Analysis
- max time kernel
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-31_dcd523c70becb0d19e053e05a5c10bd7_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_dcd523c70becb0d19e053e05a5c10bd7_elex_emotet_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-31_dcd523c70becb0d19e053e05a5c10bd7_elex_emotet_stop.exe
- Size 208KB
- Sample260531-19bkhaby2n
- SHA256 bceb22a191169550b0a35fb6f51001615b8210c8310840830dd60b0aea3a4b5c
- MD5 dcd523c70becb0d19e053e05a5c10bd7
- SHA1 e26246d6daf7757bedbdb8d5bfca3a1e761e2925
- SHA512 9a49eed878e69892854c973add3715881ea0383eb22115af8b2c776d7a9d023220f1268c9445cf25f6ac0911a0ab9d8623c9ce9c09ab30d666710c33af9b634f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFlcdL+LOfX4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFlc5+LOvkEj1
- TLSH T195247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3484 PCYW.exe 2016 RZM.exe 1240 TPFL.exe 784 CSPA.exe 5380 TQN.exe 5476 VGPFVVD.exe 5516 ARL.exe 6120 IBT.exe 340 ERNMRQQ.exe 436 APT.exe 5068 ZNS.exe 5616 VVUUVSV.exe 5184 YDOKYRQ.exe 1284 PTNNCKX.exe 1552 RDXUVYZ.exe 3456 TTQWT.exe 3076 NPVFDVW.exe 4292 RXP.exe 5300 RHY.exe 5528 VXSXXX.exe 6088 AAWVCOW.exe 4520 ZQVGOIL.exe 1800 EBZETZ.exe 1992 REVLYQI.exe 5772 MZAU.exe 5832 DEKMY.exe 3948 VHBQV.exe 3356 VSKRJ.exe 4136 SXQOQFC.exe 3720 XIMNVW.exe 2352 BQOV.exe 880 RGNFKP.exe 5428 VOHN.exe 5524 SUNK.exe 4732 SMVEIB.exe 124 EAOV.exe 4352 OCPC.exe 3164 TFT.exe 4784 GQPH.exe 5944 NLN.exe 4236 BORABFJ.exe 4788 BHZ.exe 568 QCWN.exe 756 EHC.exe 3276 VSS.exe 2244 NSS.exe 5400 VLB.exe 5440 GDEL.exe 1148 IBXFI.exe 3320 ZREQ.exe 2200 MUAO.exe 3328 OXJV.exe 5720 GABH.exe 5188 GKJA.exe 5004 SDETC.exe 2400 KLMKL.exe 3544 XWIQ.exe 4272 SJNAA.exe 4636 ZEKM.exe 4516 OZP.exe 5892 QXIA.exe 3080 ZKTSI.exe 4656 ZQTZJ.exe 6104 HAU.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\YDOKYRQ.exe.bat VVUUVSV.exe File created C:\windows\SysWOW64\OCPC.exe EAOV.exe File created C:\windows\SysWOW64\VFLU.exe.bat FQFR.exe File opened for modification C:\windows\SysWOW64\BNMNUXI.exe EHGQN.exe File opened for modification C:\windows\SysWOW64\JSPVA.exe HUOSCU.exe File created C:\windows\SysWOW64\JSPVA.exe.bat HUOSCU.exe File opened for modification C:\windows\SysWOW64\TBRQUS.exe GYNKHAN.exe File created C:\windows\SysWOW64\EYG.exe HAJWQI.exe File created C:\windows\SysWOW64\QTZKGG.exe EYG.exe File opened for modification C:\windows\SysWOW64\AAWVCOW.exe VXSXXX.exe File created C:\windows\SysWOW64\GDEL.exe.bat VLB.exe File created C:\windows\SysWOW64\MKTUWQ.exe.bat MRLS.exe File created C:\windows\SysWOW64\MFA.exe.bat FKDJ.exe File opened for modification C:\windows\SysWOW64\HAJWQI.exe LUDZJGN.exe File created C:\windows\SysWOW64\DVTGLJ.exe.bat WAWUJIS.exe File created C:\windows\SysWOW64\XWIQ.exe.bat KLMKL.exe File created C:\windows\SysWOW64\NEMGZX.exe.bat RGGJ.exe File created C:\windows\SysWOW64\NJN.exe YEHMMK.exe File created C:\windows\SysWOW64\HWWPCM.exe FYDNDX.exe File created C:\windows\SysWOW64\RZM.exe.bat PCYW.exe File created C:\windows\SysWOW64\SXQOQFC.exe VSKRJ.exe File created C:\windows\SysWOW64\QXIA.exe.bat OZP.exe File created C:\windows\SysWOW64\WQJQCL.exe.bat WFAP.exe File created C:\windows\SysWOW64\IPVHIFV.exe RZO.exe File opened for modification C:\windows\SysWOW64\ZIXO.exe THQA.exe File opened for modification C:\windows\SysWOW64\EHGQN.exe XMJEDM.exe File created C:\windows\SysWOW64\MKTUWQ.exe