Analysis
- max time kernel
96s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 17:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_6ef73f907b66e73e6c0f711cf0113aff_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_6ef73f907b66e73e6c0f711cf0113aff_elex_emotet_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-09_6ef73f907b66e73e6c0f711cf0113aff_elex_emotet_stop.exe
- Size 208KB
- Sample260709-vrypese19x
- SHA256 fe2b3d1d86423fa2bf25a0c84ec3d9648e09f3a88bb48a9280f903f1698e388c
- MD5 6ef73f907b66e73e6c0f711cf0113aff
- SHA1 18798a588eaf32afb909b902d946ca5a01c01f47
- SHA512 00199766de335e217478e9f5575cf97653509d667bcc87fbd1e93d06d78fedb9539fa3ec2fbf7f6f4b0f466d489a0e3f1a7da43b08323be4f2e0dcab09314b59
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf34NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOfQEjK
- TLSH T17C247D2235D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 248 ZDQ.exe 4024 OTD.exe 3752 AJKPZZR.exe 4580 JJMC.exe 3556 TJOHO.exe 5428 IMX.exe 5652 TFAE.exe 4536 OIJDOGH.exe 4076 YQL.exe 4564 EQSWIG.exe 1184 EWTKKL.exe 1432 IMZKWD.exe 4804 GXC.exe 1844 VSMNQE.exe 1528 LIVE.exe 3844 UIPJA.exe 5764 JLG.exe 3764 VEBG.exe 3908 QGRFHCI.exe 2868 LCWO.exe 4480 PFUJRVZ.exe 5256 JSZT.exe 3644 EFWCMU.exe 3984 CDPF.exe 4472 IZOGDDA.exe 1064 ORWU.exe 4696 JMBDXF.exe 4992 PMIRGZ.exe 3408 PSBF.exe 1776 CDREWPQ.exe 5964 KIJ.exe 2972 RDTXQ.exe 4732 URYGSOI.exe 940 HWGSCA.exe 5544 CKK.exe 4228 YPV.exe 5668 GVVF.exe 1712 SNY.exe 5860 QOFMV.exe 4748 BEM.exe 4900 APPCIQE.exe 1452 NZXAWBA.exe 2872 XAZ.exe 4028 XDDJN.exe 1368 ZARD.exe 2236 RBTIYC.exe 3220 XBA.exe 3872 ARHWU.exe 4828 MKCPCW.exe 2812 GXH.exe 3976 QXJDQ.exe 2156 WYQRZVL.exe 2584 ZOXZ.exe 3800 GJWAQRX.exe 3716 LJEOZTY.exe 3256 GWJX.exe 5192 BKNHTS.exe 2088 VXS.exe 3796 BXAMM.exe 3996 BLAAOZ.exe 1492 QGKE.exe 4736 GWLWGIS.exe 2252 AJPN.exe 5296 VXUXAH.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\NZXAWBA.exe APPCIQE.exe File created C:\windows\SysWOW64\QATEZ.exe FHYL.exe File opened for modification C:\windows\SysWOW64\QYCUPJ.exe ZNEWPP.exe File opened for modification C:\windows\SysWOW64\MDQ.exe ZAHYB.exe File opened for modification C:\windows\SysWOW64\ISH.exe HXDAKC.exe File created C:\windows\SysWOW64\EWTKKL.exe EQSWIG.exe File created C:\windows\SysWOW64\KIJ.exe.bat CDREWPQ.exe File created C:\windows\SysWOW64\GXH.exe.bat MKCPCW.exe File created C:\windows\SysWOW64\QXJDQ.exe.bat GXH.exe File created C:\windows\SysWOW64\QYCUPJ.exe.bat ZNEWPP.exe File opened for modification C:\windows\SysWOW64\ZNTDL.exe ESO.exe File created C:\windows\SysWOW64\SRYZZT.exe.bat MQQMQ.exe File opened for modification C:\windows\SysWOW64\KIJ.exe CDREWPQ.exe File opened for modification C:\windows\SysWOW64\BKNHTS.exe GWJX.exe File created C:\windows\SysWOW64\VXS.exe BKNHTS.exe File opened for modification C:\windows\SysWOW64\AJPN.exe GWLWGIS.exe File opened for modification C:\windows\SysWOW64\KIC.exe PVXYAX.exe File opened for modification C:\windows\SysWOW64\EXPSU.exe KKKJ.exe File created C:\windows\SysWOW64\TAYMNS.exe ZNTDL.exe File created C:\windows\SysWOW64\DJTSIJL.exe SRYZZT.exe File opened for modification C:\windows\SysWOW64\AJKPZZR.exe OTD.exe File opened for modification C:\windows\SysWOW64\VEBG.exe JLG.exe File created C:\windows\SysWOW64\EXPSU.exe KKKJ.exe File created C:\windows\SysWOW64\FHYL.exe EEMPM.exe