Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 20:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-25_c2909380a8de2518a51c1ac67c26a858_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_c2909380a8de2518a51c1ac67c26a858_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-06-25_c2909380a8de2518a51c1ac67c26a858_elex_emotet_stop.exe
- Size 208KB
- Sample260629-yrcnqsft2j
- SHA256 91d8234723281645765574b1c6458cbe2d03d33579e0ff587372d570e7e17094
- MD5 c2909380a8de2518a51c1ac67c26a858
- SHA1 cf15156ee94ee0f7e4588eb6d7e99e0319eaf1e9
- SHA512 a6597937b78ac7a10a20dc65ade812f1f0dce4091920113ccde754f56d6079626b25c33f75b32cc44132661bc7c0fb6eb5c3a0339c412e4f3ac72cb802b65161
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfc4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOUQEjq
- TLSH T14F247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5516 KRQSGIL.exe 4956 QMCTMXU.exe 2984 LAHC.exe 2824 PINCIP.exe 3548 MNT.exe 5780 UTU.exe 544 IZRLY.exe 5864 QRAEM.exe 3368 BKDXUHZ.exe 4696 MCG.exe 5508 SCGDL.exe 4372 HALAS.exe 940 STOTAA.exe 4992 DLREBPP.exe 4284 ARPBQZR.exe 3388 LJS.exe 1096 IPYRF.exe 1872 IZZKL.exe 2092 KVDCVUL.exe 3592 BGCSVOH.exe 3212 HGJF.exe 5988 FYRTVL.exe 4448 HTW.exe 3052 CHTUH.exe 5264 HKXS.exe 3312 SCALV.exe 2800 NXFVFJL.exe 4812 JVCS.exe 2272 VOF.exe 5692 BONYD.exe 5732 MGQJMK.exe 3656 UZRKZOI.exe 804 FSU.exe 1268 TXZA.exe 5620 BDSPQ.exe 4236 ZDZCZUW.exe 1796 FDH.exe 3824 HBI.exe 3764 SUDD.exe 1220 KZOVF.exe 1972 KNO.exe 5164 GKU.exe 2952 RDPZ.exe 3608 MYTJGT.exe 3276 MJCCUX.exe 1128 UOCRVK.exe 2960 FUGW.exe 4788 SXK.exe 3932 XHGBAZR.exe 1396 FNG.exe 2336 OAQIRJ.exe 5272 QQJCPY.exe 5492 GTBO.exe 992 TWX.exe 1852 EOAGW.exe 2656 GMTIU.exe 5412 GXCBI.exe 2828 CCIYP.exe 1632 OVDRXJ.exe 2292 NOL.exe 3912 EYKI.exe 5176 MJKK.exe 2748 IOQHF.exe 4620 JUQNHJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\HAJWQI.exe WHGDQ.exe File created C:\windows\SysWOW64\BUXI.exe LEYXF.exe File opened for modification C:\windows\SysWOW64\KZOVF.exe SUDD.exe File created C:\windows\SysWOW64\GMTIU.exe EOAGW.exe File created C:\windows\SysWOW64\LIJHYZN.exe RVEQO.exe File opened for modification C:\windows\SysWOW64\OHRZXX.exe VJGTCQ.exe File created C:\windows\SysWOW64\OHRZXX.exe.bat VJGTCQ.exe File opened for modification C:\windows\SysWOW64\HRIDHWE.exe FBPB.exe File created C:\windows\SysWOW64\HMQNCI.exe FOPLV.exe File created C:\windows\SysWOW64\IHLYBNV.exe GKK.exe File opened for modification C:\windows\SysWOW64\CHIIZ.exe ARHO.exe File created C:\windows\SysWOW64\HRIDHWE.exe FBPB.exe File opened for modification C:\windows\SysWOW64\ZDVVNL.exe RSMCZZ.exe File created C:\windows\SysWOW64\BKDXUHZ.exe QRAEM.exe File opened for modification C:\windows\SysWOW64\ARPBQZR.exe DLREBPP.exe File opened for modification C:\windows\SysWOW64\AHA.exe YSHQ.exe File created C:\windows\SysWOW64\RQYYQ.exe.bat PSXESJP.exe File created C:\windows\SysWOW64\NOL.exe.bat OVDRXJ.exe File opened for modification C:\windows\SysWOW64\RQYYQ.exe PSXESJP.exe File created C:\windows\SysWOW64\EOAGW.exe TWX.exe File opened for modification C:\windows\SysWOW64\LITFZC.exe PDNISB.exe File opened for modification C:\windows\SysWOW64\NOL.exe OVDRXJ.exe File created C:\windows\SysWOW64\RHFK.exe VRK.exe File created C:\windows\SysWOW64\IPYRF.exe.bat LJS.exe File created C:\windows\SysWOW64\BGCSVOH.exe KVDCVUL.exe File opened for modification C:\windows\SysWOW64\TXZA.exe FSU.exe File created C:\windows\SysWOW64\FUGW.exe.bat UOCRVK.exe