Analysis
- max time kernel
83s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe
- Size 208KB
- Sample260709-txeytsdv4r
- SHA256 c50766671459b4e6862d5d9a36b7c878855f4915731b54556bbcbb50386d728a
- MD5 cf45b5270dc959633a6aca568776a8c8
- SHA1 114b0b4191a72bfa00016e1184fca1dc9914ea33
- SHA512 5aec369421807bcbe65eb7f51753ac824ac9e8d99448bc254db075dc6d5859325e3cb414b1b598dbb55012dbdaa92fa25e421d0666fed14bf160097a0ac1a85b
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfv4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOnQEj6
- TLSH T124247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4848 MCUOF.exe 1480 OLSRQTO.exe 1320 RYJ.exe 1828 HJMJKTR.exe 1756 ZRAGWKM.exe 928 NMEHCYC.exe 4644 FPQDQO.exe 4748 EATTQ.exe 700 WIHYD.exe 1672 LYIQKG.exe 5932 OLZZDAZ.exe 4536 BJZDF.exe 4268 YPRSVH.exe 5588 TVREX.exe 1648 VSXY.exe 3560 YGOAY.exe 4812 GTBO.exe 3340 OZGV.exe 2400 DPHMS.exe 1128 UXVSE.exe 5560 MXJ.exe 716 SSJ.exe 5524 DLQJ.exe 5084 GTZXM.exe 4328 IRESCLQ.exe 2448 KMW.exe 4792 JXGJWKU.exe 4492 ZNHJC.exe 3160 BAZKOR.exe 916 ATB.exe 6012 CRHVENV.exe 900 ZHVMU.exe 3532 NFD.exe 5984 VSH.exe 5260 GLXPXF.exe 1188 LLYSBCH.exe 2868 PTFS.exe 5580 CEVQCFQ.exe 4824 PCVCEI.exe 460 ZAJXL.exe 256 JXPJA.exe 596 AIRZBNG.exe 2496 BLVDPD.exe 2456 JRIJZ.exe 612 YUR.exe 908 RPVRQ.exe 2392 GFW.exe 2256 OSJ.exe 4520 HLY.exe 5140 GWBQZNJ.exe 4772 KMIYL.exe 4384 XOQ.exe 3328 WHBFIOP.exe 5364 ENFUTM.exe 2832 FQJ.exe 5388 VBUFHQI.exe 4288 RLCEVBD.exe 828 PWFM.exe 5000 ZWHZHFC.exe 1784 ZALV.exe 2468 KSBG.exe 2060 LVEJJT.exe 1376 EYIFP.exe 1604 ETMJUZG.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VBUFHQI.exe FQJ.exe File created C:\windows\SysWOW64\ETMJUZG.exe.bat EYIFP.exe File created C:\windows\SysWOW64\VRDSI.exe UOZ.exe File opened for modification C:\windows\SysWOW64\VRDSI.exe UOZ.exe File created C:\windows\SysWOW64\EXU.exe PCKYN.exe File created C:\windows\SysWOW64\AIRZBNG.exe JXPJA.exe File created C:\windows\SysWOW64\WHBFIOP.exe.bat XOQ.exe File created C:\windows\SysWOW64\ZNHJC.exe JXGJWKU.exe File created C:\windows\SysWOW64\ZNHJC.exe.bat JXGJWKU.exe File created C:\windows\SysWOW64\OGFTCE.exe.bat EISYMW.exe File created C:\windows\SysWOW64\AMJHGLQ.exe.bat BBGRX.exe File created C:\windows\SysWOW64\YGOAY.exe VSXY.exe File created C:\windows\SysWOW64\JXGJWKU.exe KMW.exe File opened for modification C:\windows\SysWOW64\VBUFHQI.exe FQJ.exe File created C:\windows\SysWOW64\ENFUTM.exe WHBFIOP.exe File created C:\windows\SysWOW64\RYJ.exe OLSRQTO.exe File opened for modification C:\windows\SysWOW64\RYJ.exe OLSRQTO.exe File created C:\windows\SysWOW64\NMEHCYC.exe.bat ZRAGWKM.exe File created C:\windows\SysWOW64\DPHMS.exe.bat OZGV.exe File created C:\windows\SysWOW64\UXVSE.exe DPHMS.exe File created C:\windows\SysWOW64\JXGJWKU.exe.bat KMW.exe File created C:\windows\SysWOW64\GFW.exe.bat RPVRQ.exe File created C:\windows\SysWOW64\HJMJKTR.exe RYJ.exe File created C:\windows\SysWOW64\YGOAY.exe.bat VSXY.exe File created C:\windows\SysWOW64\ZAJXL.exe PCVCEI.exe File created C:\windows\SysWOW64\BLVDPD.exe.bat AIRZBNG.exe File opened for modification C:\windows\SysWOW64\OGFTCE.exe EISYMW.exe File created C:\windows\SysWOW64\HKPXYLN.exe SPFT.exe File opened for modification C:\windows\SysWOW64\HKPXYLN.exe SPFT.exe File created C:\windows\SysWOW64\HKPXYLN.exe.bat SPFT.exe File created C:\windows\SysWOW64\UXVSE.exe.bat