MRLS.exe File opened for modification C:\windows\SysWOW64\IBT.exe ARL.exe File created C:\windows\SysWOW64\OJXX.exe STDQC.exe File created C:\windows\SysWOW64\OJXX.exe.bat STDQC.exe File created C:\windows\SysWOW64\HAJWQI.exe LUDZJGN.exe File created C:\windows\SysWOW64\VDRB.exe RVXT.exe File opened for modification C:\windows\SysWOW64\SXQOQFC.exe VSKRJ.exe File created C:\windows\SysWOW64\NWZ.exe FBCT.exe File created C:\windows\SysWOW64\EBLZLX.exe.bat ZBDL.exe File opened for modification C:\windows\SysWOW64\VVUUVSV.exe ZNS.exe File opened for modification C:\windows\SysWOW64\YDOKYRQ.exe VVUUVSV.exe File created C:\windows\SysWOW64\WTGZ.exe.bat OJXX.exe File created C:\windows\SysWOW64\VOHN.exe RGNFKP.exe File opened for modification C:\windows\SysWOW64\ZOU.exe JYVCVE.exe File opened for modification C:\windows\SysWOW64\TZFZ.exe QMAITJU.exe File created C:\windows\SysWOW64\SXQOQFC.exe.bat VSKRJ.exe File created C:\windows\SysWOW64\BORABFJ.exe.bat NLN.exe File opened for modification C:\windows\SysWOW64\RZO.exe EOSGRCT.exe File created C:\windows\SysWOW64\KRXO.exe.bat XGB.exe File created C:\windows\SysWOW64\ZAJXL.exe DUDZ.exe File opened for modification C:\windows\SysWOW64\QZX.exe KYQTY.exe File created C:\windows\SysWOW64\UVNLRS.exe FNM.exe File opened for modification C:\windows\SysWOW64\RZM.exe PCYW.exe File created C:\windows\SysWOW64\IBT.exe.bat ARL.exe File created C:\windows\SysWOW64\VVUUVSV.exe.bat ZNS.exe File opened for modification C:\windows\SysWOW64\MZAU.exe REVLYQI.exe File created C:\windows\SysWOW64\ZOU.exe JYVCVE.exe File created C:\windows\SysWOW64\QMAITJU.exe.bat ZOU.exe File created C:\windows\SysWOW64\OIR.exe GYIMZO.exe File created C:\windows\SysWOW64\UFWWFMF.exe.bat FKZ.exe File created C:\windows\SysWOW64\WCU.exe.bat SMRHD.exe File created C:\windows\SysWOW64\IMTEAGG.exe.bat RHIMKB.exe File opened for modification C:\windows\SysWOW64\UVNLRS.exe FNM.exe File opened for modification C:\windows\SysWOW64\MKTUWQ.exe MRLS.exe File created C:\windows\SysWOW64\HUVZKJS.exe SOPCDZ.exe File created C:\windows\SysWOW64\HUVZKJS.exe.bat SOPCDZ.exe File created C:\windows\SysWOW64\ULYK.exe.bat NQBYQ.exe File created C:\windows\SysWOW64\MEBVA.exe.bat BMGC.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\JLAUPH.exe LKSH.exe File created C:\windows\WAWUJIS.exe SSC.exe File opened for modification C:\windows\ZVYEPFJ.exe IGZBDLC.exe File created C:\windows\RDXUVYZ.exe PTNNCKX.exe File opened for modification C:\windows\system\DUXDAOR.exe TZFZ.exe File created C:\windows\system\ZLO.exe.bat WQJQCL.exe File created C:\windows\system\LKSH.exe.bat HUYZV.exe File created C:\windows\system\WXPL.exe UHOR.exe File created C:\windows\system\ZBDL.exe NIA.exe File opened for modification C:\windows\system\AZRCT.exe JJTZH.exe File created C:\windows\NQBYQ.exe ZOXZ.exe File created C:\windows\APT.exe.bat ERNMRQQ.exe File created C:\windows\TTQWT.exe RDXUVYZ.exe File opened for modification C:\windows\system\SJNAA.exe XWIQ.exe File created C:\windows\system\RILXZP.exe.bat BTFM.exe File created C:\windows\system\KMDA.exe RILXZP.exe File created C:\windows\system\RHA.exe.bat KMDA.exe File created C:\windows\system\ZZBSPAG.exe.bat TWX.exe File created C:\windows\system\HWP.exe.bat ABSG.exe File created C:\windows\TQN.exe CSPA.exe File created C:\windows\VXSXXX.exe.bat RHY.exe File created C:\windows\TFT.exe OCPC.exe File