File created C:\windows\SysWOW64\EYG.exe HAJWQI.exe File created C:\windows\SysWOW64\ZPDQ.exe DJY.exe File opened for modification C:\windows\SysWOW64\EJSJVBK.exe ZGWLQK.exe File created C:\windows\SysWOW64\AESBHY.exe JRIJZ.exe File opened for modification C:\windows\SysWOW64\HALAS.exe SCGDL.exe File created C:\windows\SysWOW64\HGJF.exe BGCSVOH.exe File created C:\windows\SysWOW64\QMCTMXU.exe KRQSGIL.exe File opened for modification C:\windows\SysWOW64\BKDXUHZ.exe QRAEM.exe File created C:\windows\SysWOW64\YSHQ.exe.bat HEWYTNJ.exe File created C:\windows\SysWOW64\HBX.exe OJUWPM.exe File created C:\windows\SysWOW64\FFPVI.exe IIK.exe File created C:\windows\SysWOW64\WRODE.exe DOXAA.exe File created C:\windows\SysWOW64\EZPDDW.exe.bat HTKG.exe File created C:\windows\SysWOW64\YSHQ.exe HEWYTNJ.exe File created C:\windows\SysWOW64\JMMHOP.exe YTJOF.exe File created C:\windows\SysWOW64\LITFZC.exe PDNISB.exe File created C:\windows\SysWOW64\LITFZC.exe.bat PDNISB.exe File created C:\windows\SysWOW64\HRIDHWE.exe.bat FBPB.exe File opened for modification C:\windows\SysWOW64\MDLZ.exe BKI.exe File created C:\windows\SysWOW64\MDLZ.exe.bat BKI.exe File created C:\windows\SysWOW64\CHIIZ.exe ARHO.exe File opened for modification C:\windows\SysWOW64\WRODE.exe DOXAA.exe File created C:\windows\SysWOW64\MNT.exe.bat PINCIP.exe File opened for modification C:\windows\SysWOW64\JUQNHJ.exe IOQHF.exe File opened for modification C:\windows\SysWOW64\ZGWLQK.exe MWAELSV.exe File opened for modification C:\windows\SysWOW64\JSQQ.exe HUWO.exe File created C:\windows\SysWOW64\BUXI.exe.bat LEYXF.exe File created C:\windows\SysWOW64\ACTR.exe.bat AKSQQLB.exe File created C:\windows\SysWOW64\TBWYLAG.exe.bat ZDVVNL.exe File opened for modification C:\windows\SysWOW64\YSHQ.exe HEWYTNJ.exe File opened for modification C:\windows\SysWOW64\HBX.exe OJUWPM.exe File created C:\windows\SysWOW64\LEYXF.exe MTAHF.exe File created C:\windows\SysWOW64\EJSJVBK.exe ZGWLQK.exe File created C:\windows\SysWOW64\JSQQ.exe.bat HUWO.exe File opened for modification C:\windows\SysWOW64\HGJF.exe BGCSVOH.exe File created C:\windows\SysWOW64\FUGW.exe UOCRVK.exe File opened for modification C:\windows\SysWOW64\ACTR.exe AKSQQLB.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\RDPZ.exe GKU.exe File created C:\windows\system\YBANZ.exe NIXU.exe File created C:\windows\system\AMZ.exe ABQ.exe File created C:\windows\system\HUWO.exe CRSPY.exe File opened for modification C:\windows\XOZS.exe XVQQ.exe File created C:\windows\system\YDF.exe.bat MKCTBFY.exe File opened for modification C:\windows\KHTXFCH.exe YOQEWN.exe File created C:\windows\system\OVDRXJ.exe.bat CCIYP.exe File opened for modification C:\windows\JVCS.exe NXFVFJL.exe File created C:\windows\HTW.exe FYRTVL.exe File created C:\windows\PINCIP.exe.bat LAHC.exe File created C:\windows\system\HBI.exe FDH.exe File created C:\windows\system\YBANZ.exe.bat NIXU.exe File opened for modification C:\windows\system\ZRNM.exe RHFK.exe File created C:\windows\system\SQLU.exe.bat FFPVI.exe File created C:\windows\system\HKXS.exe CHTUH.exe File created C:\windows\XHGBAZR.exe.bat SXK.exe File created C:\windows\CCIYP.exe GXCBI.exe File opened for modification C:\windows\OJUWPM.exe ZDOZI.exe File created C:\windows\system\CYR.exe LITFZC.exe File created C:\windows\ZZESA.exe.bat ZPDQ.exe File opened for modification C:\windows\XDDJN.exe VFKHHZ.exe File created C:\windows\XOZS.exe XVQQ.exe File created C:\windows\JVCS.exe NXFVFJL.exe