Analysis
- max time kernel
87s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 02:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe
- Size 448KB
- Sample260707-cl4dlscy8n
- SHA256 64f4426befba5d228e07b5b5c1b2c75cd4c8fa6c6a19540d7fafeb7856004e73
- MD5 954e68fa5bac8cddf109317cb3c685f5
- SHA1 1a07fed910da349f09c98280a2a5edce1bdec1dd
- SHA512 5f026a53cf47d505ad862c0fe795fa192a52c4338b7baa7d5194e0f0305cd998e55d762bf73a7bceb7f32c7fdc5098d92b66bff32a3f7616384ad7d0d748d551
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOskEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOskmZzcukG2/
- TLSH T164A49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1832 NMJIWYM.exe 5620 XEF.exe 592 EPDPBM.exe 3112 AQESF.exe 1212 MYLSSAO.exe 3068 JYVCVE.exe 1340 LWAOLM.exe 5940 KHLEL.exe 1484 SUQL.exe 2400 NXGKKCL.exe 2360 EFNPXTO.exe 4288 XIQLCI.exe 4776 FODRNH.exe 5236 EZGHW.exe 1548 HPPE.exe 2524 PUO.exe 5912 CAOPYL.exe 2124 HGGEOGD.exe 2652 BOH.exe 2496 AZSIE.exe 3500 ZHKGSR.exe 708 NFSS.exe 3912 IQBQIFN.exe 3268 FQLTUJW.exe 3788 YLOOZ.exe 4248 AGGYTK.exe 1040 OEGKV.exe 1272 IZLTFW.exe 3392 UCV.exe 1524 YLCGSB.exe 5080 MGNHG.exe 3848 UTSOR.exe 1456 ERS.exe 4560 DCVQQWM.exe 3324 SSWI.exe 2004 EKLT.exe 2972 IASBSC.exe 2616 GLVRT.exe 4332 AEKCK.exe 4760 GZJCPM.exe 1500 VUTH.exe 5920 OXX.exe 5328 WDBRQVW.exe 2092 JIJDSH.exe 5924 ROOKC.exe 2580 VEU.exe 1284 EHLF.exe 4832 LXUFKVO.exe 3660 KIWVTB.exe 1368 FLFL.exe 4592 JBLULE.exe 1048 PWX.exe 5464 TEEUL.exe 4564 IUFM.exe 4152 CMUXBZV.exe 5076 CAU.exe 5708 GIBTPEM.exe 992 QGHG.exe 1688 ZOJ.exe 6040 BBNCK.exe 2040 NUD.exe 3004 LFGDCRQ.exe 2568 RFNR.exe 4860 MSSAVT.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\IZLTFW.exe OEGKV.exe File created C:\windows\SysWOW64\IZLTFW.exe.bat OEGKV.exe File created C:\windows\SysWOW64\VEU.exe ROOKC.exe File opened for modification C:\windows\SysWOW64\BBNCK.exe ZOJ.exe File created C:\windows\SysWOW64\HXICIUS.exe FZVHSMJ.exe File opened for modification C:\windows\SysWOW64\HXICIUS.exe FZVHSMJ.exe File opened for modification C:\windows\SysWOW64\SUQL.exe KHLEL.exe File created C:\windows\SysWOW64\FQLTUJW.exe IQBQIFN.exe File created C:\windows\SysWOW64\WRUEHMC.exe WORJU.exe File created C:\windows\SysWOW64\UDFCDZR.exe.bat DDDX.exe File opened for modification C:\windows\SysWOW64\OSDEE.exe EUXSX.exe File created C:\windows\SysWOW64\ZHKGSR.exe AZSIE.exe File created C:\windows\SysWOW64\UCV.exe IZLTFW.exe File opened for modification C:\windows\SysWOW64\DCVQQWM.exe ERS.exe File opened for modification C:\windows\SysWOW64\JIJDSH.exe WDBRQVW.exe File opened for modification C:\windows\SysWOW64\VEU.exe ROOKC.exe File created C:\windows\SysWOW64\CAU.exe CMUXBZV.exe File opened for modification C:\windows\SysWOW64\CAU.exe CMUXBZV.exe File created C:\windows\SysWOW64\HVGIRRB.exe OSDEE.exe File created C:\windows\SysWOW64\FQLTUJW.exe.bat IQBQIFN.exe File opened for modification C:\windows\SysWOW64\UCV.exe IZLTFW.exe File opened for modification C:\windows\SysWOW64\AEKCK.exe GLVRT.exe File created C:\windows\SysWOW64\MOPW.exe XLFRFE.exe File created C:\windows\SysWOW64\LGXJRBE.exe KKT.exe File opened for modification C:\windows\SysWOW64\LGXJRBE.exe KKT.exe File created C:\windows\SysWOW64\HVGIRRB.exe.bat OSDEE.exe File created C:\windows\SysWOW64\SUQL.exe KHLEL.exe File opened for modification C:\windows\SysWOW64\FQLTUJW.exe IQBQIFN.exe File