLY.exe File created C:\windows\ATRU.exe.bat TYUIT.exe File created C:\windows\DYULRDL.exe.bat QVQFMM.exe File created C:\windows\system\ZTWNSO.exe ZOEZQB.exe File created C:\windows\AIDON.exe.bat BPVMZ.exe File created C:\windows\system\OVY.exe.bat OPGFOKJ.exe File opened for modification C:\windows\system\PSUJD.exe IXXWBJ.exe File created C:\windows\JVTN.exe DULZJEE.exe File created C:\windows\HTQJ.exe.bat KNSM.exe File created C:\windows\KBI.exe.bat XQMIZUW.exe File opened for modification C:\windows\system\XYJZTD.exe RWFAOMG.exe File created C:\windows\YXT.exe ICBSG.exe File opened for modification C:\windows\WDPSYVP.exe HIGOF.exe File opened for modification C:\windows\system\WFVSSO.exe FQOPGC.exe File opened for modification C:\windows\TQX.exe HAIFDC.exe File created C:\windows\IEHGABE.exe RRWOSF.exe File created C:\windows\JQHR.exe.bat BXZP.exe File created C:\windows\NWVK.exe.bat WHXIW.exe File created C:\windows\JXKL.exe.bat NSE.exe File created C:\windows\GWN.exe.bat JQP.exe File created C:\windows\system\SPJ.exe XCERJM.exe File created C:\windows\SDC.exe JQRYXFN.exe File created C:\windows\ARU.exe NGQH.exe File created C:\windows\system\WJC.exe WVKQYSK.exe File created C:\windows\system\WJC.exe.bat WVKQYSK.exe File opened for modification C:\windows\system\GQWMQO.exe CICWNPB.exe File created C:\windows\system\PSUJD.exe.bat IXXWBJ.exe File opened for modification C:\windows\BPSKY.exe ZRYI.exe File opened for modification C:\windows\PKGYTX.exe QUZV.exe File opened for modification C:\windows\system\CIYK.exe ETSZ.exe File created C:\windows\FQEWQ.exe.bat PTXLE.exe File opened for modification C:\windows\system\OVY.exe OPGFOKJ.exe File created C:\windows\system\ZEYUB.exe.bat MTCNWS.exe File created C:\windows\system\FAJ.exe QFZYJ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 4624 3804 WerFault.exe 77 5836 2812 WerFault.exe 82 3636 3896 WerFault.exe 88 4380 5084 WerFault.exe 93 2220 616 WerFault.exe 98 4928 4880 WerFault.exe 102 6012 2872 WerFault.exe 108 3748 5840 WerFault.exe 113 1316 5492 WerFault.exe 117 5724 2368 WerFault.exe 123 4228 5564 WerFault.exe 128 2792 5500 WerFault.exe 133 4084 4736 WerFault.exe 138 5304 1400 WerFault.exe 143 340 5612 WerFault.exe 148 4544 4552 WerFault.exe 153 688 1568 WerFault.exe 158 2456 5028 WerFault.exe 163 868 4384 WerFault.exe 168 3408 3856 WerFault.exe 173 4692 2948 WerFault.exe 178 1832 2252 WerFault.exe 183 5248 3612 WerFault.exe 188 2216 3728 WerFault.exe 193 668 4372 WerFault.exe 197 2448 4548 WerFault.exe 202 6128 3988 WerFault.exe 208 1448 3328 WerFault.exe 213 5388 4664 WerFault.exe 217 5900 5408 WerFault.exe 223 5412 1004 WerFault.exe 228 2276 5792 WerFault.exe 233 5848 1344 WerFault.exe 237 5368 3380 WerFault.exe 243 4380 3316 WerFault.exe 248 2104 5004 WerFault.exe 253 4376 1356 WerFault.exe 258 5536 2280 WerFault.exe 263 3872 2880 WerFault.exe 268 1112 4496 WerFault.exe 273 5692 2664 WerFault.exe 278 5980 1232 WerFault.exe 282 3404 3416 WerFault.exe 288 3148 5928 WerFault.exe 293 3884 4604 WerFault.exe 298 5224 3080 WerFault.exe 302 1192 2968 WerFault.exe 308 4524 4908 WerFault.exe 313 3636 5104 WerFault.exe 318 2524 5504 WerFault.exe 323 3472 2220 WerFault.exe 328 2740 4360 WerFault.exe 333 1272 5456 WerFault.exe 337 864 1832 WerFault.exe 343 5696 3348 WerFault.exe 348 2052 400 WerFault.exe 353 5656 3592 WerFault.exe 358 2660 2644 WerFault.exe 362 4260 1836 WerFault.exe 368 1828 3296 WerFault.exe 372 2116 684 WerFault.exe 378 4080 1500 WerFault.exe 383 3116 2480 WerFault.exe 388 2504 576 WerFault.exe 393 