DPHMS.exe File created C:\windows\SysWOW64\CEVQCFQ.exe PTFS.exe File created C:\windows\SysWOW64\AIRZBNG.exe.bat JXPJA.exe File created C:\windows\SysWOW64\VBUFHQI.exe.bat FQJ.exe File created C:\windows\SysWOW64\AYNELF.exe OGFTCE.exe File created C:\windows\SysWOW64\THON.exe.bat VRDSI.exe File opened for modification C:\windows\SysWOW64\HJMJKTR.exe RYJ.exe File opened for modification C:\windows\SysWOW64\CEVQCFQ.exe PTFS.exe File created C:\windows\SysWOW64\CEVQCFQ.exe.bat PTFS.exe File created C:\windows\SysWOW64\ZAJXL.exe.bat PCVCEI.exe File opened for modification C:\windows\SysWOW64\BLVDPD.exe AIRZBNG.exe File opened for modification C:\windows\SysWOW64\AYNELF.exe OGFTCE.exe File created C:\windows\SysWOW64\PTFIO.exe LSVG.exe File created C:\windows\SysWOW64\VRDSI.exe.bat UOZ.exe File created C:\windows\SysWOW64\DPHMS.exe OZGV.exe File opened for modification C:\windows\SysWOW64\GFW.exe RPVRQ.exe File opened for modification C:\windows\SysWOW64\ENFUTM.exe WHBFIOP.exe File created C:\windows\SysWOW64\OGFTCE.exe EISYMW.exe File created C:\windows\SysWOW64\AYNELF.exe.bat OGFTCE.exe File opened for modification C:\windows\SysWOW64\THON.exe VRDSI.exe File created C:\windows\SysWOW64\BBGRX.exe.bat RDTXQ.exe File created C:\windows\SysWOW64\EXU.exe.bat PCKYN.exe File opened for modification C:\windows\SysWOW64\YGOAY.exe VSXY.exe File opened for modification C:\windows\SysWOW64\ZNHJC.exe JXGJWKU.exe File opened for modification C:\windows\SysWOW64\PTFIO.exe LSVG.exe File created C:\windows\SysWOW64\THON.exe VRDSI.exe File created C:\windows\SysWOW64\CVF.exe.bat LUDZJGN.exe File created C:\windows\SysWOW64\DSTM.exe EXU.exe File created C:\windows\SysWOW64\RYJ.exe.bat OLSRQTO.exe File opened for modification C:\windows\SysWOW64\NMEHCYC.exe ZRAGWKM.exe File opened for modification C:\windows\SysWOW64\DPHMS.exe OZGV.exe File created C:\windows\SysWOW64\PTFIO.exe.bat LSVG.exe File opened for modification C:\windows\SysWOW64\CVF.exe LUDZJGN.exe File opened for modification C:\windows\SysWOW64\BBGRX.exe RDTXQ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\ZORS.exe ETMJUZG.exe File created C:\windows\YPRSVH.exe.bat BJZDF.exe File created C:\windows\GTBO.exe.bat YGOAY.exe File created C:\windows\system\DLQJ.exe.bat SSJ.exe File created C:\windows\PCVCEI.exe CEVQCFQ.exe File created C:\windows\GWBQZNJ.exe HLY.exe File created C:\windows\FQJ.exe ENFUTM.exe File created C:\windows\KSBG.exe.bat ZALV.exe File opened for modification C:\windows\VYJHA.exe CVF.exe File created C:\windows\system\DLQJ.exe SSJ.exe File opened for modification C:\windows\WIHYD.exe EATTQ.exe File created C:\windows\system\OLSRQTO.exe MCUOF.exe File created C:\windows\ZRAGWKM.exe.bat HJMJKTR.exe File opened for modification C:\windows\HLY.exe OSJ.exe File created C:\windows\FYYPW.exe.bat ONNHNF.exe File created C:\windows\VYJHA.exe CVF.exe File created C:\windows\VYJHA.exe.bat CVF.exe File opened for modification C:\windows\system\MCUOF.exe 2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe File created C:\windows\EATTQ.exe FPQDQO.exe File created C:\windows\WIHYD.exe EATTQ.exe File opened for modification C:\windows\system\OLZZDAZ.exe LYIQKG.exe File created C:\windows\IRESCLQ.exe GTZXM.exe File created C:\windows\system\RDTXQ.exe.bat VYJHA.exe File created C:\windows\system\AETAE.exe.bat FTKCPUN.exe File created C:\windows\system\OLSRQTO.exe.bat