created C:\windows\SysWOW64\IZLTFW.exe OEGKV.exe File created C:\windows\SysWOW64\AEKCK.exe.bat GLVRT.exe File created C:\windows\SysWOW64\VEU.exe.bat ROOKC.exe File created C:\windows\SysWOW64\VBUFHQI.exe.bat MSSAVT.exe File created C:\windows\SysWOW64\CMQYQM.exe.bat LBNIHGY.exe File opened for modification C:\windows\SysWOW64\MOPW.exe XLFRFE.exe File created C:\windows\SysWOW64\FLFL.exe KIWVTB.exe File created C:\windows\SysWOW64\CAU.exe.bat CMUXBZV.exe File created C:\windows\SysWOW64\MOPW.exe.bat XLFRFE.exe File opened for modification C:\windows\SysWOW64\WRUEHMC.exe WORJU.exe File opened for modification C:\windows\SysWOW64\TCF.exe JCDDVXX.exe File opened for modification C:\windows\SysWOW64\UDFCDZR.exe DDDX.exe File created C:\windows\SysWOW64\OSDEE.exe EUXSX.exe File opened for modification C:\windows\SysWOW64\HVGIRRB.exe OSDEE.exe File created C:\windows\SysWOW64\YLCGSB.exe.bat UCV.exe File created C:\windows\SysWOW64\SJQQ.exe WEYBMG.exe File created C:\windows\SysWOW64\CMQYQM.exe LBNIHGY.exe File created C:\windows\SysWOW64\TCF.exe.bat JCDDVXX.exe File created C:\windows\SysWOW64\VRDSI.exe FBCT.exe File opened for modification C:\windows\SysWOW64\CQRJGFN.exe UDFCDZR.exe File opened for modification C:\windows\SysWOW64\AZSIE.exe BOH.exe File opened for modification C:\windows\SysWOW64\ZHKGSR.exe AZSIE.exe File created C:\windows\SysWOW64\UCV.exe.bat IZLTFW.exe File created C:\windows\SysWOW64\DCVQQWM.exe ERS.exe File created C:\windows\SysWOW64\AEKCK.exe GLVRT.exe File created C:\windows\SysWOW64\CQRJGFN.exe.bat UDFCDZR.exe File created C:\windows\SysWOW64\DCVQQWM.exe.bat ERS.exe File opened for modification C:\windows\SysWOW64\FLFL.exe KIWVTB.exe File created C:\windows\SysWOW64\FLFL.exe.bat KIWVTB.exe File opened for modification C:\windows\SysWOW64\CMQYQM.exe LBNIHGY.exe File created C:\windows\SysWOW64\WRUEHMC.exe.bat WORJU.exe File created C:\windows\SysWOW64\TCF.exe JCDDVXX.exe File created C:\windows\SysWOW64\OSDEE.exe.bat EUXSX.exe File opened for modification C:\windows\SysWOW64\YLCGSB.exe UCV.exe File created C:\windows\SysWOW64\YLCGSB.exe UCV.exe File created C:\windows\SysWOW64\HXICIUS.exe.bat FZVHSMJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\GZJCPM.exe AEKCK.exe File created C:\windows\KIWVTB.exe.bat LXUFKVO.exe File opened for modification C:\windows\LFGDCRQ.exe NUD.exe File created C:\windows\OEGKV.exe.bat AGGYTK.exe File created C:\windows\SSWI.exe.bat DCVQQWM.exe File created C:\windows\system\JBLULE.exe.bat FLFL.exe File created C:\windows\RFNR.exe LFGDCRQ.exe File created C:\windows\EUXSX.exe.bat MRL.exe File created C:\windows\IQBQIFN.exe.bat NFSS.exe File opened for modification C:\windows\system\IASBSC.exe EKLT.exe File created C:\windows\LFGDCRQ.exe.bat NUD.exe File opened for modification C:\windows\system\LBNIHGY.exe PWHTAWF.exe File created C:\windows\system\JCDDVXX.exe WRUEHMC.exe File created C:\windows\DDDX.exe OIT.exe File created C:\windows\CMUXBZV.exe.bat IUFM.exe File created C:\windows\system\ECLJLR.exe.bat SJQQ.exe File created C:\windows\system\NNSXYW.exe SANO.exe File created C:\windows\system\HPPE.exe EZGHW.exe File created C:\windows\system\HPPE.exe.bat EZGHW.exe File created C:\windows\system\PUO.exe.bat HPPE.exe File created C:\windows\TSMJ.exe ECLJLR.exe File created C:\windows\system\NNSXYW.exe.bat SANO.exe File created C:\windows\system\EFNPXTO.exe.bat