File created C:\windows\CCIYP.exe.bat GXCBI.exe File opened for modification C:\windows\ZPX.exe METNDTN.exe File created C:\windows\system\RSMCZZ.exe.bat GARJR.exe File opened for modification C:\windows\OVJNYKW.exe OHRZXX.exe File created C:\windows\system\BWOB.exe.bat ZYV.exe File opened for modification C:\windows\system\HIYGIMR.exe UFU.exe File opened for modification C:\windows\system\AMZ.exe ABQ.exe File created C:\windows\DJY.exe PGUV.exe File created C:\windows\system\HTKG.exe.bat TWEJ.exe File opened for modification C:\windows\FNG.exe XHGBAZR.exe File created C:\windows\system\GKK.exe.bat JMMHOP.exe File created C:\windows\QDIEH.exe UGC.exe File created C:\windows\system\BARKF.exe CHIIZ.exe File opened for modification C:\windows\system\MMASZM.exe BUXI.exe File opened for modification C:\windows\ZBVBC.exe JLP.exe File created C:\windows\MGQJMK.exe.bat BONYD.exe File opened for modification C:\windows\system\IOQHF.exe MJKK.exe File opened for modification C:\windows\system\YBFL.exe QRFR.exe File opened for modification C:\windows\LCUF.exe AJRMV.exe File created C:\windows\system\CRSPY.exe UYSOKPP.exe File opened for modification C:\windows\system\HUWO.exe CRSPY.exe File opened for modification C:\windows\XHGBAZR.exe SXK.exe File created C:\windows\system\IOQHF.exe MJKK.exe File created C:\windows\system\CRSPY.exe.bat UYSOKPP.exe File created C:\windows\system\SXK.exe FUGW.exe File created C:\windows\system\VRK.exe.bat NGC.exe File created C:\windows\system\EJPO.exe RHLHZ.exe File created C:\windows\ZZESA.exe ZPDQ.exe File opened for modification C:\windows\HEWYTNJ.exe QTGAUS.exe File created C:\windows\KVDCVUL.exe IZZKL.exe File opened for modification C:\windows\KVDCVUL.exe IZZKL.exe File created C:\windows\FDH.exe.bat ZDZCZUW.exe File opened for modification C:\windows\system\GKU.exe KNO.exe File opened for modification C:\windows\system\IDJ.exe RQYYQ.exe File opened for modification C:\windows\system\BKI.exe BAZ.exe File created C:\windows\HTW.exe.bat FYRTVL.exe File created C:\windows\ENJ.exe IHLYBNV.exe File created C:\windows\system\QRFR.exe.bat OTD.exe File created C:\windows\MSCZX.exe.bat KCBE.exe File opened for modification C:\windows\system\PGUV.exe TBWYLAG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 4612 2004 WerFault.exe 86 708 5516 WerFault.exe 91 1920 4956 WerFault.exe 97 1472 2984 WerFault.exe 102 4152 2824 WerFault.exe 107 1464 3548 WerFault.exe 112 3164 5780 WerFault.exe 117 5768 544 WerFault.exe 122 1172 5864 WerFault.exe 127 5380 3368 WerFault.exe 132 4612 4696 WerFault.exe 137 708 5508 WerFault.exe 142 1756 4372 WerFault.exe 147 2144 940 WerFault.exe 152 1064 4992 WerFault.exe 157 1360 4284 WerFault.exe 162 5492 3388 WerFault.exe 167 4888 1096 WerFault.exe 172 2452 1872 WerFault.exe 177 2772 2092 WerFault.exe 182 5888 3592 WerFault.exe 187 5072 3212 WerFault.exe 192 4876 5988 WerFault.exe 197 3112 4448 WerFault.exe 202 2596 3052 WerFault.exe 207 2100 5264 WerFault.exe 212 5448 3312 WerFault.exe 217 5352 2800 WerFault.exe 222 2204 4812 WerFault.exe 227 4204 2272 WerFault.exe 232 4568 5692 WerFault.exe 237 4280 5732 WerFault.exe 242 1060 3656 WerFault.exe 247 2308 804 WerFault.exe 252 6012 1268 WerFault.exe 257 4540 5620 WerFault.exe 262 4492 4236 WerFault.exe 267 6060 1796 WerFault.exe 272 5532 3824 WerFault.exe 277 5728 3764 WerFault.exe 282 2016 1220 WerFault.exe 287 1296 1972 WerFault.exe 292 2804 5164 WerFault.exe 297 1900 2952 WerFault.exe 302 4748 3608 