Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/06/2026, 12:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe
- Size 448KB
- Sample260606-p3bfdaft8j
- SHA256 ac6966c9c136852a1e7a16f420e860e539245e43f54180e8e7dbd181ba470286
- MD5 b16154855d036d6091564e8cea6d0389
- SHA1 00cad49aef9f4acee11ff0d086bc46f46decd4b0
- SHA512 71166ee9a9c5e65f51275e51d98adb14e2bc497cb4fcb6a18e8a9bf911a5d7aa3022f18a934d8f60ea62574f43b6aab153ea45ce0ec8ce88d77d90328b9888ee
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOxkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOxkmZzcukG2/
- TLSH T1E1A49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2908 OJQ.exe 4272 MUTSNCE.exe 4472 DSAUYWL.exe 1692 LCJW.exe 5156 HKDEPZV.exe 4420 FICOBSC.exe 3568 YDBSXXL.exe 4308 ZGDZQLN.exe 4112 FRHGVC.exe 332 JZBNY.exe 5776 BHBE.exe 5536 SXIH.exe 4260 FIENY.exe 5456 VYKQ.exe 2448 ZGF.exe 4996 GBCKPBA.exe 5752 UMGQUS.exe 2168 TWG.exe 6136 FPJD.exe 4496 DFIN.exe 5684 KAN.exe 4460 XLJYJQQ.exe 3032 IOAKNVR.exe 4612 XJGWXO.exe 6028 QJFMG.exe 616 MZAU.exe 5100 XWLAV.exe 4324 BFF.exe 3468 TNN.exe 3288 MIECLV.exe 1640 RTAAQNR.exe 4752 GOXUAO.exe 3856 NJCHC.exe 3432 EZBJ.exe 2648 LRKL.exe 3400 EMBO.exe 5748 XUBF.exe 5308 PCJVXR.exe 112 WXGHZ.exe 104 PTXLE.exe 5944 AYJRQV.exe 3176 RJZPQP.exe 2416 NGF.exe 2308 NZO.exe 5696 ACKMYUH.exe 5260 UILWFNK.exe 5524 ALPDSE.exe 1288 NVLBXVH.exe 4156 UQINZX.exe 1528 LESFPTD.exe 2856 HMUNSS.exe 1680 LUOVVZ.exe 1540 CHZNLVI.exe 940 YPTDOU.exe 2536 CFNLRT.exe 5024 CQWMFF.exe 5488 GYQUI.exe 2176 LJUTNV.exe 1880 JZTDZ.exe 4708 YEZSGRU.exe 5804 ACSVMO.exe 1556 CFCCXC.exe 2484 RAZOH.exe 1672 DNR.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\ZGF.exe VYKQ.exe File created C:\windows\SysWOW64\DNR.exe.bat RAZOH.exe File opened for modification C:\windows\SysWOW64\ARAABOE.exe THRZ.exe File created C:\windows\SysWOW64\REUQK.exe HWSL.exe File opened for modification C:\windows\SysWOW64\LWNM.exe VYHJ.exe File created C:\windows\SysWOW64\KWSO.exe.bat CLKNNPP.exe File created C:\windows\SysWOW64\VSZXJ.exe VEZJ.exe File created C:\windows\SysWOW64\KNI.exe.bat VSZXJ.exe File created C:\windows\SysWOW64\BFF.exe.bat XWLAV.exe File created C:\windows\SysWOW64\EZBJ.exe.bat NJCHC.exe File opened for modification C:\windows\SysWOW64\LRKL.exe EZBJ.exe File created C:\windows\SysWOW64\XDTE.exe PSKKBHC.exe File created C:\windows\SysWOW64\XSMJ.exe IXPXW.exe File created C:\windows\SysWOW64\CECN.exe.bat LOVK.exe File opened for modification C:\windows\SysWOW64\SXIH.exe BHBE.exe File created C:\windows\SysWOW64\JGMIUJP.exe MBGLFZV.exe File opened for modification C:\windows\SysWOW64\KGZSNKT.exe YNE.exe File created C:\windows\SysWOW64\KGZSNKT.exe.bat YNE.exe File created C:\windows\SysWOW64\PXLKMQP.exe.bat TPQUJRT.exe File opened for modification C:\windows\SysWOW64\SGC.exe QIB.exe File created C:\windows\SysWOW64\NRIQPJ.exe.bat SEDZ.exe File created C:\windows\SysWOW64\MZAU.exe QJFMG.exe File opened for modification C:\windows\SysWOW64\RTAAQNR.exe MIECLV.exe File opened for modification C:\windows\SysWOW64\QHW.exe KWSO.exe File created C:\windows\SysWOW64\MUTSNCE.exe OJQ.exe File opened for modification C:\windows\SysWOW64\MZAU.exe QJFMG.exe File opened for modification C:\windows\SysWOW64\LOVK.exe YDZEP.exe File created C:\windows\SysWOW64\KWSO.exe CLKNNPP.exe File opened for modification C:\windows\SysWOW64\TFXGF.exe WZA.exe File created C:\windows\SysWOW64\WQJQCL.exe.bat NLY.exe File created