NXGKKCL.exe File opened for modification C:\windows\system\UTSOR.exe MGNHG.exe File opened for modification C:\windows\system\ERS.exe UTSOR.exe File opened for modification C:\windows\HAMF.exe HXICIUS.exe File created C:\windows\NXGKKCL.exe.bat SUQL.exe File opened for modification C:\windows\system\EZGHW.exe FODRNH.exe File created C:\windows\GLVRT.exe IASBSC.exe File opened for modification C:\windows\system\FZVHSMJ.exe CMQYQM.exe File opened for modification C:\windows\system\PUO.exe HPPE.exe File created C:\windows\HAMF.exe HXICIUS.exe File created C:\windows\system\PUO.exe HPPE.exe File created C:\windows\BOH.exe HGGEOGD.exe File created C:\windows\EHLF.exe.bat VEU.exe File opened for modification C:\windows\TEEUL.exe PWX.exe File created C:\windows\XIQLCI.exe.bat EFNPXTO.exe File opened for modification C:\windows\YLOOZ.exe FQLTUJW.exe File created C:\windows\system\UTSOR.exe MGNHG.exe File created C:\windows\QGHG.exe GIBTPEM.exe File created C:\windows\system\NUD.exe.bat BBNCK.exe File created C:\windows\system\XEF.exe NMJIWYM.exe File created C:\windows\system\FODRNH.exe.bat XIQLCI.exe File created C:\windows\AGGYTK.exe.bat YLOOZ.exe File opened for modification C:\windows\PWX.exe JBLULE.exe File created C:\windows\system\NUD.exe BBNCK.exe File created C:\windows\ZSUW.exe TSMJ.exe File created C:\windows\system\XVVKYFC.exe.bat HAMF.exe File opened for modification C:\windows\WDBRQVW.exe OXX.exe File created C:\windows\system\IUFM.exe.bat TEEUL.exe File opened for modification C:\windows\UFZGDG.exe ZSUW.exe File opened for modification C:\windows\system\XVVKYFC.exe HAMF.exe File opened for modification C:\windows\system\EFNPXTO.exe NXGKKCL.exe File created C:\windows\XIQLCI.exe EFNPXTO.exe File opened for modification C:\windows\GLVRT.exe IASBSC.exe File opened for modification C:\windows\system\IUFM.exe TEEUL.exe File opened for modification C:\windows\NGYAHL.exe XVVKYFC.exe File created C:\windows\CAOPYL.exe PUO.exe File created C:\windows\YLOOZ.exe FQLTUJW.exe File opened for modification C:\windows\OEGKV.exe AGGYTK.exe File created C:\windows\system\XLFRFE.exe.bat NNSXYW.exe File created C:\windows\system\EFNPXTO.exe NXGKKCL.exe File created C:\windows\ROOKC.exe.bat JIJDSH.exe File opened for modification C:\windows\EUXSX.exe MRL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 4452 5496 WerFault.exe 86 1876 1832 WerFault.exe 91 4780 5620 WerFault.exe 97 2960 592 WerFault.exe 102 5284 3112 WerFault.exe 107 4564 1212 WerFault.exe 112 2032 3068 WerFault.exe 117 2100 1340 WerFault.exe 122 1900 5940 WerFault.exe 127 3324 1484 WerFault.exe 132 6008 2400 WerFault.exe 137 4184 2360 WerFault.exe 141 3128 4288 WerFault.exe 147 1684 4776 WerFault.exe 152 4468 5236 WerFault.exe 157 4740 1548 WerFault.exe 162 1296 2524 WerFault.exe 167 5000 5912 WerFault.exe 172 4616 2124 WerFault.exe 177 5444 2652 WerFault.exe 182 1456 2496 WerFault.exe 187 4072 3500 WerFault.exe 192 3000 708 WerFault.exe 197 2752 3912 WerFault.exe 202 3368 3268 WerFault.exe 207 5096 3788 WerFault.exe 212 3844 4248 WerFault.exe 217 1472 1040 WerFault.exe 222 5472 1272 WerFault.exe 227 3736 3392 WerFault.exe 232 1216 1524 WerFault.exe 237 2092 5080 WerFault.exe 242 5544 3848 WerFault.exe 247 2316 1456 WerFault.exe 252 1284 4560 WerFault.exe 257 2596 3324 WerFault.exe 262 2428 2004 WerFault.exe 267 1144 2972 WerFault.exe 272 1268 2616 