Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/06/2026, 04:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-29_b4e0a3e3981156f3b3e5eddadcdd0033_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_b4e0a3e3981156f3b3e5eddadcdd0033_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-06-29_b4e0a3e3981156f3b3e5eddadcdd0033_elex_emotet_stop.exe
- Size 208KB
- Sample260630-e8vq4aex2s
- SHA256 a63295dd181d53e14d1506d0674fc4d47fd565ae422ecd8c60121fb22226286c
- MD5 b4e0a3e3981156f3b3e5eddadcdd0033
- SHA1 bc1a76979fd9f3b32535da5e39d19c41b730abe2
- SHA512 515183a0308cd31dc527f9336d30bd92a4586515016c0ee008e5c19ff55508ee287058dfdfaa825ca390af62568fb0690d532ba9029c55d58ef7e24ed8fc7955
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfi4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOKQEjK
- TLSH T179247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E315A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1376 KWM.exe 2692 NRVW.exe 3348 PPWY.exe 3444 YPYDIM.exe 4996 PCJVXR.exe 3208 UFF.exe 4220 WDG.exe 1928 TJE.exe 3104 POKQX.exe 1852 PZSKL.exe 2284 ARVCTC.exe 1356 CPPFRZC.exe 948 IPWSATD.exe 668 FVC.exe 1840 KYY.exe 1792 GDEL.exe 1232 IBXFI.exe 1076 OBFTR.exe 1796 DZKQYEN.exe 1300 ZFQN.exe 1268 NPM.exe 4192 JNSJ.exe 5600 UFNB.exe 4736 GYQUI.exe 3116 DYYIZYK.exe 828 RJCGEX.exe 5180 THVICMU.exe 6044 ZHDW.exe 2960 VFITAQ.exe 2468 AQESF.exe 1844 XVKPMR.exe 3748 KYGNRJ.exe 5032 KRPPFV.exe 2744 MGQJMK.exe 4068 ZRMPR.exe 5124 ZCV.exe 5984 BAOLDC.exe 4688 JSW.exe 2188 OVSLWXU.exe 5444 QTU.exe 5252 GJS.exe 3848 DOYN.exe 4812 ZUEK.exe 2496 WZCHJJ.exe 4704 YPDBPY.exe 4948 MVJYWI.exe 1544 UNKAKM.exe 1068 FGNLSBD.exe 5848 HWG.exe 1096 EBMKG.exe 1696 EUUDM.exe 4596 YHZNWER.exe 5972 KAC.exe 3916 MYVICI.exe 1292 TIEJ.exe 3264 IOC.exe 5668 DBGII.exe 6028 ZHMFPGV.exe 5932 BEOHVVE.exe 1568 YCLWCEF.exe 6072 SXQN.exe 4140 JNX.exe 2864 WQTPD.exe 392 SVZM.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\WDG.exe UFF.exe File created C:\windows\SysWOW64\BAOLDC.exe.bat ZCV.exe File created C:\windows\SysWOW64\GJS.exe.bat QTU.exe File created C:\windows\SysWOW64\WEODLCP.exe.bat LLLKKV.exe File created C:\windows\SysWOW64\ZNCAI.exe CQWLB.exe File created C:\windows\SysWOW64\FGTH.exe XNLO.exe File created C:\windows\SysWOW64\CMR.exe.bat UBRUIA.exe File opened for modification C:\windows\SysWOW64\PVW.exe NXDH.exe File created C:\windows\SysWOW64\NRVW.exe KWM.exe File created C:\windows\SysWOW64\KRPPFV.exe KYGNRJ.exe File opened for modification C:\windows\SysWOW64\BAOLDC.exe ZCV.exe File created C:\windows\SysWOW64\YHG.exe.bat BBAUTV.exe File created C:\windows\SysWOW64\OAZDS.exe.bat RUT.exe File created C:\windows\SysWOW64\KXXBZ.exe.bat OAZDS.exe File created C:\windows\SysWOW64\CPNRJ.exe FPFDSCL.exe File created C:\windows\SysWOW64\QXJDQ.exe VKE.exe File opened for modification C:\windows\SysWOW64\POKQX.exe TJE.exe File created C:\windows\SysWOW64\MIMJV.exe.bat AQJQN.exe File created C:\windows\SysWOW64\MVU.exe.bat ZSQVDEN.exe File created C:\windows\SysWOW64\VPSHMSR.exe.bat MBHXW.exe File created C:\windows\SysWOW64\OFRIC.exe DMO.exe File created C:\windows\SysWOW64\QXJDQ.exe.bat VKE.exe File created C:\windows\SysWOW64\ADB.exe OLY.exe File created C:\windows\SysWOW64\NRVW.exe.bat