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LAPCEMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPSKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZGHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFLTBAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZSAYR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELFWCJT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KRZNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TRW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZQVJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZGSQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWZWZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYJZTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVTN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOGCAS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGQLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TYUIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFZYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXMYUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTEQUFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVEQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCIZUY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XCERJM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RRWOSF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIGOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GQWMQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYAWBQB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DULZJEE.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3804 2026-05-11_5598e768c970a71f6e75f66c42e13ce7_elex_emotet_stop.exe 3804 2026-05-11_5598e768c970a71f6e75f66c42e13ce7_elex_emotet_stop.exe 2812 DWOIS.exe 2812 DWOIS.exe 3896 LXXCZPD.exe 3896 LXXCZPD.exe 5084 TKKJKNZ.exe 5084 TKKJKNZ.exe 616 BVSC.exe 616 BVSC.exe 4880 BIKRZ.exe 4880 BIKRZ.exe 2872 DLUGK.exe 2872 DLUGK.exe 5840 ZJSVZ.exe 5840 ZJSVZ.exe 5492 ETWBET.exe 5492 ETWBET.exe 2368 DJVEI.exe 2368 DJVEI.exe 5564 CUGU.exe 5564 CUGU.exe 5500 LCIZUY.exe 5500 LCIZUY.exe 4736 LNIBID.exe 4736 LNIBID.exe 1400 WFLTQKQ.exe 1400 WFLTQKQ.exe 5612 JQP.exe 5612 JQP.exe 4552 GWN.exe 4552 GWN.exe 1568 IMO.exe 1568 IMO.exe 5028 RZZJ.exe 5028 RZZJ.exe 4384 EKVID.exe 4384 EKVID.exe 3856 ASPQ.exe 3856 ASPQ.exe 2948 YIW.exe 2948 YIW.exe 2252 ETSZ.exe 2252 ETSZ.exe 3612 CIYK.exe 3612 CIYK.exe 3728 ZOEZQB.exe 3728 ZOEZQB.exe 4372 ZTWNSO.exe 4372 ZTWNSO.exe 4548 MEAUX.exe 4548 MEAUX.exe 3988 XCERJM.exe 3988 XCERJM.exe 3328 SPJ.exe 3328 SPJ.exe 4664 IAH.exe 4664 IAH.exe 5408 FGFWI.exe 5408 FGFWI.exe 1004 FQOPO.exe 1004 FQOPO.exe 5792 BWTMDWB.exe 5792 BWTMDWB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3804 2026-05-11_5598e768c970a71f6e75f66c42e13ce7_elex_emotet_stop.exe 3804 2026-05-11_5598e768c970a71f6e75f66c42e13ce7_elex_emotet_stop.exe 2812 DWOIS.exe 2812 DWOIS.exe 3896 LXXCZPD.exe 3896 LXXCZPD.exe 5084 TKKJKNZ.exe 5084 TKKJKNZ.exe 616 BVSC.exe 616 BVSC.exe 4880 BIKRZ.exe 4880 BIKRZ.exe 2872 DLUGK.exe 2872 DLUGK.exe 5840 ZJSVZ.exe 5840 ZJSVZ.exe 5492 ETWBET.exe 5492 ETWBET.exe 2368 DJVEI.exe 2368 DJVEI.exe 5564 CUGU.exe 5564 CUGU.exe 5500 LCIZUY.exe 5500 LCIZUY.exe 4736 LNIBID.exe 4736 LNIBID.exe 1400 WFLTQKQ.exe 1400 WFLTQKQ.exe 5612 JQP.exe 5612 JQP.exe 4552 GWN.exe 4552 GWN.exe 1568 IMO.exe 1568 IMO.exe 5028 RZZJ.exe 5028 RZZJ.exe 4384 EKVID.exe 4384 EKVID.exe 3856 ASPQ.exe 3856 ASPQ.exe 2948 YIW.exe 2948 YIW.exe 2252 ETSZ.exe 2252 ETSZ.exe 3612 CIYK.exe 3612 CIYK.exe 3728 ZOEZQB.exe 3728 ZOEZQB.exe 4372 ZTWNSO.exe 4372 ZTWNSO.exe 4548 MEAUX.exe 4548 MEAUX.exe 3988 XCERJM.exe 3988 XCERJM.exe 3328 SPJ.exe 3328 SPJ.exe 4664 IAH.exe 4664 IAH.exe 5408 FGFWI.exe 5408 FGFWI.exe 1004 FQOPO.exe 1004 FQOPO.exe 5792 BWTMDWB.exe 5792 BWTMDWB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3804 wrote to memory of 5580 3804 2026-05-11_5598e768c970a71f6e75f66c42e13ce7_elex_emotet_stop.exe 78 PID 5580 wrote to memory of 2812 5580 cmd.exe 82 PID 2812 wrote to memory of 5152 2812 DWOIS.exe 84 PID 5152 wrote to memory of 3896 5152 cmd.exe 88 PID 3896 wrote to memory of 5096 3896 LXXCZPD.exe 89 PID 5096 wrote to memory of 5084 5096 cmd.exe 93 PID 5084 wrote to memory of 3456 5084 TKKJKNZ.exe 94 PID 3456 wrote to memory of 616 3456 cmd.exe 98 PID 616 wrote to memory of 896 616 BVSC.exe 99 PID 896 wrote to memory of 4880 896 cmd.exe 102 PID 4880 wrote to memory of 5308 4880 BIKRZ.exe 104 PID 5308 wrote to memory of 2872 5308 cmd.exe 108 PID 2872 wrote to memory of 2784 2872 