WerFault.exe 277 3876 4332 WerFault.exe 282 3508 4760 WerFault.exe 287 2120 1500 WerFault.exe 292 4568 5920 WerFault.exe 297 3236 5328 WerFault.exe 302 1900 2092 WerFault.exe 307 3192 5924 WerFault.exe 312 3260 2580 WerFault.exe 317 3084 1284 WerFault.exe 322 3584 4832 WerFault.exe 327 924 3660 WerFault.exe 332 2748 1368 WerFault.exe 337 4120 4592 WerFault.exe 342 2568 1048 WerFault.exe 347 5188 5464 WerFault.exe 352 3724 4564 WerFault.exe 357 5272 4152 WerFault.exe 362 996 5076 WerFault.exe 367 1720 5708 WerFault.exe 372 6112 992 WerFault.exe 377 5728 1688 WerFault.exe 382 432 6040 WerFault.exe 387 6140 2040 WerFault.exe 392 4224 3004 WerFault.exe 397 6028 2568 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZJCPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGNHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ERS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIBTPEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBUFHQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HPPE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IQBQIFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGHG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XIQLCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FODRNH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAOPYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKLT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROOKC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZVHSMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZGHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UFZGDG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JCDDVXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BRK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDFCDZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDDX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHLEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TEEUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MRL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HGGEOGD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEGKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCF.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5496 2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe 5496 2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe 1832 NMJIWYM.exe 1832 NMJIWYM.exe 5620 XEF.exe 5620 XEF.exe 592 EPDPBM.exe 592 EPDPBM.exe 3112 AQESF.exe 3112 AQESF.exe 1212 MYLSSAO.exe 1212 MYLSSAO.exe 3068 JYVCVE.exe 3068 JYVCVE.exe 1340 LWAOLM.exe 1340 LWAOLM.exe 5940 KHLEL.exe 5940 KHLEL.exe 1484 SUQL.exe 1484 SUQL.exe 2400 NXGKKCL.exe 2400 NXGKKCL.exe 2360 EFNPXTO.exe 2360 EFNPXTO.exe 4288 XIQLCI.exe 4288 XIQLCI.exe 4776 FODRNH.exe 4776 FODRNH.exe 5236 EZGHW.exe 5236 EZGHW.exe 1548 HPPE.exe 1548 HPPE.exe 2524 PUO.exe 2524 PUO.exe 5912 CAOPYL.exe 5912 CAOPYL.exe 2124 HGGEOGD.exe 2124 HGGEOGD.exe 2652 BOH.exe 2652 BOH.exe 2496 AZSIE.exe 2496 AZSIE.exe 3500 ZHKGSR.exe 3500 ZHKGSR.exe 708 NFSS.exe 708 NFSS.exe 3912 IQBQIFN.exe 3912 IQBQIFN.exe 3268 FQLTUJW.exe 3268 FQLTUJW.exe 3788 YLOOZ.exe 3788 YLOOZ.exe 4248 AGGYTK.exe 4248 AGGYTK.exe 1040 OEGKV.exe 1040 OEGKV.exe 1272 IZLTFW.exe 1272 IZLTFW.exe 3392 UCV.exe 3392 UCV.exe 1524 YLCGSB.exe 1524 YLCGSB.exe 5080 MGNHG.exe 5080 MGNHG.