File opened for modification C:\windows\SysWOW64\QATEZ.exe FHYL.exe File created C:\windows\SysWOW64\JWUC.exe.bat AOSXXO.exe File created C:\windows\SysWOW64\MDQ.exe.bat ZAHYB.exe File opened for modification C:\windows\SysWOW64\YXXB.exe DJTSIJL.exe File created C:\windows\SysWOW64\AJKPZZR.exe OTD.exe File created C:\windows\SysWOW64\UIPJA.exe LIVE.exe File opened for modification C:\windows\SysWOW64\QXJDQ.exe GXH.exe File created C:\windows\SysWOW64\YLQKGA.exe.bat LAILSX.exe File opened for modification C:\windows\SysWOW64\LRETD.exe YLQKGA.exe File created C:\windows\SysWOW64\MQQMQ.exe MDQ.exe File created C:\windows\SysWOW64\YXXB.exe.bat DJTSIJL.exe File created C:\windows\SysWOW64\AJKPZZR.exe.bat OTD.exe File created C:\windows\SysWOW64\VEBG.exe.bat JLG.exe File created C:\windows\SysWOW64\AJPN.exe GWLWGIS.exe File created C:\windows\SysWOW64\ZNEWPP.exe.bat QATEZ.exe File opened for modification C:\windows\SysWOW64\EQSWIG.exe YQL.exe File created C:\windows\SysWOW64\EQSWIG.exe.bat YQL.exe File opened for modification C:\windows\SysWOW64\PSBF.exe PMIRGZ.exe File created C:\windows\SysWOW64\RBTIYC.exe.bat ZARD.exe File opened for modification C:\windows\SysWOW64\PCRDRAC.exe MOMMH.exe File created C:\windows\SysWOW64\IUU.exe XBRPKR.exe File opened for modification C:\windows\SysWOW64\IUU.exe XBRPKR.exe File created C:\windows\SysWOW64\JWUC.exe AOSXXO.exe File opened for modification C:\windows\SysWOW64\VXS.exe BKNHTS.exe File created C:\windows\SysWOW64\YLQKGA.exe LAILSX.exe File created C:\windows\SysWOW64\TAYMNS.exe.bat ZNTDL.exe File created C:\windows\SysWOW64\SRYZZT.exe MQQMQ.exe File opened for modification C:\windows\SysWOW64\SRYZZT.exe MQQMQ.exe File created C:\windows\SysWOW64\DJTSIJL.exe.bat SRYZZT.exe File created C:\windows\SysWOW64\MEWHG.exe VTTRYC.exe File created C:\windows\SysWOW64\PSBF.exe PMIRGZ.exe File created C:\windows\SysWOW64\KIJ.exe CDREWPQ.exe File created C:\windows\SysWOW64\QXJDQ.exe GXH.exe File created C:\windows\SysWOW64\IUU.exe.bat XBRPKR.exe File created C:\windows\SysWOW64\FHYL.exe.bat EEMPM.exe File created C:\windows\SysWOW64\EKZTLM.exe.bat JWUC.exe File opened for modification C:\windows\SysWOW64\ZAHYB.exe YXW.exe File created C:\windows\SysWOW64\YXXB.exe DJTSIJL.exe File created C:\windows\SysWOW64\KIC.exe PVXYAX.exe File created C:\windows\SysWOW64\KIC.exe.bat PVXYAX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\IZOGDDA.exe CDPF.exe File opened for modification C:\windows\YPV.exe CKK.exe File created C:\windows\GVVF.exe.bat YPV.exe File opened for modification C:\windows\system\FCEHZW.exe CUXHNEE.exe File opened for modification C:\windows\system\UHTP.exe AMO.exe File opened for modification C:\windows\EEMPM.exe RCERFKX.exe File opened for modification C:\windows\BXAMM.exe VXS.exe File opened for modification C:\windows\BEM.exe QOFMV.exe File created C:\windows\XDDJN.exe.bat XAZ.exe File created C:\windows\system\TQEM.exe KIC.exe File created C:\windows\system\ZBFA.exe.bat TAYMNS.exe File created C:\windows\system\TFAE.exe IMX.exe File created C:\windows\BEM.exe QOFMV.exe File created C:\windows\AMO.exe LRETD.exe File created C:\windows\system\OGL.exe.bat ZBFA.exe File created C:\windows\YPV.exe.bat CKK.exe File opened for modification C:\windows\LAILSX.exe SFWP.exe File created C:\windows\LAILSX.exe.bat SFWP.exe File created C:\windows\system\MOMMH.exe.bat