Analysis
- max time kernel
73s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe
- Size 448KB
- Sample260629-e15akaes6m
- SHA256 03971d1f683fc6ab58bde9a2459482f42d6ed2a90bd7785be1746226e4e4bd7e
- MD5 a3123d560fe687d6f90b528f58d33fb2
- SHA1 95e5d3a742732451d93baa32d1f497070cc143b1
- SHA512 5894a45ca32f1daa942cb4a71f01ccff0706d0973b2cacbc071ee81f027682023400c7e77f2b469ff8ef428516445864f2d0159e75c87d93ca39cf66837362b5
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOOkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOOkmZzcukG2/
- TLSH T11FA49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 4556 UULRVEN.exe 4884 DSFSGAE.exe 2632 RIUZRR.exe 6076 BGATYZ.exe 5852 QBJX.exe 1484 HMUNSS.exe 976 PRZUC.exe 3172 ZPEOK.exe 3724 ANMXUJ.exe 5388 NYDW.exe 5444 XWIQ.exe 1200 HTW.exe 3496 PKXC.exe 4444 ZHDW.exe 4800 MKLNHRR.exe 5148 JLV.exe 4564 ITJ.exe 1592 RTLAB.exe 1136 LMTKL.exe 1896 DPWOYBO.exe 4508 ESAKE.exe 2152 IAP.exe 5176 OVGT.exe 860 ZOVE.exe 5816 DECMQX.exe 5972 LJCSSKA.exe 368 NHIMZS.exe 2756 WKYIOCL.exe 872 MVJYWI.exe 5584 NYNUC.exe 1236 ABV.exe 5080 KYJNF.exe 3256 AOKE.exe 1056 SRO.exe 1148 MKVTBV.exe 5552 ILFVNZC.exe 5572 YGOAY.exe 2172 QJSEDCE.exe 2972 RMWZ.exe 2408 LZBRT.exe 364 DZDW.exe 3744 KCMAPK.exe 1976 SIMPRXI.exe 5540 RTPFAD.exe 3420 GOZJLXF.exe 4780 RGC.exe 1296 KJFFYVW.exe 4460 ORMFL.exe 5596 OUYBQD.exe 4948 WICQBB.exe 5608 TFI.exe 2356 MIMJV.exe 6008 QZTJ.exe 5412 QUWMNJ.exe 3900 UKD.exe 3216 AXCNWF.exe 3364 ENJ.exe 6108 TIAABK.exe 5052 OVF.exe 260 IRCSO.exe 4484 JMOWTZD.exe 3136 HHFXY.exe 1564 YUPPN.exe 1260 WQP.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\DPWOYBO.exe LMTKL.exe File created C:\windows\SysWOW64\YGOAY.exe ILFVNZC.exe File created C:\windows\SysWOW64\MIMJV.exe TFI.exe File created C:\windows\SysWOW64\AXCNWF.exe UKD.exe File opened for modification C:\windows\SysWOW64\UQYQFCH.exe NVZI.exe File created C:\windows\SysWOW64\KHAJ.exe HUVZKJS.exe File created C:\windows\SysWOW64\NYDW.exe ANMXUJ.exe File created C:\windows\SysWOW64\XWIQ.exe.bat NYDW.exe File created C:\windows\SysWOW64\LMTKL.exe RTLAB.exe File opened for modification C:\windows\SysWOW64\SIMPRXI.exe KCMAPK.exe File created C:\windows\SysWOW64\OXFK.exe.bat WPDFHGW.exe File created C:\windows\SysWOW64\KHAJ.exe.bat HUVZKJS.exe File opened for modification C:\windows\SysWOW64\OAZDS.exe XMOLCDO.exe File opened for modification C:\windows\SysWOW64\JLV.exe MKLNHRR.exe File created C:\windows\SysWOW64\NYDW.exe.bat ANMXUJ.exe File opened for modification C:\windows\SysWOW64\ZHDW.exe PKXC.exe File opened for modification C:\windows\SysWOW64\AOKE.exe KYJNF.exe File created C:\windows\SysWOW64\UKD.exe QUWMNJ.exe File opened for modification C:\windows\SysWOW64\OXFK.exe WPDFHGW.exe File created C:\windows\SysWOW64\XWIQ.exe NYDW.exe File opened for modification C:\windows\SysWOW64\ESAKE.exe DPWOYBO.exe File created C:\windows\SysWOW64\AOKE.exe.bat KYJNF.exe File opened for modification C:\windows\SysWOW64\OUYBQD.exe ORMFL.exe File opened for modification C:\windows\SysWOW64\UKD.exe QUWMNJ.exe File created C:\windows\SysWOW64\UQYQFCH.exe.bat NVZI.exe File opened for modification C:\windows\SysWOW64\ANMXUJ.exe ZPEOK.exe File opened for modification C:\windows\SysWOW64\RTLAB.exe ITJ.exe File created C:\windows\SysWOW64\LMTKL.exe.bat RTLAB.exe File opened for modification C:\windows\SysWOW64\YGOAY.exe ILFVNZC.exe File created C:\windows\SysWOW64\YGOAY.exe.bat ILFVNZC.exe File created C:\windows\SysWOW64\OUYBQD.exe ORMFL.exe File created C:\windows\SysWOW64\OVF.exe.bat TIAABK.exe File