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5496 2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe 5496 2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe 1832 NMJIWYM.exe 1832 NMJIWYM.exe 5620 XEF.exe 5620 XEF.exe 592 EPDPBM.exe 592 EPDPBM.exe 3112 AQESF.exe 3112 AQESF.exe 1212 MYLSSAO.exe 1212 MYLSSAO.exe 3068 JYVCVE.exe 3068 JYVCVE.exe 1340 LWAOLM.exe 1340 LWAOLM.exe 5940 KHLEL.exe 5940 KHLEL.exe 1484 SUQL.exe 1484 SUQL.exe 2400 NXGKKCL.exe 2400 NXGKKCL.exe 2360 EFNPXTO.exe 2360 EFNPXTO.exe 4288 XIQLCI.exe 4288 XIQLCI.exe 4776 FODRNH.exe 4776 FODRNH.exe 5236 EZGHW.exe 5236 EZGHW.exe 1548 HPPE.exe 1548 HPPE.exe 2524 PUO.exe 2524 PUO.exe 5912 CAOPYL.exe 5912 CAOPYL.exe 2124 HGGEOGD.exe 2124 HGGEOGD.exe 2652 BOH.exe 2652 BOH.exe 2496 AZSIE.exe 2496 AZSIE.exe 3500 ZHKGSR.exe 3500 ZHKGSR.exe 708 NFSS.exe 708 NFSS.exe 3912 IQBQIFN.exe 3912 IQBQIFN.exe 3268 FQLTUJW.exe 3268 FQLTUJW.exe 3788 YLOOZ.exe 3788 YLOOZ.exe 4248 AGGYTK.exe 4248 AGGYTK.exe 1040 OEGKV.exe 1040 OEGKV.exe 1272 IZLTFW.exe 1272 IZLTFW.exe 3392 UCV.exe 3392 UCV.exe 1524 YLCGSB.exe 1524 YLCGSB.exe 5080 MGNHG.exe 5080 MGNHG.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5496 wrote to memory of 1672 5496 2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe 87 PID 1672 wrote to memory of 1832 1672 cmd.exe 91 PID 1832 wrote to memory of 1924 1832 NMJIWYM.exe 93 PID 1924 wrote to memory of 5620 1924 cmd.exe 97 PID 5620 wrote to memory of 5020 5620 XEF.exe 98 PID 5020 wrote to memory of 592 5020 cmd.exe 102 PID 592 wrote to memory of 1552 592 EPDPBM.exe 103 PID 1552 wrote to memory of 3112 1552 cmd.exe 107 PID 3112 wrote to memory of 2640 3112 AQESF.exe 108 PID 2640 wrote to memory of 1212 2640 cmd.exe 112 PID 1212 wrote to memory of 276 1212 MYLSSAO.exe 113 PID 276 wrote to memory of 3068 276 cmd.exe 117 PID 3068 wrote to memory of 5492 3068 JYVCVE.exe 118 PID 5492 wrote to memory of 1340 5492 cmd.exe 122 PID 1340 wrote to memory of 1116 1340 LWAOLM.exe 123 PID 1116 wrote to memory of 5940 1116 cmd.exe 127 PID 5940 wrote to memory of 5916 5940 KHLEL.exe 128 PID 5916 wrote to memory of 1484 5916 cmd.exe 132 PID 1484 wrote to memory of 4132 1484 SUQL.exe 133 PID 4132 wrote to memory of 2400 4132 cmd.exe 137 PID 2400 wrote to memory of 4076 2400 NXGKKCL.exe 138 PID 4076 wrote to memory of 2360 4076 cmd.exe 141 PID 2360 wrote to memory of 5404 2360 EFNPXTO.exe 143 PID 5404 wrote to memory of 4288 5404 cmd.exe 147 PID 4288 wrote to memory of 4500 4288 XIQLCI.exe 148 PID 4776 wrote to memory of 3824 4776 FODRNH.exe 153 PID 3824 wrote to memory of 5236 3824 cmd.exe 157 PID 5236 wrote to memory of 1820 5236 EZGHW.exe 158 PID 1820 wrote to memory of 1548 1820 cmd.exe 162 PID 1548 wrote to memory of 5180 1548 HPPE.exe 163 PID 5180 wrote to memory of 2524 5180 cmd.exe 167 PID 2524 wrote to memory of 1400 2524 PUO.exe 168 PID 1400 wrote to memory of 5912 1400 cmd.exe 172 PID 5912 wrote to memory of 1816 5912 CAOPYL.exe 173 PID 1816 wrote to memory of 2124 1816 cmd.exe 177 PID 2124 wrote to memory of 3852 2124 HGGEOGD.exe 178 PID 3852 wrote to memory of 2652 3852 cmd.exe 182 PID 2652 wrote to memory of 6004 2652 BOH.exe 183 PID 6004 wrote to memory of 2496 6004 cmd.exe 187 PID 2496 wrote to memory of 5516 2496 AZSIE.exe 188 PID 5516 wrote to memory of 3500 5516 cmd.exe 192 PID 3500 wrote to memory of 1444 3500 ZHKGSR.exe 193 PID 1444 wrote to memory of 708 1444 cmd.exe 197 PID 708 wrote to memory of 1856 708 NFSS.exe 198 PID 