Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/06/2026, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-03_5260aaf2738327099aea811b265481ba_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-03_5260aaf2738327099aea811b265481ba_elex_emotet_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-06-03_5260aaf2738327099aea811b265481ba_elex_emotet_stop.exe
- Size 208KB
- Sample260603-thfltacv2k
- SHA256 51c4af04a1476cf0e0e13687b434fdd041600142f05cf42e64dc0fa886cf2377
- MD5 5260aaf2738327099aea811b265481ba
- SHA1 885f4ece2076ec6712585861b50cff98d28e09e4
- SHA512 151e92d365ae4743fcef1b0e99f76096955783099707ecaace09de41bfe956df2743fd5e5d9777ce5c007d7466a4b905e44e432bc041b086e05b043ffc66a7d6
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfS4NLthEjQT6c:MlZtbLWIgd1LZ9oECZbclc5+LOqQEje
- TLSH T181247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3424 YUOTH.exe 5600 GIBI.exe 2060 BVFRTX.exe 5408 GYBQHOD.exe 4356 IBLFRCX.exe 2840 XWIRTD.exe 5620 XJIGDQI.exe 6036 THGVKSC.exe 1628 YSK.exe 1708 ESS.exe 4644 UNPBINO.exe 5616 NLI.exe 1776 MBPGSVL.exe 6096 XTS.exe 4828 UZPOH.exe 572 OMUFRMJ.exe 3728 DSAUYWL.exe 4420 LCJW.exe 3956 WVEPU.exe 3784 MLLRY.exe 4220 FOC.exe 1724 NYLWQ.exe 5720 DWJH.exe 4236 DCKWE.exe 1580 PUNGEQ.exe 3152 QXOVPM.exe 4864 PNVYBX.exe 5252 GYLWAS.exe 1492 HBVDLG.exe 544 YYUGXZ.exe 4872 SMZ.exe 2272 MECI.exe 4720 AKZ.exe 3216 CABH.exe 5384 PLX.exe 3328 GAERL.exe 5348 OTMKZ.exe 3568 XTGPDA.exe 5660 ZRHRJPE.exe 4980 BUJZUDY.exe 5520 XZPWBNA.exe 1280 JSS.exe 4612 OSZCS.exe 728 FDQAA.exe 3844 WTXDD.exe 3360 HMSWMS.exe 2064 YZCOBOW.exe 3816 RUBRYTF.exe 2552 SXDYQHH.exe 6048 UVWAPWP.exe 488 UFF.exe 1740 WDG.exe 3180 XGKAO.exe 2368 ZJMHZ.exe 3048 UROP.exe 5804 WUPW.exe 2016 YSRY.exe 4524 GCRZH.exe 4484 NXW.exe 5124 LYRHRGZ.exe 5436 HDPW.exe 3060 IJPL.exe 5904 NJXYQ.exe 3700 KPDVXZ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\JJNCLMG.exe.bat KTH.exe File created C:\windows\SysWOW64\SWCUM.exe LTFIDR.exe File created C:\windows\SysWOW64\PJVPQNA.exe CYR.exe File created C:\windows\SysWOW64\UZPOH.exe XTS.exe File opened for modification C:\windows\SysWOW64\WDG.exe UFF.exe File created C:\windows\SysWOW64\EMF.exe JYAZAP.exe File created C:\windows\SysWOW64\EMF.exe.bat JYAZAP.exe File created C:\windows\SysWOW64\VEWGHZ.exe GYYJ.exe File created C:\windows\SysWOW64\DSTM.exe.bat BUAJW.exe File created C:\windows\SysWOW64\PUFWM.exe GUDR.exe File opened for modification C:\windows\SysWOW64\OSKMRI.exe HXNAP.exe File opened for modification C:\windows\SysWOW64\DZVOAI.exe TZTJ.exe File created C:\windows\SysWOW64\PICGJ.exe.bat QSDVFL.exe File created C:\windows\SysWOW64\VEWGHZ.exe.bat GYYJ.exe File created C:\windows\SysWOW64\GAERL.exe PLX.exe File created C:\windows\SysWOW64\EXS.exe.bat XCVN.exe File created C:\windows\SysWOW64\XSCDFS.exe BMWO.exe File created C:\windows\SysWOW64\LKRWGRT.exe ZRO.exe File created C:\windows\SysWOW64\QXOVPM.exe.bat PUNGEQ.exe File opened for modification C:\windows\SysWOW64\KPDVXZ.exe NJXYQ.exe File created C:\windows\SysWOW64\ZURS.exe CPLV.exe File created C:\windows\SysWOW64\USA.exe.bat VZRSGN.exe File created C:\windows\SysWOW64\GYBQHOD.exe.bat BVFRTX.exe File created C:\windows\SysWOW64\SMZ.exe YYUGXZ.exe File opened for modification C:\windows\SysWOW64\QMLONN.exe JJNCLMG.exe File created C:\windows\SysWOW64\YRULS.exe JWPZQQ.exe File opened for modification C:\windows\SysWOW64\PDNISB.exe BARKF.exe File created C:\windows\SysWOW64\YCMDZD.exe.bat