Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 17:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-22_4a12c52294684b4c004fd0e0814261ab_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_4a12c52294684b4c004fd0e0814261ab_elex_emotet_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-22_4a12c52294684b4c004fd0e0814261ab_elex_emotet_stop.exe
- Size 208KB
- Sample260522-we853acs2p
- SHA256 00c4befcfeb56ac52d08ada87bffb6f852cda5566af57e1f9020934aeee44119
- MD5 4a12c52294684b4c004fd0e0814261ab
- SHA1 463987aaa016b690fcab7f5b4eeb153f7e6ddb62
- SHA512 e9537df755392686b2cb345d98432e0e614ce6edaa9d7c72117dd8d5daf19203bb4d628ba07f6be8ea5d7db323c2be741a2355da658e30cbf609a8ef80cf27de
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfw4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOYQEjK
- TLSH T1D4247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E315A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4552 ZFGXKP.exe 656 FBKXP.exe 2056 SDOW.exe 928 UGQLN.exe 4756 YWSTQ.exe 1772 OMRWU.exe 4956 VHOI.exe 2108 JSS.exe 4868 OVON.exe 4440 KAUK.exe 4492 YDQQI.exe 4532 FYVD.exe 1980 NRVW.exe 2840 XMVICWM.exe 3104 HPWPNKN.exe 4204 BNXJTHV.exe 2820 XSVG.exe 4952 FNA.exe 4728 UIXEMLN.exe 3504 UTGGAXC.exe 992 OOYXB.exe 3460 DMWUINS.exe 2540 QXASNF.exe 4228 GMZDZY.exe 3048 FCGGLKJ.exe 1916 QVBZLZ.exe 4092 MLDHOYU.exe 3332 ZOZFBP.exe 1628 ZGIHHT.exe 944 YWG.exe 2012 UCMHAXM.exe 2920 LNL.exe 1568 USVWP.exe 5092 YIPE.exe 2072 EIXSJH.exe 4760 LDUEL.exe 4328 XRM.exe 4020 HTW.exe 1376 MWSJKCB.exe 1696 QMMRNB.exe 4148 QXV.exe 2588 SVOMZC.exe 4676 FYS.exe 5044 LIORRKI.exe 4064 HOU.exe 3652 GEB.exe 4468 ARXJN.exe 912 AKGCB.exe 3152 HFLO.exe 1300 JVEQ.exe 4480 NLY.exe 792 TLGMD.exe 3448 JBNPH.exe 3020 EOSGRCT.exe 4684 CERJDO.exe 4788 PRJAEC.exe 4856 AKMTM.exe 4448 ACN.exe 644 ZSTXEII.exe 2220 AQN.exe 4924 RGTCOQX.exe 4768 XGB.exe 2816 BOV.exe 4168 VKAHK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\FYVD.exe YDQQI.exe File opened for modification C:\windows\SysWOW64\UTGGAXC.exe UIXEMLN.exe File opened for modification C:\windows\SysWOW64\JVEQ.exe HFLO.exe File created C:\windows\SysWOW64\ZDGZ.exe.bat EPBQTWW.exe File created C:\windows\SysWOW64\HOC.exe QYVXJLY.exe File opened for modification C:\windows\SysWOW64\TZWWRVS.exe OWA.exe File opened for modification C:\windows\SysWOW64\ULYK.exe NQBYQ.exe File created C:\windows\SysWOW64\LSRM.exe YHN.exe File opened for modification C:\windows\SysWOW64\HFLO.exe AKGCB.exe File created C:\windows\SysWOW64\JVEQ.exe HFLO.exe File opened for modification C:\windows\SysWOW64\FSRTQM.exe UXAQMI.exe File opened for modification C:\windows\SysWOW64\IDYHN.exe LFTKGO.exe File created C:\windows\SysWOW64\FNA.exe.bat XSVG.exe File created C:\windows\SysWOW64\MLDHOYU.exe.bat QVBZLZ.exe File created C:\windows\SysWOW64\USVWP.exe LNL.exe File opened for modification C:\windows\SysWOW64\AKGCB.exe ARXJN.exe File opened for modification C:\windows\SysWOW64\VXODI.exe IMKFVR.exe File created C:\windows\SysWOW64\JMVCTUV.exe HOC.exe File opened for modification C:\windows\SysWOW64\QEVMO.exe AJYAEY.exe File created C:\windows\SysWOW64\XNHEMO.exe QSKSKNR.exe File created C:\windows\SysWOW64\HEGZAZ.exe NONXTC.exe File created C:\windows\SysWOW64\HEGZAZ.exe.bat NONXTC.exe File opened for modification C:\windows\SysWOW64\HOC.exe QYVXJLY.exe File created C:\windows\SysWOW64\KOGQB.exe TQZ.exe File created C:\windows\SysWOW64\NRVW.exe.bat