WerFault.exe 307 5172 3276 WerFault.exe 312 5376 1128 WerFault.exe 317 4444 2960 WerFault.exe 322 1460 4788 WerFault.exe 327 6000 3932 WerFault.exe 332 2164 1396 WerFault.exe 337 5352 2336 WerFault.exe 342 2204 5272 WerFault.exe 347 1332 5492 WerFault.exe 352 856 992 WerFault.exe 357 2544 1852 WerFault.exe 362 5960 2656 WerFault.exe 367 2980 5412 WerFault.exe 372 3920 2828 WerFault.exe 377 3784 1632 WerFault.exe 382 5792 2292 WerFault.exe 387 3652 3912 WerFault.exe 392 5552 5176 WerFault.exe 397 2116 2748 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KHTXFCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LAHC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JRIJZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRSPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZPDQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ENJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XGOIK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUQNHJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AJRMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IZZKL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JVCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMTIU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVEQO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HAJWQI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KVDCVUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UZRKZOI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YTWGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDNISB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BQSTCKP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARPBQZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LGE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUGW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GKK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWAELSV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFPVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GVIV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFKHHZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HUWO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IOQHF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKCTBFY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLFRFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2004 2026-06-25_c2909380a8de2518a51c1ac67c26a858_elex_emotet_stop.exe 2004 2026-06-25_c2909380a8de2518a51c1ac67c26a858_elex_emotet_stop.exe 5516 KRQSGIL.exe 5516 KRQSGIL.exe 4956 QMCTMXU.exe 4956 QMCTMXU.exe 2984 LAHC.exe 2984 LAHC.exe 2824 PINCIP.exe 2824 PINCIP.exe 3548 MNT.exe 3548 MNT.exe 5780 UTU.exe 5780 UTU.exe 544 IZRLY.exe 544 IZRLY.exe 5864 QRAEM.exe 5864 QRAEM.exe 3368 BKDXUHZ.exe 3368 BKDXUHZ.exe 4696 MCG.exe 4696 MCG.exe 5508 SCGDL.exe 5508 SCGDL.exe 4372 HALAS.exe 4372 HALAS.exe 940 STOTAA.exe 940 STOTAA.exe 4992 DLREBPP.exe 4992 DLREBPP.exe 4284 ARPBQZR.exe 4284 ARPBQZR.exe 3388 LJS.exe 3388 LJS.exe 1096 IPYRF.exe 1096 IPYRF.exe 1872 IZZKL.exe 1872 IZZKL.exe 2092 KVDCVUL.exe 2092 KVDCVUL.exe 3592 BGCSVOH.exe 3592 BGCSVOH.exe 3212 HGJF.exe 3212 HGJF.exe 5988 FYRTVL.exe 5988 FYRTVL.exe 4448 HTW.exe 4448 HTW.exe 3052 CHTUH.exe 3052 CHTUH.exe 5264 HKXS.exe 5264 HKXS.exe 3312 SCALV.exe 3312 SCALV.exe 2800 NXFVFJL.exe 2800 NXFVFJL.exe 4812 JVCS.exe 4812 JVCS.exe 2272 VOF.exe 2272 VOF.exe 5692 BONYD.exe 5692 BONYD.exe 5732 MGQJMK.exe 5732 MGQJMK.