created C:\windows\SysWOW64\OAZDS.exe XMOLCDO.exe File created C:\windows\SysWOW64\ANMXUJ.exe.bat ZPEOK.exe File created C:\windows\SysWOW64\DPWOYBO.exe LMTKL.exe File opened for modification C:\windows\SysWOW64\MIMJV.exe TFI.exe File opened for modification C:\windows\SysWOW64\IRCSO.exe OVF.exe File created C:\windows\SysWOW64\MGQQIJ.exe BONX.exe File created C:\windows\SysWOW64\XMOLCDO.exe.bat XHOXBQM.exe File created C:\windows\SysWOW64\ANMXUJ.exe ZPEOK.exe File created C:\windows\SysWOW64\HUVZKJS.exe.bat MGQQIJ.exe File created C:\windows\SysWOW64\XMOLCDO.exe XHOXBQM.exe File created C:\windows\SysWOW64\DPWOYBO.exe.bat LMTKL.exe File created C:\windows\SysWOW64\ESAKE.exe.bat DPWOYBO.exe File created C:\windows\SysWOW64\ABV.exe NYNUC.exe File created C:\windows\SysWOW64\SIMPRXI.exe.bat KCMAPK.exe File created C:\windows\SysWOW64\IRCSO.exe OVF.exe File opened for modification C:\windows\SysWOW64\YUPPN.exe HHFXY.exe File created C:\windows\SysWOW64\UQYQFCH.exe NVZI.exe File opened for modification C:\windows\SysWOW64\CCYWWG.exe DMNTBBZ.exe File created C:\windows\SysWOW64\BDTDBB.exe GSK.exe File created C:\windows\SysWOW64\OAZDS.exe.bat XMOLCDO.exe File opened for modification C:\windows\SysWOW64\OVGT.exe IAP.exe File created C:\windows\SysWOW64\ABV.exe.bat NYNUC.exe File created C:\windows\SysWOW64\CCYWWG.exe.bat DMNTBBZ.exe File opened for modification C:\windows\SysWOW64\MGQQIJ.exe BONX.exe File created C:\windows\SysWOW64\RTLAB.exe.bat ITJ.exe File created C:\windows\SysWOW64\MIMJV.exe.bat TFI.exe File opened for modification C:\windows\SysWOW64\AXCNWF.exe UKD.exe File created C:\windows\SysWOW64\LJJ.exe.bat JLIVQ.exe File created C:\windows\SysWOW64\HUVZKJS.exe MGQQIJ.exe File opened for modification C:\windows\SysWOW64\HUVZKJS.exe MGQQIJ.exe File opened for modification C:\windows\SysWOW64\XMOLCDO.exe XHOXBQM.exe File created C:\windows\SysWOW64\AOKE.exe KYJNF.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\RMWZ.exe.bat QJSEDCE.exe File created C:\windows\system\WKYIOCL.exe.bat NHIMZS.exe File opened for modification C:\windows\system\ZPEOK.exe PRZUC.exe File created C:\windows\ITJ.exe.bat JLV.exe File created C:\windows\system\IAP.exe ESAKE.exe File opened for modification C:\windows\ZOVE.exe OVGT.exe File created C:\windows\system\NYNUC.exe.bat MVJYWI.exe File opened for modification C:\windows\SRO.exe AOKE.exe File opened for modification C:\windows\system\DZDW.exe LZBRT.exe File created C:\windows\system\TFI.exe WICQBB.exe File created C:\windows\LJCSSKA.exe.bat DECMQX.exe File created C:\windows\system\QUWMNJ.exe.bat QZTJ.exe File opened for modification C:\windows\ENJ.exe AXCNWF.exe File created C:\windows\HHFXY.exe JMOWTZD.exe File created C:\windows\system\WQP.exe YUPPN.exe File opened for modification C:\windows\DMNTBBZ.exe LJJ.exe File created C:\windows\XHOXBQM.exe HEFT.exe File created C:\windows\system\GBSUA.exe.bat EDMASP.exe File opened for modification C:\windows\system\IAP.exe ESAKE.exe File created C:\windows\KYJNF.exe ABV.exe File created C:\windows\GOZJLXF.exe RTPFAD.exe File created C:\windows\system\OVDZYPM.exe.bat OAZDS.exe File created C:\windows\HTW.exe XWIQ.exe File opened for modification C:\windows\LZBRT.exe RMWZ.exe File opened for modification C:\windows\WPDFHGW.exe CCYWWG.exe File created C:\windows\system\DRFEP.exe GBSUA.exe File created C:\windows\system\RIUZRR.exe DSFSGAE.exe File created C:\windows\system\NVZI.exe.bat WQP.exe File created C:\windows\WPDFHGW.exe CCYWWG.exe File opened for modification C:\windows\XYHPO.exe OXFK.exe