FYVD.exe File created C:\windows\SysWOW64\FNA.exe XSVG.exe File opened for modification C:\windows\SysWOW64\XDTE.exe VARX.exe File created C:\windows\SysWOW64\DBGYIK.exe.bat NLAVEQ.exe File opened for modification C:\windows\SysWOW64\QCZU.exe YGZQXU.exe File created C:\windows\SysWOW64\XFXCVC.exe ZEC.exe File opened for modification C:\windows\SysWOW64\CZTYH.exe ZZB.exe File created C:\windows\SysWOW64\BJXXPK.exe WGBQJ.exe File opened for modification C:\windows\SysWOW64\FBKXP.exe ZFGXKP.exe File created C:\windows\SysWOW64\NRVW.exe FYVD.exe File created C:\windows\SysWOW64\TKQ.exe XFK.exe File created C:\windows\SysWOW64\HXMD.exe.bat OUMA.exe File created C:\windows\SysWOW64\JRSASY.exe.bat ZOJ.exe File opened for modification C:\windows\SysWOW64\JXN.exe HUD.exe File opened for modification C:\windows\SysWOW64\GVTQRX.exe BKPRMGB.exe File created C:\windows\SysWOW64\GVTQRX.exe.bat BKPRMGB.exe File created C:\windows\SysWOW64\PRJAEC.exe CERJDO.exe File created C:\windows\SysWOW64\XNHEMO.exe.bat QSKSKNR.exe File created C:\windows\SysWOW64\FOOXLKX.exe.bat UVT.exe File created C:\windows\SysWOW64\ULYK.exe NQBYQ.exe File created C:\windows\SysWOW64\ZVQXC.exe XFXCVC.exe File created C:\windows\SysWOW64\FYVD.exe.bat YDQQI.exe File created C:\windows\SysWOW64\XSVG.exe BNXJTHV.exe File created C:\windows\SysWOW64\JXN.exe.bat HUD.exe File created C:\windows\SysWOW64\KYLLZ.exe.bat XNHEMO.exe File opened for modification C:\windows\SysWOW64\WEUA.exe FOOXLKX.exe File created C:\windows\SysWOW64\USVWP.exe.bat LNL.exe File created C:\windows\SysWOW64\VKAHK.exe BOV.exe File opened for modification C:\windows\SysWOW64\TKQ.exe XFK.exe File created C:\windows\SysWOW64\MMK.exe HMD.exe File created C:\windows\SysWOW64\GVTQRX.exe BKPRMGB.exe File opened for modification C:\windows\SysWOW64\ZVQXC.exe XFXCVC.exe File opened for modification C:\windows\SysWOW64\UGQLN.exe SDOW.exe File opened for modification C:\windows\SysWOW64\FYVD.exe YDQQI.exe File created C:\windows\SysWOW64\BNXJTHV.exe HPWPNKN.exe File opened for modification C:\windows\SysWOW64\FNA.exe XSVG.exe File opened for modification C:\windows\SysWOW64\MLDHOYU.exe QVBZLZ.exe File created C:\windows\SysWOW64\XSCDFS.exe.bat HCDATY.exe File created C:\windows\SysWOW64\UCCDS.exe XXW.exe File created C:\windows\SysWOW64\WEUA.exe FOOXLKX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\TBHKSOO.exe.bat OYD.exe File created C:\windows\system\UVT.exe.bat XQNHWT.exe File opened for modification C:\windows\system\UIXEMLN.exe FNA.exe File created C:\windows\QXASNF.exe.bat DMWUINS.exe File opened for modification C:\windows\BAWT.exe XSCDFS.exe File created C:\windows\system\HLDGYLG.exe JVWVURQ.exe File created C:\windows\MHCODC.exe KFTHKN.exe File created C:\windows\DMWUINS.exe.bat OOYXB.exe File opened for modification C:\windows\YWG.exe ZGIHHT.exe File opened for modification C:\windows\HTW.exe XRM.exe File created C:\windows\XGB.exe RGTCOQX.exe File created C:\windows\system\WXOPTB.exe.bat YHPFPP.exe File created C:\windows\OMRWU.exe YWSTQ.exe File opened for modification C:\windows\KDCAMZD.exe IATTCLJ.exe File created C:\windows\system\HUYZV.exe BUQ.exe File created C:\windows\system\UBIKY.exe.bat ZOXPJ.exe File created C:\windows\WZBE.exe.bat UBIKY.exe File opened for modification C:\windows\SSEL.exe DMYN.exe File created C:\windows\SSEL.exe.bat DMYN.exe File created C:\windows\UHQQQBA.exe.bat