LOB.exe File opened for modification C:\windows\SysWOW64\MBXYDX.exe PVRBW.exe File created C:\windows\SysWOW64\WCWJJPB.exe.bat XROID.exe File created C:\windows\SysWOW64\YOL.exe.bat HYE.exe File created C:\windows\SysWOW64\MLLRY.exe.bat WVEPU.exe File opened for modification C:\windows\SysWOW64\ZJMHZ.exe XGKAO.exe File created C:\windows\SysWOW64\NQR.exe QKTULIA.exe File created C:\windows\SysWOW64\PICGJ.exe QSDVFL.exe File created C:\windows\SysWOW64\ZJMHZ.exe XGKAO.exe File created C:\windows\SysWOW64\KPDVXZ.exe.bat NJXYQ.exe File opened for modification C:\windows\SysWOW64\HBVDLG.exe GYLWAS.exe File opened for modification C:\windows\SysWOW64\JSS.exe XZPWBNA.exe File opened for modification C:\windows\SysWOW64\KXXD.exe ORR.exe File opened for modification C:\windows\SysWOW64\COXA.exe ARW.exe File created C:\windows\SysWOW64\UIPJA.exe NNSXYW.exe File created C:\windows\SysWOW64\DSTM.exe BUAJW.exe File created C:\windows\SysWOW64\NLI.exe UNPBINO.exe File opened for modification C:\windows\SysWOW64\JQAKUNN.exe WDHS.exe File created C:\windows\SysWOW64\LTFIDR.exe.bat PVZL.exe File created C:\windows\SysWOW64\HEO.exe.bat KYQJGR.exe File created C:\windows\SysWOW64\UNPBINO.exe ESS.exe File created C:\windows\SysWOW64\YOL.exe HYE.exe File created C:\windows\SysWOW64\MBXYDX.exe.bat PVRBW.exe File opened for modification C:\windows\SysWOW64\THGVKSC.exe XJIGDQI.exe File created C:\windows\SysWOW64\WVEPU.exe.bat LCJW.exe File created C:\windows\SysWOW64\ROUGHHR.exe UIPJA.exe File created C:\windows\SysWOW64\GIBI.exe YUOTH.exe File created C:\windows\SysWOW64\XJIGDQI.exe.bat XWIRTD.exe File created C:\windows\SysWOW64\UZPOH.exe.bat XTS.exe File created C:\windows\SysWOW64\DWJH.exe.bat NYLWQ.exe File created C:\windows\SysWOW64\HMSWMS.exe.bat WTXDD.exe File created C:\windows\SysWOW64\KYQJGR.exe OSKMRI.exe File opened for modification C:\windows\SysWOW64\PICGJ.exe QSDVFL.exe File opened for modification C:\windows\SysWOW64\YRULS.exe JWPZQQ.exe File opened for modification C:\windows\SysWOW64\GYBQHOD.exe BVFRTX.exe File created C:\windows\SysWOW64\SMZ.exe.bat YYUGXZ.exe File created C:\windows\SysWOW64\HMSWMS.exe WTXDD.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\GUDR.exe OMDB.exe File opened for modification C:\windows\BNIPNL.exe PUFWM.exe File opened for modification C:\windows\MKLNHRR.exe BNIPNL.exe File opened for modification C:\windows\GGIV.exe KYGNRJ.exe File created C:\windows\system\AQZSL.exe.bat IIZBDUO.exe File created C:\windows\RVJYIY.exe DKFRD.exe File opened for modification C:\windows\system\VUNGXWE.exe HRRHRF.exe File created C:\windows\system\YMAFYHO.exe CEFPVI.exe File created C:\windows\OMUFRMJ.exe UZPOH.exe File created C:\windows\system\WTXDD.exe FDQAA.exe File created C:\windows\system\XCVN.exe KPDVXZ.exe File created C:\windows\RIRX.exe PKQ.exe File opened for modification C:\windows\system\GOX.exe ZTRY.exe File created C:\windows\system\JJU.exe.bat COXA.exe File opened for modification C:\windows\system\ZNEYC.exe XPDEV.exe File opened for modification C:\windows\system\WTXDD.exe FDQAA.exe File created C:\windows\system\RUBRYTF.exe.bat YZCOBOW.exe File opened for modification C:\windows\system\SXDYQHH.exe RUBRYTF.exe File created C:\windows\system\UFF.exe.bat UVWAPWP.exe File created C:\windows\system\XCVN.exe.bat KPDVXZ.exe File created C:\windows\KXVE.exe.bat IZC.exe File created C:\windows\system\LWFMSR.exe HOYMGGC.exe File opened for modification