SBH.exe File created C:\windows\HEWYTNJ.exe.bat IUU.exe File created C:\windows\system\LCMVIQ.exe.bat FCEHZW.exe File created C:\windows\OTD.exe.bat ZDQ.exe File created C:\windows\system\LIVE.exe.bat VSMNQE.exe File opened for modification C:\windows\system\LJEOZTY.exe GJWAQRX.exe File created C:\windows\GWLWGIS.exe QGKE.exe File opened for modification C:\windows\HYYIOPL.exe OYJX.exe File created C:\windows\HYYIOPL.exe.bat OYJX.exe File created C:\windows\system\AOSXXO.exe OGL.exe File created C:\windows\system\CUXHNEE.exe.bat MEWHG.exe File created C:\windows\system\VSMNQE.exe GXC.exe File created C:\windows\IZOGDDA.exe.bat CDPF.exe File created C:\windows\GVVF.exe YPV.exe File opened for modification C:\windows\system\ARHWU.exe XBA.exe File opened for modification C:\windows\system\GWJX.exe LJEOZTY.exe File created C:\windows\BLAAOZ.exe BXAMM.exe File created C:\windows\AMO.exe.bat LRETD.exe File created C:\windows\system\OGL.exe ZBFA.exe File created C:\windows\IMX.exe.bat TJOHO.exe File opened for modification C:\windows\LCWO.exe QGRFHCI.exe File created C:\windows\PMIRGZ.exe JMBDXF.exe File opened for modification C:\windows\XBA.exe RBTIYC.exe File opened for modification C:\windows\SFWP.exe XKZGCHK.exe File created C:\windows\KXWN.exe.bat PCRDRAC.exe File opened for modification C:\windows\system\AOSXXO.exe OGL.exe File opened for modification C:\windows\system\VXUXAH.exe AJPN.exe File opened for modification C:\windows\system\TIMJ.exe LCMVIQ.exe File opened for modification C:\windows\OTD.exe ZDQ.exe File created C:\windows\system\TJOHO.exe.bat JJMC.exe File opened for modification C:\windows\system\GXC.exe IMZKWD.exe File created C:\windows\JSZT.exe.bat PFUJRVZ.exe File created C:\windows\system\HXDAKC.exe KXWN.exe File created C:\windows\APPCIQE.exe BEM.exe File created C:\windows\XBA.exe RBTIYC.exe File created C:\windows\TZLASLX.exe.bat QMGRI.exe File created C:\windows\system\SBH.exe TQEM.exe File opened for modification C:\windows\system\HXDAKC.exe KXWN.exe File created C:\windows\URYGSOI.exe.bat RDTXQ.exe File created C:\windows\OYJX.exe.bat EXPSU.exe File created C:\windows\HYYIOPL.exe OYJX.exe File opened for modification C:\windows\YXW.exe EKZTLM.exe File created C:\windows\LCWO.exe QGRFHCI.exe File opened for modification C:\windows\PFUJRVZ.exe LCWO.exe File created C:\windows\ORWU.exe IZOGDDA.exe File opened for modification C:\windows\OYJX.exe EXPSU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 1356 2724 WerFault.exe 86 1416 248 WerFault.exe 90 5312 4024 WerFault.exe 97 5912 3752 WerFault.exe 102 5844 4580 WerFault.exe 107 5596 3556 WerFault.exe 112 1244 5428 WerFault.exe 117 5960 5652 WerFault.exe 122 6100 4536 WerFault.exe 127 2032 4076 WerFault.exe 132 5632 4564 WerFault.exe 137 4776 1184 WerFault.exe 142 1448 1432 WerFault.exe 147 3304 4804 WerFault.exe 152 4300 1844 WerFault.exe 157 4200 1528 WerFault.exe 162 4008 3844 WerFault.exe 167 2156 5764 WerFault.exe 172 2764 3764 WerFault.exe 177 3800 3908 WerFault.exe 182 5900 2868 WerFault.exe 187 5044 4480 WerFault.exe 192 3060 5256 WerFault.exe 197 3856 3644 WerFault.exe 202 4824 3984 WerFault.exe 207 5312 4472 WerFault.exe 212 4368 1064 WerFault.exe 217 1904 4696 WerFault.exe 222 2848 4992 WerFault.exe 227 3008 3408 WerFault.exe 232 4348 1776 WerFault.exe 237 1204 5964 WerFault.exe 242 3036 2972 