File created C:\windows\DSFSGAE.exe UULRVEN.exe File created C:\windows\system\MKVTBV.exe SRO.exe File created C:\windows\system\YDDOEYJ.exe.bat BDTDBB.exe File created C:\windows\LJCSSKA.exe DECMQX.exe File created C:\windows\system\RMWZ.exe QJSEDCE.exe File opened for modification C:\windows\ORMFL.exe KJFFYVW.exe File created C:\windows\ORMFL.exe.bat KJFFYVW.exe File created C:\windows\system\QZTJ.exe MIMJV.exe File created C:\windows\system\YDDOEYJ.exe BDTDBB.exe File created C:\windows\system\UULRVEN.exe 2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe File created C:\windows\ITJ.exe JLV.exe File created C:\windows\system\IAP.exe.bat ESAKE.exe File created C:\windows\system\QJSEDCE.exe YGOAY.exe File opened for modification C:\windows\system\QUWMNJ.exe QZTJ.exe File opened for modification C:\windows\system\NVZI.exe WQP.exe File created C:\windows\GSK.exe.bat HHIX.exe File opened for modification C:\windows\system\OVDZYPM.exe OAZDS.exe File opened for modification C:\windows\system\BGATYZ.exe RIUZRR.exe File opened for modification C:\windows\HMUNSS.exe QBJX.exe File created C:\windows\system\PRZUC.exe HMUNSS.exe File opened for modification C:\windows\PKXC.exe HTW.exe File created C:\windows\MKLNHRR.exe.bat ZHDW.exe File opened for modification C:\windows\system\KCMAPK.exe DZDW.exe File created C:\windows\HHFXY.exe.bat JMOWTZD.exe File opened for modification C:\windows\GSK.exe HHIX.exe File opened for modification C:\windows\HTW.exe XWIQ.exe File opened for modification C:\windows\system\TFI.exe WICQBB.exe File created C:\windows\ENJ.exe.bat AXCNWF.exe File created C:\windows\TIAABK.exe ENJ.exe File created C:\windows\system\WQP.exe.bat YUPPN.exe File created C:\windows\DMNTBBZ.exe LJJ.exe File opened for modification C:\windows\XHOXBQM.exe HEFT.exe File created C:\windows\EDMASP.exe.bat YDF.exe File created C:\windows\DSFSGAE.exe.bat UULRVEN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 3856 4172 WerFault.exe 88 2280 4556 WerFault.exe 93 5600 4884 WerFault.exe 99 2932 2632 WerFault.exe 104 4252 6076 WerFault.exe 109 2904 5852 WerFault.exe 114 4224 1484 WerFault.exe 119 3500 976 WerFault.exe 124 5940 3172 WerFault.exe 129 1116 3724 WerFault.exe 134 1152 5388 WerFault.exe 139 860 5444 WerFault.exe 144 5052 1200 WerFault.exe 149 1936 3496 WerFault.exe 154 4864 4444 WerFault.exe 159 4108 4800 WerFault.exe 164 2824 5148 WerFault.exe 169 4636 4564 WerFault.exe 174 3096 1592 WerFault.exe 179 3012 1136 WerFault.exe 184 5940 1896 WerFault.exe 189 3908 4508 WerFault.exe 194 3932 2152 WerFault.exe 199 1172 5176 WerFault.exe 204 2820 860 WerFault.exe 209 4540 5816 WerFault.exe 214 4948 5972 WerFault.exe 219 2544 368 WerFault.exe 224 124 2756 WerFault.exe 229 4856 872 WerFault.exe 234 5012 5584 WerFault.exe 239 3584 1236 WerFault.exe 244 4736 5080 WerFault.exe 249 5384 3256 WerFault.exe 254 680 1056 WerFault.exe 259 2108 1148 WerFault.exe 265 840 5552 WerFault.exe 270 4488 5572 WerFault.exe 275 4948 2172 WerFault.exe 280 5004 2972 WerFault.exe 285 636 2408 WerFault.exe 290 6128 364 WerFault.exe 295 3244 3744 WerFault.exe 300 4828 1976 WerFault.exe 305 1884 5540 WerFault.exe 310 3716 3420 WerFault.exe 315 5664 4780 WerFault.exe 320 3480 1296 WerFault.exe 325 4756 4460 WerFault.exe 330 4124 5596 WerFault.exe 335 1572 4948 WerFault.exe 340 3464 5608 WerFault.exe 345 6128 2356 WerFault.exe 350 5948 6008 WerFault.exe 355 4456 5412 WerFault.exe 360 2044 3900 WerFault.exe 365 680 3216 WerFault.exe 370 1172 3364 WerFault.exe 375 4236 6108 WerFault.exe 380 2476 5052 