MCUOF.exe File created C:\windows\XOQ.exe.bat KMIYL.exe File opened for modification C:\windows\EYIFP.exe LVEJJT.exe File created C:\windows\system\FTKCPUN.exe.bat HYLBT.exe File opened for modification C:\windows\system\LYIQKG.exe WIHYD.exe File opened for modification C:\windows\system\ATB.exe BAZKOR.exe File created C:\windows\system\NFD.exe ZHVMU.exe File created C:\windows\system\VSH.exe NFD.exe File created C:\windows\LLYSBCH.exe GLXPXF.exe File created C:\windows\system\ZORS.exe.bat ETMJUZG.exe File created C:\windows\BJZDF.exe OLZZDAZ.exe File created C:\windows\IRESCLQ.exe.bat GTZXM.exe File created C:\windows\system\ATB.exe.bat BAZKOR.exe File opened for modification C:\windows\system\VSH.exe NFD.exe File opened for modification C:\windows\system\JRIJZ.exe BLVDPD.exe File opened for modification C:\windows\system\LSVG.exe HKPXYLN.exe File created C:\windows\system\XJGHVVH.exe.bat PTFIO.exe File opened for modification C:\windows\system\ONNHNF.exe EPIN.exe File created C:\windows\system\KMW.exe.bat IRESCLQ.exe File created C:\windows\BAZKOR.exe.bat ZNHJC.exe File created C:\windows\system\JXPJA.exe.bat ZAJXL.exe File created C:\windows\DXFSRR.exe ZORS.exe File created C:\windows\EPIN.exe URCS.exe File created C:\windows\system\ONNHNF.exe EPIN.exe File opened for modification C:\windows\FYYPW.exe ONNHNF.exe File created C:\windows\system\FTKCPUN.exe HYLBT.exe File created C:\windows\BAZKOR.exe ZNHJC.exe File opened for modification C:\windows\CRHVENV.exe ATB.exe File created C:\windows\system\RLCEVBD.exe.bat VBUFHQI.exe File created C:\windows\PWFM.exe RLCEVBD.exe File opened for modification C:\windows\KSBG.exe ZALV.exe File created C:\windows\LVEJJT.exe.bat KSBG.exe File created C:\windows\system\RKS.exe.bat HNM.exe File created C:\windows\system\POODSAU.exe.bat AYNELF.exe File opened for modification C:\windows\MXJ.exe UXVSE.exe File created C:\windows\GTZXM.exe.bat DLQJ.exe File opened for modification C:\windows\system\RLCEVBD.exe VBUFHQI.exe File opened for modification C:\windows\DXFSRR.exe ZORS.exe File created C:\windows\system\EISYMW.exe.bat RKS.exe File created C:\windows\ZMBXZJD.exe POODSAU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 3400 2500 WerFault.exe 86 5588 4848 WerFault.exe 91 4520 1480 WerFault.exe 96 460 1320 WerFault.exe 102 3516 1828 WerFault.exe 107 8 1756 WerFault.exe 112 6024 928 WerFault.exe 117 2588 4644 WerFault.exe 122 3556 4748 WerFault.exe 127 5204 700 WerFault.exe 132 4136 1672 WerFault.exe 137 1608 5932 WerFault.exe 142 5568 4536 WerFault.exe 147 856 4268 WerFault.exe 152 4856 5588 WerFault.exe 157 3948 1648 WerFault.exe 162 4956 3560 WerFault.exe 167 916 4812 WerFault.exe 172 5180 3340 WerFault.exe 176 3684 2400 WerFault.exe 182 1772 1128 WerFault.exe 187 6032 5560 WerFault.exe 191 3388 716 WerFault.exe 197 2896 5524 WerFault.exe 202 2868 5084 WerFault.exe 207 4916 4328 WerFault.exe 212 4736 2448 WerFault.exe 217 2280 4792 WerFault.exe 222 1612 4492 WerFault.exe 227 5956 3160 WerFault.exe 232 2436 916 WerFault.exe 237 1176 6012 WerFault.exe 242 4192 900 WerFault.exe 247 4596 3532 WerFault.exe 252 2308 5984 WerFault.exe 257 5352 5260 WerFault.exe 262 2684 1188 WerFault.exe 267 2628 2868 WerFault.exe 272 4736 5580 WerFault.exe 277 4272 4824 WerFault.exe 282 2368 460 WerFault.exe 287 2876 256 WerFault.exe 292 1692 596 WerFault.exe 297 3468 2496 