created C:\windows\VLB.exe.bat NSS.exe File opened for modification C:\windows\JYVCVE.exe HAU.exe File opened for modification C:\windows\system\PJNPMZ.exe ADHS.exe File created C:\windows\CSPA.exe TPFL.exe File opened for modification C:\windows\ARL.exe VGPFVVD.exe File opened for modification C:\windows\REVLYQI.exe EBZETZ.exe File opened for modification C:\windows\EOSGRCT.exe ZLO.exe File created C:\windows\LIKGV.exe.bat QVG.exe File created C:\windows\system\RPZ.exe.bat QZX.exe File created C:\windows\NHYFTKC.exe LEWYIWI.exe File created C:\windows\system\KWZYS.exe.bat UZAWH.exe File created C:\windows\REVLYQI.exe EBZETZ.exe File created C:\windows\VHBQV.exe DEKMY.exe File opened for modification C:\windows\system\GYIMZO.exe BNMNUXI.exe File opened for modification C:\windows\system\OQS.exe OKADEWJ.exe File created C:\windows\system\FYDNDX.exe DVTGLJ.exe File opened for modification C:\windows\system\SMVEIB.exe SUNK.exe File created C:\windows\system\PJNPMZ.exe.bat ADHS.exe File created C:\windows\system\RPZ.exe QZX.exe File created C:\windows\system\FKDJ.exe.bat IMX.exe File opened for modification C:\windows\system\TWX.exe PGDEHCQ.exe File opened for modification C:\windows\system\ZBDL.exe NIA.exe File created C:\windows\YLVS.exe.bat MSS.exe File created C:\windows\system\BQOV.exe.bat XIMNVW.exe File created C:\windows\system\ZKTSI.exe QXIA.exe File created C:\windows\MJKK.exe IBQCV.exe File created C:\windows\IMX.exe.bat RPZ.exe File created C:\windows\NHYFTKC.exe.bat LEWYIWI.exe File opened for modification C:\windows\system\SSC.exe NHYFTKC.exe File created C:\windows\system\EGQ.exe.bat OIR.exe File created C:\windows\system\EISYMW.exe.bat MFA.exe File opened for modification C:\windows\JDQLVVA.exe OHLCS.exe File created C:\windows\system\AZRCT.exe.bat JJTZH.exe File opened for modification C:\windows\ZREQ.exe IBXFI.exe File created C:\windows\system\BTFM.exe ZQDF.exe File opened for modification C:\windows\system\SLRR.exe VFLU.exe File created C:\windows\system\JRIJZ.exe FJOBWDP.exe File created C:\windows\SDETC.exe GKJA.exe File created C:\windows\ARL.exe VGPFVVD.exe File created C:\windows\system\ZLO.exe WQJQCL.exe File opened for modification C:\windows\RVXT.exe LVQF.exe File opened for modification C:\windows\APT.exe ERNMRQQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 2120 3768 WerFault.exe 82 4948 3484 WerFault.exe 87 3892 2016 WerFault.exe 93 708 1240 WerFault.exe 98 5264 784 WerFault.exe 102 2420 5380 WerFault.exe 108 5540 5476 WerFault.exe 113 6124 5516 WerFault.exe 118 6100 6120 WerFault.exe 123 2828 340 WerFault.exe 128 4992 436 WerFault.exe 133 5948 5068 WerFault.exe 138 4236 5616 WerFault.exe 143 2412 5184 WerFault.exe 148 2672 1284 WerFault.exe 153 4396 1552 WerFault.exe 157 1124 3456 WerFault.exe 163 1576 3076 WerFault.exe 168 5272 4292 WerFault.exe 173 5508 5300 WerFault.exe 177 2908 5528 WerFault.exe 182 2836 6088 WerFault.exe 188 3636 4520 WerFault.exe 192 1720 1800 WerFault.exe 198 1608 1992 WerFault.exe 203 5784 5772 WerFault.exe 208 4236 5832 WerFault.exe 213 1292 3948 WerFault.exe 218 4200 3356 WerFault.exe 223 5088 4136 WerFault.exe 228 3892 3720 WerFault.exe 233 4676 2352 WerFault.exe 238 5316 880 WerFault.exe 243 2500 5428 WerFault.exe 248 496 5524 WerFault.exe 253 6000 4732 WerFault.exe 258 2564 124 WerFault.exe 263 6008 4352 WerFault.exe 268 5836 3164 WerFault.exe 273 1264 4784 