DLUGK.exe 109 PID 2784 wrote to memory of 5840 2784 cmd.exe 113 PID 5840 wrote to memory of 5532 5840 ZJSVZ.exe 114 PID 5532 wrote to memory of 5492 5532 cmd.exe 117 PID 5492 wrote to memory of 2260 5492 ETWBET.exe 119 PID 2260 wrote to memory of 2368 2260 cmd.exe 123 PID 2368 wrote to memory of 4008 2368 DJVEI.exe 124 PID 4008 wrote to memory of 5564 4008 cmd.exe 128 PID 5564 wrote to memory of 2188 5564 CUGU.exe 129 PID 2188 wrote to memory of 5500 2188 cmd.exe 133 PID 5500 wrote to memory of 2788 5500 LCIZUY.exe 134 PID 2788 wrote to memory of 4736 2788 cmd.exe 138 PID 4736 wrote to memory of 3904 4736 LNIBID.exe 139 PID 3904 wrote to memory of 1400 3904 cmd.exe 143 PID 1400 wrote to memory of 2024 1400 WFLTQKQ.exe 144 PID 2024 wrote to memory of 5612 2024 cmd.exe 148 PID 5612 wrote to memory of 2840 5612 JQP.exe 149 PID 2840 wrote to memory of 4552 2840 cmd.exe 153 PID 4552 wrote to memory of 4204 4552 GWN.exe 154 PID 4204 wrote to memory of 1568 4204 cmd.exe 158 PID 1568 wrote to memory of 4624 1568 IMO.exe 159 PID 4624 wrote to memory of 5028 4624 cmd.exe 163 PID 5028 wrote to memory of 3344 5028 RZZJ.exe 164 PID 3344 wrote to memory of 4384 3344 cmd.exe 168 PID 4384 wrote to memory of 2344 4384 EKVID.exe 169 PID 2344 wrote to memory of 3856 2344 cmd.exe 173 PID 3856 wrote to memory of 4120 3856 ASPQ.exe 174 PID 4120 wrote to memory of 2948 4120 cmd.exe 178 PID 2948 wrote to memory of 3428 2948 YIW.exe 179 PID 3428 wrote to memory of 2252 3428 cmd.exe 183 PID 2252 wrote to memory of 2268 2252 ETSZ.exe 184 PID 2268 wrote to memory of 3612 2268 cmd.exe 188 PID 3612 wrote to memory of 1616 3612 CIYK.exe 189 PID 1616 wrote to memory of 3728 1616 cmd.exe 193 PID 3728 wrote to memory of 5844 3728 ZOEZQB.exe 194 PID 5844 wrote to memory of 4372 5844 cmd.exe 197 PID 4372 wrote to memory of 2528 4372 ZTWNSO.exe 199 PID 2528 wrote to memory of 4548 2528 cmd.exe 202 PID 4548 wrote to memory of 4404 4548 MEAUX.exe 204 PID 4404 wrote to memory of 3988 4404 cmd.exe 208 PID 3988 wrote to memory of 5572 3988 XCERJM.exe 209 PID 5572 wrote to memory of 3328 5572 cmd.exe 213 PID 3328 wrote to memory of 1428 3328 SPJ.exe 214 PID 1428 wrote to memory of 4664 1428 cmd.exe 217 PID 4664 wrote to memory of 4084 4664 IAH.exe 219 PID 4084 wrote to memory of 5408 4084 cmd.exe 223 PID 5408 wrote to memory of 2688 5408 FGFWI.exe 224 PID 2688 wrote to memory of 1004 2688 cmd.exe 228 PID 1004 wrote to memory of 4780 1004 FQOPO.exe 229 PID 4780 wrote to memory of 5792 4780 cmd.exe 233 PID 5792 wrote to memory of 4032 5792 BWTMDWB.exe 234 PID 4032 wrote to memory of 1344 4032 cmd.exe 237
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_5598e768c970a71f6e75f66c42e13ce7_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5598e768c970a71f6e75f66c42e13ce7_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWOIS.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\SysWOW64\DWOIS.exeC:\windows\system32\DWOIS.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LXXCZPD.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\windows\LXXCZPD.exeC:\windows\LXXCZPD.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TKKJKNZ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\windows\system\TKKJKNZ.exeC:\windows\system\TKKJKNZ.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVSC.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\windows\SysWOW64\BVSC.exeC:\windows\system32\BVSC.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BIKRZ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\windows\SysWOW64\BIKRZ.exeC:\windows\system32\BIKRZ.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DLUGK.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\windows\DLUGK.exeC:\windows\DLUGK.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJSVZ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\windows\ZJSVZ.exeC:\windows\ZJSVZ.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ETWBET.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\SysWOW64\ETWBET.exeC:\windows\system32\ETWBET.