Analysis
- max time kernel
88s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 03:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe
- Size 208KB
- Sample260707-ej6gasev7p
- SHA256 037564a08bfd3cf5f14a4cfa455aac66abf194339b3d4a69b2f989618755ecc2
- MD5 4a55943cab9500fa7dfe23fb0f270733
- SHA1 601255595302ced5a392e4725d95d8fc02c14f83
- SHA512 c2dbbbd3b30416f8459f853f1f564458ca3ce4a12eb37c8338028b98fc313d9bf634979541efa34debec3f02061420b9bfe05b1c2f752c9de4ac8084698e2b39
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbFl1dL+LOfF4pLthEjQT6j:MlZtbLWIgd1LZ9oECZbFl15+LOdkEj1
- TLSH T174247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4520 OYTF.exe 2556 XWNO.exe 1768 DRZH.exe 5376 JNYIIGG.exe 4048 ZIHUB.exe 2552 GYIMZO.exe 5536 HTMPN.exe 4704 FQF.exe 2420 ORHXD.exe 4044 GZJCPM.exe 548 YCNYU.exe 2972 XSY.exe 5472 DNYC.exe 4224 YACLWK.exe 1176 LLLKKV.exe 3308 CMNPOSK.exe 4060 PWDOC.exe 5424 HXX.exe 1404 QFZYJ.exe 4076 PVS.exe 5104 ELTADZG.exe 4968 KLBOUBH.exe 5484 TTDTX.exe 5404 GEM.exe 5856 OKMY.exe 2632 CMUXBZV.exe 1556 WIZG.exe 5380 WNZV.exe 4748 NBKNDIA.exe 776 IOOW.exe 5508 ROIJQ.exe 2524 DHLURV.exe 4840 DKPYE.exe 4208 YXUHGLX.exe 1144 NAD.exe 2860 INIVC.exe 240 ZOK.exe 3516 XOSWW.exe 2436 DJRWBA.exe 3744 HRYW.exe 1604 DXEUU.exe 1880 NFGZYAF.exe 5392 ZNMH.exe 6024 RQQ.exe 5292 XRY.exe 2764 MHZQFYB.exe 5100 LWKLA.exe 5132 GSPCCDY.exe 1652 PSR.exe 4496 KFVQQ.exe 940 VYYJYP.exe 5232 HOFJK.exe 4976 ZJJNQXT.exe 1128 RRLS.exe 3952 TPQ.exe 1468 NCVWT.exe 728 IQAFVDI.exe 2052 UGHF.exe 4072 YOVNUO.exe 5884 QRZJZ.exe 1272 IZBODBD.exe 2620 CMY.exe 5612 RHPKGV.exe 1068 QDPLDZI.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\LWKLA.exe.bat MHZQFYB.exe File opened for modification C:\windows\SysWOW64\KFVQQ.exe PSR.exe File created C:\windows\SysWOW64\VYYJYP.exe.bat KFVQQ.exe File created C:\windows\SysWOW64\KFZ.exe.bat BFXDKTG.exe File created C:\windows\SysWOW64\IUBQTO.exe PBYXL.exe File opened for modification C:\windows\SysWOW64\CPNRJ.exe FPFDSCL.exe File opened for modification C:\windows\SysWOW64\WKG.exe LSDU.exe File opened for modification C:\windows\SysWOW64\KLBOUBH.exe ELTADZG.exe File opened for modification C:\windows\SysWOW64\WNZV.exe WIZG.exe File created C:\windows\SysWOW64\WNZV.exe.bat WIZG.exe File opened for modification C:\windows\SysWOW64\MHZQFYB.exe XRY.exe File created C:\windows\SysWOW64\RGFXAEF.exe.bat WTAOYE.exe File opened for modification C:\windows\SysWOW64\WNOZ.exe BAJQMCL.exe File created C:\windows\SysWOW64\CPNRJ.exe.bat FPFDSCL.exe File created C:\windows\SysWOW64\WKG.exe.bat LSDU.exe File created C:\windows\SysWOW64\OYTF.exe 2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe File created C:\windows\SysWOW64\HRYW.exe.bat DJRWBA.exe File created C:\windows\SysWOW64\HOFJK.exe VYYJYP.exe File created C:\windows\SysWOW64\TPQ.exe.bat RRLS.exe File opened for modification C:\windows\SysWOW64\QDPLDZI.exe RHPKGV.exe File created C:\windows\SysWOW64\QDPLDZI.exe.bat RHPKGV.exe File created C:\windows\SysWOW64\SCVVW.exe IUBQTO.exe File created C:\windows\SysWOW64\WNOZ.exe.bat BAJQMCL.exe File opened for modification C:\windows\SysWOW64\TTDTX.exe KLBOUBH.exe File created C:\windows\SysWOW64\GSPCCDY.exe.bat LWKLA.exe File created C:\windows\SysWOW64\KFZ.exe BFXDKTG.exe File opened for modification C:\windows\SysWOW64\QFHWF.exe KFZ.exe File created C:\windows\SysWOW64\QFHWF.exe.bat KFZ.exe File created C:\windows\SysWOW64\CPNRJ.exe FPFDSCL.exe File opened for modification C:\windows\SysWOW64\APW.exe UPPWMC.exe File created C:\windows\SysWOW64\ZJYTQKM.exe ZVYEPFJ.exe File created C:\windows\SysWOW64\LLLKKV.exe YACLWK.exe File created C:\windows\SysWOW64\QFZYJ.exe HXX.exe File created C:\windows\SysWOW64\RQQ.exe.bat ZNMH.exe File created C:\windows\SysWOW64\HOFJK.exe.bat VYYJYP.exe File created C:\windows\SysWOW64\WNOZ.exe BAJQMCL.exe File created C:\windows\SysWOW64\APW.exe UPPWMC.exe