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2004 2026-06-25_c2909380a8de2518a51c1ac67c26a858_elex_emotet_stop.exe 2004 2026-06-25_c2909380a8de2518a51c1ac67c26a858_elex_emotet_stop.exe 5516 KRQSGIL.exe 5516 KRQSGIL.exe 4956 QMCTMXU.exe 4956 QMCTMXU.exe 2984 LAHC.exe 2984 LAHC.exe 2824 PINCIP.exe 2824 PINCIP.exe 3548 MNT.exe 3548 MNT.exe 5780 UTU.exe 5780 UTU.exe 544 IZRLY.exe 544 IZRLY.exe 5864 QRAEM.exe 5864 QRAEM.exe 3368 BKDXUHZ.exe 3368 BKDXUHZ.exe 4696 MCG.exe 4696 MCG.exe 5508 SCGDL.exe 5508 SCGDL.exe 4372 HALAS.exe 4372 HALAS.exe 940 STOTAA.exe 940 STOTAA.exe 4992 DLREBPP.exe 4992 DLREBPP.exe 4284 ARPBQZR.exe 4284 ARPBQZR.exe 3388 LJS.exe 3388 LJS.exe 1096 IPYRF.exe 1096 IPYRF.exe 1872 IZZKL.exe 1872 IZZKL.exe 2092 KVDCVUL.exe 2092 KVDCVUL.exe 3592 BGCSVOH.exe 3592 BGCSVOH.exe 3212 HGJF.exe 3212 HGJF.exe 5988 FYRTVL.exe 5988 FYRTVL.exe 4448 HTW.exe 4448 HTW.exe 3052 CHTUH.exe 3052 CHTUH.exe 5264 HKXS.exe 5264 HKXS.exe 3312 SCALV.exe 3312 SCALV.exe 2800 NXFVFJL.exe 2800 NXFVFJL.exe 4812 JVCS.exe 4812 JVCS.exe 2272 VOF.exe 2272 VOF.exe 5692 BONYD.exe 5692 BONYD.exe 5732 MGQJMK.exe 5732 MGQJMK.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 5676 2004 2026-06-25_c2909380a8de2518a51c1ac67c26a858_elex_emotet_stop.exe 87 PID 5676 wrote to memory of 5516 5676 cmd.exe 91 PID 5516 wrote to memory of 504 5516 KRQSGIL.exe 93 PID 504 wrote to memory of 4956 504 cmd.exe 97 PID 4956 wrote to memory of 1544 4956 QMCTMXU.exe 98 PID 1544 wrote to memory of 2984 1544 cmd.exe 102 PID 2984 wrote to memory of 4940 2984 LAHC.exe 103 PID 4940 wrote to memory of 2824 4940 cmd.exe 107 PID 2824 wrote to memory of 4592 2824 PINCIP.exe 108 PID 4592 wrote to memory of 3548 4592 cmd.exe 112 PID 3548 wrote to memory of 264 3548 MNT.exe 113 PID 264 wrote to memory of 5780 264 cmd.exe 117 PID 5780 wrote to memory of 2184 5780 UTU.exe 118 PID 2184 wrote to memory of 544 2184 cmd.exe 122 PID 544 wrote to memory of 2052 544 IZRLY.exe 123 PID 2052 wrote to memory of 5864 2052 cmd.exe 127 PID 5864 wrote to memory of 3792 5864 QRAEM.exe 128 PID 3792 wrote to memory of 3368 3792 cmd.exe 132 PID 3368 wrote to memory of 3860 3368 BKDXUHZ.exe 133 PID 3860 wrote to memory of 4696 3860 cmd.exe 137 PID 4696 wrote to memory of 4616 4696 MCG.exe 138 PID 4616 wrote to memory of 5508 4616 cmd.exe 142 PID 5508 wrote to memory of 592 5508 SCGDL.exe 143 PID 592 wrote to memory of 4372 592 cmd.exe 147 PID 4372 wrote to memory of 5812 4372 HALAS.exe 148 PID 5812 wrote to memory of 940 5812 cmd.exe 152 PID 940 wrote to memory of 2600 940 STOTAA.exe 153 PID 2600 wrote to memory of 4992 2600 cmd.exe 157 PID 4992 wrote to memory of 1488 4992 DLREBPP.exe 158 PID 1488 wrote to memory of 4284 1488 cmd.exe 162 PID 4284 wrote to memory of 5200 4284 ARPBQZR.exe 163 PID 5200 wrote to memory of 3388 5200 cmd.exe 167 PID 3388 wrote to memory of 6052 3388 LJS.exe 168 PID 6052 wrote to memory of 1096 6052 cmd.exe 172 PID 1096 wrote to memory of 1464 1096 IPYRF.exe 173 PID 1464 wrote to memory of 1872 1464 cmd.exe 177 PID 1872 wrote to memory of 5596 1872 IZZKL.exe 178 PID 5596 wrote to memory of 2092 5596 cmd.exe 182 PID 2092 wrote to memory of 2896 2092 KVDCVUL.exe 183 PID 2896 wrote to memory of 3592 2896 cmd.exe 187 PID 3592 wrote to memory of 3024 3592 BGCSVOH.exe 188 PID 3024 wrote to memory of 3212 3024 cmd.exe 192 PID 3212 wrote to memory of 5656 3212 HGJF.exe 193 PID 5656 wrote to memory of 5988 5656 cmd.exe 197 PID 5988 wrote to memory of 5464 5988 FYRTVL.exe 198 PID 5464 wrote to memory of 4448 