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DJVEI.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\windows\SysWOW64\DJVEI.exeC:\windows\system32\DJVEI.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CUGU.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\windows\SysWOW64\CUGU.exeC:\windows\system32\CUGU.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCIZUY.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\windows\SysWOW64\LCIZUY.exeC:\windows\system32\LCIZUY.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LNIBID.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\windows\LNIBID.exeC:\windows\LNIBID.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFLTQKQ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\windows\WFLTQKQ.exeC:\windows\WFLTQKQ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JQP.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\windows\SysWOW64\JQP.exeC:\windows\system32\JQP.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWN.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\windows\GWN.exeC:\windows\GWN.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IMO.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\windows\SysWOW64\IMO.exeC:\windows\system32\IMO.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RZZJ.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\system\RZZJ.exeC:\windows\system\RZZJ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EKVID.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\windows\SysWOW64\EKVID.exeC:\windows\system32\EKVID.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASPQ.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\windows\SysWOW64\ASPQ.exeC:\windows\system32\ASPQ.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YIW.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\windows\system\YIW.exeC:\windows\system\YIW.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ETSZ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\windows\system\ETSZ.exeC:\windows\system\ETSZ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CIYK.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\windows\system\CIYK.exeC:\windows\system\CIYK.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOEZQB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\windows\system\ZOEZQB.exeC:\windows\system\ZOEZQB.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZTWNSO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\system\ZTWNSO.exeC:\windows\system\ZTWNSO.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEAUX.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\windows\system\MEAUX.exeC:\windows\system\MEAUX.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XCERJM.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\windows\XCERJM.exeC:\windows\XCERJM.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPJ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\windows\system\SPJ.exeC:\windows\system\SPJ.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAH.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\SysWOW64\IAH.exeC:\windows\system32\IAH.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGFWI.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\windows\SysWOW64\FGFWI.exeC:\windows\system32\FGFWI.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQOPO.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\windows\system\FQOPO.exeC:\windows\system\FQOPO.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BWTMDWB.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\windows\system\BWTMDWB.exeC:\windows\system\BWTMDWB.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DTNOB.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\windows\SysWOW64\DTNOB.exeC:\windows\system32\DTNOB.exe65⤵
- Executes dropped EXE
PID:1344 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QWRNHK.exe.bat" "66⤵PID:5480
-
C:\windows\system\QWRNHK.exeC:\windows\system\QWRNHK.exe67⤵
- Executes dropped EXE