1856 wrote to memory of 3912 1856 cmd.exe 202 PID 3912 wrote to memory of 5856 3912 IQBQIFN.exe 203 PID 5856 wrote to memory of 3268 5856 cmd.exe 207 PID 3268 wrote to memory of 5296 3268 FQLTUJW.exe 208 PID 5296 wrote to memory of 3788 5296 cmd.exe 212 PID 3788 wrote to memory of 4696 3788 YLOOZ.exe 213 PID 4696 wrote to memory of 4248 4696 cmd.exe 217 PID 4248 wrote to memory of 3024 4248 AGGYTK.exe 218 PID 3024 wrote to memory of 1040 3024 cmd.exe 222 PID 1040 wrote to memory of 2424 1040 OEGKV.exe 223 PID 2424 wrote to memory of 1272 2424 cmd.exe 227 PID 1272 wrote to memory of 2960 1272 IZLTFW.exe 228 PID 2960 wrote to memory of 3392 2960 cmd.exe 232 PID 3392 wrote to memory of 4804 3392 UCV.exe 233 PID 4804 wrote to memory of 1524 4804 cmd.exe 237 PID 1524 wrote to memory of 6044 1524 YLCGSB.exe 238 PID 6044 wrote to memory of 5080 6044 cmd.exe 242 PID 5080 wrote to memory of 3104 5080 MGNHG.exe 243 PID 3104 wrote to memory of 3848 3104 cmd.exe 247 PID 3848 wrote to memory of 4532 3848 UTSOR.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_954e68fa5bac8cddf109317cb3c685f5_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NMJIWYM.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\windows\system\NMJIWYM.exeC:\windows\system\NMJIWYM.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XEF.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\windows\system\XEF.exeC:\windows\system\XEF.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EPDPBM.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\windows\system\EPDPBM.exeC:\windows\system\EPDPBM.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQESF.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\windows\system\AQESF.exeC:\windows\system\AQESF.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MYLSSAO.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\windows\system\MYLSSAO.exeC:\windows\system\MYLSSAO.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JYVCVE.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:276 -
C:\windows\JYVCVE.exeC:\windows\JYVCVE.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LWAOLM.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\LWAOLM.exeC:\windows\LWAOLM.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KHLEL.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\windows\KHLEL.exeC:\windows\KHLEL.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUQL.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\windows\SysWOW64\SUQL.exeC:\windows\system32\SUQL.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXGKKCL.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\windows\NXGKKCL.exeC:\windows\NXGKKCL.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EFNPXTO.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\system\EFNPXTO.exeC:\windows\system\EFNPXTO.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XIQLCI.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\windows\XIQLCI.exeC:\windows\XIQLCI.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FODRNH.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
PID:4500 -