C:\windows\system\AQOO.exe TGNM.exe File created C:\windows\GGIV.exe.bat KYGNRJ.exe File opened for modification C:\windows\system\IMHSBSY.exe EWN.exe File created C:\windows\QCQA.exe ONPG.exe File opened for modification C:\windows\PVRBW.exe QCQA.exe File opened for modification C:\windows\IJRGO.exe MBXYDX.exe File created C:\windows\RGYZS.exe BIAOGI.exe File opened for modification C:\windows\system\NGS.exe CNPLCTG.exe File created C:\windows\system\MAFLAOS.exe.bat KXVE.exe File opened for modification C:\windows\EAZQVD.exe THWXU.exe File created C:\windows\system\BIAOGI.exe.bat DSTM.exe File created C:\windows\LCJW.exe DSAUYWL.exe File created C:\windows\PUNGEQ.exe DCKWE.exe File created C:\windows\GYLWAS.exe.bat PNVYBX.exe File created C:\windows\system\XGKAO.exe.bat WDG.exe File opened for modification C:\windows\system\KYGNRJ.exe VDJBQHP.exe File opened for modification C:\windows\ZRO.exe JTPAMQ.exe File created C:\windows\ZRO.exe.bat JTPAMQ.exe File created C:\windows\system\DXRBQAR.exe SFOQIS.exe File opened for modification C:\windows\CFADA.exe LQB.exe File created C:\windows\system\OZJXIU.exe GGIV.exe File opened for modification C:\windows\RIRX.exe PKQ.exe File created C:\windows\system\SUMKHOL.exe BEOHVVE.exe File created C:\windows\KWMTBFF.exe SSVQFBX.exe File created C:\windows\RUDOQ.exe JJU.exe File opened for modification C:\windows\VAVMVJI.exe WCWJJPB.exe File created C:\windows\HYWFJ.exe.bat FVNPZ.exe File created C:\windows\system\SXDYQHH.exe.bat RUBRYTF.exe File created C:\windows\system\LQB.exe EXS.exe File created C:\windows\MKLNHRR.exe.bat BNIPNL.exe File created C:\windows\system\HRRHRF.exe.bat RTKWGL.exe File created C:\windows\system\LOB.exe PJVPQNA.exe File created C:\windows\system\NNSXYW.exe USA.exe File opened for modification C:\windows\system\NNSXYW.exe USA.exe File created C:\windows\system\IMHSBSY.exe EWN.exe File created C:\windows\BAWT.exe.bat XSCDFS.exe File created C:\windows\system\XROID.exe.bat VUNGXWE.exe File created C:\windows\TUKBK.exe.bat NUD.exe File created C:\windows\UOXQYK.exe.bat HDBJTS.exe File created C:\windows\REMGTGR.exe.bat RUDNFTD.exe File created C:\windows\EWN.exe EMF.exe File opened for modification C:\windows\KUYEC.exe FJCY.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 2096 5160 WerFault.exe 79 3788 3424 WerFault.exe 83 4740 5600 WerFault.exe 90 5492 2060 WerFault.exe 95 2552 5408 WerFault.exe 99 2984 4356 WerFault.exe 105 3892 2840 WerFault.exe 110 4944 5620 WerFault.exe 115 5612 6036 WerFault.exe 120 2912 1628 WerFault.exe 125 4760 1708 WerFault.exe 130 3884 4644 WerFault.exe 134 3776 5616 WerFault.exe 140 5744 1776 WerFault.exe 145 6064 6096 WerFault.exe 150 3292 4828 WerFault.exe 154 4252 572 WerFault.exe 160 5412 3728 WerFault.exe 165 5808 4420 WerFault.exe 170 4592 3956 WerFault.exe 175 6048 3784 WerFault.exe 179 3024 4220 WerFault.exe 185 3568 1724 WerFault.exe 190 6084 5720 WerFault.exe 194 896 4236 WerFault.exe 200 4888 1580 WerFault.exe 204 5464 3152 WerFault.exe 209 5876 4864 WerFault.exe 215 1112 5252 WerFault.exe 220 4884 1492 WerFault.exe 225 3460 544 WerFault.exe 230 2344 4872 WerFault.exe 235 3748 2272 WerFault.exe 240 5824 4720 WerFault.exe 245 2492 3216 WerFault.exe 250 4956 5384 WerFault.exe 254 4164 3328 WerFault.exe 260 4280 5348 WerFault.exe 265 5460 3568 WerFault.exe 270 2276 5660 WerFault.exe 275 1348 4980 WerFault.exe 280 4168 5520 WerFault.exe 285 5952 1280 WerFault.exe 290 4904 4612 WerFault.exe 295 3528 