MMK.exe File created C:\windows\system\YZYZQ.exe.bat KOUALL.exe File opened for modification C:\windows\ZOXPJ.exe VYDHGBO.exe File created C:\windows\system\WGBQJ.exe.bat DYTAB.exe File created C:\windows\BAWT.exe.bat XSCDFS.exe File created C:\windows\system\UXAQMI.exe SKVG.exe File created C:\windows\BISOGSF.exe.bat WXOPTB.exe File created C:\windows\system\FCGGLKJ.exe.bat GMZDZY.exe File opened for modification C:\windows\system\FYS.exe SVOMZC.exe File created C:\windows\XWNO.exe ZGO.exe File opened for modification C:\windows\system\NLAVEQ.exe FSRTQM.exe File created C:\windows\system\OORYZRF.exe.bat HTU.exe File created C:\windows\system\WGBQJ.exe DYTAB.exe File created C:\windows\IIH.exe.bat VFLU.exe File created C:\windows\system\HLDGYLG.exe.bat JVWVURQ.exe File created C:\windows\system\IILLJMI.exe SNO.exe File opened for modification C:\windows\DYULRDL.exe KDCAMZD.exe File created C:\windows\PCVCEI.exe KZZWYRF.exe File created C:\windows\KFTHKN.exe.bat DKWUIMY.exe File opened for modification C:\windows\QXASNF.exe DMWUINS.exe File opened for modification C:\windows\ACN.exe AKMTM.exe File created C:\windows\QMMRNB.exe MWSJKCB.exe File opened for modification C:\windows\system\ARXJN.exe GEB.exe File created C:\windows\PCVCEI.exe.bat KZZWYRF.exe File created C:\windows\LYP.exe.bat SVPJS.exe File opened for modification C:\windows\MBQ.exe LYP.exe File created C:\windows\YDQQI.exe KAUK.exe File created C:\windows\system\AKMTM.exe.bat PRJAEC.exe File created C:\windows\system\FBV.exe.bat DYULRDL.exe File opened for modification C:\windows\system\BKPRMGB.exe UPS.exe File created C:\windows\WZBE.exe UBIKY.exe File created C:\windows\system\FYDNDX.exe.bat OIWKRE.exe File created C:\windows\VAYSFXX.exe.bat SSEL.exe File created C:\windows\system\KAUK.exe OVON.exe File created C:\windows\system\GMZDZY.exe.bat QXASNF.exe File created C:\windows\NLY.exe JVEQ.exe File created C:\windows\TLGMD.exe NLY.exe File created C:\windows\system\JBNPH.exe.bat TLGMD.exe File created C:\windows\system\IMKFVR.exe.bat XOZZJ.exe File created C:\windows\FZQJ.exe.bat MWZG.exe File created C:\windows\system\FFFPGV.exe WFDKD.exe File created C:\windows\system\JBNPH.exe TLGMD.exe File created C:\windows\MGR.exe.bat QQXE.exe File created C:\windows\OWA.exe KOGQB.exe File created C:\windows\system\DMYN.exe.bat LEYXF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 3188 756 WerFault.exe 79 3360 4552 WerFault.exe 84 4920 656 WerFault.exe 90 4976 2056 WerFault.exe 95 2648 928 WerFault.exe 100 2828 4756 WerFault.exe 105 4768 1772 WerFault.exe 110 2020 4956 WerFault.exe 115 2312 2108 WerFault.exe 119 4784 4868 WerFault.exe 125 2120 4440 WerFault.exe 130 4888 4492 WerFault.exe 135 1272 4532 WerFault.exe 139 1740 1980 WerFault.exe 144 3636 2840 WerFault.exe 150 5008 3104 WerFault.exe 155 552 4204 WerFault.exe 159 4664 2820 WerFault.exe 164 1204 4952 WerFault.exe 169 3248 4728 WerFault.exe 175 2748 3504 WerFault.exe 179 2208 992 WerFault.exe 185 1720 3460 WerFault.exe 190 1956 2540 WerFault.exe 195 2616 4228 WerFault.exe 200 4144 3048 WerFault.exe 205 3216 1916 WerFault.exe 209 3548 4092 WerFault.exe 215 2232 3332 WerFault.exe 219 1536 1628 WerFault.exe 225 4520 944 WerFault.exe 229 3656 2012 WerFault.exe 235 4072 2920 WerFault.exe 240 2876 1568 WerFault.exe 245 3400 5092 WerFault.exe 250 3864 2072 WerFault.exe 255 2544 4760 WerFault.exe 259 3384 4328 WerFault.exe 264 