5464 cmd.exe 202 PID 4448 wrote to memory of 2476 4448 HTW.exe 203 PID 2476 wrote to memory of 3052 2476 cmd.exe 207 PID 3052 wrote to memory of 4544 3052 CHTUH.exe 208 PID 4544 wrote to memory of 5264 4544 cmd.exe 212 PID 5264 wrote to memory of 5416 5264 HKXS.exe 213 PID 5416 wrote to memory of 3312 5416 cmd.exe 217 PID 3312 wrote to memory of 5484 3312 SCALV.exe 218 PID 5484 wrote to memory of 2800 5484 cmd.exe 222 PID 2800 wrote to memory of 1648 2800 NXFVFJL.exe 223 PID 1648 wrote to memory of 4812 1648 cmd.exe 227 PID 4812 wrote to memory of 3516 4812 JVCS.exe 228 PID 3516 wrote to memory of 2272 3516 cmd.exe 232 PID 2272 wrote to memory of 2584 2272 VOF.exe 233 PID 2584 wrote to memory of 5692 2584 cmd.exe 237 PID 5692 wrote to memory of 1612 5692 BONYD.exe 238 PID 1612 wrote to memory of 5732 1612 cmd.exe 242 PID 5732 wrote to memory of 2452 5732 MGQJMK.exe 243 PID 2452 wrote to memory of 3656 2452 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_c2909380a8de2518a51c1ac67c26a858_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_c2909380a8de2518a51c1ac67c26a858_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KRQSGIL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\windows\SysWOW64\KRQSGIL.exeC:\windows\system32\KRQSGIL.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QMCTMXU.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:504 -
C:\windows\SysWOW64\QMCTMXU.exeC:\windows\system32\QMCTMXU.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LAHC.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\windows\LAHC.exeC:\windows\LAHC.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PINCIP.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\windows\PINCIP.exeC:\windows\PINCIP.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MNT.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\windows\SysWOW64\MNT.exeC:\windows\system32\MNT.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTU.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:264 -
C:\windows\system\UTU.exeC:\windows\system\UTU.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IZRLY.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\windows\SysWOW64\IZRLY.exeC:\windows\system32\IZRLY.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QRAEM.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\windows\SysWOW64\QRAEM.exeC:\windows\system32\QRAEM.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BKDXUHZ.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\windows\SysWOW64\BKDXUHZ.exeC:\windows\system32\BKDXUHZ.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MCG.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\windows\MCG.exeC:\windows\MCG.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SCGDL.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\windows\system\SCGDL.exeC:\windows\system\SCGDL.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HALAS.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\windows\SysWOW64\HALAS.exeC:\windows\system32\HALAS.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\STOTAA.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\windows\system\STOTAA.exeC:\windows\system\STOTAA.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DLREBPP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\windows\SysWOW64\DLREBPP.exeC:\windows\system32\DLREBPP.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ARPBQZR.