728 WerFault.exe 300 1296 3844 WerFault.exe 305 2452 3360 WerFault.exe 310 2288 2064 WerFault.exe 314 2412 3816 WerFault.exe 319 4292 2552 WerFault.exe 325 5500 6048 WerFault.exe 330 5668 488 WerFault.exe 334 248 1740 WerFault.exe 340 1980 3180 WerFault.exe 344 5128 2368 WerFault.exe 350 5180 3048 WerFault.exe 355 3344 5804 WerFault.exe 360 1388 2016 WerFault.exe 365 3384 4524 WerFault.exe 369 4256 4484 WerFault.exe 374 5548 5124 WerFault.exe 380 5064 5436 WerFault.exe 385 4404 3060 WerFault.exe 390 584 5904 WerFault.exe 395 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZURS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLIBT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LXCEH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBVDLG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UROP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PWWQG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUYEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUJZUDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XROID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDNISB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUOTH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WNBCSR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VUNGXWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZCOBOW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HXNAP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LKRWGRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NQBYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMUFRMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAZQVD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CNBHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EWN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GCRZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FVNPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RUDNFTD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FJCY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GGIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UNMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPDEV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THGVKSC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5160 2026-06-03_5260aaf2738327099aea811b265481ba_elex_emotet_stop.exe 5160 2026-06-03_5260aaf2738327099aea811b265481ba_elex_emotet_stop.exe 3424 YUOTH.exe 3424 YUOTH.exe 5600 GIBI.exe 5600 GIBI.exe 2060 BVFRTX.exe 2060 BVFRTX.exe 5408 GYBQHOD.exe 5408 GYBQHOD.exe 4356 IBLFRCX.exe 4356 IBLFRCX.exe 2840 XWIRTD.exe 2840 XWIRTD.exe 5620 XJIGDQI.exe 5620 XJIGDQI.exe 6036 THGVKSC.exe 6036 THGVKSC.exe 1628 YSK.exe 1628 YSK.exe 1708 ESS.exe 1708 ESS.exe 4644 UNPBINO.exe 4644 UNPBINO.exe 5616 NLI.exe 5616 NLI.exe 1776 MBPGSVL.exe 1776 MBPGSVL.exe 6096 XTS.exe 6096 XTS.exe 4828 UZPOH.exe 4828 UZPOH.exe 572 OMUFRMJ.exe 572 OMUFRMJ.exe 3728 DSAUYWL.exe 3728 DSAUYWL.exe 4420 LCJW.exe 4420 LCJW.exe 3956 WVEPU.exe 3956 WVEPU.exe 3784 MLLRY.exe 3784 MLLRY.exe 4220 FOC.exe 4220 FOC.exe 1724 NYLWQ.exe 1724 NYLWQ.exe 5720 DWJH.exe 5720 DWJH.exe 4236 DCKWE.exe 4236 DCKWE.exe 1580 PUNGEQ.exe 1580 PUNGEQ.exe 3152 QXOVPM.exe 3152 QXOVPM.exe 4864 PNVYBX.exe 4864 PNVYBX.exe 5252 GYLWAS.exe 5252 GYLWAS.exe 1492 HBVDLG.exe 1492 HBVDLG.exe 544 YYUGXZ.exe 544 YYUGXZ.exe 4872 SMZ.exe 4872 SMZ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5160 2026-06-03_5260aaf2738327099aea811b265481ba_elex_emotet_stop.exe 