C:\windows\SysWOW64\UQINZX.exe NVLBXVH.exe File created C:\windows\SysWOW64\VSZXJ.exe.bat VEZJ.exe File created C:\windows\SysWOW64\EWO.exe.bat XBJA.exe File created C:\windows\SysWOW64\GAFEA.exe.bat BPJG.exe File opened for modification C:\windows\SysWOW64\TDJL.exe GAFEA.exe File opened for modification C:\windows\SysWOW64\NRIQPJ.exe SEDZ.exe File created C:\windows\SysWOW64\VYNGH.exe TIULB.exe File opened for modification C:\windows\SysWOW64\RRVAXU.exe ZIVK.exe File created C:\windows\SysWOW64\ZVQXC.exe.bat PXLKMQP.exe File created C:\windows\SysWOW64\YEZSGRU.exe.bat JZTDZ.exe File created C:\windows\SysWOW64\UAOFHG.exe.bat PXSHCPA.exe File opened for modification C:\windows\SysWOW64\ZZZM.exe BZSY.exe File created C:\windows\SysWOW64\JIQAEIV.exe HKPXYLN.exe File opened for modification C:\windows\SysWOW64\WQJQCL.exe NLY.exe File opened for modification C:\windows\SysWOW64\GAFEA.exe BPJG.exe File created C:\windows\SysWOW64\NGF.exe RJZPQP.exe File opened for modification C:\windows\SysWOW64\NGF.exe RJZPQP.exe File created C:\windows\SysWOW64\UILWFNK.exe TKRCGYC.exe File created C:\windows\SysWOW64\VEZJ.exe.bat VUYP.exe File created C:\windows\SysWOW64\LWNM.exe.bat VYHJ.exe File opened for modification C:\windows\SysWOW64\VEZJ.exe VUYP.exe File opened for modification C:\windows\SysWOW64\GWRSXB.exe BTNUSKM.exe File created C:\windows\SysWOW64\KCZ.exe.bat DHUC.exe File opened for modification C:\windows\SysWOW64\SCLFD.exe AUMOU.exe File created C:\windows\SysWOW64\IDYHN.exe.bat MVERKZK.exe File created C:\windows\SysWOW64\FRHGVC.exe.bat ZGDZQLN.exe File created C:\windows\SysWOW64\GWRSXB.exe.bat BTNUSKM.exe File created C:\windows\SysWOW64\JGMIUJP.exe.bat MBGLFZV.exe File opened for modification C:\windows\SysWOW64\CECN.exe LOVK.exe File created C:\windows\SysWOW64\SEDZ.exe.bat HLA.exe File created C:\windows\SysWOW64\GNHLIN.exe SCLFD.exe File created C:\windows\SysWOW64\GNHLIN.exe.bat SCLFD.exe File created C:\windows\SysWOW64\LRKL.exe EZBJ.exe File created C:\windows\SysWOW64\BHBE.exe JZBNY.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\TRLYMAC.exe.bat EWO.exe File created C:\windows\JHKBYU.exe TRLYMAC.exe File opened for modification C:\windows\system\TIULB.exe UKNBP.exe File created C:\windows\CHZNLVI.exe.bat LUOVVZ.exe File opened for modification C:\windows\system\XBM.exe LIJHYZN.exe File created C:\windows\EKJ.exe.bat XPEX.exe File created C:\windows\ZDOZI.exe FQJ.exe File created C:\windows\system\KEOJD.exe.bat DJRWBA.exe File created C:\windows\EPIN.exe REMGTGR.exe File opened for modification C:\windows\system\REJ.exe BOCUJSB.exe File created C:\windows\ACSVMO.exe YEZSGRU.exe File created C:\windows\system\CBZYJ.exe ADFED.exe File opened for modification C:\windows\FQJ.exe XXJ.exe File opened for modification C:\windows\ECVP.exe CECN.exe File opened for modification C:\windows\BRK.exe LWNM.exe File created C:\windows\AUMOU.exe NRIQPJ.exe File created C:\windows\system\UKNBP.exe GNHLIN.exe File opened for modification C:\windows\DSAUYWL.exe MUTSNCE.exe File opened for modification C:\windows\DFIN.exe FPJD.exe File opened for modification C:\windows\HMUNSS.exe LESFPTD.exe File opened for modification C:\windows\YPTDOU.exe CHZNLVI.exe File created C:\windows\PTAU.exe WQJQCL.exe File created C:\windows\system\CPTDZ.exe ARAABOE.exe File created C:\windows\XBJA.exe GQTC.exe File created C:\windows\FQJ.exe XXJ.exe File created C:\windows\system\YDBSXXL.exe.bat FICOBSC.exe