Analysis
- max time kernel
98s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 20:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe
- Size 208KB
- Sample260702-y33pasay9p
- SHA256 d5ce47627439dd4e2e06db3d0379a0366f564947acdc72b1d996b07789cfba14
- MD5 779d701a4f0afd12b5280d57edf02269
- SHA1 eafee814d2d56f1b6c7966c9750e1bfc82743506
- SHA512 f38bfec189f9408afa753e97775e8568e58c2bfb9c240f1b32b60fc3bb60a564a73b3799f18498f21d19d02ef7d3adff5085f6ef0d7c13be7069df8bf1a3614d
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfu4NLthEjQT6c:MlZtbLWIgd1LZ9oECZbclc5+LOmQEje
- TLSH T1A5247D2235D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2112 ANMXUJ.exe 5192 OIKQJ.exe 3516 ATHWB.exe 704 IZIKDC.exe 256 MPOKP.exe 2488 CFPKNID.exe 2880 FNWK.exe 428 YQA.exe 4356 EQHBW.exe 5472 VRJGAQE.exe 3444 JBSFO.exe 1064 JEDB.exe 4388 TFXGF.exe 3484 LIJJKMN.exe 1804 XQQJ.exe 4532 SLVBZE.exe 1144 YDC.exe 3008 SZHYS.exe 3100 CZB.exe 5640 RUTH.exe 2868 RXW.exe 5396 BFYQ.exe 5548 MYTJGT.exe 8 WWHDV.exe 5300 RJMNXBH.exe 6020 WJTAOWI.exe 3672 ICO.exe 6044 GCWHGF.exe 1196 RVZSGNO.exe 992 DDGA.exe 2608 OVJSB.exe 5020 XELYESU.exe 5516 NZUCP.exe 2696 HMZLZE.exe 4912 CZE.exe 2128 IVVDOH.exe 5620 OVDRXJ.exe 5136 GYGND.exe 2348 SGV.exe 5476 COXA.exe 240 RJGELCX.exe 3620 JMKIRS.exe 2340 BNMNUXI.exe 1136 DLSH.exe 1776 XYXRMF.exe 5084 PGZW.exe 1404 EBIAJXJ.exe 4440 GZOVQ.exe 2768 GCAY.exe 2464 KKGYIO.exe 5588 FFL.exe 5876 LTKJ.exe 3684 AOUVIEU.exe 124 ABMJJJW.exe 4720 VPRT.exe 3860 PCVCEI.exe 5976 SPA.exe 2824 DQQ.exe 2968 VQSC.exe 5820 KLBOUBH.exe 2276 KZT.exe 5568 GWZS.exe 1544 BREBNQ.exe 2496 QHR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\JEDB.exe JBSFO.exe File created C:\windows\SysWOW64\YDC.exe SLVBZE.exe File created C:\windows\SysWOW64\JMKIRS.exe.bat RJGELCX.exe File created C:\windows\SysWOW64\ABMJJJW.exe AOUVIEU.exe File opened for modification C:\windows\SysWOW64\ZZZM.exe OGWBK.exe File created C:\windows\SysWOW64\KGE.exe.bat PSHHLX.exe File opened for modification C:\windows\SysWOW64\ZPDQ.exe OWA.exe File created C:\windows\SysWOW64\ANMXUJ.exe.bat 2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe File created C:\windows\SysWOW64\NFX.exe QHR.exe File created C:\windows\SysWOW64\JXN.exe.bat ZZZM.exe File created C:\windows\SysWOW64\LVZ.exe.bat UIPJA.exe File created C:\windows\SysWOW64\PSHHLX.exe.bat LKSH.exe File opened for modification C:\windows\SysWOW64\CTATQD.exe HGVK.exe File created C:\windows\SysWOW64\BNMNUXI.exe JMKIRS.exe File created C:\windows\SysWOW64\JBSFO.exe VRJGAQE.exe File opened for modification C:\windows\SysWOW64\MFM.exe XPDEV.exe File created C:\windows\SysWOW64\MFM.exe XPDEV.exe File created C:\windows\SysWOW64\MYTJGT.exe BFYQ.exe File created C:\windows\SysWOW64\OIKQJ.exe.bat ANMXUJ.exe File opened for modification C:\windows\SysWOW64\ATHWB.exe OIKQJ.exe File opened for modification C:\windows\SysWOW64\UCCDS.exe UXCP.exe File created C:\windows\SysWOW64\SZHYS.exe.bat YDC.exe File opened for modification C:\windows\SysWOW64\JMKIRS.exe RJGELCX.exe File opened for modification C:\windows\SysWOW64\UDAEVVZ.exe UXAQMI.exe File created C:\windows\SysWOW64\ZZZM.exe.bat OGWBK.exe File created C:\windows\SysWOW64\ATHWB.exe OIKQJ.exe File opened for modification C:\windows\SysWOW64\YNCE.exe OPXKC.exe File created C:\windows\SysWOW64\VSIT.exe YNCE.exe File created C:\windows\SysWOW64\ZPDQ.exe.bat OWA.exe File created C:\windows\SysWOW64\CTATQD.exe.bat HGVK.exe File created C:\windows\SysWOW64\SZHYS.exe YDC.exe File opened for modification C:\windows\SysWOW64\RVZSGNO.exe GCWHGF.exe File created C:\windows\SysWOW64\GCAY.exe GZOVQ.exe File created C:\windows\SysWOW64\GCAY.exe.bat GZOVQ.exe File opened for modification C:\windows\SysWOW64\NFX.exe QHR.exe File created C:\windows\SysWOW64\JEDB.exe JBSFO.exe File created C:\windows\SysWOW64\UDAEVVZ.exe UXAQMI.exe File opened for modification C:\windows\SysWOW64\JBSFO.exe