1992 4020 WerFault.exe 270 1004 1376 WerFault.exe 275 2064 1696 WerFault.exe 280 3588 4148 WerFault.exe 285 3804 2588 WerFault.exe 290 1780 4676 WerFault.exe 295 464 5044 WerFault.exe 300 2816 4064 WerFault.exe 305 4800 3652 WerFault.exe 310 2232 4468 WerFault.exe 315 1004 912 WerFault.exe 319 2064 3152 WerFault.exe 325 4044 1300 WerFault.exe 330 2128 4480 WerFault.exe 335 3756 792 WerFault.exe 340 4412 3448 WerFault.exe 345 864 3020 WerFault.exe 350 3520 4684 WerFault.exe 355 2748 4788 WerFault.exe 359 1044 4856 WerFault.exe 365 4876 4448 WerFault.exe 370 4248 644 WerFault.exe 375 2848 2220 WerFault.exe 379 3124 4924 WerFault.exe 385 3272 4768 WerFault.exe 390 1216 2816 WerFault.exe 395 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBOCVTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DNZBJZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYAAOZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBKXP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWSJKCB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZDGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCCDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMMRNB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRJAEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HCDATY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZWWRVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KGAOYM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYTAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UGQLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVON.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QVBZLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRSASY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZTYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OORYZRF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAWT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCVCEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZVQXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXOPTB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UHQQQBA.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 756 2026-05-22_4a12c52294684b4c004fd0e0814261ab_elex_emotet_stop.exe 756 2026-05-22_4a12c52294684b4c004fd0e0814261ab_elex_emotet_stop.exe 4552 ZFGXKP.exe 4552 ZFGXKP.exe 656 FBKXP.exe 656 FBKXP.exe 2056 SDOW.exe 2056 SDOW.exe 928 UGQLN.exe 928 UGQLN.exe 4756 YWSTQ.exe 4756 YWSTQ.exe 1772 OMRWU.exe 1772 OMRWU.exe 4956 VHOI.exe 4956 VHOI.exe 2108 JSS.exe 2108 JSS.exe 4868 OVON.exe 4868 OVON.exe 4440 KAUK.exe 4440 KAUK.exe 4492 YDQQI.exe 4492 YDQQI.exe 4532 FYVD.exe 4532 FYVD.exe 1980 NRVW.exe 1980 NRVW.exe 2840 XMVICWM.exe 2840 XMVICWM.exe 3104 HPWPNKN.exe 3104 HPWPNKN.exe 4204 BNXJTHV.exe 4204 BNXJTHV.exe 2820 XSVG.exe 2820 XSVG.exe 4952 FNA.exe 4952 FNA.exe 4728 UIXEMLN.exe 4728 UIXEMLN.exe 3504 UTGGAXC.exe 3504 UTGGAXC.exe 992 OOYXB.exe 992 OOYXB.exe 3460 DMWUINS.exe 3460 DMWUINS.exe 2540 QXASNF.exe 2540 QXASNF.exe 4228 GMZDZY.exe 4228 GMZDZY.exe 3048 FCGGLKJ.exe 3048 FCGGLKJ.exe 1916 QVBZLZ.exe 1916 QVBZLZ.exe 4092 MLDHOYU.exe 4092 MLDHOYU.exe 3332 ZOZFBP.exe 3332 ZOZFBP.exe 1628 ZGIHHT.exe 1628 ZGIHHT.exe 944 YWG.exe 944 YWG.exe 2012 UCMHAXM.exe 2012 UCMHAXM.