File opened for modification C:\windows\AYJRQV.exe PTXLE.exe File created C:\windows\system\IXPXW.exe.bat RHIMKB.exe File created C:\windows\EKJ.exe XPEX.exe File created C:\windows\VLVF.exe.bat ZOPQ.exe File opened for modification C:\windows\system\ZIVK.exe BIAOGI.exe File opened for modification C:\windows\system\UKNBP.exe GNHLIN.exe File created C:\windows\system\EBAB.exe.bat NLTYA.exe File created C:\windows\IJU.exe EBAB.exe File created C:\windows\system\DJRWBA.exe.bat KGA.exe File opened for modification C:\windows\system\KFJIRCL.exe WHLLC.exe File created C:\windows\QIB.exe ZVQXC.exe File created C:\windows\system\TWG.exe UMGQUS.exe File created C:\windows\ACN.exe LXPXLM.exe File created C:\windows\TYUIT.exe UAOFHG.exe File created C:\windows\system\GMK.exe EKJ.exe File created C:\windows\KGA.exe.bat FDWMREK.exe File created C:\windows\system\XRY.exe.bat FJYAQG.exe File opened for modification C:\windows\system\EKWYWVV.exe LHENARM.exe File opened for modification C:\windows\system\NROEH.exe GWRSXB.exe File opened for modification C:\windows\ENJ.exe XSMJ.exe File opened for modification C:\windows\system\YNE.exe CHYKYT.exe File opened for modification C:\windows\MHCODC.exe VSWL.exe File created C:\windows\system\LHENARM.exe KEVFHDL.exe File created C:\windows\system\REJ.exe BOCUJSB.exe File opened for modification C:\windows\system\NZO.exe NGF.exe File opened for modification C:\windows\system\BTNUSKM.exe XDTE.exe File created C:\windows\ENJ.exe XSMJ.exe File created C:\windows\system\CHYKYT.exe.bat NKSNR.exe File created C:\windows\YDZEP.exe JIQAEIV.exe File created C:\windows\system\RSM.exe.bat EPIN.exe File opened for modification C:\windows\system\CDPF.exe DLHE.exe File created C:\windows\WXGHZ.exe PCJVXR.exe File opened for modification C:\windows\PTXLE.exe WXGHZ.exe File created C:\windows\ACSVMO.exe.bat YEZSGRU.exe File created C:\windows\system\RGUBL.exe DAOEE.exe File created C:\windows\system\REJ.exe.bat BOCUJSB.exe File created C:\windows\ZFP.exe GXH.exe File created C:\windows\system\TNN.exe.bat BFF.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 2964 732 WerFault.exe 79 4468 2908 WerFault.exe 83 1140 4272 WerFault.exe 90 2356 4472 WerFault.exe 95 4808 1692 WerFault.exe 99 2400 5156 WerFault.exe 105 5740 4420 WerFault.exe 109 5588 3568 WerFault.exe 114 2992 4308 WerFault.exe 120 4568 4112 WerFault.exe 125 5700 332 WerFault.exe 130 5496 5776 WerFault.exe 135 5564 5536 WerFault.exe 139 3468 4260 WerFault.exe 145 6004 5456 WerFault.exe 149 4608 2448 WerFault.exe 154 5968 4996 WerFault.exe 159 4680 5752 WerFault.exe 165 3204 2168 WerFault.exe 170 4632 6136 WerFault.exe 175 4816 4496 WerFault.exe 180 3180 5684 WerFault.exe 184 2292 4460 WerFault.exe 190 5020 3032 WerFault.exe 195 1540 4612 WerFault.exe 199 3316 6028 WerFault.exe 204 5496 616 WerFault.exe 209 5292 5100 WerFault.exe 215 2308 4324 WerFault.exe 220 4296 3468 WerFault.exe 225 1500 3288 WerFault.exe 229 4368 1640 WerFault.exe 235 5372 4752 WerFault.exe 239 5836 3856 WerFault.exe 245 2148 3432 WerFault.exe 250 1168 2648 WerFault.exe 255 2124 3400 WerFault.exe 259 2128 5748 WerFault.exe 264 5768 5308 WerFault.exe 269 1336 112 WerFault.exe 275 412 104 WerFault.exe 280 4064 5944 WerFault.exe 285 3688 3176 WerFault.exe 290 4880 2416 WerFault.exe 295 5312 2308 WerFault.exe 300 3596 5696 WerFault.exe 304 4040 1256 WerFault.exe 309 1984 5260 WerFault.exe 315 1796 5524 WerFault.exe 319 4732 1288 WerFault.exe 