File created C:\windows\SysWOW64\FXQFWR.exe.bat WKG.exe File created C:\windows\SysWOW64\FJFGZ.exe.bat ZJYTQKM.exe File created C:\windows\SysWOW64\XSY.exe.bat YCNYU.exe File created C:\windows\SysWOW64\KLBOUBH.exe ELTADZG.exe File opened for modification C:\windows\SysWOW64\RQQ.exe ZNMH.exe File created C:\windows\SysWOW64\GSPCCDY.exe LWKLA.exe File opened for modification C:\windows\SysWOW64\FJFGZ.exe ZJYTQKM.exe File created C:\windows\SysWOW64\WXURW.exe.bat FXSETOD.exe File opened for modification C:\windows\SysWOW64\OYTF.exe 2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe File created C:\windows\SysWOW64\LLLKKV.exe.bat YACLWK.exe File created C:\windows\SysWOW64\HRYW.exe DJRWBA.exe File opened for modification C:\windows\SysWOW64\HRYW.exe DJRWBA.exe File created C:\windows\SysWOW64\QDPLDZI.exe RHPKGV.exe File created C:\windows\SysWOW64\YWGOHR.exe.bat RGFXAEF.exe File opened for modification C:\windows\SysWOW64\BFXDKTG.exe VEPP.exe File opened for modification C:\windows\SysWOW64\SCVVW.exe IUBQTO.exe File created C:\windows\SysWOW64\WIZG.exe.bat CMUXBZV.exe File created C:\windows\SysWOW64\KFVQQ.exe PSR.exe File created C:\windows\SysWOW64\IUBQTO.exe.bat PBYXL.exe File created C:\windows\SysWOW64\APW.exe.bat UPPWMC.exe File created C:\windows\SysWOW64\FJFGZ.exe ZJYTQKM.exe File opened for modification C:\windows\SysWOW64\FXSETOD.exe ZXKQKM.exe File created C:\windows\SysWOW64\XSY.exe YCNYU.exe File opened for modification C:\windows\SysWOW64\WIZG.exe CMUXBZV.exe File opened for modification C:\windows\SysWOW64\YXUHGLX.exe DKPYE.exe File created C:\windows\SysWOW64\RQQ.exe ZNMH.exe File created C:\windows\SysWOW64\MHZQFYB.exe XRY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\ZIHUB.exe JNYIIGG.exe File opened for modification C:\windows\system\YACLWK.exe DNYC.exe File created C:\windows\ZNMH.exe.bat NFGZYAF.exe File created C:\windows\system\XRY.exe RQQ.exe File opened for modification C:\windows\system\QRZJZ.exe YOVNUO.exe File created C:\windows\BAJQMCL.exe SCVVW.exe File created C:\windows\DRZH.exe XWNO.exe File created C:\windows\system\IZBODBD.exe QRZJZ.exe File opened for modification C:\windows\FPFDSCL.exe ELBZNF.exe File opened for modification C:\windows\NBKNDIA.exe WNZV.exe File created C:\windows\IOOW.exe NBKNDIA.exe File created C:\windows\BRK.exe.bat YWGOHR.exe File opened for modification C:\windows\LSDU.exe URJPUQ.exe File opened for modification C:\windows\NFGZYAF.exe DXEUU.exe File created C:\windows\BKR.exe.bat RCPLFQE.exe File opened for modification C:\windows\CMUXBZV.exe OKMY.exe File opened for modification C:\windows\system\VEPP.exe BRK.exe File opened for modification C:\windows\system\FJZWIQP.exe BBSWW.exe File opened for modification C:\windows\system\OKMY.exe GEM.exe File opened for modification C:\windows\system\RCPLFQE.exe MBHXW.exe File created C:\windows\system\FJZWIQP.exe BBSWW.exe File opened for modification C:\windows\DRZH.exe XWNO.exe File created C:\windows\BKR.exe RCPLFQE.exe File created C:\windows\system\DJRWBA.exe XOSWW.exe File opened for modification C:\windows\system\JNYIIGG.exe DRZH.exe File created C:\windows\CMNPOSK.exe LLLKKV.exe File created C:\windows\NFGZYAF.exe.bat DXEUU.exe File created C:\windows\ZNMH.exe NFGZYAF.exe File opened for modification C:\windows\RBRKC.exe WOM.exe File created C:\windows\system\NGFWLMO.exe.bat SSANJ.exe File created C:\windows\URJPUQ.exe FWR.exe File created C:\windows\system\UBHJPN.exe.bat ZNCZ.exe File created C:\windows\VLF.exe NGFWLMO.exe File created C:\windows\NAD.exe YXUHGLX.exe File opened for modification C:\windows\ZNCZ.exe OVH.exe File created C:\windows\ROD.exe LBLFHSZ.exe File created C:\windows\system\FJZWIQP.exe.bat BBSWW.exe File opened for modification C:\windows\system\XRY.exe RQQ.exe File opened for modification C:\windows\system\GYIMZO.exe ZIHUB.exe File opened for modification