VRJGAQE.exe File created C:\windows\SysWOW64\RXW.exe RUTH.exe File created C:\windows\SysWOW64\SGV.exe.bat GYGND.exe File opened for modification C:\windows\SysWOW64\COXA.exe SGV.exe File created C:\windows\SysWOW64\NFX.exe.bat QHR.exe File created C:\windows\SysWOW64\LVZ.exe UIPJA.exe File created C:\windows\SysWOW64\PSHHLX.exe LKSH.exe File created C:\windows\SysWOW64\YNCE.exe.bat OPXKC.exe File created C:\windows\SysWOW64\ABMJJJW.exe.bat AOUVIEU.exe File opened for modification C:\windows\SysWOW64\KLBOUBH.exe VQSC.exe File opened for modification C:\windows\SysWOW64\RWK.exe AJAGG.exe File created C:\windows\SysWOW64\RRVAXU.exe.bat HTPG.exe File created C:\windows\SysWOW64\MYTJGT.exe.bat BFYQ.exe File opened for modification C:\windows\SysWOW64\SGV.exe GYGND.exe File created C:\windows\SysWOW64\UIPJA.exe AVK.exe File created C:\windows\SysWOW64\KGE.exe PSHHLX.exe File created C:\windows\SysWOW64\RRVAXU.exe HTPG.exe File created C:\windows\SysWOW64\TFXGF.exe.bat JEDB.exe File opened for modification C:\windows\SysWOW64\OGWBK.exe ZBZ.exe File opened for modification C:\windows\SysWOW64\KGE.exe PSHHLX.exe File created C:\windows\SysWOW64\MJUP.exe.bat ARZX.exe File created C:\windows\SysWOW64\COXA.exe.bat SGV.exe File opened for modification C:\windows\SysWOW64\GCAY.exe GZOVQ.exe File opened for modification C:\windows\SysWOW64\RRVAXU.exe HTPG.exe File created C:\windows\SysWOW64\HSJNM.exe MFM.exe File opened for modification C:\windows\SysWOW64\ANMXUJ.exe 2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe File created C:\windows\SysWOW64\RXW.exe.bat RUTH.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\XXBE.exe GXZZH.exe File opened for modification C:\windows\system\XELYESU.exe OVJSB.exe File opened for modification C:\windows\system\HTPG.exe TNJRICL.exe File created C:\windows\OWA.exe.bat RRVAXU.exe File created C:\windows\system\GCWHGF.exe ICO.exe File created C:\windows\system\UXAQMI.exe DKPYE.exe File opened for modification C:\windows\AJAGG.exe ADHS.exe File created C:\windows\RJMNXBH.exe.bat WWHDV.exe File created C:\windows\system\DQQ.exe.bat SPA.exe File opened for modification C:\windows\system\XQD.exe WNZV.exe File opened for modification C:\windows\system\GLLMZ.exe VSIT.exe File created C:\windows\ICO.exe.bat WJTAOWI.exe File opened for modification C:\windows\system\DDGA.exe RVZSGNO.exe File opened for modification C:\windows\system\PGZW.exe XYXRMF.exe File created C:\windows\ZONJHW.exe QGLEE.exe File opened for modification C:\windows\system\TNJRICL.exe BNHEXE.exe File created C:\windows\XPDEV.exe.bat ZPDQ.exe File created C:\windows\system\WWHDV.exe MYTJGT.exe File created C:\windows\system\OVJSB.exe DDGA.exe File opened for modification C:\windows\PCVCEI.exe VPRT.exe File opened for modification C:\windows\ZPTKLH.exe HMIOFJB.exe File created C:\windows\system\XXBE.exe.bat GXZZH.exe File opened for modification C:\windows\system\GCWHGF.exe ICO.exe File created C:\windows\system\KZT.exe KLBOUBH.exe File opened for modification C:\windows\SEIID.exe XQD.exe File opened for modification C:\windows\CGOWWBG.exe HSJNM.exe File created C:\windows\EQHBW.exe YQA.exe File created C:\windows\system\LTKJ.exe FFL.exe File created C:\windows\system\KZT.exe.bat KLBOUBH.exe File opened for modification C:\windows\system\HMIOFJB.exe GJELA.exe File created C:\windows\system\DDGA.exe RVZSGNO.exe File created C:\windows\system\RJGELCX.exe COXA.exe File created C:\windows\system\DEX.exe OJGFKLF.exe File created C:\windows\AJAGG.exe ADHS.exe File opened for modification C:\windows\UXCP.exe TUYLD.exe File opened for modification C:\windows\KGPZS.exe TGNM.exe File created C:\windows\KGPZS.exe.bat TGNM.exe File created C:\windows\system\PGZW.exe.bat XYXRMF.exe File created C:\windows\system\DQQ.exe SPA.exe File opened for modification C:\windows\system\GWZS.exe KZT.exe File opened for modification C:\windows\XPDEV.exe