WerFault.exe 247 464 4732 WerFault.exe 252 4036 940 WerFault.exe 257 1460 5544 WerFault.exe 262 2968 4228 WerFault.exe 267 4300 5668 WerFault.exe 272 1544 1712 WerFault.exe 277 6084 5860 WerFault.exe 283 3376 4748 WerFault.exe 288 544 4900 WerFault.exe 293 3104 1452 WerFault.exe 298 3344 2872 WerFault.exe 303 1824 4028 WerFault.exe 308 5804 1368 WerFault.exe 313 5496 2236 WerFault.exe 318 5312 3220 WerFault.exe 323 4868 3872 WerFault.exe 328 4468 4828 WerFault.exe 333 6084 2812 WerFault.exe 338 3376 3976 WerFault.exe 343 544 2156 WerFault.exe 348 1228 2584 WerFault.exe 353 1596 3800 WerFault.exe 358 3324 3716 WerFault.exe 363 4812 3256 WerFault.exe 368 1116 5192 WerFault.exe 373 4848 2088 WerFault.exe 378 4852 3796 WerFault.exe 383 1836 3996 WerFault.exe 388 3504 1492 WerFault.exe 393 1656 4736 WerFault.exe 398 2484 2252 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFUJRVZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJWAQRX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UHTP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FHYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODRSUD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LIVE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJKPZZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARHWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMZKWD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ORWU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QATEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QYCUPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMGRI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WYK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VXUXAH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XKZGCHK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APPCIQE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GXH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LAILSX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TIMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKNHTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIC.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2724 2026-07-09_6ef73f907b66e73e6c0f711cf0113aff_elex_emotet_stop.exe 2724 2026-07-09_6ef73f907b66e73e6c0f711cf0113aff_elex_emotet_stop.exe 248 ZDQ.exe 248 ZDQ.exe 4024 OTD.exe 4024 OTD.exe 3752 AJKPZZR.exe 3752 AJKPZZR.exe 4580 JJMC.exe 4580 JJMC.exe 3556 TJOHO.exe 3556 TJOHO.exe 5428 IMX.exe 5428 IMX.exe 5652 TFAE.exe 5652 TFAE.exe 4536 OIJDOGH.exe 4536 OIJDOGH.exe 4076 YQL.exe 4076 YQL.exe 4564 EQSWIG.exe 4564 EQSWIG.exe 1184 EWTKKL.exe 1184 EWTKKL.exe 1432 IMZKWD.exe 1432 IMZKWD.exe 4804 GXC.exe 4804 GXC.exe 1844 VSMNQE.exe 1844 VSMNQE.exe 1528 LIVE.exe 1528 LIVE.exe 3844 UIPJA.exe 3844 UIPJA.exe 5764 JLG.exe 5764 JLG.exe 3764 VEBG.exe 3764 VEBG.exe 3908 QGRFHCI.exe 3908 QGRFHCI.exe 2868 LCWO.exe 2868 LCWO.exe 4480 PFUJRVZ.exe 4480 PFUJRVZ.exe 5256 JSZT.exe 5256 JSZT.exe 3644 EFWCMU.exe 3644 EFWCMU.exe 3984 CDPF.exe 3984 CDPF.exe 4472 IZOGDDA.exe 4472 IZOGDDA.exe 1064 ORWU.exe 1064 ORWU.exe 4696 JMBDXF.exe 4696 JMBDXF.exe 4992 PMIRGZ.exe 4992 PMIRGZ.exe 3408 PSBF.exe 3408 PSBF.exe 1776 CDREWPQ.exe 1776 CDREWPQ.exe 5964 KIJ.exe 5964 KIJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2724 2026-07-09_6ef73f907b66e73e6c0f711cf0113aff_elex_emotet_stop.exe 2724 