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHNTU.exe.bat" "68⤵PID:5212
-
C:\windows\SysWOW64\WHNTU.exeC:\windows\system32\WHNTU.exe69⤵
- Executes dropped EXE
PID:3316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XKWBE.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1244 -
C:\windows\XKWBE.exeC:\windows\XKWBE.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQOPGC.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5788 -
C:\windows\FQOPGC.exeC:\windows\FQOPGC.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFVSSO.exe.bat" "74⤵PID:3088
-
C:\windows\system\WFVSSO.exeC:\windows\system\WFVSSO.exe75⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JQRYXFN.exe.bat" "76⤵PID:1564
-
C:\windows\SysWOW64\JQRYXFN.exeC:\windows\system32\JQRYXFN.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SDC.exe.bat" "78⤵PID:5708
-
C:\windows\SDC.exeC:\windows\SDC.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGGP.exe.bat" "80⤵PID:5804
-
C:\windows\SysWOW64\FGGP.exeC:\windows\system32\FGGP.exe81⤵
- Executes dropped EXE
PID:2664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RZJIS.exe.bat" "82⤵PID:4892
-
C:\windows\RZJIS.exeC:\windows\RZJIS.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WZQVJ.exe.bat" "84⤵PID:2028
-
C:\windows\WZQVJ.exeC:\windows\WZQVJ.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WFIKKP.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3520 -
C:\windows\WFIKKP.exeC:\windows\WFIKKP.exe87⤵
- Executes dropped EXE
PID:5928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NDPNWJF.exe.bat" "88⤵PID:2620
-
C:\windows\system\NDPNWJF.exeC:\windows\system\NDPNWJF.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AFLTBAZ.exe.bat" "90⤵PID:6132
-
C:\windows\SysWOW64\AFLTBAZ.exeC:\windows\system32\AFLTBAZ.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HAIFDC.exe.bat" "92⤵PID:2864
-
C:\windows\SysWOW64\HAIFDC.exeC:\windows\system32\HAIFDC.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQX.exe.bat" "94⤵PID:3888
-
C:\windows\TQX.exeC:\windows\TQX.exe95⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGQH.exe.bat" "96⤵PID:4304
-
C:\windows\SysWOW64\NGQH.exeC:\windows\system32\NGQH.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ARU.exe.bat" "98⤵PID:5324
-
C:\windows\ARU.exeC:\windows\ARU.exe99⤵
- Executes dropped EXE
PID:5504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XXSD.exe.bat" "100⤵PID:3136
-
C:\windows\XXSD.exeC:\windows\XXSD.exe101⤵
- Executes dropped EXE
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CAW.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:948 -
C:\windows\system\CAW.exeC:\windows\system\CAW.exe103⤵
- Executes dropped EXE
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPVMZ.exe.bat" "104⤵PID:5136
-
C:\windows\system\BPVMZ.exeC:\windows\system\BPVMZ.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AIDON.exe.bat" "106⤵PID:4868
-
C:\windows\AIDON.exeC:\windows\AIDON.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNJDU.exe.bat" "108⤵PID:1572
-
C:\windows\SysWOW64\XNJDU.exeC:\windows\system32\XNJDU.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QJBOY.exe.bat" "110⤵PID:5188
-
C:\windows\SysWOW64\QJBOY.exeC:\windows\system32\QJBOY.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PBJIE.exe.bat" "112⤵PID:2296
-
C:\windows\PBJIE.exeC:\windows\PBJIE.exe113⤵
- Executes dropped EXE
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ORISQ.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:1972 -
C:\windows\ORISQ.exeC:\windows\ORISQ.exe115⤵
- Executes dropped EXE
PID:2644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPJNW.exe.bat" "116⤵PID:5516
-
C:\windows\system\QPJNW.exeC:\windows\system\QPJNW.exe117⤵
- Executes dropped EXE
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSFTBR.exe.bat" "118⤵PID:2792
-
C:\windows\system\VSFTBR.exeC:\windows\system\VSFTBR.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ICBSG.exe.bat" "120⤵PID:4872
-
C:\windows\SysWOW64\ICBSG.exeC:\windows\system32\ICBSG.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-