ZPDQ.exe File created C:\windows\IZIKDC.exe.bat ATHWB.exe File opened for modification C:\windows\RJMNXBH.exe WWHDV.exe File created C:\windows\system\OVJSB.exe.bat DDGA.exe File created C:\windows\system\UXAQMI.exe.bat DKPYE.exe File created C:\windows\system\OPXKC.exe.bat FPVF.exe File created C:\windows\YQA.exe.bat FNWK.exe File created C:\windows\system\BFYQ.exe RXW.exe File opened for modification C:\windows\WJTAOWI.exe RJMNXBH.exe File created C:\windows\system\VQSC.exe.bat DQQ.exe File created C:\windows\DKKPK.exe.bat JXN.exe File created C:\windows\WHLLC.exe.bat KRE.exe File created C:\windows\ZPTKLH.exe HMIOFJB.exe File created C:\windows\system\OPXKC.exe FPVF.exe File opened for modification C:\windows\IZIKDC.exe ATHWB.exe File opened for modification C:\windows\system\LTKJ.exe FFL.exe File created C:\windows\WJTAOWI.exe RJMNXBH.exe File opened for modification C:\windows\system\CZE.exe HMZLZE.exe File opened for modification C:\windows\system\IVVDOH.exe CZE.exe File created C:\windows\system\OVDRXJ.exe.bat IVVDOH.exe File created C:\windows\system\DLSH.exe.bat BNMNUXI.exe File created C:\windows\system\SPA.exe.bat PCVCEI.exe File created C:\windows\system\FPVF.exe ZONJHW.exe File created C:\windows\system\ARZX.exe MLT.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 1356 5936 WerFault.exe 87 3672 2112 WerFault.exe 92 4972 5192 WerFault.exe 98 3752 3516 WerFault.exe 103 4236 704 WerFault.exe 108 1720 256 WerFault.exe 113 2528 2488 WerFault.exe 118 4500 2880 WerFault.exe 123 4940 428 WerFault.exe 128 2584 4356 WerFault.exe 133 1908 5472 WerFault.exe 138 2804 3444 WerFault.exe 143 1232 1064 WerFault.exe 148 5136 4388 WerFault.exe 153 3044 3484 WerFault.exe 158 2120 1804 WerFault.exe 163 5220 4532 WerFault.exe 168 2760 1144 WerFault.exe 173 2680 3008 WerFault.exe 178 2848 3100 WerFault.exe 183 1656 5640 WerFault.exe 188 3592 2868 WerFault.exe 193 4884 5396 WerFault.exe 198 4392 5548 WerFault.exe 203 2008 8 WerFault.exe 208 3304 5300 WerFault.exe 213 4948 6020 WerFault.exe 218 1640 3672 WerFault.exe 223 4676 6044 WerFault.exe 228 276 1196 WerFault.exe 233 1304 992 WerFault.exe 238 5864 2608 WerFault.exe 243 1428 5020 WerFault.exe 248 2700 5516 WerFault.exe 253 2572 2696 WerFault.exe 258 1332 4912 WerFault.exe 263 1800 2128 WerFault.exe 268 5948 5620 WerFault.exe 273 4268 5136 WerFault.exe 279 5284 2348 WerFault.exe 284 4348 5476 WerFault.exe 289 6040 240 WerFault.exe 294 2528 3620 WerFault.exe 299 4280 2340 WerFault.exe 304 5660 1136 WerFault.exe 309 1004 1776 WerFault.exe 314 3524 5084 WerFault.exe 319 2168 1404 WerFault.exe 324 1200 4440 WerFault.exe 329 3884 2768 WerFault.exe 334 5344 2464 WerFault.exe 339 2404 5588 WerFault.exe 344 5740 5876 WerFault.exe 349 3228 3684 WerFault.exe 354 1104 124 WerFault.exe 359 2848 4720 WerFault.exe 364 3748 3860 WerFault.exe 369 2564 5976 WerFault.exe 374 3132 2824 WerFault.exe 379 5056 2968 WerFault.exe 384 6012 5820 WerFault.exe 389 6016 2276 WerFault.exe 394 2728 5568 WerFault.exe 399 3172 1544 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZIKDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGWBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ATHWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MPOKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZZZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVJSB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNJRICL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYGND.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMIOFJB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRJGAQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YFPHULN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNMNUXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVZSGNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TUYLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHLLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANMXUJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFPKNID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SZHYS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WJTAOWI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TGNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKKPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSHHLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XYXRMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCVCEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BREBNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NZUCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HMZLZE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DKPYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5936 2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe 5936 2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe 2112 ANMXUJ.exe 2112 ANMXUJ.exe 5192 OIKQJ.exe 5192 OIKQJ.exe 3516 ATHWB.exe 3516 ATHWB.exe 704 IZIKDC.exe 704 IZIKDC.exe 256 MPOKP.exe 256 MPOKP.exe 2488 CFPKNID.exe 2488 CFPKNID.exe 2880 FNWK.exe 2880 FNWK.exe 428 YQA.exe 428 YQA.exe 4356 EQHBW.exe 4356 EQHBW.exe 5472 VRJGAQE.exe 5472 VRJGAQE.exe 3444 JBSFO.exe 3444 JBSFO.exe 1064 JEDB.exe 1064 JEDB.exe 4388 TFXGF.exe 4388 TFXGF.exe 3484 LIJJKMN.exe 3484 LIJJKMN.exe 1804 XQQJ.exe 1804 XQQJ.exe 4532 SLVBZE.exe 4532 SLVBZE.exe 1144 YDC.exe 1144 YDC.exe 3008 SZHYS.exe 3008 SZHYS.exe 3100 CZB.exe 3100 CZB.exe 5640 RUTH.exe 5640 RUTH.exe 2868 RXW.exe 2868 RXW.exe 5396 BFYQ.exe 5396 BFYQ.exe 5548 MYTJGT.exe 5548 MYTJGT.exe 8 WWHDV.exe 8 WWHDV.exe 5300 RJMNXBH.exe 5300 RJMNXBH.exe 6020 WJTAOWI.exe 6020 WJTAOWI.exe 3672 ICO.exe 3672 ICO.exe 6044 GCWHGF.exe 6044 GCWHGF.exe 1196 RVZSGNO.exe 1196 RVZSGNO.exe 992 DDGA.exe 992 DDGA.exe 2608 OVJSB.exe 2608 OVJSB.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5936 2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe 5936 2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe 2112 ANMXUJ.exe 2112 ANMXUJ.exe 5192 OIKQJ.exe 5192 OIKQJ.exe 3516 ATHWB.exe 3516 ATHWB.exe 704 IZIKDC.exe 704 IZIKDC.exe 256 MPOKP.exe 256 MPOKP.exe 2488 CFPKNID.exe 2488 CFPKNID.exe 2880 FNWK.exe 2880 FNWK.exe 428 YQA.exe 428 YQA.exe 4356 EQHBW.exe 4356 EQHBW.exe 5472 VRJGAQE.exe 5472 VRJGAQE.exe 3444 JBSFO.exe 3444 JBSFO.exe 1064 JEDB.exe 1064 JEDB.exe 4388 TFXGF.exe 4388 TFXGF.exe 3484 LIJJKMN.exe 3484 LIJJKMN.exe 1804 XQQJ.exe 1804 XQQJ.exe 4532 SLVBZE.exe 4532 SLVBZE.exe 1144 YDC.exe 1144 YDC.exe 3008 SZHYS.exe 3008 SZHYS.exe 3100 CZB.exe 3100 CZB.exe 5640 RUTH.exe 5640 RUTH.exe 2868 RXW.exe 2868 RXW.exe 5396 BFYQ.exe 5396 BFYQ.exe 5548 MYTJGT.exe 5548 MYTJGT.exe 8 WWHDV.exe 8 WWHDV.exe 5300 RJMNXBH.exe 5300 RJMNXBH.exe 6020 WJTAOWI.exe 6020 WJTAOWI.exe 3672 ICO.exe 3672 ICO.exe 6044 GCWHGF.exe 6044 GCWHGF.exe 1196 RVZSGNO.exe 1196 RVZSGNO.exe 992 DDGA.exe 992 DDGA.exe 2608 OVJSB.exe 2608 OVJSB.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5936 wrote to memory of 1636 5936 2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe 88 PID 1636 wrote to memory of 2112 1636 cmd.exe 92 PID 2112 wrote to memory of 5312 2112 ANMXUJ.exe 94 PID 5312 wrote to memory of 5192 5312 cmd.exe 98 PID 5192 wrote to memory of 2900 5192 OIKQJ.exe 99 PID 2900 wrote to memory of 3516 2900 cmd.exe 103 PID 3516 wrote to memory of 5932 3516 ATHWB.exe 104 PID 5932 wrote to memory of 704 5932 cmd.exe 108 PID 704 wrote to memory of 2676 704 IZIKDC.exe 109 PID 2676 wrote to memory of 256 2676 cmd.exe 113 PID 256 wrote to memory of 4104 256 MPOKP.exe 114 PID 4104 wrote to memory of 2488 4104 cmd.exe 118 PID 2488 wrote to memory of 2712 2488 CFPKNID.exe 119 PID 2712 wrote to memory of 2880 2712 cmd.exe 123 PID 2880 wrote to memory of 4144 2880 FNWK.exe 124 PID 4144 wrote to memory of 428 4144 cmd.exe 128 PID 428 wrote to memory of 4512 428 YQA.exe 129 PID 4512 wrote to memory of 4356 4512 cmd.exe 