C:\windows\system\DKPYE.exe DHLURV.exe File created C:\windows\system\DKPYE.exe.bat DHLURV.exe File created C:\windows\system\DXEUU.exe HRYW.exe File created C:\windows\system\UBHJPN.exe ZNCZ.exe File opened for modification C:\windows\BAJQMCL.exe SCVVW.exe File created C:\windows\CMNPOSK.exe.bat LLLKKV.exe File opened for modification C:\windows\system\XOSWW.exe ZOK.exe File created C:\windows\BRK.exe YWGOHR.exe File created C:\windows\UPPWMC.exe CPNRJ.exe File created C:\windows\XWNO.exe.bat OYTF.exe File created C:\windows\system\JNYIIGG.exe.bat DRZH.exe File created C:\windows\system\HXX.exe PWDOC.exe File created C:\windows\system\INIVC.exe NAD.exe File created C:\windows\ZJJNQXT.exe HOFJK.exe File opened for modification C:\windows\system\YMB.exe VLF.exe File opened for modification C:\windows\CMY.exe IZBODBD.exe File opened for modification C:\windows\system\MBHXW.exe ROD.exe File created C:\windows\system\HXX.exe.bat PWDOC.exe File created C:\windows\IQAFVDI.exe.bat NCVWT.exe File created C:\windows\ZOK.exe.bat INIVC.exe File created C:\windows\ZNCZ.exe.bat OVH.exe File created C:\windows\system\AVVZAU.exe.bat WNOZ.exe File created C:\windows\URJPUQ.exe.bat FWR.exe File created C:\windows\ZXKQKM.exe.bat FJFGZ.exe File created C:\windows\FQF.exe.bat HTMPN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
- Program crash 64 IoCs
pid pid_target Process procid_target 5272 6012 WerFault.exe 86 2636 4520 WerFault.exe 91 5452 2556 WerFault.exe 97 4340 1768 WerFault.exe 102 1132 5376 WerFault.exe 107 4028 4048 WerFault.exe 112 5036 2552 WerFault.exe 117 2348 5536 WerFault.exe 122 3204 4704 WerFault.exe 127 2700 2420 WerFault.exe 132 5484 4044 WerFault.exe 137 3548 548 WerFault.exe 142 5580 2972 WerFault.exe 147 1652 5472 WerFault.exe 152 5360 4224 WerFault.exe 157 2904 1176 WerFault.exe 162 5228 3308 WerFault.exe 167 1536 4060 WerFault.exe 172 1964 5424 WerFault.exe 177 1208 1404 WerFault.exe 182 2408 4076 WerFault.exe 187 1896 5104 WerFault.exe 192 3512 4968 WerFault.exe 197 2932 5484 WerFault.exe 202 2516 5404 WerFault.exe 207 704 5856 WerFault.exe 212 1484 2632 WerFault.exe 217 3896 1556 WerFault.exe 222 5232 5380 WerFault.exe 227 4008 4748 WerFault.exe 232 6100 776 WerFault.exe 237 2432 5508 WerFault.exe 242 4600 2524 WerFault.exe 247 4660 4840 WerFault.exe 252 5456 4208 WerFault.exe 257 1580 1144 WerFault.exe 262 424 2860 WerFault.exe 267 2756 240 WerFault.exe 272 4496 3516 WerFault.exe 277 2836 2436 WerFault.exe 282 5288 3744 WerFault.exe 287 4488 1604 WerFault.exe 292 2480 1880 WerFault.exe 297 1364 5392 WerFault.exe 302 3972 6024 WerFault.exe 307 5468 5292 WerFault.exe 312 5476 2764 WerFault.exe 317 3652 5100 WerFault.exe 322 1592 5132 WerFault.exe 327 1940 1652 WerFault.exe 332 5228 4496 WerFault.exe 337 1536 940 WerFault.exe 342 904 5232 WerFault.exe 347 3436 4976 WerFault.exe 352 5664 1128 WerFault.exe 357 2864 3952 WerFault.exe 362 1032 1468 WerFault.exe 367 3156 728 WerFault.exe 372 5156 2052 WerFault.exe 377 5264 4072 WerFault.exe 382 3896 5884 WerFault.exe 387 992 1272 WerFault.exe 392 1996 2620 WerFault.exe 397 6100 5612 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XWNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GZJCPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YACLWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPFDSCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROIJQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LLLKKV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUBQTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XSY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INIVC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GSPCCDY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNMH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LSDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORHXD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBHXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVVZAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFZYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZIHUB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTDTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NBKNDIA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBSWW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMNPOSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXUHGLX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZNCZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ELTADZG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLBOUBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFHWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSANJ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6012 2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe 6012 2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe 4520 OYTF.exe 4520 OYTF.exe 2556 XWNO.exe 2556 XWNO.exe 1768 DRZH.exe 1768 DRZH.exe 5376 JNYIIGG.exe 5376 JNYIIGG.exe 4048 ZIHUB.exe 4048 ZIHUB.exe 2552 GYIMZO.exe 2552 GYIMZO.exe 5536 HTMPN.exe 5536 HTMPN.exe 4704 FQF.exe 4704 FQF.exe 2420 ORHXD.exe 2420 ORHXD.exe 4044 GZJCPM.exe 4044 GZJCPM.exe 548 YCNYU.exe 548 YCNYU.exe 2972 XSY.exe 2972 XSY.exe 5472 DNYC.exe 5472 DNYC.exe 4224 YACLWK.exe 4224 YACLWK.exe 1176 LLLKKV.exe 1176 LLLKKV.exe 3308 CMNPOSK.exe 3308 CMNPOSK.exe 4060 PWDOC.exe 4060 PWDOC.exe 5424 HXX.exe 5424 HXX.exe 1404 QFZYJ.exe 1404 QFZYJ.exe 4076 PVS.exe 4076 PVS.exe 5104 ELTADZG.exe 5104 ELTADZG.exe 4968 KLBOUBH.exe 4968 KLBOUBH.exe 5484 TTDTX.exe 5484 TTDTX.exe 5404 GEM.exe 5404 GEM.exe 5856 OKMY.exe 5856 OKMY.exe 2632 CMUXBZV.exe 2632 CMUXBZV.exe 1556 WIZG.exe 1556 WIZG.exe 5380 WNZV.exe 5380 WNZV.exe 4748 NBKNDIA.exe 4748 NBKNDIA.exe 776 IOOW.exe 776 IOOW.exe 5508 ROIJQ.exe 5508 ROIJQ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 6012 2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe 6012 2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe 4520 OYTF.exe 4520 OYTF.exe 2556 XWNO.exe 2556 XWNO.exe 1768 DRZH.exe 1768 DRZH.exe 5376 JNYIIGG.exe 5376 JNYIIGG.exe 4048 ZIHUB.exe 4048 ZIHUB.exe 2552 GYIMZO.exe 2552 GYIMZO.exe 5536 HTMPN.exe 5536 HTMPN.exe 4704 FQF.exe 4704 FQF.exe 2420 ORHXD.exe 2420 ORHXD.exe 4044 GZJCPM.exe 4044 GZJCPM.exe 548 YCNYU.exe 548 YCNYU.exe 2972 XSY.exe 2972 XSY.exe 5472 DNYC.exe 5472 DNYC.exe 4224 YACLWK.exe 4224 YACLWK.exe 1176 LLLKKV.exe 1176 LLLKKV.exe 3308 CMNPOSK.exe 3308 CMNPOSK.exe 4060 PWDOC.exe 4060 PWDOC.exe 5424 HXX.exe 5424 HXX.exe 1404 QFZYJ.exe 1404 QFZYJ.exe 4076 PVS.exe 4076 PVS.exe 5104 ELTADZG.exe 5104 ELTADZG.exe 4968 KLBOUBH.exe 4968 KLBOUBH.exe 5484 TTDTX.exe 5484 TTDTX.exe 5404 GEM.exe 5404 GEM.exe 5856 OKMY.exe 5856 OKMY.exe 2632 CMUXBZV.exe 2632 CMUXBZV.exe 1556 WIZG.exe 1556 WIZG.exe 5380 WNZV.exe 5380 WNZV.exe 4748 NBKNDIA.exe 4748 NBKNDIA.exe 776 IOOW.exe 776 IOOW.exe 5508 ROIJQ.exe 5508 ROIJQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6012 wrote to memory of 6028 6012 2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe 87 PID 6028 wrote to memory of 4520 6028 cmd.exe 91 PID 4520 wrote to memory of 5628 4520 OYTF.exe 93 PID 5628 wrote to memory of 2556 5628 cmd.exe 97 PID 2556 wrote to memory of 1300 2556 XWNO.exe 98 PID 1300 wrote to memory of 1768 1300 cmd.exe 102 PID 1768 wrote to memory of 6112 1768 DRZH.exe 103 PID 6112 wrote to memory of 5376 6112 cmd.exe 107 PID 5376 wrote to memory of 4200 5376 JNYIIGG.exe 108 PID 4200 wrote to memory of 4048 4200 cmd.exe 112 PID 4048 wrote to memory of 3540 4048 ZIHUB.exe 113 PID 3540 wrote to memory of 2552 3540 cmd.exe 117 PID 2552 wrote to memory of 1140 2552 GYIMZO.exe 118 PID 1140 wrote to memory of 5536 1140 cmd.exe 122 PID 5536 wrote to memory of 1992 5536 HTMPN.exe 123 PID 1992 wrote to memory of 4704 1992 cmd.exe 127 PID 4704 wrote to memory of 3276 