5160 2026-06-03_5260aaf2738327099aea811b265481ba_elex_emotet_stop.exe 3424 YUOTH.exe 3424 YUOTH.exe 5600 GIBI.exe 5600 GIBI.exe 2060 BVFRTX.exe 2060 BVFRTX.exe 5408 GYBQHOD.exe 5408 GYBQHOD.exe 4356 IBLFRCX.exe 4356 IBLFRCX.exe 2840 XWIRTD.exe 2840 XWIRTD.exe 5620 XJIGDQI.exe 5620 XJIGDQI.exe 6036 THGVKSC.exe 6036 THGVKSC.exe 1628 YSK.exe 1628 YSK.exe 1708 ESS.exe 1708 ESS.exe 4644 UNPBINO.exe 4644 UNPBINO.exe 5616 NLI.exe 5616 NLI.exe 1776 MBPGSVL.exe 1776 MBPGSVL.exe 6096 XTS.exe 6096 XTS.exe 4828 UZPOH.exe 4828 UZPOH.exe 572 OMUFRMJ.exe 572 OMUFRMJ.exe 3728 DSAUYWL.exe 3728 DSAUYWL.exe 4420 LCJW.exe 4420 LCJW.exe 3956 WVEPU.exe 3956 WVEPU.exe 3784 MLLRY.exe 3784 MLLRY.exe 4220 FOC.exe 4220 FOC.exe 1724 NYLWQ.exe 1724 NYLWQ.exe 5720 DWJH.exe 5720 DWJH.exe 4236 DCKWE.exe 4236 DCKWE.exe 1580 PUNGEQ.exe 1580 PUNGEQ.exe 3152 QXOVPM.exe 3152 QXOVPM.exe 4864 PNVYBX.exe 4864 PNVYBX.exe 5252 GYLWAS.exe 5252 GYLWAS.exe 1492 HBVDLG.exe 1492 HBVDLG.exe 544 YYUGXZ.exe 544 YYUGXZ.exe 4872 SMZ.exe 4872 SMZ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5160 wrote to memory of 6068 5160 2026-06-03_5260aaf2738327099aea811b265481ba_elex_emotet_stop.exe 80 PID 6068 wrote to memory of 3424 6068 cmd.exe 83 PID 3424 wrote to memory of 5488 3424 YUOTH.exe 86 PID 5488 wrote to memory of 5600 5488 cmd.exe 90 PID 5600 wrote to memory of 1500 5600 GIBI.exe 91 PID 1500 wrote to memory of 2060 1500 cmd.exe 95 PID 2060 wrote to memory of 4132 2060 BVFRTX.exe 96 PID 4132 wrote to memory of 5408 4132 cmd.exe 99 PID 5408 wrote to memory of 5940 5408 GYBQHOD.exe 101 PID 5940 wrote to memory of 4356 5940 cmd.exe 105 PID 4356 wrote to memory of 4744 4356 IBLFRCX.exe 106 PID 4744 wrote to memory of 2840 4744 cmd.exe 110 PID 2840 wrote to memory of 2072 2840 XWIRTD.exe 111 PID 2072 wrote to memory of 5620 2072 cmd.exe 115 PID 5620 wrote to memory of 1264 5620 XJIGDQI.exe 116 PID 1264 wrote to memory of 6036 1264 cmd.exe 120 PID 6036 wrote to memory of 1664 6036 THGVKSC.exe 121 PID 1664 wrote to memory of 1628 1664 cmd.exe 125 PID 1628 wrote to memory of 3988 1628 YSK.exe 126 PID 3988 wrote to memory of 1708 3988 cmd.exe 130 PID 1708 wrote to memory of 4532 1708 ESS.exe 131 PID 4532 wrote to memory of 4644 4532 cmd.exe 134 PID 4644 wrote to memory of 5964 4644 UNPBINO.exe 136 PID 5964 wrote to memory of 5616 5964 cmd.exe 140 PID 5616 wrote to memory of 3856 5616 NLI.exe 141 PID 3856 wrote to memory of 1776 3856 cmd.exe 145 PID 1776 wrote to memory of 3432 1776 MBPGSVL.exe 146 PID 3432 wrote to memory of 6096 3432 cmd.exe 150 PID 6096 wrote to memory of 1032 6096 XTS.exe 151 PID 1032 wrote to memory of 4828 1032 cmd.exe 154 PID 4828 wrote to memory of 3632 4828 UZPOH.exe 156 PID 3632 wrote to memory of 572 3632 cmd.exe 160 PID 572 wrote to memory of 3960 572 OMUFRMJ.exe 161 PID 3960 wrote to memory of 3728 3960 cmd.exe 165 PID 3728 wrote to memory of 1392 3728 DSAUYWL.exe 166 PID 1392 wrote to memory of 4420 1392 cmd.exe 170 PID 4420 wrote to memory of 4216 4420 LCJW.exe 171 PID 4216 wrote to memory of 3956 4216 cmd.exe 175 PID 3956 wrote to memory of 3740 3956 WVEPU.exe 176 PID 3740 wrote to memory of 3784 3740 cmd.exe 179 PID 3784 wrote to memory of 6120 3784 MLLRY.exe 181 PID 6120 wrote to memory of 4220 6120 cmd.exe 185 PID 4220 wrote to memory of 1536 4220 FOC.exe 186 PID 1536 wrote to memory of 1724 1536 cmd.exe 190 PID 1724 wrote to memory of 4608 1724 NYLWQ.exe 191 PID 4608 wrote to memory of 5720 4608 