2026-07-09_6ef73f907b66e73e6c0f711cf0113aff_elex_emotet_stop.exe 248 ZDQ.exe 248 ZDQ.exe 4024 OTD.exe 4024 OTD.exe 3752 AJKPZZR.exe 3752 AJKPZZR.exe 4580 JJMC.exe 4580 JJMC.exe 3556 TJOHO.exe 3556 TJOHO.exe 5428 IMX.exe 5428 IMX.exe 5652 TFAE.exe 5652 TFAE.exe 4536 OIJDOGH.exe 4536 OIJDOGH.exe 4076 YQL.exe 4076 YQL.exe 4564 EQSWIG.exe 4564 EQSWIG.exe 1184 EWTKKL.exe 1184 EWTKKL.exe 1432 IMZKWD.exe 1432 IMZKWD.exe 4804 GXC.exe 4804 GXC.exe 1844 VSMNQE.exe 1844 VSMNQE.exe 1528 LIVE.exe 1528 LIVE.exe 3844 UIPJA.exe 3844 UIPJA.exe 5764 JLG.exe 5764 JLG.exe 3764 VEBG.exe 3764 VEBG.exe 3908 QGRFHCI.exe 3908 QGRFHCI.exe 2868 LCWO.exe 2868 LCWO.exe 4480 PFUJRVZ.exe 4480 PFUJRVZ.exe 5256 JSZT.exe 5256 JSZT.exe 3644 EFWCMU.exe 3644 EFWCMU.exe 3984 CDPF.exe 3984 CDPF.exe 4472 IZOGDDA.exe 4472 IZOGDDA.exe 1064 ORWU.exe 1064 ORWU.exe 4696 JMBDXF.exe 4696 JMBDXF.exe 4992 PMIRGZ.exe 4992 PMIRGZ.exe 3408 PSBF.exe 3408 PSBF.exe 1776 CDREWPQ.exe 1776 CDREWPQ.exe 5964 KIJ.exe 5964 KIJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2724 wrote to memory of 4740 2724 2026-07-09_6ef73f907b66e73e6c0f711cf0113aff_elex_emotet_stop.exe 87 PID 4740 wrote to memory of 248 4740 cmd.exe 90 PID 248 wrote to memory of 4584 248 ZDQ.exe 93 PID 4584 wrote to memory of 4024 4584 cmd.exe 97 PID 4024 wrote to memory of 4332 4024 OTD.exe 98 PID 4332 wrote to memory of 3752 4332 cmd.exe 102 PID 3752 wrote to memory of 4716 3752 AJKPZZR.exe 103 PID 4716 wrote to memory of 4580 4716 cmd.exe 107 PID 4580 wrote to memory of 828 4580 JJMC.exe 108 PID 828 wrote to memory of 3556 828 cmd.exe 112 PID 3556 wrote to memory of 1276 3556 TJOHO.exe 113 PID 1276 wrote to memory of 5428 1276 cmd.exe 117 PID 5428 wrote to memory of 3204 5428 IMX.exe 118 PID 3204 wrote to memory of 5652 3204 cmd.exe 122 PID 5652 wrote to memory of 2592 5652 TFAE.exe 123 PID 2592 wrote to memory of 4536 2592 cmd.exe 127 PID 4536 wrote to memory of 2644 4536 OIJDOGH.exe 128 PID 2644 wrote to memory of 4076 2644 cmd.exe 132 PID 4076 wrote to memory of 5360 4076 YQL.exe 133 PID 5360 wrote to memory of 4564 5360 cmd.exe 137 PID 4564 wrote to memory of 5824 4564 EQSWIG.exe 138 PID 5824 wrote to memory of 1184 5824 cmd.exe 142 PID 1184 wrote to memory of 2068 1184 EWTKKL.exe 143 PID 2068 wrote to memory of 1432 2068 cmd.exe 147 PID 1432 wrote to memory of 1356 1432 IMZKWD.exe 148 PID 1356 wrote to memory of 4804 1356 cmd.exe 152 PID 4804 wrote to memory of 2912 4804 GXC.exe 153 PID 2912 wrote to memory of 1844 2912 cmd.exe 157 PID 1844 wrote to memory of 1120 1844 VSMNQE.exe 158 PID 1120 wrote to memory of 1528 1120 cmd.exe 162 PID 1528 wrote to memory of 4728 1528 LIVE.exe 163 PID 4728 wrote to memory of 3844 4728 cmd.exe 167 PID 3844 wrote to memory of 3268 3844 UIPJA.exe 168 PID 3268 wrote to memory of 5764 3268 cmd.exe 172 PID 5764 wrote to memory of 5948 5764 JLG.exe 173 PID 5948 wrote to memory of 3764 5948 cmd.exe 177 PID 3764 wrote to memory of 5840 3764 VEBG.exe 178 PID 5840 wrote to memory of 3908 5840 cmd.exe 182 PID 3908 wrote to memory of 252 3908 QGRFHCI.exe 183 PID 252 wrote to memory of 2868 252 cmd.exe 187 PID 2868 wrote to memory of 5052 2868 LCWO.exe 188 PID 5052 wrote to memory of 4480 5052 cmd.exe 192 PID 4480 wrote to memory of 2032 4480 PFUJRVZ.exe 193 PID 2032 wrote to memory of 5256 2032 cmd.exe 197 PID 5256 wrote to memory of 5632 5256 JSZT.exe 198 PID 