4704 FQF.exe 128 PID 3276 wrote to memory of 2420 3276 cmd.exe 132 PID 2420 wrote to memory of 4324 2420 ORHXD.exe 133 PID 4324 wrote to memory of 4044 4324 cmd.exe 137 PID 4044 wrote to memory of 3500 4044 GZJCPM.exe 138 PID 3500 wrote to memory of 548 3500 cmd.exe 142 PID 548 wrote to memory of 916 548 YCNYU.exe 143 PID 916 wrote to memory of 2972 916 cmd.exe 147 PID 2972 wrote to memory of 5176 2972 XSY.exe 148 PID 5176 wrote to memory of 5472 5176 cmd.exe 152 PID 5472 wrote to memory of 2004 5472 DNYC.exe 153 PID 2004 wrote to memory of 4224 2004 cmd.exe 157 PID 4224 wrote to memory of 3452 4224 YACLWK.exe 158 PID 3452 wrote to memory of 1176 3452 cmd.exe 162 PID 1176 wrote to memory of 1304 1176 LLLKKV.exe 163 PID 1304 wrote to memory of 3308 1304 cmd.exe 167 PID 3308 wrote to memory of 4776 3308 CMNPOSK.exe 168 PID 4776 wrote to memory of 4060 4776 cmd.exe 172 PID 4060 wrote to memory of 1480 4060 PWDOC.exe 173 PID 1480 wrote to memory of 5424 1480 cmd.exe 177 PID 5424 wrote to memory of 1380 5424 HXX.exe 178 PID 1380 wrote to memory of 1404 1380 cmd.exe 182 PID 1404 wrote to memory of 2884 1404 QFZYJ.exe 183 PID 2884 wrote to memory of 4076 2884 cmd.exe 187 PID 4076 wrote to memory of 5136 4076 PVS.exe 188 PID 5136 wrote to memory of 5104 5136 cmd.exe 192 PID 5104 wrote to memory of 3472 5104 ELTADZG.exe 193 PID 3472 wrote to memory of 4968 3472 cmd.exe 197 PID 4968 wrote to memory of 2772 4968 KLBOUBH.exe 198 PID 2772 wrote to memory of 5484 2772 cmd.exe 202 PID 5484 wrote to memory of 2960 5484 TTDTX.exe 203 PID 2960 wrote to memory of 5404 2960 cmd.exe 207 PID 5404 wrote to memory of 3712 5404 GEM.exe 208 PID 3712 wrote to memory of 5856 3712 cmd.exe 212 PID 5856 wrote to memory of 4264 5856 OKMY.exe 213 PID 4264 wrote to memory of 2632 4264 cmd.exe 217 PID 2632 wrote to memory of 6048 2632 CMUXBZV.exe 218 PID 6048 wrote to memory of 1556 6048 cmd.exe 222 PID 1556 wrote to memory of 2080 1556 WIZG.exe 223 PID 2080 wrote to memory of 5380 2080 cmd.exe 227 PID 5380 wrote to memory of 3584 5380 WNZV.exe 228 PID 3584 wrote to memory of 4748 3584 cmd.exe 232 PID 4748 wrote to memory of 1132 4748 NBKNDIA.exe 233 PID 1132 wrote to memory of 776 1132 cmd.exe 237 PID 776 wrote to memory of 6088 776 IOOW.exe 238 PID 6088 wrote to memory of 5508 6088 cmd.exe 242 PID 5508 wrote to memory of 5220 5508 ROIJQ.exe 243 PID 5220 wrote to memory of 2524 5220 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_4a55943cab9500fa7dfe23fb0f270733_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OYTF.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\windows\SysWOW64\OYTF.exeC:\windows\system32\OYTF.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XWNO.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\XWNO.exeC:\windows\XWNO.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DRZH.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\windows\DRZH.exeC:\windows\DRZH.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JNYIIGG.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\windows\system\JNYIIGG.exeC:\windows\system\JNYIIGG.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZIHUB.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\windows\system\ZIHUB.exeC:\windows\system\ZIHUB.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYIMZO.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\windows\system\GYIMZO.exeC:\windows\system\GYIMZO.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HTMPN.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\windows\system\HTMPN.exeC:\windows\system\HTMPN.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQF.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\windows\FQF.exeC:\windows\FQF.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORHXD.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\windows\system\ORHXD.exeC:\windows\system\ORHXD.