WerFault.exe 385 1576 260 WerFault.exe 390 308 4484 WerFault.exe 395 5848 3136 WerFault.exe 400 5684 1564 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMTKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DMNTBBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANMXUJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NHIMZS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WKYIOCL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTPFAD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UQYQFCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DPWOYBO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LZBRT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RGC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UULRVEN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXFK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZHDW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ITJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RTLAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JMOWTZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OVDZYPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KCMAPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLIVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HHFXY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUVZKJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XMOLCDO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ESAKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AOKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILFVNZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WICQBB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJCSSKA.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-487906980-2895880840-1957110281-1000\{A1B05A23-F772-4A92-9724-F5438B23CCC9} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-487906980-2895880840-1957110281-1000\{2627485E-65B8-441B-B855-19F087AE55A3} explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4172 2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe 4172 2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe 4556 UULRVEN.exe 4556 UULRVEN.exe 4884 DSFSGAE.exe 4884 DSFSGAE.exe 2632 RIUZRR.exe 2632 RIUZRR.exe 6076 BGATYZ.exe 6076 BGATYZ.exe 5852 QBJX.exe 5852 QBJX.exe 1484 HMUNSS.exe 1484 HMUNSS.exe 976 PRZUC.exe 976 PRZUC.exe 3172 ZPEOK.exe 3172 ZPEOK.exe 3724 ANMXUJ.exe 3724 ANMXUJ.exe 5388 NYDW.exe 5388 NYDW.exe 5444 XWIQ.exe 5444 XWIQ.exe 1200 HTW.exe 1200 HTW.exe 3496 PKXC.exe 3496 PKXC.exe 4444 ZHDW.exe 4444 ZHDW.exe 4800 MKLNHRR.exe 4800 MKLNHRR.exe 5148 JLV.exe 5148 JLV.exe 4564 ITJ.exe 4564 ITJ.exe 1592 RTLAB.exe 1592 RTLAB.exe 1136 LMTKL.exe 1136 LMTKL.exe 1896 DPWOYBO.exe 1896 DPWOYBO.exe 4508 ESAKE.exe 4508 ESAKE.exe 2152 IAP.exe 2152 IAP.exe 5176 OVGT.exe 5176 OVGT.exe 860 ZOVE.exe 860 ZOVE.exe 5816 DECMQX.exe 5816 DECMQX.exe 5972 LJCSSKA.exe 5972 LJCSSKA.exe 368 NHIMZS.exe 368 NHIMZS.exe 2756 WKYIOCL.exe 2756 WKYIOCL.exe 872 MVJYWI.exe 872 MVJYWI.exe 5584 NYNUC.exe 5584 NYNUC.exe 1236 ABV.exe 1236 ABV.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 3672 explorer.exe Token: SeCreatePagefilePrivilege 3672 explorer.exe Token: SeShutdownPrivilege 3672 explorer.exe Token: SeCreatePagefilePrivilege 3672 explorer.exe Token: SeShutdownPrivilege 3672 explorer.exe Token: SeCreatePagefilePrivilege 3672 explorer.exe Token: SeShutdownPrivilege 3672 explorer.exe Token: SeCreatePagefilePrivilege 3672 explorer.exe Token: SeShutdownPrivilege 3672 explorer.exe Token: SeCreatePagefilePrivilege 3672 explorer.exe Token: SeShutdownPrivilege 3672 explorer.exe Token: SeCreatePagefilePrivilege 3672 explorer.