5632 wrote to memory of 3644 5632 cmd.exe 202 PID 3644 wrote to memory of 5684 3644 EFWCMU.exe 203 PID 5684 wrote to memory of 3984 5684 cmd.exe 207 PID 3984 wrote to memory of 520 3984 CDPF.exe 208 PID 520 wrote to memory of 4472 520 cmd.exe 212 PID 4472 wrote to memory of 5248 4472 IZOGDDA.exe 213 PID 5248 wrote to memory of 1064 5248 cmd.exe 217 PID 1064 wrote to memory of 1804 1064 ORWU.exe 218 PID 1804 wrote to memory of 4696 1804 cmd.exe 222 PID 4696 wrote to memory of 3044 4696 JMBDXF.exe 223 PID 3044 wrote to memory of 4992 3044 cmd.exe 227 PID 4992 wrote to memory of 1068 4992 PMIRGZ.exe 228 PID 1068 wrote to memory of 3408 1068 cmd.exe 232 PID 3408 wrote to memory of 1920 3408 PSBF.exe 233 PID 1920 wrote to memory of 1776 1920 cmd.exe 237 PID 1776 wrote to memory of 2552 1776 CDREWPQ.exe 238 PID 2552 wrote to memory of 5964 2552 cmd.exe 242 PID 5964 wrote to memory of 4924 5964 KIJ.exe 243 PID 4924 wrote to memory of 2972 4924 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_6ef73f907b66e73e6c0f711cf0113aff_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_6ef73f907b66e73e6c0f711cf0113aff_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDQ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\system\ZDQ.exeC:\windows\system\ZDQ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OTD.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\windows\OTD.exeC:\windows\OTD.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AJKPZZR.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\windows\SysWOW64\AJKPZZR.exeC:\windows\system32\AJKPZZR.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TJOHO.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828 -
C:\windows\system\TJOHO.exeC:\windows\system\TJOHO.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMX.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\windows\IMX.exeC:\windows\IMX.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAE.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\system\TFAE.exeC:\windows\system\TFAE.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OIJDOGH.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\system\OIJDOGH.exeC:\windows\system\OIJDOGH.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YQL.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\windows\system\YQL.exeC:\windows\system\YQL.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EQSWIG.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\windows\SysWOW64\EQSWIG.exeC:\windows\system32\EQSWIG.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EWTKKL.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\windows\SysWOW64\EWTKKL.exeC:\windows\system32\EWTKKL.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMZKWD.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\windows\IMZKWD.exeC:\windows\IMZKWD.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXC.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\windows\system\GXC.exeC:\windows\system\GXC.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSMNQE.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\windows\system\VSMNQE.exeC:\windows\system\VSMNQE.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LIVE.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\windows\system\LIVE.exeC:\windows\system\LIVE.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UIPJA.