133 PID 4356 wrote to memory of 5384 4356 EQHBW.exe 134 PID 5384 wrote to memory of 5472 5384 cmd.exe 138 PID 5472 wrote to memory of 3880 5472 VRJGAQE.exe 139 PID 3880 wrote to memory of 3444 3880 cmd.exe 143 PID 3444 wrote to memory of 3772 3444 JBSFO.exe 144 PID 3772 wrote to memory of 1064 3772 cmd.exe 148 PID 1064 wrote to memory of 5288 1064 JEDB.exe 149 PID 5288 wrote to memory of 4388 5288 cmd.exe 153 PID 4388 wrote to memory of 1348 4388 TFXGF.exe 154 PID 1348 wrote to memory of 3484 1348 cmd.exe 158 PID 3484 wrote to memory of 2320 3484 LIJJKMN.exe 159 PID 2320 wrote to memory of 1804 2320 cmd.exe 163 PID 1804 wrote to memory of 2576 1804 XQQJ.exe 164 PID 2576 wrote to memory of 4532 2576 cmd.exe 168 PID 4532 wrote to memory of 4256 4532 SLVBZE.exe 169 PID 4256 wrote to memory of 1144 4256 cmd.exe 173 PID 1144 wrote to memory of 4236 1144 YDC.exe 174 PID 4236 wrote to memory of 3008 4236 cmd.exe 178 PID 3008 wrote to memory of 4092 3008 SZHYS.exe 179 PID 4092 wrote to memory of 3100 4092 cmd.exe 183 PID 3100 wrote to memory of 1248 3100 CZB.exe 184 PID 1248 wrote to memory of 5640 1248 cmd.exe 188 PID 5640 wrote to memory of 4160 5640 RUTH.exe 189 PID 4160 wrote to memory of 2868 4160 cmd.exe 193 PID 2868 wrote to memory of 4568 2868 RXW.exe 194 PID 4568 wrote to memory of 5396 4568 cmd.exe 198 PID 5396 wrote to memory of 4956 5396 BFYQ.exe 199 PID 4956 wrote to memory of 5548 4956 cmd.exe 203 PID 5548 wrote to memory of 1056 5548 MYTJGT.exe 204 PID 1056 wrote to memory of 8 1056 cmd.exe 208 PID 8 wrote to memory of 3988 8 WWHDV.exe 209 PID 3988 wrote to memory of 5300 3988 cmd.exe 213 PID 5300 wrote to memory of 4996 5300 RJMNXBH.exe 214 PID 4996 wrote to memory of 6020 4996 cmd.exe 218 PID 6020 wrote to memory of 4724 6020 WJTAOWI.exe 219 PID 4724 wrote to memory of 3672 4724 cmd.exe 223 PID 3672 wrote to memory of 5252 3672 ICO.exe 224 PID 5252 wrote to memory of 6044 5252 cmd.exe 228 PID 6044 wrote to memory of 1088 6044 GCWHGF.exe 229 PID 1088 wrote to memory of 1196 1088 cmd.exe 233 PID 1196 wrote to memory of 6136 1196 RVZSGNO.exe 234 PID 6136 wrote to memory of 992 6136 cmd.exe 238 PID 992 wrote to memory of 4476 992 DDGA.exe 239 PID 4476 wrote to memory of 2608 4476 cmd.exe 243 PID 2608 wrote to memory of 4520 2608 OVJSB.exe 244 PID 4520 wrote to memory of 5020 4520 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_779d701a4f0afd12b5280d57edf02269_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANMXUJ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\windows\SysWOW64\ANMXUJ.exeC:\windows\system32\ANMXUJ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIKQJ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\windows\SysWOW64\OIKQJ.exeC:\windows\system32\OIKQJ.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATHWB.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\windows\SysWOW64\ATHWB.exeC:\windows\system32\ATHWB.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZIKDC.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\IZIKDC.exeC:\windows\IZIKDC.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MPOKP.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\windows\system\MPOKP.exeC:\windows\system\MPOKP.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CFPKNID.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\windows\CFPKNID.exeC:\windows\CFPKNID.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FNWK.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\windows\system\FNWK.exeC:\windows\system\FNWK.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YQA.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\windows\YQA.exeC:\windows\YQA.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQHBW.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\windows\EQHBW.exeC:\windows\EQHBW.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VRJGAQE.