324 5956 4156 WerFault.exe 330 5428 1528 WerFault.exe 334 1200 2856 WerFault.exe 339 1484 1680 WerFault.exe 345 5716 1540 WerFault.exe 350 5936 940 WerFault.exe 355 3428 2536 WerFault.exe 359 4604 5024 WerFault.exe 364 6068 5488 WerFault.exe 370 4712 2176 WerFault.exe 374 5436 1880 WerFault.exe 380 5544 4708 WerFault.exe 385 1496 5804 WerFault.exe 389 1028 1556 WerFault.exe 394 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAZOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XBM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQWMFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DHUC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBCFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WHLLC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QIB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RJZPQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALPDSE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZOVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THRZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHIMKB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBGLFZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLJYJQQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIQAEIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PCJVXR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZSUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HKPXYLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCJW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TDJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EKWYWVV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWSO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACKMYUH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACSVMO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBZYJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PTAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTNUSKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JHKBYU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZOPQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BHBE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LUOVVZ.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 732 2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe 732 2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe 2908 OJQ.exe 2908 OJQ.exe 4272 MUTSNCE.exe 4272 MUTSNCE.exe 4472 DSAUYWL.exe 4472 DSAUYWL.exe 1692 LCJW.exe 1692 LCJW.exe 5156 HKDEPZV.exe 5156 HKDEPZV.exe 4420 FICOBSC.exe 4420 FICOBSC.exe 3568 YDBSXXL.exe 3568 YDBSXXL.exe 4308 ZGDZQLN.exe 4308 ZGDZQLN.exe 4112 FRHGVC.exe 4112 FRHGVC.exe 332 JZBNY.exe 332 JZBNY.exe 5776 BHBE.exe 5776 BHBE.exe 5536 SXIH.exe 5536 SXIH.exe 4260 FIENY.exe 4260 FIENY.exe 5456 VYKQ.exe 5456 VYKQ.exe 2448 ZGF.exe 2448 ZGF.exe 4996 GBCKPBA.exe 4996 GBCKPBA.exe 5752 UMGQUS.exe 5752 UMGQUS.exe 2168 TWG.exe 2168 TWG.exe 6136 FPJD.exe 6136 FPJD.exe 4496 DFIN.exe 4496 DFIN.exe 5684 KAN.exe 5684 KAN.exe 4460 XLJYJQQ.exe 4460 XLJYJQQ.exe 3032 IOAKNVR.exe 3032 IOAKNVR.exe 4612 XJGWXO.exe 4612 XJGWXO.exe 6028 QJFMG.exe 6028 QJFMG.exe 616 MZAU.exe 616 MZAU.exe 5100 XWLAV.exe 5100 XWLAV.exe 4324 BFF.exe 4324 BFF.exe 3468 TNN.exe 3468 TNN.exe 3288 MIECLV.exe 3288 MIECLV.exe 1640 RTAAQNR.exe 1640 RTAAQNR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 732 2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe 732 2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe 2908 OJQ.exe 2908 OJQ.exe 4272 MUTSNCE.exe 4272 MUTSNCE.exe 4472 DSAUYWL.exe 4472 DSAUYWL.exe 1692 LCJW.exe 1692 LCJW.exe 5156 HKDEPZV.exe 5156 HKDEPZV.exe 4420 FICOBSC.exe 4420 FICOBSC.exe 3568 YDBSXXL.exe 3568 YDBSXXL.exe 4308 ZGDZQLN.exe 4308 ZGDZQLN.exe 4112 FRHGVC.exe 4112 FRHGVC.exe 332 JZBNY.exe 332 JZBNY.exe 5776 BHBE.exe 5776 BHBE.exe 5536 SXIH.exe 5536 SXIH.exe 4260 FIENY.exe 4260 FIENY.exe 5456 VYKQ.exe 5456 VYKQ.exe 2448 ZGF.exe 2448 ZGF.exe 4996 GBCKPBA.exe 4996 GBCKPBA.exe 5752 UMGQUS.exe 5752 UMGQUS.exe 2168 TWG.exe 2168 TWG.exe 6136 FPJD.exe 6136 FPJD.exe 4496 DFIN.exe 4496 DFIN.exe 5684 KAN.exe 5684 KAN.exe 4460 XLJYJQQ.exe 4460 XLJYJQQ.exe 3032 IOAKNVR.exe 3032 IOAKNVR.exe 4612 XJGWXO.exe 4612 XJGWXO.exe 6028 QJFMG.exe 6028 QJFMG.exe 616 MZAU.exe 616 MZAU.exe 5100 XWLAV.exe 5100 XWLAV.exe 4324 BFF.exe 4324 BFF.exe 3468 TNN.exe 3468 TNN.exe 3288 MIECLV.exe 3288 MIECLV.exe 1640 RTAAQNR.exe 1640 RTAAQNR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 732 wrote to memory of 1112 732 2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe 80 PID 1112 wrote to memory of 2908 1112 cmd.exe 83 PID 2908 wrote to memory of 652 2908 OJQ.exe 86 PID 652 wrote to memory of 4272 652 cmd.exe 90 PID 4272 wrote to memory of 4804 4272 MUTSNCE.exe 91 PID 4804 wrote to memory of 4472 4804 cmd.exe 95 PID 4472 wrote to memory of 5364 4472 DSAUYWL.exe 96 PID 5364 wrote to memory of 1692 5364 cmd.exe 99 PID 1692 wrote to memory of 2072 1692 LCJW.exe 101 PID 2072 wrote to memory of 5156 2072 cmd.exe 105 PID 5156 wrote to memory of 1604 5156 HKDEPZV.exe 106 PID 1604 wrote to memory of 4420 1604 cmd.exe 109 PID 4420 wrote to memory of 2388 4420 FICOBSC.exe 111 PID 2388 wrote to memory of 3568 2388 cmd.exe 114 PID 3568 wrote to memory of 760 3568 YDBSXXL.exe 116 PID 760 wrote to memory of 4308 760 cmd.exe 120 PID 4308 wrote to memory of 2272 4308 ZGDZQLN.exe 121 PID 2272 wrote to memory of 4112 2272 cmd.exe 125 PID 4112 wrote to memory of 1684 4112 FRHGVC.exe 126 PID 1684 wrote to memory of 332 1684 cmd.exe 130 PID 332 wrote to memory of 3244 332 JZBNY.exe 131 PID 3244 wrote to memory of 5776 3244 cmd.exe 135 PID 5776 wrote to memory of 460 5776 BHBE.exe 136 PID 460 wrote to memory of 5536 460 cmd.exe 139 PID 5536 wrote to memory of 3612 5536 SXIH.exe 141 PID 3612 wrote to memory of 4260 3612 cmd.exe 145 PID 4260 wrote to memory of 3724 4260 FIENY.exe 146 PID 3724 wrote to memory of 5456 3724 cmd.exe 149 PID 5456 wrote to memory of 4168 5456 VYKQ.exe 151 PID 4168 wrote to memory of 2448 4168 cmd.exe 154 PID 2448 wrote to memory of 5932 2448 ZGF.exe 156 PID 5932 wrote to memory of 4996 5932 cmd.exe 159 PID 4996 wrote to memory of 4956 4996 GBCKPBA.exe 161 PID 4956 wrote to memory of 5752 4956 cmd.exe 165 PID 5752 wrote to memory of 1140 5752 UMGQUS.exe 166 PID 1140 wrote to memory of 2168 1140 cmd.exe 170 PID 2168 wrote to memory of 3828 2168 TWG.exe 171 PID 3828 wrote to memory of 6136 3828 cmd.exe 175 PID 6136 wrote to memory of 4808 6136 FPJD.exe 176 PID 4808 wrote to memory of 4496 4808 cmd.exe 180 PID 4496 wrote to memory of 3004 4496 DFIN.exe 181 PID 3004 wrote to memory of 5684 3004 cmd.exe 184 PID 5684 wrote to memory of 1676 5684 KAN.exe 186 PID 1676 wrote to memory of 4460 1676 cmd.exe 190 PID 4460 wrote to memory of 4908 4460 XLJYJQQ.exe 191 PID 4908 wrote to memory of 3032 4908 cmd.exe 195 PID 3032 wrote to memory of 1588 3032 IOAKNVR.exe 196 PID 1588 wrote to memory of 4612 