WerFault.exe 278 2584 5944 WerFault.exe 283 2412 4236 WerFault.exe 288 2672 4788 WerFault.exe 293 4892 568 WerFault.exe 298 3660 756 WerFault.exe 303 1268 3276 WerFault.exe 308 5364 2244 WerFault.exe 312 5252 5400 WerFault.exe 318 5756 5440 WerFault.exe 323 6056 1148 WerFault.exe 328 3876 3320 WerFault.exe 333 2652 2200 WerFault.exe 338 5124 3328 WerFault.exe 343 4476 5720 WerFault.exe 347 5196 5188 WerFault.exe 353 4120 5004 WerFault.exe 358 2092 2400 WerFault.exe 363 3860 3544 WerFault.exe 368 3648 4272 WerFault.exe 373 1092 4636 WerFault.exe 378 5416 4516 WerFault.exe 382 3708 5892 WerFault.exe 388 6072 3080 WerFault.exe 393 3024 4656 WerFault.exe 398 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HIGOF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VOHN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADHS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYNKHAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QCWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYWAX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UERYXA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEHYQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UHXNB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZBSPAG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WCU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCYW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRZTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AZRCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAWVCOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHBQV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXQOQFC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NPVFDVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BORABFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RZO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SLRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAJXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UZAWH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GABH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3768 2026-05-31_dcd523c70becb0d19e053e05a5c10bd7_elex_emotet_stop.exe 3768 2026-05-31_dcd523c70becb0d19e053e05a5c10bd7_elex_emotet_stop.exe 3484 PCYW.exe 3484 PCYW.exe 2016 RZM.exe 2016 RZM.exe 1240 TPFL.exe 1240 TPFL.exe 784 CSPA.exe 784 CSPA.exe 5380 TQN.exe 5380 TQN.exe 5476 VGPFVVD.exe 5476 VGPFVVD.exe 5516 ARL.exe 5516 ARL.exe 6120 IBT.exe 6120 IBT.exe 340 ERNMRQQ.exe 340 ERNMRQQ.exe 436 APT.exe 436 APT.exe 5068 ZNS.exe 5068 ZNS.exe 5616 VVUUVSV.exe 5616 VVUUVSV.exe 5184 YDOKYRQ.exe 5184 YDOKYRQ.exe 1284 PTNNCKX.exe 1284 PTNNCKX.exe 1552 RDXUVYZ.exe 1552 RDXUVYZ.exe 3456 TTQWT.exe 3456 TTQWT.exe 3076 NPVFDVW.exe 3076 NPVFDVW.exe 4292 RXP.exe 4292 RXP.exe 5300 RHY.exe 5300 RHY.exe 5528 VXSXXX.exe 5528 VXSXXX.exe 6088 AAWVCOW.exe 6088 AAWVCOW.exe 4520 ZQVGOIL.exe 4520 ZQVGOIL.exe 1800 EBZETZ.exe 1800 EBZETZ.exe 1992 REVLYQI.exe 1992 REVLYQI.exe 5772 MZAU.exe 5772 MZAU.exe 5832 DEKMY.exe 5832 DEKMY.exe 3948 VHBQV.exe 3948 VHBQV.exe 3356 VSKRJ.exe 3356 VSKRJ.exe 4136 SXQOQFC.exe 4136 SXQOQFC.exe 3720 XIMNVW.exe 3720 XIMNVW.exe 2352 BQOV.exe 2352 BQOV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 3768 2026-05-31_dcd523c70becb0d19e053e05a5c10bd7_elex_emotet_stop.exe 3768 2026-05-31_dcd523c70becb0d19e053e05a5c10bd7_elex_emotet_stop.exe 3484 PCYW.exe 3484 PCYW.exe 2016 