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJCPM.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\GZJCPM.exeC:\windows\GZJCPM.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCNYU.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\windows\YCNYU.exeC:\windows\YCNYU.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XSY.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\windows\SysWOW64\XSY.exeC:\windows\system32\XSY.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DNYC.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\windows\system\DNYC.exeC:\windows\system\DNYC.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YACLWK.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\system\YACLWK.exeC:\windows\system\YACLWK.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LLLKKV.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\SysWOW64\LLLKKV.exeC:\windows\system32\LLLKKV.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMNPOSK.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\windows\CMNPOSK.exeC:\windows\CMNPOSK.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PWDOC.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\windows\system\PWDOC.exeC:\windows\system\PWDOC.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HXX.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\windows\system\HXX.exeC:\windows\system\HXX.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QFZYJ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\windows\SysWOW64\QFZYJ.exeC:\windows\system32\QFZYJ.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVS.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\windows\SysWOW64\PVS.exeC:\windows\system32\PVS.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELTADZG.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\windows\system\ELTADZG.exeC:\windows\system\ELTADZG.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLBOUBH.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\windows\SysWOW64\KLBOUBH.exeC:\windows\system32\KLBOUBH.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TTDTX.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\SysWOW64\TTDTX.exeC:\windows\system32\TTDTX.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GEM.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\windows\system\GEM.exeC:\windows\system\GEM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKMY.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\system\OKMY.exeC:\windows\system\OKMY.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CMUXBZV.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\windows\CMUXBZV.exeC:\windows\CMUXBZV.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WIZG.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\windows\SysWOW64\WIZG.exeC:\windows\system32\WIZG.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WNZV.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\windows\SysWOW64\WNZV.exeC:\windows\system32\WNZV.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NBKNDIA.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\windows\NBKNDIA.exeC:\windows\NBKNDIA.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOOW.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\IOOW.exeC:\windows\IOOW.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROIJQ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\windows\system\ROIJQ.exeC:\windows\system\ROIJQ.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DHLURV.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\DHLURV.exeC:\windows\DHLURV.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKPYE.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:2388 -
C:\windows\system\DKPYE.exeC:\windows\system\DKPYE.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YXUHGLX.exe.bat" "68⤵PID:3048
-