1588 cmd.exe 199 PID 4612 wrote to memory of 4648 4612 XJGWXO.exe 201 PID 4648 wrote to memory of 6028 4648 cmd.exe 204 PID 6028 wrote to memory of 4412 6028 QJFMG.exe 206 PID 4412 wrote to memory of 616 4412 cmd.exe 209 PID 616 wrote to memory of 924 616 MZAU.exe 211 PID 924 wrote to memory of 5100 924 cmd.exe 215 PID 5100 wrote to memory of 3376 5100 XWLAV.exe 216 PID 3376 wrote to memory of 4324 3376 cmd.exe 220 PID 4324 wrote to memory of 3864 4324 BFF.exe 221 PID 3864 wrote to memory of 3468 3864 cmd.exe 225 PID 3468 wrote to memory of 4520 3468 TNN.exe 226 PID 4520 wrote to memory of 3288 4520 cmd.exe 229 PID 3288 wrote to memory of 4000 3288 MIECLV.exe 231 PID 4000 wrote to memory of 1640 4000 cmd.exe 235 PID 1640 wrote to memory of 3952 1640 RTAAQNR.exe 236 PID 3952 wrote to memory of 4752 3952 cmd.exe 239
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-06_b16154855d036d6091564e8cea6d0389_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OJQ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\windows\system\OJQ.exeC:\windows\system\OJQ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MUTSNCE.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\windows\SysWOW64\MUTSNCE.exeC:\windows\system32\MUTSNCE.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DSAUYWL.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\DSAUYWL.exeC:\windows\DSAUYWL.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LCJW.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\LCJW.exeC:\windows\LCJW.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HKDEPZV.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\windows\SysWOW64\HKDEPZV.exeC:\windows\system32\HKDEPZV.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FICOBSC.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\windows\system\FICOBSC.exeC:\windows\system\FICOBSC.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YDBSXXL.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\windows\system\YDBSXXL.exeC:\windows\system\YDBSXXL.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGDZQLN.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:760 -
C:\windows\system\ZGDZQLN.exeC:\windows\system\ZGDZQLN.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FRHGVC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\windows\SysWOW64\FRHGVC.exeC:\windows\system32\FRHGVC.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZBNY.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\windows\JZBNY.exeC:\windows\JZBNY.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BHBE.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\windows\SysWOW64\BHBE.exeC:\windows\system32\BHBE.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SXIH.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:460 -
C:\windows\SysWOW64\SXIH.exeC:\windows\system32\SXIH.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FIENY.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\windows\system\FIENY.exeC:\windows\system\FIENY.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VYKQ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\windows\system\VYKQ.exeC:\windows\system\VYKQ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZGF.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\windows\SysWOW64\ZGF.exeC:\windows\system32\ZGF.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBCKPBA.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\windows\system\GBCKPBA.exeC:\windows\system\GBCKPBA.