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 756 2026-05-22_4a12c52294684b4c004fd0e0814261ab_elex_emotet_stop.exe 756 2026-05-22_4a12c52294684b4c004fd0e0814261ab_elex_emotet_stop.exe 4552 ZFGXKP.exe 4552 ZFGXKP.exe 656 FBKXP.exe 656 FBKXP.exe 2056 SDOW.exe 2056 SDOW.exe 928 UGQLN.exe 928 UGQLN.exe 4756 YWSTQ.exe 4756 YWSTQ.exe 1772 OMRWU.exe 1772 OMRWU.exe 4956 VHOI.exe 4956 VHOI.exe 2108 JSS.exe 2108 JSS.exe 4868 OVON.exe 4868 OVON.exe 4440 KAUK.exe 4440 KAUK.exe 4492 YDQQI.exe 4492 YDQQI.exe 4532 FYVD.exe 4532 FYVD.exe 1980 NRVW.exe 1980 NRVW.exe 2840 XMVICWM.exe 2840 XMVICWM.exe 3104 HPWPNKN.exe 3104 HPWPNKN.exe 4204 BNXJTHV.exe 4204 BNXJTHV.exe 2820 XSVG.exe 2820 XSVG.exe 4952 FNA.exe 4952 FNA.exe 4728 UIXEMLN.exe 4728 UIXEMLN.exe 3504 UTGGAXC.exe 3504 UTGGAXC.exe 992 OOYXB.exe 992 OOYXB.exe 3460 DMWUINS.exe 3460 DMWUINS.exe 2540 QXASNF.exe 2540 QXASNF.exe 4228 GMZDZY.exe 4228 GMZDZY.exe 3048 FCGGLKJ.exe 3048 FCGGLKJ.exe 1916 QVBZLZ.exe 1916 QVBZLZ.exe 4092 MLDHOYU.exe 4092 MLDHOYU.exe 3332 ZOZFBP.exe 3332 ZOZFBP.exe 1628 ZGIHHT.exe 1628 ZGIHHT.exe 944 YWG.exe 944 YWG.exe 2012 UCMHAXM.exe 2012 UCMHAXM.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 756 wrote to memory of 3744 756 2026-05-22_4a12c52294684b4c004fd0e0814261ab_elex_emotet_stop.exe 80 PID 3744 wrote to memory of 4552 3744 cmd.exe 84 PID 4552 wrote to memory of 724 4552 ZFGXKP.exe 86 PID 724 wrote to memory of 656 724 cmd.exe 90 PID 656 wrote to memory of 1760 656 FBKXP.exe 91 PID 1760 wrote to memory of 2056 1760 cmd.exe 95 PID 2056 wrote to memory of 2928 2056 SDOW.exe 96 PID 2928 wrote to memory of 928 2928 cmd.exe 100 PID 928 wrote to memory of 4040 928 UGQLN.exe 101 PID 4040 wrote to memory of 4756 4040 cmd.exe 105 PID 4756 wrote to memory of 1984 4756 YWSTQ.exe 106 PID 1984 wrote to memory of 1772 1984 cmd.exe 110 PID 1772 wrote to memory of 3336 1772 OMRWU.exe 111 PID 3336 wrote to memory of 4956 3336 cmd.exe 115 PID 4956 wrote to memory of 2724 4956 VHOI.exe 116 PID 2724 wrote to memory of 2108 2724 cmd.exe 119 PID 2108 wrote to memory of 3628 2108 JSS.exe 121 PID 3628 wrote to memory of 4868 3628 cmd.exe 125 PID 4868 wrote to memory of 3884 4868 OVON.exe 126 PID 3884 wrote to memory of 4440 3884 cmd.exe 130 PID 4440 wrote to memory of 1552 4440 KAUK.exe 131 PID 1552 wrote to memory of 4492 1552 cmd.exe 135 PID 4492 wrote to memory of 3888 4492 YDQQI.exe 136 PID 3888 wrote to memory of 4532 3888 cmd.exe 139 PID 4532 wrote to memory of 3256 4532 FYVD.exe 141 PID 3256 wrote to memory of 1980 3256 cmd.exe 144 PID 1980 wrote to memory of 2240 1980 NRVW.exe 146 PID 2240 wrote to memory of 2840 2240 cmd.exe 150 PID 2840 wrote to memory of 3484 2840 XMVICWM.exe 151 PID 3484 wrote to memory of 3104 3484 cmd.exe 155 PID 3104 wrote to memory of 4032 3104 HPWPNKN.exe 156 PID 4032 wrote to memory of 4204 4032 cmd.exe 159 PID 4204 wrote to memory of 3452 4204 BNXJTHV.exe 161 PID 3452 wrote to memory of 2820 3452 cmd.exe 164 PID 2820 wrote to memory of 2212 2820 XSVG.exe 166 PID 2212 wrote to memory of 4952 2212 cmd.exe 169 PID 4952 wrote to memory of 4140 4952 FNA.exe 171 PID 4140 wrote to memory of 4728 4140 cmd.exe 175 PID 4728 wrote to memory of 3492 4728 UIXEMLN.exe 176 PID 3492 wrote to memory of 3504 3492 cmd.exe 179 PID 3504 wrote to memory of 784 3504 UTGGAXC.exe 181 PID 784 wrote to memory of 992 784 cmd.exe 185 PID 992 wrote to memory of 936 992 OOYXB.exe 186 PID 936 wrote to memory of 3460 936 cmd.exe 190 PID 3460 wrote to memory of 1852 3460 DMWUINS.exe 191 PID 1852 wrote to memory of 2540 1852 cmd.exe 195 PID 2540 wrote to memory of 