KWM.exe File created C:\windows\SysWOW64\GDEL.exe KYY.exe File opened for modification C:\windows\SysWOW64\MIMJV.exe AQJQN.exe File created C:\windows\SysWOW64\DYXUTX.exe.bat YNTNOFC.exe File created C:\windows\SysWOW64\HUD.exe.bat URZS.exe File created C:\windows\SysWOW64\CPNRJ.exe.bat FPFDSCL.exe File opened for modification C:\windows\SysWOW64\TNGHL.exe WQA.exe File opened for modification C:\windows\SysWOW64\IGZBDLC.exe VDVVYU.exe File opened for modification C:\windows\SysWOW64\NRVW.exe KWM.exe File created C:\windows\SysWOW64\WDG.exe UFF.exe File created C:\windows\SysWOW64\ASI.exe PZFZ.exe File created C:\windows\SysWOW64\RUT.exe DONJEGG.exe File created C:\windows\SysWOW64\MVYVG.exe KXXBZ.exe File created C:\windows\SysWOW64\AJMEO.exe ELHH.exe File opened for modification C:\windows\SysWOW64\DPVQGL.exe GKXBZC.exe File opened for modification C:\windows\SysWOW64\KOB.exe OQVAID.exe File created C:\windows\SysWOW64\UFNB.exe.bat JNSJ.exe File created C:\windows\SysWOW64\KXXBZ.exe OAZDS.exe File created C:\windows\SysWOW64\MVYVG.exe.bat KXXBZ.exe File opened for modification C:\windows\SysWOW64\HUD.exe URZS.exe File created C:\windows\SysWOW64\ZOHYQS.exe CQBJ.exe File opened for modification C:\windows\SysWOW64\QFGDNH.exe TZAGG.exe File created C:\windows\SysWOW64\JAN.exe.bat PMIRGZ.exe File created C:\windows\SysWOW64\WDEGRIH.exe BIAOGI.exe File created C:\windows\SysWOW64\YPYDIM.exe PPWY.exe File created C:\windows\SysWOW64\KRPPFV.exe.bat KYGNRJ.exe File created C:\windows\SysWOW64\BLVDPD.exe.bat ZNCAI.exe File opened for modification C:\windows\SysWOW64\ZOHYQS.exe CQBJ.exe File created C:\windows\SysWOW64\JAN.exe PMIRGZ.exe File created C:\windows\SysWOW64\IZWORJT.exe VPSHMSR.exe File created C:\windows\SysWOW64\LPB.exe.bat RRZYEYG.exe File created C:\windows\SysWOW64\RNJNS.exe.bat LNB.exe File created C:\windows\SysWOW64\UFNB.exe JNSJ.exe File opened for modification C:\windows\SysWOW64\LLLKKV.exe UNMH.exe File created C:\windows\SysWOW64\IZWORJT.exe.bat VPSHMSR.exe File created C:\windows\SysWOW64\GKXBZC.exe LWSK.exe File created C:\windows\SysWOW64\EIVUBU.exe.bat ZFZVWDF.exe File opened for modification C:\windows\SysWOW64\VXC.exe IUYYSFQ.exe File created C:\windows\SysWOW64\OLY.exe HSPKQC.exe File opened for modification C:\windows\SysWOW64\OLY.exe HSPKQC.exe File created C:\windows\SysWOW64\ZHDW.exe THVICMU.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\FLTWY.exe FGTH.exe File created C:\windows\LEWYIWI.exe.bat SJFV.exe File created C:\windows\IIYDSF.exe.bat RTZAGMU.exe File created C:\windows\system\LNB.exe.bat VXC.exe File created C:\windows\system\UNKAKM.exe MVJYWI.exe File created C:\windows\system\UNKAKM.exe.bat MVJYWI.exe File opened for modification C:\windows\ICJLD.exe ASI.exe File opened for modification C:\windows\APHN.exe LKCQFXJ.exe File created C:\windows\PMIRGZ.exe.bat WHXTT.exe File created C:\windows\FPFDSCL.exe XWWBMQW.exe File created C:\windows\system\VDVVYU.exe QSZXLDE.exe File created C:\windows\IUYYSFQ.exe.bat LPB.exe File opened for modification C:\windows\ZCV.exe ZRMPR.exe File created C:\windows\system\MVJYWI.exe.bat YPDBPY.exe File created C:\windows\MYVICI.exe KAC.exe File created C:\windows\system\PHXXTOD.exe