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 5728 sihost.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe 3672 explorer.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3672 explorer.exe 3672 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4172 2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe 4172 2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe 4556 UULRVEN.exe 4556 UULRVEN.exe 4884 DSFSGAE.exe 4884 DSFSGAE.exe 2632 RIUZRR.exe 2632 RIUZRR.exe 6076 BGATYZ.exe 6076 BGATYZ.exe 5852 QBJX.exe 5852 QBJX.exe 1484 HMUNSS.exe 1484 HMUNSS.exe 976 PRZUC.exe 976 PRZUC.exe 3172 ZPEOK.exe 3172 ZPEOK.exe 3724 ANMXUJ.exe 3724 ANMXUJ.exe 5388 NYDW.exe 5388 NYDW.exe 5444 XWIQ.exe 5444 XWIQ.exe 1200 HTW.exe 1200 HTW.exe 3496 PKXC.exe 3496 PKXC.exe 4444 ZHDW.exe 4444 ZHDW.exe 4800 MKLNHRR.exe 4800 MKLNHRR.exe 5148 JLV.exe 5148 JLV.exe 4564 ITJ.exe 4564 ITJ.exe 1592 RTLAB.exe 1592 RTLAB.exe 1136 LMTKL.exe 1136 LMTKL.exe 1896 DPWOYBO.exe 1896 DPWOYBO.exe 4508 ESAKE.exe 4508 ESAKE.exe 2152 IAP.exe 2152 IAP.exe 5176 OVGT.exe 5176 OVGT.exe 860 ZOVE.exe 860 ZOVE.exe 5816 DECMQX.exe 5816 DECMQX.exe 5972 LJCSSKA.exe 5972 LJCSSKA.exe 368 NHIMZS.exe 368 NHIMZS.exe 2756 WKYIOCL.exe 2756 WKYIOCL.exe 872 MVJYWI.exe 872 MVJYWI.exe 5584 NYNUC.exe 5584 NYNUC.exe 1236 ABV.exe 1236 ABV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4172 wrote to memory of 5912 4172 2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe 89 PID 5912 wrote to memory of 4556 5912 cmd.exe 93 PID 4556 wrote to memory of 2800 4556 UULRVEN.exe 95 PID 2800 wrote to memory of 4884 2800 cmd.exe 99 PID 4884 wrote to memory of 1196 4884 DSFSGAE.exe 100 PID 1196 wrote to memory of 2632 1196 cmd.exe 104 PID 2632 wrote to memory of 2744 2632 RIUZRR.exe 105 PID 2744 wrote to memory of 6076 2744 cmd.exe 109 PID 6076 wrote to memory of 1600 6076 BGATYZ.exe 110 PID 1600 wrote to memory of 5852 1600 cmd.exe 114 PID 5852 wrote to memory of 240 5852 QBJX.exe 115 PID 240 wrote to memory of 1484 240 cmd.exe 119 PID 1484 wrote to memory of 1588 1484 HMUNSS.exe 120 PID 1588 wrote to memory of 976 1588 cmd.exe 124 PID 976 wrote to memory of 2596 976 PRZUC.exe 125 PID 2596 wrote to memory of 3172 2596 cmd.exe 129 PID 3172 wrote to memory of 984 3172 ZPEOK.exe 130 PID 984 wrote to memory of 3724 984 cmd.exe 134 PID 3724 wrote to memory of 5292 3724 ANMXUJ.exe 135 PID 5292 wrote to memory of 5388 5292 cmd.exe 139 PID 5388 wrote to memory of 5556 5388 NYDW.exe 140 PID 5556 wrote to memory of 5444 5556 cmd.exe 144 PID 5444 wrote to memory of 5220 5444 XWIQ.exe 145 PID 5220 wrote to memory of 1200 5220 cmd.exe 149 PID 1200 wrote to memory of 2992 1200 HTW.exe 150 PID 2992 wrote to memory of 3496 2992 cmd.exe 154 PID 3496 wrote to memory of 5760 3496 PKXC.exe 155 PID 5760 wrote to memory of 4444 5760 cmd.exe 159 PID 4444 wrote to memory of 5748 4444 ZHDW.exe 160 PID 5748 wrote to memory of 4800 5748 cmd.exe 164 PID 4800 wrote to memory of 3148 4800 MKLNHRR.exe 165 PID 3148 wrote to memory of 5148 3148 cmd.exe 169 PID 5148 wrote to memory of 3984 5148 JLV.exe 170 PID 3984 wrote to memory of 4564 3984 cmd.exe 174 PID 4564 wrote to memory of 4196 4564 ITJ.exe 175 PID 4196 wrote to memory of 1592 4196 cmd.exe 179 PID 1592 wrote to memory of 1132 1592 RTLAB.exe 180 PID 1132 wrote to memory of 1136 1132 cmd.exe 184 PID 1136 wrote to memory of 1632 1136 LMTKL.exe 185 PID 1632 wrote to memory of 1896 1632 cmd.exe 189 PID 1896 wrote to memory