C:\windows\SysWOW64\YXUHGLX.exeC:\windows\system32\YXUHGLX.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NAD.exe.bat" "70⤵PID:3016
-
C:\windows\NAD.exeC:\windows\NAD.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INIVC.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:3548 -
C:\windows\system\INIVC.exeC:\windows\system\INIVC.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOK.exe.bat" "74⤵PID:124
-
C:\windows\ZOK.exeC:\windows\ZOK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XOSWW.exe.bat" "76⤵PID:704
-
C:\windows\system\XOSWW.exeC:\windows\system\XOSWW.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DJRWBA.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:1756 -
C:\windows\system\DJRWBA.exeC:\windows\system\DJRWBA.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRYW.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3888 -
C:\windows\SysWOW64\HRYW.exeC:\windows\system32\HRYW.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DXEUU.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5440 -
C:\windows\system\DXEUU.exeC:\windows\system\DXEUU.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NFGZYAF.exe.bat" "84⤵PID:2824
-
C:\windows\NFGZYAF.exeC:\windows\NFGZYAF.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZNMH.exe.bat" "86⤵PID:4876
-
C:\windows\ZNMH.exeC:\windows\ZNMH.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RQQ.exe.bat" "88⤵PID:3572
-
C:\windows\SysWOW64\RQQ.exeC:\windows\system32\RQQ.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XRY.exe.bat" "90⤵PID:4012
-
C:\windows\system\XRY.exeC:\windows\system\XRY.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MHZQFYB.exe.bat" "92⤵PID:4896
-
C:\windows\SysWOW64\MHZQFYB.exeC:\windows\system32\MHZQFYB.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWKLA.exe.bat" "94⤵PID:2952
-
C:\windows\SysWOW64\LWKLA.exeC:\windows\system32\LWKLA.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GSPCCDY.exe.bat" "96⤵PID:4736
-
C:\windows\SysWOW64\GSPCCDY.exeC:\windows\system32\GSPCCDY.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PSR.exe.bat" "98⤵PID:3292
-
C:\windows\PSR.exeC:\windows\PSR.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KFVQQ.exe.bat" "100⤵PID:5836
-
C:\windows\SysWOW64\KFVQQ.exeC:\windows\system32\KFVQQ.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VYYJYP.exe.bat" "102⤵PID:6064
-
C:\windows\SysWOW64\VYYJYP.exeC:\windows\system32\VYYJYP.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HOFJK.exe.bat" "104⤵PID:3872
-
C:\windows\SysWOW64\HOFJK.exeC:\windows\system32\HOFJK.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJJNQXT.exe.bat" "106⤵PID:1676
-
C:\windows\ZJJNQXT.exeC:\windows\ZJJNQXT.exe107⤵
- Executes dropped EXE
PID:4976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RRLS.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5744 -
C:\windows\SysWOW64\RRLS.exeC:\windows\system32\RRLS.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TPQ.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:2668 -
C:\windows\SysWOW64\TPQ.exeC:\windows\system32\TPQ.exe111⤵
- Executes dropped EXE
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NCVWT.exe.bat" "112⤵PID:4860
-
C:\windows\NCVWT.exeC:\windows\NCVWT.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IQAFVDI.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3392 -
C:\windows\IQAFVDI.exeC:\windows\IQAFVDI.exe115⤵
- Executes dropped EXE
PID:728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UGHF.exe.bat" "116⤵PID:5020
-
C:\windows\system\UGHF.exeC:\windows\system\UGHF.exe117⤵
- Executes dropped EXE
PID:2052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOVNUO.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2316 -
C:\windows\YOVNUO.exeC:\windows\YOVNUO.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QRZJZ.exe.bat" "120⤵PID:436
-
C:\windows\system\QRZJZ.exeC:\windows\system\QRZJZ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-