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\windows\SysWOW64\UIPJA.exeC:\windows\system32\UIPJA.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLG.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\JLG.exeC:\windows\JLG.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBG.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\SysWOW64\VEBG.exeC:\windows\system32\VEBG.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QGRFHCI.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\windows\system\QGRFHCI.exeC:\windows\system\QGRFHCI.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCWO.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:252 -
C:\windows\LCWO.exeC:\windows\LCWO.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFUJRVZ.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\windows\PFUJRVZ.exeC:\windows\PFUJRVZ.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JSZT.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\JSZT.exeC:\windows\JSZT.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EFWCMU.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5632 -
C:\windows\EFWCMU.exeC:\windows\EFWCMU.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDPF.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\windows\system\CDPF.exeC:\windows\system\CDPF.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZOGDDA.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\windows\IZOGDDA.exeC:\windows\IZOGDDA.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ORWU.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\windows\ORWU.exeC:\windows\ORWU.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JMBDXF.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\windows\JMBDXF.exeC:\windows\JMBDXF.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMIRGZ.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\windows\PMIRGZ.exeC:\windows\PMIRGZ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PSBF.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\windows\SysWOW64\PSBF.exeC:\windows\system32\PSBF.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CDREWPQ.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\windows\system\CDREWPQ.exeC:\windows\system\CDREWPQ.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\windows\SysWOW64\KIJ.exeC:\windows\system32\KIJ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDTXQ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\windows\system\RDTXQ.exeC:\windows\system\RDTXQ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\URYGSOI.exe.bat" "66⤵PID:1280
-
C:\windows\URYGSOI.exeC:\windows\URYGSOI.exe67⤵
- Executes dropped EXE
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWGSCA.exe.bat" "68⤵PID:4600
-
C:\windows\HWGSCA.exeC:\windows\HWGSCA.exe69⤵
- Executes dropped EXE
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKK.exe.bat" "70⤵PID:5580
-
C:\windows\CKK.exeC:\windows\CKK.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YPV.exe.bat" "72⤵PID:4704
-
C:\windows\YPV.exeC:\windows\YPV.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GVVF.exe.bat" "74⤵PID:2616
-
C:\windows\GVVF.exeC:\windows\GVVF.exe75⤵
- Executes dropped EXE
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SNY.exe.bat" "76⤵PID:4988
-