WerFault.exe 302 5340 2456 WerFault.exe 307 1780 612 WerFault.exe 312 4564 908 WerFault.exe 317 2404 2392 WerFault.exe 322 2124 2256 WerFault.exe 327 4800 4520 WerFault.exe 332 1664 5140 WerFault.exe 337 2876 4772 WerFault.exe 342 5504 4384 WerFault.exe 347 4896 3328 WerFault.exe 352 4556 5364 WerFault.exe 357 3048 2832 WerFault.exe 362 5884 5388 WerFault.exe 367 1388 4288 WerFault.exe 372 3512 828 WerFault.exe 376 4400 5000 WerFault.exe 382 2912 1784 WerFault.exe 387 6044 2468 WerFault.exe 392 5720 2060 WerFault.exe 397 3900 1376 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTKCPUN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENFUTM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KSBG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKPXYLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WIHYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTZXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XJGHVVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPIN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRDSI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POODSAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLSRQTO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLZZDAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EYIFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTFIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWBQZNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJZDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPRSVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONNHNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPQDQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDTXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCVCEI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FQJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZGV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXGJWKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZMBXZJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VSXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPHMS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZAJXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLVDPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AMJHGLQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KMIYL.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe 2500 2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe 4848 MCUOF.exe 4848 MCUOF.exe 1480 OLSRQTO.exe 1480 OLSRQTO.exe 1320 RYJ.exe 1320 RYJ.exe 1828 HJMJKTR.exe 1828 HJMJKTR.exe 1756 ZRAGWKM.exe 1756 ZRAGWKM.exe 928 NMEHCYC.exe 928 NMEHCYC.exe 4644 FPQDQO.exe 4644 FPQDQO.exe 4748 EATTQ.exe 4748 EATTQ.exe 700 WIHYD.exe 700 WIHYD.exe 1672 LYIQKG.exe 1672 LYIQKG.exe 5932 OLZZDAZ.exe 5932 OLZZDAZ.exe 4536 BJZDF.exe 4536 BJZDF.exe 4268 YPRSVH.exe 4268 YPRSVH.exe 5588 TVREX.exe 5588 TVREX.exe 1648 VSXY.exe 1648 VSXY.exe 3560 YGOAY.exe 3560 YGOAY.exe 4812 GTBO.exe 4812 GTBO.exe 3340 OZGV.exe 3340 OZGV.exe 2400 DPHMS.exe 2400 DPHMS.exe 1128 UXVSE.exe 1128 UXVSE.exe 5560 MXJ.exe 5560 MXJ.exe 716 SSJ.exe 716 SSJ.exe 5524 DLQJ.exe 5524 DLQJ.exe 5084 GTZXM.exe 5084 GTZXM.exe 4328 IRESCLQ.exe 4328 IRESCLQ.exe 2448 KMW.exe 2448 KMW.exe 4792 JXGJWKU.exe 4792 JXGJWKU.exe 4492 ZNHJC.exe 4492 ZNHJC.exe 3160 BAZKOR.exe 3160 BAZKOR.exe 916 ATB.exe 916 ATB.exe 6012 CRHVENV.exe 6012 