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\windows\VRJGAQE.exeC:\windows\VRJGAQE.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JBSFO.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\windows\SysWOW64\JBSFO.exeC:\windows\system32\JBSFO.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JEDB.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\windows\SysWOW64\JEDB.exeC:\windows\system32\JEDB.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TFXGF.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\windows\SysWOW64\TFXGF.exeC:\windows\system32\TFXGF.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIJJKMN.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\windows\system\LIJJKMN.exeC:\windows\system\LIJJKMN.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XQQJ.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\windows\XQQJ.exeC:\windows\XQQJ.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLVBZE.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\SLVBZE.exeC:\windows\SLVBZE.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YDC.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\windows\SysWOW64\YDC.exeC:\windows\system32\YDC.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZHYS.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\windows\SysWOW64\SZHYS.exeC:\windows\system32\SZHYS.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZB.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\windows\system\CZB.exeC:\windows\system\CZB.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RUTH.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\windows\system\RUTH.exeC:\windows\system\RUTH.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RXW.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\windows\SysWOW64\RXW.exeC:\windows\system32\RXW.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BFYQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\windows\system\BFYQ.exeC:\windows\system\BFYQ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYTJGT.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\SysWOW64\MYTJGT.exeC:\windows\system32\MYTJGT.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WWHDV.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\system\WWHDV.exeC:\windows\system\WWHDV.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJMNXBH.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\windows\RJMNXBH.exeC:\windows\RJMNXBH.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJTAOWI.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\windows\WJTAOWI.exeC:\windows\WJTAOWI.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ICO.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\windows\ICO.exeC:\windows\ICO.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCWHGF.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\windows\system\GCWHGF.exeC:\windows\system\GCWHGF.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVZSGNO.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\windows\SysWOW64\RVZSGNO.exeC:\windows\system32\RVZSGNO.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DDGA.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\windows\system\DDGA.exeC:\windows\system\DDGA.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVJSB.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\windows\system\OVJSB.exeC:\windows\system\OVJSB.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XELYESU.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\system\XELYESU.exeC:\windows\system\XELYESU.exe65⤵
- Executes dropped EXE
PID:5020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NZUCP.exe.bat" "66⤵PID:3092
-
C:\windows\NZUCP.exeC:\windows\NZUCP.exe67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HMZLZE.exe.bat" "68⤵PID:2072
-
C:\windows\system\HMZLZE.exeC:\windows\system\HMZLZE.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZE.exe.bat" "70⤵PID:2172