of 4516 1896 DPWOYBO.exe 190 PID 4516 wrote to memory of 4508 4516 cmd.exe 194 PID 4508 wrote to memory of 5316 4508 ESAKE.exe 195 PID 5316 wrote to memory of 2152 5316 cmd.exe 199 PID 2152 wrote to memory of 5580 2152 IAP.exe 200 PID 5580 wrote to memory of 5176 5580 cmd.exe 204 PID 5176 wrote to memory of 1304 5176 OVGT.exe 205 PID 1304 wrote to memory of 860 1304 cmd.exe 209 PID 860 wrote to memory of 5868 860 ZOVE.exe 210 PID 5868 wrote to memory of 5816 5868 cmd.exe 214 PID 5816 wrote to memory of 2740 5816 DECMQX.exe 215 PID 2740 wrote to memory of 5972 2740 cmd.exe 219 PID 5972 wrote to memory of 2576 5972 LJCSSKA.exe 220 PID 2576 wrote to memory of 368 2576 cmd.exe 224 PID 368 wrote to memory of 3048 368 NHIMZS.exe 225 PID 3048 wrote to memory of 2756 3048 cmd.exe 229 PID 2756 wrote to memory of 244 2756 WKYIOCL.exe 230 PID 244 wrote to memory of 872 244 cmd.exe 234 PID 872 wrote to memory of 2180 872 MVJYWI.exe 235 PID 2180 wrote to memory of 5584 2180 cmd.exe 239 PID 5584 wrote to memory of 2168 5584 NYNUC.exe 240 PID 2168 wrote to memory of 1236 2168 cmd.exe 244 PID 1236 wrote to memory of 4784 1236 ABV.exe 245 PID 4784 wrote to memory of 5080 4784 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a3123d560fe687d6f90b528f58d33fb2_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UULRVEN.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\system\UULRVEN.exeC:\windows\system\UULRVEN.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DSFSGAE.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\DSFSGAE.exeC:\windows\DSFSGAE.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIUZRR.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\windows\system\RIUZRR.exeC:\windows\system\RIUZRR.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BGATYZ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\windows\system\BGATYZ.exeC:\windows\system\BGATYZ.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QBJX.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\windows\QBJX.exeC:\windows\QBJX.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HMUNSS.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\windows\HMUNSS.exeC:\windows\HMUNSS.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PRZUC.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\windows\system\PRZUC.exeC:\windows\system\PRZUC.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPEOK.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\windows\system\ZPEOK.exeC:\windows\system\ZPEOK.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ANMXUJ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\windows\SysWOW64\ANMXUJ.exeC:\windows\system32\ANMXUJ.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NYDW.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\windows\SysWOW64\NYDW.exeC:\windows\system32\NYDW.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XWIQ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\windows\SysWOW64\XWIQ.exeC:\windows\system32\XWIQ.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HTW.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\windows\HTW.exeC:\windows\HTW.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PKXC.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\windows\PKXC.exeC:\windows\PKXC.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZHDW.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\windows\SysWOW64\ZHDW.exeC:\windows\system32\ZHDW.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKLNHRR.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\MKLNHRR.exeC:\windows\MKLNHRR.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JLV.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\windows\SysWOW64\JLV.exeC:\windows\system32\JLV.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ITJ.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\windows\ITJ.exeC:\windows\ITJ.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RTLAB.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\windows\SysWOW64\RTLAB.exeC:\windows\system32\RTLAB.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LMTKL.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\windows\SysWOW64\LMTKL.exeC:\windows\system32\LMTKL.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DPWOYBO.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\windows\SysWOW64\DPWOYBO.exeC:\windows\system32\DPWOYBO.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ESAKE.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\windows\SysWOW64\ESAKE.exeC:\windows\system32\ESAKE.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IAP.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\windows\system\IAP.exeC:\windows\system\IAP.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVGT.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\SysWOW64\OVGT.exeC:\windows\system32\OVGT.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOVE.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\windows\ZOVE.exeC:\windows\ZOVE.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DECMQX.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\windows\system\DECMQX.exeC:\windows\system\DECMQX.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LJCSSKA.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\windows\LJCSSKA.exeC:\windows\LJCSSKA.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NHIMZS.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\NHIMZS.exeC:\windows\NHIMZS.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WKYIOCL.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\windows\system\WKYIOCL.exeC:\windows\system\WKYIOCL.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVJYWI.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:244 -
C:\windows\system\MVJYWI.exeC:\windows\system\MVJYWI.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NYNUC.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\windows\system\NYNUC.exeC:\windows\system\NYNUC.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ABV.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\windows\SysWOW64\ABV.exeC:\windows\system32\ABV.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KYJNF.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\windows\KYJNF.exeC:\windows\KYJNF.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AOKE.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:3056 -
C:\windows\SysWOW64\AOKE.exeC:\windows\system32\AOKE.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SRO.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\windows\SRO.exeC:\windows\SRO.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKVTBV.exe.bat" "70⤵PID:1280
-
C:\windows\system\MKVTBV.exeC:\windows\system\MKVTBV.exe71⤵
- Executes dropped EXE
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILFVNZC.exe.bat" "72⤵PID:3760
-
C:\windows\system\ILFVNZC.exeC:\windows\system\ILFVNZC.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGOAY.exe.bat" "74⤵PID:3708
-
C:\windows\SysWOW64\YGOAY.exeC:\windows\system32\YGOAY.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJSEDCE.exe.bat" "76⤵PID:1552