CRHVENV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2500 2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe 2500 2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe 4848 MCUOF.exe 4848 MCUOF.exe 1480 OLSRQTO.exe 1480 OLSRQTO.exe 1320 RYJ.exe 1320 RYJ.exe 1828 HJMJKTR.exe 1828 HJMJKTR.exe 1756 ZRAGWKM.exe 1756 ZRAGWKM.exe 928 NMEHCYC.exe 928 NMEHCYC.exe 4644 FPQDQO.exe 4644 FPQDQO.exe 4748 EATTQ.exe 4748 EATTQ.exe 700 WIHYD.exe 700 WIHYD.exe 1672 LYIQKG.exe 1672 LYIQKG.exe 5932 OLZZDAZ.exe 5932 OLZZDAZ.exe 4536 BJZDF.exe 4536 BJZDF.exe 4268 YPRSVH.exe 4268 YPRSVH.exe 5588 TVREX.exe 5588 TVREX.exe 1648 VSXY.exe 1648 VSXY.exe 3560 YGOAY.exe 3560 YGOAY.exe 4812 GTBO.exe 4812 GTBO.exe 3340 OZGV.exe 3340 OZGV.exe 2400 DPHMS.exe 2400 DPHMS.exe 1128 UXVSE.exe 1128 UXVSE.exe 5560 MXJ.exe 5560 MXJ.exe 716 SSJ.exe 716 SSJ.exe 5524 DLQJ.exe 5524 DLQJ.exe 5084 GTZXM.exe 5084 GTZXM.exe 4328 IRESCLQ.exe 4328 IRESCLQ.exe 2448 KMW.exe 2448 KMW.exe 4792 JXGJWKU.exe 4792 JXGJWKU.exe 4492 ZNHJC.exe 4492 ZNHJC.exe 3160 BAZKOR.exe 3160 BAZKOR.exe 916 ATB.exe 916 ATB.exe 6012 CRHVENV.exe 6012 CRHVENV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 3264 2500 2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe 87 PID 3264 wrote to memory of 4848 3264 cmd.exe 91 PID 4848 wrote to memory of 3356 4848 MCUOF.exe 93 PID 3356 wrote to memory of 1480 3356 cmd.exe 96 PID 1480 wrote to memory of 4612 1480 OLSRQTO.exe 98 PID 4612 wrote to memory of 1320 4612 cmd.exe 102 PID 1320 wrote to memory of 5224 1320 RYJ.exe 103 PID 5224 wrote to memory of 1828 5224 cmd.exe 107 PID 1828 wrote to memory of 4828 1828 HJMJKTR.exe 108 PID 4828 wrote to memory of 1756 4828 cmd.exe 112 PID 1756 wrote to memory of 2560 1756 ZRAGWKM.exe 113 PID 2560 wrote to memory of 928 2560 cmd.exe 117 PID 928 wrote to memory of 2412 928 NMEHCYC.exe 118 PID 2412 wrote to memory of 4644 2412 cmd.exe 122 PID 4644 wrote to memory of 5780 4644 FPQDQO.exe 123 PID 5780 wrote to memory of 4748 5780 cmd.exe 127 PID 4748 wrote to memory of 5236 4748 EATTQ.exe 128 PID 5236 wrote to memory of 700 5236 cmd.exe 132 PID 700 wrote to memory of 4312 700 WIHYD.exe 133 PID 4312 wrote to memory of 1672 4312 cmd.exe 137 PID 1672 wrote to memory of 5792 1672 LYIQKG.exe 138 PID 5792 wrote to memory of 5932 5792 cmd.exe 142 PID 5932 wrote to memory of 1428 5932 OLZZDAZ.exe 143 PID 1428 wrote to memory of 4536 1428 cmd.exe 147 PID 4536 wrote to memory of 3452 4536 BJZDF.exe 148 PID 3452 wrote to memory of 4268 3452 cmd.exe 152 PID 4268 wrote to memory of 4568 4268 YPRSVH.exe 153 PID 4568 wrote to memory of 5588 4568 cmd.exe 157 PID 5588 wrote to memory of 4496 5588 TVREX.exe 158 PID 4496 wrote to memory of 1648 4496 cmd.exe 162 PID 1648 wrote to memory of 5808 1648 VSXY.exe 163 PID 5808 wrote to memory of 3560 5808 cmd.exe 167 PID 3560 wrote to memory of 3120 3560 YGOAY.exe 168 PID 3120 wrote to memory of 4812 3120 cmd.exe 172 PID 4812 wrote to memory of 2508 4812 GTBO.exe 173 PID 2508 wrote to memory of 3340 2508 cmd.exe 176 PID 3340 wrote to memory of 3836 3340 OZGV.exe 178 PID 3836 wrote to memory of 2400 3836 cmd.exe 182 PID 2400 wrote to memory of 5024 2400 DPHMS.exe 183 PID 5024 wrote to memory of 1128 5024 cmd.exe 187 PID 1128 wrote to memory of 1048 1128 UXVSE.exe 188 PID 1048 wrote to memory of 5560 1048 cmd.exe 191 PID 5560 wrote to memory of 2976 5560 MXJ.exe 