C:\windows\system\FODRNH.exeC:\windows\system\FODRNH.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZGHW.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\windows\system\EZGHW.exeC:\windows\system\EZGHW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HPPE.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\windows\system\HPPE.exeC:\windows\system\HPPE.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PUO.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\windows\system\PUO.exeC:\windows\system\PUO.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CAOPYL.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\windows\CAOPYL.exeC:\windows\CAOPYL.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HGGEOGD.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\windows\HGGEOGD.exeC:\windows\HGGEOGD.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOH.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\windows\BOH.exeC:\windows\BOH.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AZSIE.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\windows\SysWOW64\AZSIE.exeC:\windows\system32\AZSIE.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZHKGSR.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\SysWOW64\ZHKGSR.exeC:\windows\system32\ZHKGSR.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFSS.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\windows\system\NFSS.exeC:\windows\system\NFSS.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQBQIFN.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\windows\IQBQIFN.exeC:\windows\IQBQIFN.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FQLTUJW.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\windows\SysWOW64\FQLTUJW.exeC:\windows\system32\FQLTUJW.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLOOZ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\windows\YLOOZ.exeC:\windows\YLOOZ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGGYTK.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\windows\AGGYTK.exeC:\windows\AGGYTK.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OEGKV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\OEGKV.exeC:\windows\OEGKV.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZLTFW.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\windows\SysWOW64\IZLTFW.exeC:\windows\system32\IZLTFW.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCV.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\windows\SysWOW64\UCV.exeC:\windows\system32\UCV.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YLCGSB.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\SysWOW64\YLCGSB.exeC:\windows\system32\YLCGSB.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGNHG.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\windows\MGNHG.exeC:\windows\MGNHG.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTSOR.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\windows\system\UTSOR.exeC:\windows\system\UTSOR.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ERS.exe.bat" "66⤵PID:4532
-
C:\windows\system\ERS.exeC:\windows\system\ERS.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCVQQWM.exe.bat" "68⤵PID:3600
-
C:\windows\SysWOW64\DCVQQWM.exeC:\windows\system32\DCVQQWM.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSWI.exe.bat" "70⤵PID:4576
-
C:\windows\SSWI.exeC:\windows\SSWI.exe71⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EKLT.exe.bat" "72⤵PID:5304
-
C:\windows\system\EKLT.exeC:\windows\system\EKLT.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IASBSC.exe.bat" "74⤵PID:4236
-