RZM.exe 2016 RZM.exe 1240 TPFL.exe 1240 TPFL.exe 784 CSPA.exe 784 CSPA.exe 5380 TQN.exe 5380 TQN.exe 5476 VGPFVVD.exe 5476 VGPFVVD.exe 5516 ARL.exe 5516 ARL.exe 6120 IBT.exe 6120 IBT.exe 340 ERNMRQQ.exe 340 ERNMRQQ.exe 436 APT.exe 436 APT.exe 5068 ZNS.exe 5068 ZNS.exe 5616 VVUUVSV.exe 5616 VVUUVSV.exe 5184 YDOKYRQ.exe 5184 YDOKYRQ.exe 1284 PTNNCKX.exe 1284 PTNNCKX.exe 1552 RDXUVYZ.exe 1552 RDXUVYZ.exe 3456 TTQWT.exe 3456 TTQWT.exe 3076 NPVFDVW.exe 3076 NPVFDVW.exe 4292 RXP.exe 4292 RXP.exe 5300 RHY.exe 5300 RHY.exe 5528 VXSXXX.exe 5528 VXSXXX.exe 6088 AAWVCOW.exe 6088 AAWVCOW.exe 4520 ZQVGOIL.exe 4520 ZQVGOIL.exe 1800 EBZETZ.exe 1800 EBZETZ.exe 1992 REVLYQI.exe 1992 REVLYQI.exe 5772 MZAU.exe 5772 MZAU.exe 5832 DEKMY.exe 5832 DEKMY.exe 3948 VHBQV.exe 3948 VHBQV.exe 3356 VSKRJ.exe 3356 VSKRJ.exe 4136 SXQOQFC.exe 4136 SXQOQFC.exe 3720 XIMNVW.exe 3720 XIMNVW.exe 2352 BQOV.exe 2352 BQOV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3768 wrote to memory of 2304 3768 2026-05-31_dcd523c70becb0d19e053e05a5c10bd7_elex_emotet_stop.exe 83 PID 2304 wrote to memory of 3484 2304 cmd.exe 87 PID 3484 wrote to memory of 1460 3484 PCYW.exe 89 PID 1460 wrote to memory of 2016 1460 cmd.exe 93 PID 2016 wrote to memory of 4128 2016 RZM.exe 94 PID 4128 wrote to memory of 1240 4128 cmd.exe 98 PID 1240 wrote to memory of 3508 1240 TPFL.exe 99 PID 3508 wrote to memory of 784 3508 cmd.exe 102 PID 784 wrote to memory of 2188 784 CSPA.exe 104 PID 2188 wrote to memory of 5380 2188 cmd.exe 108 PID 5380 wrote to memory of 5332 5380 TQN.exe 109 PID 5332 wrote to memory of 5476 5332 cmd.exe 113 PID 5476 wrote to memory of 5592 5476 VGPFVVD.exe 114 PID 5592 wrote to memory of 5516 5592 cmd.exe 118 PID 5516 wrote to memory of 4924 5516 ARL.exe 119 PID 4924 wrote to memory of 6120 4924 cmd.exe 123 PID 6120 wrote to memory of 6004 6120 IBT.exe 124 PID 6004 wrote to memory of 340 6004 cmd.exe 128 PID 340 wrote to memory of 1792 340 ERNMRQQ.exe 129 PID 1792 wrote to memory of 436 1792 cmd.exe 133 PID 436 wrote to memory of 2880 436 APT.exe 134 PID 2880 wrote to memory of 5068 2880 cmd.exe 138 PID 5068 wrote to memory of 2996 5068 ZNS.exe 139 PID 2996 wrote to memory of 5616 2996 cmd.exe 143 PID 5616 wrote to memory of 4004 5616 VVUUVSV.exe 144 PID 4004 wrote to memory of 5184 4004 cmd.exe 148 PID 5184 wrote to memory of 4956 5184 YDOKYRQ.exe 149 PID 4956 wrote to memory of 1284 4956 cmd.exe 153 PID 1284 wrote to memory of 2124 1284 PTNNCKX.exe 154 PID 2124 wrote to memory of 1552 2124 cmd.exe 157 PID 1552 wrote to memory of 3992 1552 RDXUVYZ.exe 159 PID 3992 wrote to memory of 3456 3992 cmd.exe 163 PID 3456 wrote to memory of 3748 3456 TTQWT.exe 164 PID 3748 wrote to memory of 3076 3748 cmd.exe 168 PID 3076 wrote to memory of 2160 3076 NPVFDVW.exe 169 PID 2160 wrote to memory of 4292 2160 cmd.exe 173 PID 4292 wrote to memory of 5228 4292 RXP.exe 174 PID 5228 wrote to memory of 5300 5228 cmd.exe 177 PID 5300 wrote to memory of 5496 5300 RHY.exe 179 PID 5496 wrote to memory of 5528 5496 cmd.exe 182 PID 5528 wrote to memory of 1296 5528 VXSXXX.exe 184 PID 1296 wrote to memory of 6088 1296 cmd.exe 188 PID 6088 wrote to memory of 6124 6088 AAWVCOW.exe 189 PID 6124 wrote to memory of 4520 6124 cmd.exe 192 PID 4520 wrote to memory of 6100 4520 ZQVGOIL.exe 194 PID 6100 wrote to memory of 1800 6100 cmd.exe 198 PID 1800 wrote to memory of 6016 1800 EBZETZ.exe 199 