cmd.exe 194 PID 5720 wrote to memory of 3968 5720 DWJH.exe 196 PID 3968 wrote to memory of 4236 3968 cmd.exe 200 PID 4236 wrote to memory of 6092 4236 DCKWE.exe 201 PID 6092 wrote to memory of 1580 6092 cmd.exe 204 PID 1580 wrote to memory of 2884 1580 PUNGEQ.exe 206 PID 2884 wrote to memory of 3152 2884 cmd.exe 209 PID 3152 wrote to memory of 1648 3152 QXOVPM.exe 211 PID 1648 wrote to memory of 4864 1648 cmd.exe 215 PID 4864 wrote to memory of 3640 4864 PNVYBX.exe 216 PID 3640 wrote to memory of 5252 3640 cmd.exe 220 PID 5252 wrote to memory of 3092 5252 GYLWAS.exe 221 PID 3092 wrote to memory of 1492 3092 cmd.exe 225 PID 1492 wrote to memory of 5144 1492 HBVDLG.exe 226 PID 5144 wrote to memory of 544 5144 cmd.exe 230 PID 544 wrote to memory of 6104 544 YYUGXZ.exe 231 PID 6104 wrote to memory of 4872 6104 cmd.exe 235 PID 4872 wrote to memory of 3976 4872 SMZ.exe 236 PID 3976 wrote to memory of 2272 3976 cmd.exe 240
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-03_5260aaf2738327099aea811b265481ba_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-03_5260aaf2738327099aea811b265481ba_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUOTH.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\windows\YUOTH.exeC:\windows\YUOTH.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GIBI.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\windows\SysWOW64\GIBI.exeC:\windows\system32\GIBI.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BVFRTX.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\windows\BVFRTX.exeC:\windows\BVFRTX.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GYBQHOD.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\SysWOW64\GYBQHOD.exeC:\windows\system32\GYBQHOD.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBLFRCX.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\windows\system\IBLFRCX.exeC:\windows\system\IBLFRCX.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XWIRTD.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\windows\system\XWIRTD.exeC:\windows\system\XWIRTD.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XJIGDQI.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\SysWOW64\XJIGDQI.exeC:\windows\system32\XJIGDQI.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\THGVKSC.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\windows\SysWOW64\THGVKSC.exeC:\windows\system32\THGVKSC.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSK.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\windows\system\YSK.exeC:\windows\system\YSK.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ESS.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\windows\ESS.exeC:\windows\ESS.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UNPBINO.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\windows\SysWOW64\UNPBINO.exeC:\windows\system32\UNPBINO.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NLI.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\windows\SysWOW64\NLI.exeC:\windows\system32\NLI.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MBPGSVL.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\system\MBPGSVL.exeC:\windows\system\MBPGSVL.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XTS.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\windows\SysWOW64\XTS.exeC:\windows\system32\XTS.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UZPOH.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\windows\SysWOW64\UZPOH.exeC:\windows\system32\UZPOH.