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\windows\SysWOW64\ARPBQZR.exeC:\windows\system32\ARPBQZR.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LJS.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\windows\system\LJS.exeC:\windows\system\LJS.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IPYRF.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\SysWOW64\IPYRF.exeC:\windows\system32\IPYRF.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZZKL.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\windows\IZZKL.exeC:\windows\IZZKL.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVDCVUL.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\windows\KVDCVUL.exeC:\windows\KVDCVUL.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BGCSVOH.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\windows\SysWOW64\BGCSVOH.exeC:\windows\system32\BGCSVOH.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HGJF.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\windows\SysWOW64\HGJF.exeC:\windows\system32\HGJF.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYRTVL.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\SysWOW64\FYRTVL.exeC:\windows\system32\FYRTVL.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HTW.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\windows\HTW.exeC:\windows\HTW.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CHTUH.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\windows\CHTUH.exeC:\windows\CHTUH.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HKXS.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\windows\system\HKXS.exeC:\windows\system\HKXS.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCALV.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\windows\SCALV.exeC:\windows\SCALV.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NXFVFJL.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\windows\SysWOW64\NXFVFJL.exeC:\windows\system32\NXFVFJL.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVCS.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\windows\JVCS.exeC:\windows\JVCS.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VOF.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\windows\system\VOF.exeC:\windows\system\VOF.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BONYD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\system\BONYD.exeC:\windows\system\BONYD.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGQJMK.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\windows\MGQJMK.exeC:\windows\MGQJMK.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UZRKZOI.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\UZRKZOI.exeC:\windows\UZRKZOI.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FSU.exe.bat" "66⤵PID:2772
-
C:\windows\system\FSU.exeC:\windows\system\FSU.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TXZA.exe.bat" "68⤵PID:5888
-
C:\windows\SysWOW64\TXZA.exeC:\windows\system32\TXZA.exe69⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BDSPQ.exe.bat" "70⤵PID:2236
-
C:\windows\BDSPQ.exeC:\windows\BDSPQ.exe71⤵
- Executes dropped EXE
PID:5620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDZCZUW.exe.bat" "72⤵PID:2816
-
C:\windows\SysWOW64\ZDZCZUW.exeC:\windows\system32\ZDZCZUW.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FDH.exe.bat" "74⤵PID:920
-
C:\windows\FDH.exeC:\windows\FDH.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBI.exe.bat" "76⤵PID:4768
-
C:\windows\system\HBI.exeC:\windows\system\HBI.exe77⤵