C:\windows\SNY.exeC:\windows\SNY.exe77⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QOFMV.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:1128 -
C:\windows\QOFMV.exeC:\windows\QOFMV.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEM.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5480 -
C:\windows\BEM.exeC:\windows\BEM.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\APPCIQE.exe.bat" "82⤵PID:3048
-
C:\windows\APPCIQE.exeC:\windows\APPCIQE.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NZXAWBA.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\windows\SysWOW64\NZXAWBA.exeC:\windows\system32\NZXAWBA.exe85⤵
- Executes dropped EXE
PID:1452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XAZ.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:3848 -
C:\windows\system\XAZ.exeC:\windows\system\XAZ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDDJN.exe.bat" "88⤵PID:5396
-
C:\windows\XDDJN.exeC:\windows\XDDJN.exe89⤵
- Executes dropped EXE
PID:4028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZARD.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:5268 -
C:\windows\ZARD.exeC:\windows\ZARD.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RBTIYC.exe.bat" "92⤵PID:5880
-
C:\windows\SysWOW64\RBTIYC.exeC:\windows\system32\RBTIYC.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XBA.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:3384 -
C:\windows\XBA.exeC:\windows\XBA.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARHWU.exe.bat" "96⤵PID:1736
-
C:\windows\system\ARHWU.exeC:\windows\system\ARHWU.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKCPCW.exe.bat" "98⤵PID:5908
-
C:\windows\system\MKCPCW.exeC:\windows\system\MKCPCW.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GXH.exe.bat" "100⤵PID:4680
-
C:\windows\SysWOW64\GXH.exeC:\windows\system32\GXH.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QXJDQ.exe.bat" "102⤵PID:1288
-
C:\windows\SysWOW64\QXJDQ.exeC:\windows\system32\QXJDQ.exe103⤵
- Executes dropped EXE
PID:3976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WYQRZVL.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:5676 -
C:\windows\system\WYQRZVL.exeC:\windows\system\WYQRZVL.exe105⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOXZ.exe.bat" "106⤵PID:5576
-
C:\windows\ZOXZ.exeC:\windows\ZOXZ.exe107⤵
- Executes dropped EXE
PID:2584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJWAQRX.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:1204 -
C:\windows\GJWAQRX.exeC:\windows\GJWAQRX.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LJEOZTY.exe.bat" "110⤵PID:2948
-
C:\windows\system\LJEOZTY.exeC:\windows\system\LJEOZTY.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GWJX.exe.bat" "112⤵PID:5400
-
C:\windows\system\GWJX.exeC:\windows\system\GWJX.exe113⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BKNHTS.exe.bat" "114⤵PID:5488
-
C:\windows\SysWOW64\BKNHTS.exeC:\windows\system32\BKNHTS.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VXS.exe.bat" "116⤵PID:5140
-
C:\windows\SysWOW64\VXS.exeC:\windows\system32\VXS.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BXAMM.exe.bat" "118⤵PID:5312
-
C:\windows\BXAMM.exeC:\windows\BXAMM.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BLAAOZ.exe.bat" "120⤵PID:696
-
C:\windows\BLAAOZ.exeC:\windows\BLAAOZ.exe121⤵
- Executes dropped EXE
PID:3996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-