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMUFRMJ.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\windows\OMUFRMJ.exeC:\windows\OMUFRMJ.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DSAUYWL.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\windows\DSAUYWL.exeC:\windows\DSAUYWL.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCJW.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\windows\LCJW.exeC:\windows\LCJW.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WVEPU.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\SysWOW64\WVEPU.exeC:\windows\system32\WVEPU.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MLLRY.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\windows\SysWOW64\MLLRY.exeC:\windows\system32\MLLRY.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FOC.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\windows\FOC.exeC:\windows\FOC.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYLWQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\windows\SysWOW64\NYLWQ.exeC:\windows\system32\NYLWQ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DWJH.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\windows\SysWOW64\DWJH.exeC:\windows\system32\DWJH.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCKWE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\windows\DCKWE.exeC:\windows\DCKWE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PUNGEQ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\windows\PUNGEQ.exeC:\windows\PUNGEQ.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QXOVPM.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\windows\SysWOW64\QXOVPM.exeC:\windows\system32\QXOVPM.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PNVYBX.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\windows\system\PNVYBX.exeC:\windows\system\PNVYBX.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYLWAS.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\windows\GYLWAS.exeC:\windows\GYLWAS.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HBVDLG.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\windows\SysWOW64\HBVDLG.exeC:\windows\system32\HBVDLG.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YYUGXZ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\windows\system\YYUGXZ.exeC:\windows\system\YYUGXZ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SMZ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\SysWOW64\SMZ.exeC:\windows\system32\SMZ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MECI.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\windows\MECI.exeC:\windows\MECI.exe65⤵
- Executes dropped EXE
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AKZ.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5772 -
C:\windows\AKZ.exeC:\windows\AKZ.exe67⤵
- Executes dropped EXE
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CABH.exe.bat" "68⤵PID:4600
-
C:\windows\CABH.exeC:\windows\CABH.exe69⤵
- Executes dropped EXE
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PLX.exe.bat" "70⤵PID:2512
-
C:\windows\PLX.exeC:\windows\PLX.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GAERL.exe.bat" "72⤵PID:5184
-
C:\windows\SysWOW64\GAERL.exeC:\windows\system32\GAERL.exe73⤵
- Executes dropped EXE
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTMKZ.exe.bat" "74⤵PID:2180
-
C:\windows\OTMKZ.exeC:\windows\OTMKZ.exe75⤵