193 PID 2976 wrote to memory of 716 2976 cmd.exe 197 PID 716 wrote to memory of 3304 716 SSJ.exe 198 PID 3304 wrote to memory of 5524 3304 cmd.exe 202 PID 5524 wrote to memory of 5608 5524 DLQJ.exe 203 PID 5608 wrote to memory of 5084 5608 cmd.exe 207 PID 5084 wrote to memory of 3212 5084 GTZXM.exe 208 PID 3212 wrote to memory of 4328 3212 cmd.exe 212 PID 4328 wrote to memory of 1124 4328 IRESCLQ.exe 213 PID 1124 wrote to memory of 2448 1124 cmd.exe 217 PID 2448 wrote to memory of 3176 2448 KMW.exe 218 PID 3176 wrote to memory of 4792 3176 cmd.exe 222 PID 4792 wrote to memory of 5484 4792 JXGJWKU.exe 223 PID 5484 wrote to memory of 4492 5484 cmd.exe 227 PID 4492 wrote to memory of 4500 4492 ZNHJC.exe 228 PID 4500 wrote to memory of 3160 4500 cmd.exe 232 PID 3160 wrote to memory of 5576 3160 BAZKOR.exe 233 PID 5576 wrote to memory of 916 5576 cmd.exe 237 PID 916 wrote to memory of 6024 916 ATB.exe 238 PID 6024 wrote to memory of 6012 6024 cmd.exe 242 PID 6012 wrote to memory of 2960 6012 CRHVENV.exe 243 PID 2960 wrote to memory of 900 2960 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_cf45b5270dc959633a6aca568776a8c8_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MCUOF.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\system\MCUOF.exeC:\windows\system\MCUOF.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OLSRQTO.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\windows\system\OLSRQTO.exeC:\windows\system\OLSRQTO.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RYJ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\windows\SysWOW64\RYJ.exeC:\windows\system32\RYJ.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HJMJKTR.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\windows\SysWOW64\HJMJKTR.exeC:\windows\system32\HJMJKTR.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRAGWKM.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\windows\ZRAGWKM.exeC:\windows\ZRAGWKM.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMEHCYC.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\windows\SysWOW64\NMEHCYC.exeC:\windows\system32\NMEHCYC.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPQDQO.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\windows\SysWOW64\FPQDQO.exeC:\windows\system32\FPQDQO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EATTQ.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\EATTQ.exeC:\windows\EATTQ.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WIHYD.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\windows\WIHYD.exeC:\windows\WIHYD.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYIQKG.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\windows\system\LYIQKG.exeC:\windows\system\LYIQKG.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OLZZDAZ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\windows\system\OLZZDAZ.exeC:\windows\system\OLZZDAZ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BJZDF.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\windows\BJZDF.exeC:\windows\BJZDF.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YPRSVH.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\windows\YPRSVH.exeC:\windows\YPRSVH.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TVREX.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\windows\TVREX.exeC:\windows\TVREX.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSXY.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\windows\system\VSXY.exeC:\windows\system\VSXY.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGOAY.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\windows\SysWOW64\YGOAY.exeC:\windows\system32\YGOAY.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTBO.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\GTBO.exeC:\windows\GTBO.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OZGV.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\windows\OZGV.exeC:\windows\OZGV.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPHMS.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\windows\SysWOW64\DPHMS.exeC:\windows\system32\DPHMS.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UXVSE.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\windows\SysWOW64\UXVSE.exeC:\windows\system32\UXVSE.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MXJ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\windows\MXJ.exeC:\windows\MXJ.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SSJ.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\system\SSJ.exeC:\windows\system\SSJ.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DLQJ.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\windows\system\DLQJ.exeC:\windows\system\DLQJ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTZXM.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\windows\GTZXM.exeC:\windows\GTZXM.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IRESCLQ.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\IRESCLQ.exeC:\windows\IRESCLQ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KMW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\windows\system\KMW.exeC:\windows\system\KMW.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JXGJWKU.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\windows\SysWOW64\JXGJWKU.exeC:\windows\system32\JXGJWKU.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNHJC.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\SysWOW64\ZNHJC.exeC:\windows\system32\ZNHJC.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BAZKOR.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\windows\BAZKOR.exeC:\windows\BAZKOR.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\windows\system\ATB.exeC:\windows\system\ATB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRHVENV.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\CRHVENV.exeC:\windows\CRHVENV.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZHVMU.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\windows\ZHVMU.exeC:\windows\ZHVMU.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFD.exe.bat" "66⤵PID:1200
-
C:\windows\system\NFD.exeC:\windows\system\NFD.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSH.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1260 -
C:\windows\system\VSH.exeC:\windows\system\VSH.exe69⤵
- Executes dropped EXE
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GLXPXF.exe.bat" "70⤵PID:5948
-
C:\windows\GLXPXF.exeC:\windows\GLXPXF.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LLYSBCH.exe.bat" "72⤵PID:4060
-
C:\windows\LLYSBCH.exeC:\windows\LLYSBCH.exe73⤵
- Executes dropped EXE
PID:1188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PTFS.exe.bat" "74⤵PID:4072
-