2692 2540 QXASNF.exe 196 PID 2692 wrote to memory of 4228 2692 cmd.exe 200 PID 4228 wrote to memory of 3940 4228 GMZDZY.exe 201 PID 3940 wrote to memory of 3048 3940 cmd.exe 205 PID 3048 wrote to memory of 2696 3048 FCGGLKJ.exe 206 PID 2696 wrote to memory of 1916 2696 cmd.exe 209 PID 1916 wrote to memory of 4444 1916 QVBZLZ.exe 211 PID 4444 wrote to memory of 4092 4444 cmd.exe 215 PID 4092 wrote to memory of 4152 4092 MLDHOYU.exe 216 PID 4152 wrote to memory of 3332 4152 cmd.exe 219 PID 3332 wrote to memory of 4564 3332 ZOZFBP.exe 221 PID 4564 wrote to memory of 1628 4564 cmd.exe 225 PID 1628 wrote to memory of 3640 1628 ZGIHHT.exe 226 PID 3640 wrote to memory of 944 3640 cmd.exe 229 PID 944 wrote to memory of 5084 944 YWG.exe 231 PID 5084 wrote to memory of 2012 5084 cmd.exe 235 PID 2012 wrote to memory of 2896 2012 UCMHAXM.exe 236 PID 2896 wrote to memory of 2920 2896 cmd.exe 240
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_4a12c52294684b4c004fd0e0814261ab_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_4a12c52294684b4c004fd0e0814261ab_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZFGXKP.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\windows\system\ZFGXKP.exeC:\windows\system\ZFGXKP.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBKXP.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:724 -
C:\windows\SysWOW64\FBKXP.exeC:\windows\system32\FBKXP.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SDOW.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\windows\system\SDOW.exeC:\windows\system\SDOW.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UGQLN.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\windows\SysWOW64\UGQLN.exeC:\windows\system32\UGQLN.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YWSTQ.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\windows\SysWOW64\YWSTQ.exeC:\windows\system32\YWSTQ.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMRWU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\windows\OMRWU.exeC:\windows\OMRWU.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHOI.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\windows\VHOI.exeC:\windows\VHOI.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSS.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\windows\SysWOW64\JSS.exeC:\windows\system32\JSS.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVON.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\windows\system\OVON.exeC:\windows\system\OVON.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAUK.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\windows\system\KAUK.exeC:\windows\system\KAUK.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDQQI.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\windows\YDQQI.exeC:\windows\YDQQI.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYVD.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\windows\SysWOW64\FYVD.exeC:\windows\system32\FYVD.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRVW.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\windows\SysWOW64\NRVW.exeC:\windows\system32\NRVW.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XMVICWM.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\windows\system\XMVICWM.exeC:\windows\system\XMVICWM.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HPWPNKN.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\windows\HPWPNKN.exeC:\windows\HPWPNKN.