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UMGQUS.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\system\UMGQUS.exeC:\windows\system\UMGQUS.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWG.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\windows\system\TWG.exeC:\windows\system\TWG.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPJD.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\windows\FPJD.exeC:\windows\FPJD.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFIN.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\windows\DFIN.exeC:\windows\DFIN.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAN.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\system\KAN.exeC:\windows\system\KAN.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XLJYJQQ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\windows\XLJYJQQ.exeC:\windows\XLJYJQQ.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IOAKNVR.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\IOAKNVR.exeC:\windows\IOAKNVR.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XJGWXO.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\windows\XJGWXO.exeC:\windows\XJGWXO.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJFMG.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\windows\system\QJFMG.exeC:\windows\system\QJFMG.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MZAU.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\SysWOW64\MZAU.exeC:\windows\system32\MZAU.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XWLAV.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:924 -
C:\windows\XWLAV.exeC:\windows\XWLAV.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BFF.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\SysWOW64\BFF.exeC:\windows\system32\BFF.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TNN.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\windows\system\TNN.exeC:\windows\system\TNN.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIECLV.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\windows\SysWOW64\MIECLV.exeC:\windows\system32\MIECLV.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RTAAQNR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\windows\SysWOW64\RTAAQNR.exeC:\windows\system32\RTAAQNR.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GOXUAO.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\windows\GOXUAO.exeC:\windows\GOXUAO.exe65⤵
- Executes dropped EXE
PID:4752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJCHC.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5712 -
C:\windows\SysWOW64\NJCHC.exeC:\windows\system32\NJCHC.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EZBJ.exe.bat" "68⤵PID:2404
-
C:\windows\SysWOW64\EZBJ.exeC:\windows\system32\EZBJ.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LRKL.exe.bat" "70⤵PID:5124
-
C:\windows\SysWOW64\LRKL.exeC:\windows\system32\LRKL.exe71⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EMBO.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4788 -
C:\windows\EMBO.exeC:\windows\EMBO.exe73⤵
- Executes dropped EXE
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUBF.exe.bat" "74⤵PID:4812
-
C:\windows\system\XUBF.exeC:\windows\system\XUBF.exe75⤵
- Executes dropped EXE
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PCJVXR.exe.bat" "76⤵PID:5760
-