PID 6016 wrote to memory of 1992 6016 cmd.exe 203 PID 1992 wrote to memory of 3444 1992 REVLYQI.exe 204 PID 3444 wrote to memory of 5772 3444 cmd.exe 208 PID 5772 wrote to memory of 5692 5772 MZAU.exe 209 PID 5692 wrote to memory of 5832 5692 cmd.exe 213 PID 5832 wrote to memory of 5176 5832 DEKMY.exe 214 PID 5176 wrote to memory of 3948 5176 cmd.exe 218 PID 3948 wrote to memory of 2980 3948 VHBQV.exe 219 PID 2980 wrote to memory of 3356 2980 cmd.exe 223 PID 3356 wrote to memory of 1844 3356 VSKRJ.exe 224 PID 1844 wrote to memory of 4136 1844 cmd.exe 228 PID 4136 wrote to memory of 3316 4136 SXQOQFC.exe 229 PID 3316 wrote to memory of 3720 3316 cmd.exe 233 PID 3720 wrote to memory of 2448 3720 XIMNVW.exe 234 PID 2448 wrote to memory of 2352 2448 cmd.exe 238 PID 2352 wrote to memory of 1176 2352 BQOV.exe 239 PID 1176 wrote to memory of 880 1176 cmd.exe 243
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_dcd523c70becb0d19e053e05a5c10bd7_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_dcd523c70becb0d19e053e05a5c10bd7_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PCYW.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\windows\PCYW.exeC:\windows\PCYW.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RZM.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\windows\SysWOW64\RZM.exeC:\windows\system32\RZM.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TPFL.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\windows\TPFL.exeC:\windows\TPFL.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CSPA.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\windows\CSPA.exeC:\windows\CSPA.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQN.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\windows\TQN.exeC:\windows\TQN.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VGPFVVD.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\windows\SysWOW64\VGPFVVD.exeC:\windows\system32\VGPFVVD.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ARL.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\windows\ARL.exeC:\windows\ARL.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IBT.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\SysWOW64\IBT.exeC:\windows\system32\IBT.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ERNMRQQ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\system\ERNMRQQ.exeC:\windows\system\ERNMRQQ.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APT.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\windows\APT.exeC:\windows\APT.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNS.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\SysWOW64\ZNS.exeC:\windows\system32\ZNS.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVUUVSV.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\SysWOW64\VVUUVSV.exeC:\windows\system32\VVUUVSV.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDOKYRQ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\windows\SysWOW64\YDOKYRQ.exeC:\windows\system32\YDOKYRQ.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTNNCKX.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\PTNNCKX.exeC:\windows\PTNNCKX.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RDXUVYZ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\windows\RDXUVYZ.exeC:\windows\RDXUVYZ.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TTQWT.