- Executes dropped EXE
PID:5348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTGPDA.exe.bat" "76⤵PID:3928
-
C:\windows\XTGPDA.exeC:\windows\XTGPDA.exe77⤵
- Executes dropped EXE
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRHRJPE.exe.bat" "78⤵PID:5892
-
C:\windows\ZRHRJPE.exeC:\windows\ZRHRJPE.exe79⤵
- Executes dropped EXE
PID:5660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUJZUDY.exe.bat" "80⤵PID:848
-
C:\windows\SysWOW64\BUJZUDY.exeC:\windows\system32\BUJZUDY.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XZPWBNA.exe.bat" "82⤵PID:1704
-
C:\windows\XZPWBNA.exeC:\windows\XZPWBNA.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JSS.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3476 -
C:\windows\SysWOW64\JSS.exeC:\windows\system32\JSS.exe85⤵
- Executes dropped EXE
PID:1280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OSZCS.exe.bat" "86⤵PID:5544
-
C:\windows\system\OSZCS.exeC:\windows\system\OSZCS.exe87⤵
- Executes dropped EXE
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FDQAA.exe.bat" "88⤵PID:5592
-
C:\windows\FDQAA.exeC:\windows\FDQAA.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WTXDD.exe.bat" "90⤵PID:3080
-
C:\windows\system\WTXDD.exeC:\windows\system\WTXDD.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HMSWMS.exe.bat" "92⤵PID:5136
-
C:\windows\SysWOW64\HMSWMS.exeC:\windows\system32\HMSWMS.exe93⤵
- Executes dropped EXE
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YZCOBOW.exe.bat" "94⤵PID:3820
-
C:\windows\system\YZCOBOW.exeC:\windows\system\YZCOBOW.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUBRYTF.exe.bat" "96⤵PID:4668
-
C:\windows\system\RUBRYTF.exeC:\windows\system\RUBRYTF.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXDYQHH.exe.bat" "98⤵PID:5824
-
C:\windows\system\SXDYQHH.exeC:\windows\system\SXDYQHH.exe99⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UVWAPWP.exe.bat" "100⤵PID:4060
-
C:\windows\UVWAPWP.exeC:\windows\UVWAPWP.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UFF.exe.bat" "102⤵PID:500
-
C:\windows\system\UFF.exeC:\windows\system\UFF.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDG.exe.bat" "104⤵PID:5672
-
C:\windows\SysWOW64\WDG.exeC:\windows\system32\WDG.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XGKAO.exe.bat" "106⤵PID:1408
-
C:\windows\system\XGKAO.exeC:\windows\system\XGKAO.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZJMHZ.exe.bat" "108⤵PID:5540
-
C:\windows\SysWOW64\ZJMHZ.exeC:\windows\system32\ZJMHZ.exe109⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UROP.exe.bat" "110⤵PID:1864
-
C:\windows\SysWOW64\UROP.exeC:\windows\system32\UROP.exe111⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUPW.exe.bat" "112⤵PID:3196
-
C:\windows\SysWOW64\WUPW.exeC:\windows\system32\WUPW.exe113⤵
- Executes dropped EXE
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSRY.exe.bat" "114⤵PID:1088
-
C:\windows\system\YSRY.exeC:\windows\system\YSRY.exe115⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GCRZH.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:3900 -
C:\windows\GCRZH.exeC:\windows\GCRZH.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXW.exe.bat" "118⤵PID:3224
-
C:\windows\system\NXW.exeC:\windows\system\NXW.exe119⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYRHRGZ.exe.bat" "120⤵PID:1696
-
C:\windows\LYRHRGZ.exeC:\windows\LYRHRGZ.exe121⤵
- Executes dropped EXE
PID:5124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-