C:\windows\system\PTFS.exeC:\windows\system\PTFS.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CEVQCFQ.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:4240 -
C:\windows\SysWOW64\CEVQCFQ.exeC:\windows\system32\CEVQCFQ.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PCVCEI.exe.bat" "78⤵PID:4216
-
C:\windows\PCVCEI.exeC:\windows\PCVCEI.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZAJXL.exe.bat" "80⤵PID:2672
-
C:\windows\SysWOW64\ZAJXL.exeC:\windows\system32\ZAJXL.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXPJA.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:6052 -
C:\windows\system\JXPJA.exeC:\windows\system\JXPJA.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AIRZBNG.exe.bat" "84⤵PID:8
-
C:\windows\SysWOW64\AIRZBNG.exeC:\windows\system32\AIRZBNG.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BLVDPD.exe.bat" "86⤵PID:3300
-
C:\windows\SysWOW64\BLVDPD.exeC:\windows\system32\BLVDPD.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JRIJZ.exe.bat" "88⤵PID:1704
-
C:\windows\system\JRIJZ.exeC:\windows\system\JRIJZ.exe89⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YUR.exe.bat" "90⤵PID:1520
-
C:\windows\YUR.exeC:\windows\YUR.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RPVRQ.exe.bat" "92⤵PID:2036
-
C:\windows\system\RPVRQ.exeC:\windows\system\RPVRQ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GFW.exe.bat" "94⤵PID:2896
-
C:\windows\SysWOW64\GFW.exeC:\windows\system32\GFW.exe95⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSJ.exe.bat" "96⤵PID:4976
-
C:\windows\OSJ.exeC:\windows\OSJ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HLY.exe.bat" "98⤵PID:3772
-
C:\windows\HLY.exeC:\windows\HLY.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWBQZNJ.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:5600 -
C:\windows\GWBQZNJ.exeC:\windows\GWBQZNJ.exe101⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KMIYL.exe.bat" "102⤵PID:1612
-
C:\windows\KMIYL.exeC:\windows\KMIYL.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XOQ.exe.bat" "104⤵PID:6076
-
C:\windows\XOQ.exeC:\windows\XOQ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WHBFIOP.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:3700 -
C:\windows\SysWOW64\WHBFIOP.exeC:\windows\system32\WHBFIOP.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENFUTM.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:792 -
C:\windows\SysWOW64\ENFUTM.exeC:\windows\system32\ENFUTM.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FQJ.exe.bat" "110⤵PID:5480
-
C:\windows\FQJ.exeC:\windows\FQJ.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBUFHQI.exe.bat" "112⤵PID:3156
-
C:\windows\SysWOW64\VBUFHQI.exeC:\windows\system32\VBUFHQI.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLCEVBD.exe.bat" "114⤵PID:6064
-
C:\windows\system\RLCEVBD.exeC:\windows\system\RLCEVBD.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWFM.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:6056 -
C:\windows\PWFM.exeC:\windows\PWFM.exe117⤵
- Executes dropped EXE
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZWHZHFC.exe.bat" "118⤵PID:2180
-
C:\windows\ZWHZHFC.exeC:\windows\ZWHZHFC.exe119⤵
- Executes dropped EXE
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZALV.exe.bat" "120⤵PID:2312
-
C:\windows\SysWOW64\ZALV.exeC:\windows\system32\ZALV.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-