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\windows\TTQWT.exeC:\windows\TTQWT.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NPVFDVW.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\windows\SysWOW64\NPVFDVW.exeC:\windows\system32\NPVFDVW.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RXP.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\windows\RXP.exeC:\windows\RXP.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHY.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\windows\system\RHY.exeC:\windows\system\RHY.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VXSXXX.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\windows\VXSXXX.exeC:\windows\VXSXXX.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AAWVCOW.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\windows\SysWOW64\AAWVCOW.exeC:\windows\system32\AAWVCOW.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZQVGOIL.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\windows\SysWOW64\ZQVGOIL.exeC:\windows\system32\ZQVGOIL.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EBZETZ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\windows\EBZETZ.exeC:\windows\EBZETZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\REVLYQI.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\windows\REVLYQI.exeC:\windows\REVLYQI.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZAU.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\windows\SysWOW64\MZAU.exeC:\windows\system32\MZAU.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DEKMY.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\DEKMY.exeC:\windows\DEKMY.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHBQV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\VHBQV.exeC:\windows\VHBQV.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSKRJ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\system\VSKRJ.exeC:\windows\system\VSKRJ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SXQOQFC.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\windows\SysWOW64\SXQOQFC.exeC:\windows\system32\SXQOQFC.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIMNVW.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\windows\SysWOW64\XIMNVW.exeC:\windows\system32\XIMNVW.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BQOV.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\system\BQOV.exeC:\windows\system\BQOV.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RGNFKP.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\windows\RGNFKP.exeC:\windows\RGNFKP.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VOHN.exe.bat" "66⤵PID:4364
-
C:\windows\SysWOW64\VOHN.exeC:\windows\system32\VOHN.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUNK.exe.bat" "68⤵PID:2420
-
C:\windows\SysWOW64\SUNK.exeC:\windows\system32\SUNK.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SMVEIB.exe.bat" "70⤵PID:5596
-
C:\windows\system\SMVEIB.exeC:\windows\system\SMVEIB.exe71⤵
- Executes dropped EXE
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EAOV.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5816 -
C:\windows\EAOV.exeC:\windows\EAOV.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OCPC.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:4756 -
C:\windows\SysWOW64\OCPC.exeC:\windows\system32\OCPC.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TFT.exe.bat" "76⤵PID:5612