-
C:\windows\system\QJSEDCE.exeC:\windows\system\QJSEDCE.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2172 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RMWZ.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2708 -
C:\windows\system\RMWZ.exeC:\windows\system\RMWZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZBRT.exe.bat" "80⤵PID:2544
-
C:\windows\LZBRT.exeC:\windows\LZBRT.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DZDW.exe.bat" "82⤵PID:1212
-
C:\windows\system\DZDW.exeC:\windows\system\DZDW.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KCMAPK.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:4856 -
C:\windows\system\KCMAPK.exeC:\windows\system\KCMAPK.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SIMPRXI.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5632 -
C:\windows\SysWOW64\SIMPRXI.exeC:\windows\system32\SIMPRXI.exe87⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RTPFAD.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1284 -
C:\windows\RTPFAD.exeC:\windows\RTPFAD.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GOZJLXF.exe.bat" "90⤵PID:5860
-
C:\windows\GOZJLXF.exeC:\windows\GOZJLXF.exe91⤵
- Executes dropped EXE
PID:3420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGC.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5308 -
C:\windows\system\RGC.exeC:\windows\system\RGC.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KJFFYVW.exe.bat" "94⤵PID:1432
-
C:\windows\system\KJFFYVW.exeC:\windows\system\KJFFYVW.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ORMFL.exe.bat" "96⤵PID:2856
-
C:\windows\ORMFL.exeC:\windows\ORMFL.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUYBQD.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:5568 -
C:\windows\SysWOW64\OUYBQD.exeC:\windows\system32\OUYBQD.exe99⤵
- Executes dropped EXE
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WICQBB.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:372 -
C:\windows\WICQBB.exeC:\windows\WICQBB.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFI.exe.bat" "102⤵PID:3968
-
C:\windows\system\TFI.exeC:\windows\system\TFI.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIMJV.exe.bat" "104⤵PID:5612
-
C:\windows\SysWOW64\MIMJV.exeC:\windows\system32\MIMJV.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QZTJ.exe.bat" "106⤵PID:3528
-
C:\windows\system\QZTJ.exeC:\windows\system\QZTJ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QUWMNJ.exe.bat" "108⤵PID:1556
-
C:\windows\system\QUWMNJ.exeC:\windows\system\QUWMNJ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UKD.exe.bat" "110⤵PID:2096
-
C:\windows\SysWOW64\UKD.exeC:\windows\system32\UKD.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AXCNWF.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2276 -
C:\windows\SysWOW64\AXCNWF.exeC:\windows\system32\AXCNWF.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3216 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENJ.exe.bat" "114⤵PID:4792
-
C:\windows\ENJ.exeC:\windows\ENJ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TIAABK.exe.bat" "116⤵PID:2508
-
C:\windows\TIAABK.exeC:\windows\TIAABK.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OVF.exe.bat" "118⤵PID:1164
-
C:\windows\SysWOW64\OVF.exeC:\windows\system32\OVF.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IRCSO.exe.bat" "120⤵PID:3020
-
C:\windows\SysWOW64\IRCSO.exeC:\windows\system32\IRCSO.exe121⤵
- Executes dropped EXE
PID:260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-