-
C:\windows\system\CZE.exeC:\windows\system\CZE.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IVVDOH.exe.bat" "72⤵PID:4980
-
C:\windows\system\IVVDOH.exeC:\windows\system\IVVDOH.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVDRXJ.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3360 -
C:\windows\system\OVDRXJ.exeC:\windows\system\OVDRXJ.exe75⤵
- Executes dropped EXE
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYGND.exe.bat" "76⤵PID:2344
-
C:\windows\GYGND.exeC:\windows\GYGND.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGV.exe.bat" "78⤵PID:1752
-
C:\windows\SysWOW64\SGV.exeC:\windows\system32\SGV.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COXA.exe.bat" "80⤵PID:5080
-
C:\windows\SysWOW64\COXA.exeC:\windows\system32\COXA.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJGELCX.exe.bat" "82⤵PID:3568
-
C:\windows\system\RJGELCX.exeC:\windows\system\RJGELCX.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JMKIRS.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3040 -
C:\windows\SysWOW64\JMKIRS.exeC:\windows\system32\JMKIRS.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNMNUXI.exe.bat" "86⤵PID:5332
-
C:\windows\SysWOW64\BNMNUXI.exeC:\windows\system32\BNMNUXI.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLSH.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:948 -
C:\windows\system\DLSH.exeC:\windows\system\DLSH.exe89⤵
- Executes dropped EXE
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XYXRMF.exe.bat" "90⤵PID:1252
-
C:\windows\XYXRMF.exeC:\windows\XYXRMF.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGZW.exe.bat" "92⤵PID:2560
-
C:\windows\system\PGZW.exeC:\windows\system\PGZW.exe93⤵
- Executes dropped EXE
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBIAJXJ.exe.bat" "94⤵PID:2792
-
C:\windows\system\EBIAJXJ.exeC:\windows\system\EBIAJXJ.exe95⤵
- Executes dropped EXE
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZOVQ.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:3332 -
C:\windows\system\GZOVQ.exeC:\windows\system\GZOVQ.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GCAY.exe.bat" "98⤵PID:3244
-
C:\windows\SysWOW64\GCAY.exeC:\windows\system32\GCAY.exe99⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKGYIO.exe.bat" "100⤵PID:4680
-
C:\windows\system\KKGYIO.exeC:\windows\system\KKGYIO.exe101⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FFL.exe.bat" "102⤵PID:4552
-
C:\windows\system\FFL.exeC:\windows\system\FFL.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LTKJ.exe.bat" "104⤵PID:4312
-
C:\windows\system\LTKJ.exeC:\windows\system\LTKJ.exe105⤵
- Executes dropped EXE
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AOUVIEU.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3048 -
C:\windows\system\AOUVIEU.exeC:\windows\system\AOUVIEU.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABMJJJW.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:276 -
C:\windows\SysWOW64\ABMJJJW.exeC:\windows\system32\ABMJJJW.exe109⤵
- Executes dropped EXE
PID:124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VPRT.exe.bat" "110⤵PID:2004
-
C:\windows\VPRT.exeC:\windows\VPRT.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PCVCEI.exe.bat" "112⤵PID:4408
-
C:\windows\PCVCEI.exeC:\windows\PCVCEI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SPA.exe.bat" "114⤵PID:2156
-
C:\windows\system\SPA.exeC:\windows\system\SPA.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQQ.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4396 -
C:\windows\system\DQQ.exeC:\windows\system\DQQ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VQSC.exe.bat" "118⤵PID:2424
-
C:\windows\system\VQSC.exeC:\windows\system\VQSC.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLBOUBH.exe.bat" "120⤵PID:3328
-
C:\windows\SysWOW64\KLBOUBH.exeC:\windows\system32\KLBOUBH.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-