-
C:\windows\TFT.exeC:\windows\TFT.exe77⤵
- Executes dropped EXE
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GQPH.exe.bat" "78⤵PID:5780
-
C:\windows\SysWOW64\GQPH.exeC:\windows\system32\GQPH.exe79⤵
- Executes dropped EXE
PID:4784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NLN.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5144 -
C:\windows\NLN.exeC:\windows\NLN.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BORABFJ.exe.bat" "82⤵PID:4620
-
C:\windows\SysWOW64\BORABFJ.exeC:\windows\system32\BORABFJ.exe83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BHZ.exe.bat" "84⤵PID:4560
-
C:\windows\system\BHZ.exeC:\windows\system\BHZ.exe85⤵
- Executes dropped EXE
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QCWN.exe.bat" "86⤵PID:3884
-
C:\windows\system\QCWN.exeC:\windows\system\QCWN.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHC.exe.bat" "88⤵PID:2536
-
C:\windows\EHC.exeC:\windows\EHC.exe89⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSS.exe.bat" "90⤵PID:5108
-
C:\windows\VSS.exeC:\windows\VSS.exe91⤵
- Executes dropped EXE
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NSS.exe.bat" "92⤵PID:4076
-
C:\windows\system\NSS.exeC:\windows\system\NSS.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VLB.exe.bat" "94⤵PID:4988
-
C:\windows\VLB.exeC:\windows\VLB.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDEL.exe.bat" "96⤵PID:688
-
C:\windows\SysWOW64\GDEL.exeC:\windows\system32\GDEL.exe97⤵
- Executes dropped EXE
PID:5440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBXFI.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5768 -
C:\windows\IBXFI.exeC:\windows\IBXFI.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZREQ.exe.bat" "100⤵PID:6028
-
C:\windows\ZREQ.exeC:\windows\ZREQ.exe101⤵
- Executes dropped EXE
PID:3320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MUAO.exe.bat" "102⤵PID:676
-
C:\windows\MUAO.exeC:\windows\MUAO.exe103⤵
- Executes dropped EXE
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXJV.exe.bat" "104⤵PID:5648
-
C:\windows\system\OXJV.exeC:\windows\system\OXJV.exe105⤵
- Executes dropped EXE
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GABH.exe.bat" "106⤵PID:5652
-
C:\windows\system\GABH.exeC:\windows\system\GABH.exe107⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKJA.exe.bat" "108⤵PID:5164
-
C:\windows\system\GKJA.exeC:\windows\system\GKJA.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SDETC.exe.bat" "110⤵PID:4616
-
C:\windows\SDETC.exeC:\windows\SDETC.exe111⤵
- Executes dropped EXE
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLMKL.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2504 -
C:\windows\SysWOW64\KLMKL.exeC:\windows\system32\KLMKL.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XWIQ.exe.bat" "114⤵PID:4768
-
C:\windows\SysWOW64\XWIQ.exeC:\windows\system32\XWIQ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SJNAA.exe.bat" "116⤵PID:4748
-
C:\windows\system\SJNAA.exeC:\windows\system\SJNAA.exe117⤵
- Executes dropped EXE
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZEKM.exe.bat" "118⤵PID:4228
-
C:\windows\system\ZEKM.exeC:\windows\system\ZEKM.exe119⤵
- Executes dropped EXE
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OZP.exe.bat" "120⤵PID:5276
-
C:\windows\SysWOW64\OZP.exeC:\windows\system32\OZP.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-