- Executes dropped EXE
PID:3824 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SUDD.exe.bat" "78⤵PID:2044
-
C:\windows\SysWOW64\SUDD.exeC:\windows\system32\SUDD.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KZOVF.exe.bat" "80⤵PID:3280
-
C:\windows\SysWOW64\KZOVF.exeC:\windows\system32\KZOVF.exe81⤵
- Executes dropped EXE
PID:1220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KNO.exe.bat" "82⤵PID:3372
-
C:\windows\KNO.exeC:\windows\KNO.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKU.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\windows\system\GKU.exeC:\windows\system\GKU.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDPZ.exe.bat" "86⤵PID:5868
-
C:\windows\system\RDPZ.exeC:\windows\system\RDPZ.exe87⤵
- Executes dropped EXE
PID:2952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYTJGT.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1956 -
C:\windows\SysWOW64\MYTJGT.exeC:\windows\system32\MYTJGT.exe89⤵
- Executes dropped EXE
PID:3608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MJCCUX.exe.bat" "90⤵PID:5932
-
C:\windows\MJCCUX.exeC:\windows\MJCCUX.exe91⤵
- Executes dropped EXE
PID:3276 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UOCRVK.exe.bat" "92⤵PID:3980
-
C:\windows\UOCRVK.exeC:\windows\UOCRVK.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUGW.exe.bat" "94⤵PID:2720
-
C:\windows\SysWOW64\FUGW.exeC:\windows\system32\FUGW.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXK.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1236 -
C:\windows\system\SXK.exeC:\windows\system\SXK.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHGBAZR.exe.bat" "98⤵PID:948
-
C:\windows\XHGBAZR.exeC:\windows\XHGBAZR.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FNG.exe.bat" "100⤵PID:1856
-
C:\windows\FNG.exeC:\windows\FNG.exe101⤵
- Executes dropped EXE
PID:1396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OAQIRJ.exe.bat" "102⤵PID:2644
-
C:\windows\OAQIRJ.exeC:\windows\OAQIRJ.exe103⤵
- Executes dropped EXE
PID:2336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QQJCPY.exe.bat" "104⤵PID:3272
-
C:\windows\SysWOW64\QQJCPY.exeC:\windows\system32\QQJCPY.exe105⤵
- Executes dropped EXE
PID:5272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTBO.exe.bat" "106⤵PID:5156
-
C:\windows\GTBO.exeC:\windows\GTBO.exe107⤵
- Executes dropped EXE
PID:5492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWX.exe.bat" "108⤵PID:256
-
C:\windows\system\TWX.exeC:\windows\system\TWX.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EOAGW.exe.bat" "110⤵PID:5152
-
C:\windows\SysWOW64\EOAGW.exeC:\windows\system32\EOAGW.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GMTIU.exe.bat" "112⤵PID:2932
-
C:\windows\SysWOW64\GMTIU.exeC:\windows\system32\GMTIU.exe113⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXCBI.exe.bat" "114⤵PID:3704
-
C:\windows\system\GXCBI.exeC:\windows\system\GXCBI.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCIYP.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:6076 -
C:\windows\CCIYP.exeC:\windows\CCIYP.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OVDRXJ.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4532 -
C:\windows\system\OVDRXJ.exeC:\windows\system\OVDRXJ.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NOL.exe.bat" "120⤵PID:4772
-
C:\windows\SysWOW64\NOL.exeC:\windows\system32\NOL.exe121⤵
- Executes dropped EXE
PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-