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNXJTHV.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\windows\SysWOW64\BNXJTHV.exeC:\windows\system32\BNXJTHV.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSVG.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\SysWOW64\XSVG.exeC:\windows\system32\XSVG.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FNA.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\windows\SysWOW64\FNA.exeC:\windows\system32\FNA.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UIXEMLN.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\windows\system\UIXEMLN.exeC:\windows\system\UIXEMLN.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTGGAXC.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\windows\SysWOW64\UTGGAXC.exeC:\windows\system32\UTGGAXC.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OOYXB.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\windows\system\OOYXB.exeC:\windows\system\OOYXB.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMWUINS.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\windows\DMWUINS.exeC:\windows\DMWUINS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QXASNF.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\windows\QXASNF.exeC:\windows\QXASNF.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMZDZY.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\windows\system\GMZDZY.exeC:\windows\system\GMZDZY.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCGGLKJ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\windows\system\FCGGLKJ.exeC:\windows\system\FCGGLKJ.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QVBZLZ.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\windows\system\QVBZLZ.exeC:\windows\system\QVBZLZ.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLDHOYU.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\windows\SysWOW64\MLDHOYU.exeC:\windows\system32\MLDHOYU.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOZFBP.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\ZOZFBP.exeC:\windows\ZOZFBP.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGIHHT.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\windows\system\ZGIHHT.exeC:\windows\system\ZGIHHT.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YWG.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\windows\YWG.exeC:\windows\YWG.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UCMHAXM.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\windows\UCMHAXM.exeC:\windows\UCMHAXM.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LNL.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\windows\system\LNL.exeC:\windows\system\LNL.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\USVWP.exe.bat" "66⤵PID:240
-
C:\windows\SysWOW64\USVWP.exeC:\windows\system32\USVWP.exe67⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YIPE.exe.bat" "68⤵PID:4816
-
C:\windows\SysWOW64\YIPE.exeC:\windows\system32\YIPE.exe69⤵
- Executes dropped EXE
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EIXSJH.exe.bat" "70⤵PID:2036
-
C:\windows\EIXSJH.exeC:\windows\EIXSJH.exe71⤵
- Executes dropped EXE
PID:2072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LDUEL.exe.bat" "72⤵PID:1292
-
C:\windows\SysWOW64\LDUEL.exeC:\windows\system32\LDUEL.exe73⤵
- Executes dropped EXE