C:\windows\system\PCJVXR.exeC:\windows\system\PCJVXR.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WXGHZ.exe.bat" "78⤵PID:3576
-
C:\windows\WXGHZ.exeC:\windows\WXGHZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTXLE.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:6000 -
C:\windows\PTXLE.exeC:\windows\PTXLE.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AYJRQV.exe.bat" "82⤵PID:3420
-
C:\windows\AYJRQV.exeC:\windows\AYJRQV.exe83⤵
- Executes dropped EXE
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJZPQP.exe.bat" "84⤵PID:700
-
C:\windows\RJZPQP.exeC:\windows\RJZPQP.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NGF.exe.bat" "86⤵PID:728
-
C:\windows\SysWOW64\NGF.exeC:\windows\system32\NGF.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NZO.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4492 -
C:\windows\system\NZO.exeC:\windows\system\NZO.exe89⤵
- Executes dropped EXE
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ACKMYUH.exe.bat" "90⤵PID:5540
-
C:\windows\ACKMYUH.exeC:\windows\ACKMYUH.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKRCGYC.exe.bat" "92⤵PID:1808
-
C:\windows\SysWOW64\TKRCGYC.exeC:\windows\system32\TKRCGYC.exe93⤵
- Drops file in System32 directory
PID:1256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UILWFNK.exe.bat" "94⤵PID:5756
-
C:\windows\SysWOW64\UILWFNK.exeC:\windows\system32\UILWFNK.exe95⤵
- Executes dropped EXE
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ALPDSE.exe.bat" "96⤵PID:2424
-
C:\windows\system\ALPDSE.exeC:\windows\system\ALPDSE.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NVLBXVH.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:4824 -
C:\windows\NVLBXVH.exeC:\windows\NVLBXVH.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UQINZX.exe.bat" "100⤵PID:4340
-
C:\windows\SysWOW64\UQINZX.exeC:\windows\system32\UQINZX.exe101⤵
- Executes dropped EXE
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LESFPTD.exe.bat" "102⤵PID:3140
-
C:\windows\LESFPTD.exeC:\windows\LESFPTD.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1528 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMUNSS.exe.bat" "104⤵PID:1988
-
C:\windows\HMUNSS.exeC:\windows\HMUNSS.exe105⤵
- Executes dropped EXE
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LUOVVZ.exe.bat" "106⤵PID:2128
-
C:\windows\SysWOW64\LUOVVZ.exeC:\windows\system32\LUOVVZ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CHZNLVI.exe.bat" "108⤵PID:5332
-
C:\windows\CHZNLVI.exeC:\windows\CHZNLVI.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YPTDOU.exe.bat" "110⤵PID:2928
-
C:\windows\YPTDOU.exeC:\windows\YPTDOU.exe111⤵
- Executes dropped EXE
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CFNLRT.exe.bat" "112⤵PID:124
-
C:\windows\CFNLRT.exeC:\windows\CFNLRT.exe113⤵
- Executes dropped EXE
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CQWMFF.exe.bat" "114⤵PID:5644
-
C:\windows\system\CQWMFF.exeC:\windows\system\CQWMFF.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYQUI.exe.bat" "116⤵PID:6084
-
C:\windows\system\GYQUI.exeC:\windows\system\GYQUI.exe117⤵
- Executes dropped EXE
PID:5488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LJUTNV.exe.bat" "118⤵PID:4372
-
C:\windows\system\LJUTNV.exeC:\windows\system\LJUTNV.exe119⤵
- Executes dropped EXE
PID:2176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZTDZ.exe.bat" "120⤵PID:5116
-
C:\windows\JZTDZ.exeC:\windows\JZTDZ.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-