C:\windows\system\IASBSC.exeC:\windows\system\IASBSC.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLVRT.exe.bat" "76⤵PID:1280
-
C:\windows\GLVRT.exeC:\windows\GLVRT.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AEKCK.exe.bat" "78⤵PID:4608
-
C:\windows\SysWOW64\AEKCK.exeC:\windows\system32\AEKCK.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJCPM.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5324 -
C:\windows\GZJCPM.exeC:\windows\GZJCPM.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VUTH.exe.bat" "82⤵PID:4516
-
C:\windows\VUTH.exeC:\windows\VUTH.exe83⤵
- Executes dropped EXE
PID:1500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXX.exe.bat" "84⤵PID:5828
-
C:\windows\OXX.exeC:\windows\OXX.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDBRQVW.exe.bat" "86⤵PID:4368
-
C:\windows\WDBRQVW.exeC:\windows\WDBRQVW.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JIJDSH.exe.bat" "88⤵PID:2348
-
C:\windows\SysWOW64\JIJDSH.exeC:\windows\system32\JIJDSH.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ROOKC.exe.bat" "90⤵PID:3484
-
C:\windows\ROOKC.exeC:\windows\ROOKC.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEU.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:4872 -
C:\windows\SysWOW64\VEU.exeC:\windows\system32\VEU.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EHLF.exe.bat" "94⤵PID:2376
-
C:\windows\EHLF.exeC:\windows\EHLF.exe95⤵
- Executes dropped EXE
PID:1284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXUFKVO.exe.bat" "96⤵PID:1080
-
C:\windows\system\LXUFKVO.exeC:\windows\system\LXUFKVO.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIWVTB.exe.bat" "98⤵PID:5348
-
C:\windows\KIWVTB.exeC:\windows\KIWVTB.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FLFL.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:1776 -
C:\windows\SysWOW64\FLFL.exeC:\windows\system32\FLFL.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBLULE.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:840 -
C:\windows\system\JBLULE.exeC:\windows\system\JBLULE.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWX.exe.bat" "104⤵PID:1984
-
C:\windows\PWX.exeC:\windows\PWX.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TEEUL.exe.bat" "106⤵PID:4172
-
C:\windows\TEEUL.exeC:\windows\TEEUL.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IUFM.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1876 -
C:\windows\system\IUFM.exeC:\windows\system\IUFM.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMUXBZV.exe.bat" "110⤵PID:4568
-
C:\windows\CMUXBZV.exeC:\windows\CMUXBZV.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CAU.exe.bat" "112⤵PID:5904
-
C:\windows\SysWOW64\CAU.exeC:\windows\system32\CAU.exe113⤵
- Executes dropped EXE
PID:5076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GIBTPEM.exe.bat" "114⤵PID:3516
-
C:\windows\system\GIBTPEM.exeC:\windows\system\GIBTPEM.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QGHG.exe.bat" "116⤵PID:1348
-
C:\windows\QGHG.exeC:\windows\QGHG.exe117⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZOJ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:3540 -
C:\windows\system\ZOJ.exeC:\windows\system\ZOJ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BBNCK.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3092 -
C:\windows\SysWOW64\BBNCK.exeC:\windows\system32\BBNCK.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-