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XRM.exe.bat" "74⤵PID:3972
-
C:\windows\XRM.exeC:\windows\XRM.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HTW.exe.bat" "76⤵PID:3436
-
C:\windows\HTW.exeC:\windows\HTW.exe77⤵
- Executes dropped EXE
PID:4020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MWSJKCB.exe.bat" "78⤵PID:4640
-
C:\windows\MWSJKCB.exeC:\windows\MWSJKCB.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QMMRNB.exe.bat" "80⤵PID:4556
-
C:\windows\QMMRNB.exeC:\windows\QMMRNB.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QXV.exe.bat" "82⤵PID:2116
-
C:\windows\system\QXV.exeC:\windows\system\QXV.exe83⤵
- Executes dropped EXE
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVOMZC.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3912 -
C:\windows\SysWOW64\SVOMZC.exeC:\windows\system32\SVOMZC.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FYS.exe.bat" "86⤵PID:5096
-
C:\windows\system\FYS.exeC:\windows\system\FYS.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LIORRKI.exe.bat" "88⤵PID:2660
-
C:\windows\LIORRKI.exeC:\windows\LIORRKI.exe89⤵
- Executes dropped EXE
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HOU.exe.bat" "90⤵PID:1616
-
C:\windows\system\HOU.exeC:\windows\system\HOU.exe91⤵
- Executes dropped EXE
PID:4064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GEB.exe.bat" "92⤵PID:1924
-
C:\windows\GEB.exeC:\windows\GEB.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARXJN.exe.bat" "94⤵PID:4376
-
C:\windows\system\ARXJN.exeC:\windows\system\ARXJN.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AKGCB.exe.bat" "96⤵PID:3360
-
C:\windows\SysWOW64\AKGCB.exeC:\windows\system32\AKGCB.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFLO.exe.bat" "98⤵PID:1184
-
C:\windows\SysWOW64\HFLO.exeC:\windows\system32\HFLO.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JVEQ.exe.bat" "100⤵PID:3136
-
C:\windows\SysWOW64\JVEQ.exeC:\windows\system32\JVEQ.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLY.exe.bat" "102⤵PID:760
-
C:\windows\NLY.exeC:\windows\NLY.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TLGMD.exe.bat" "104⤵PID:1100
-
C:\windows\TLGMD.exeC:\windows\TLGMD.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBNPH.exe.bat" "106⤵PID:4700
-
C:\windows\system\JBNPH.exeC:\windows\system\JBNPH.exe107⤵
- Executes dropped EXE
PID:3448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EOSGRCT.exe.bat" "108⤵PID:2492
-
C:\windows\EOSGRCT.exeC:\windows\EOSGRCT.exe109⤵
- Executes dropped EXE
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CERJDO.exe.bat" "110⤵PID:3772
-
C:\windows\SysWOW64\CERJDO.exeC:\windows\system32\CERJDO.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJAEC.exe.bat" "112⤵PID:3172
-
C:\windows\SysWOW64\PRJAEC.exeC:\windows\system32\PRJAEC.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AKMTM.exe.bat" "114⤵PID:1596
-
C:\windows\system\AKMTM.exeC:\windows\system\AKMTM.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACN.exe.bat" "116⤵PID:1004
-
C:\windows\ACN.exeC:\windows\ACN.exe117⤵
- Executes dropped EXE
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSTXEII.exe.bat" "118⤵PID:1380
-
C:\windows\ZSTXEII.exeC:\windows\ZSTXEII.exe119⤵
- Executes dropped EXE
PID:644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQN.exe.bat" "120⤵PID:236
-
C:\windows\system\AQN.exeC:\windows\system\AQN.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-