EOCES.exe File created C:\windows\VTNWX.exe ZOHYQS.exe File created C:\windows\ZLQ.exe.bat OTNVPKX.exe File created C:\windows\LKPXJC.exe OFRIC.exe File created C:\windows\system\LNB.exe VXC.exe File created C:\windows\system\ZFQN.exe.bat DZKQYEN.exe File created C:\windows\LBVKBNH.exe.bat MIMJV.exe File created C:\windows\LZYX.exe QMTOSCL.exe File created C:\windows\URZS.exe UEHM.exe File created C:\windows\system\TBB.exe IIYDSF.exe File created C:\windows\system\BUTYTCP.exe.bat VTMKK.exe File created C:\windows\system\PCJVXR.exe.bat YPYDIM.exe File created C:\windows\system\ARVCTC.exe.bat PZSKL.exe File opened for modification C:\windows\BEOHVVE.exe ZHMFPGV.exe File created C:\windows\ZWRID.exe.bat ZLQ.exe File created C:\windows\system\HHIS.exe.bat VOF.exe File opened for modification C:\windows\EUUDM.exe EBMKG.exe File created C:\windows\system\NPM.exe.bat ZFQN.exe File created C:\windows\QTU.exe OVSLWXU.exe File opened for modification C:\windows\system\SVZM.exe WQTPD.exe File created C:\windows\EOCES.exe.bat SVZM.exe File created C:\windows\AQJQN.exe NNNR.exe File opened for modification C:\windows\system\UNMH.exe LNK.exe File opened for modification C:\windows\ZLQ.exe OTNVPKX.exe File opened for modification C:\windows\system\MVJYWI.exe YPDBPY.exe File opened for modification C:\windows\MYVICI.exe KAC.exe File created C:\windows\system\DBGII.exe IOC.exe File created C:\windows\LNK.exe UAAKFHC.exe File created C:\windows\system\HHIS.exe VOF.exe File opened for modification C:\windows\system\RBFB.exe CDZEA.exe File opened for modification C:\windows\system\VLZKRO.exe TNGHL.exe File created C:\windows\ZFZVWDF.exe.bat HUGUWWA.exe File created C:\windows\system\UFF.exe PCJVXR.exe File created C:\windows\system\RJCGEX.exe DYYIZYK.exe File opened for modification C:\windows\system\QMNN.exe KMGAPIA.exe File created C:\windows\RVOW.exe JCFV.exe File opened for modification C:\windows\LKPXJC.exe OFRIC.exe File created C:\windows\system\VTMKK.exe.bat TDTQML.exe File opened for modification C:\windows\PZSKL.exe POKQX.exe File created C:\windows\system\RJCGEX.exe.bat DYYIZYK.exe File opened for modification C:\windows\LBVKBNH.exe MIMJV.exe File created C:\windows\system\EUP.exe CEVQCFQ.exe File created C:\windows\GDJKW.exe ADB.exe File created C:\windows\system\CPHVEMJ.exe LGFQBH.exe File opened for modification C:\windows\ZHMFPGV.exe DBGII.exe File opened for modification C:\windows\ELHH.exe CNF.exe File created C:\windows\TDTQML.exe OTPKZ.exe File opened for modification C:\windows\system\BUTYTCP.exe VTMKK.exe File created C:\windows\system\PPWY.exe NRVW.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 5484 2396 WerFault.exe 86 4372 1376 WerFault.exe 91 4860 2692 WerFault.exe 97 4644 3348 WerFault.exe 102 2628 3444 WerFault.exe 107 3804 4996 WerFault.exe 112 3252 3208 WerFault.exe 117 1288 4220 WerFault.exe 122 2724 1928 WerFault.exe 127 1112 3104 WerFault.exe 132 5432 1852 WerFault.exe 137 4792 2284 WerFault.exe 142 4528 1356 WerFault.exe 147 4584 948 WerFault.exe 152 4508 668 WerFault.exe 157 2972 1840 WerFault.exe 162 4040 1792 WerFault.exe 167 5760 1232 WerFault.exe 172 1712 1076 WerFault.exe 177 4836 1796 WerFault.exe 182 1280 1300 WerFault.exe 187 6080 1268 WerFault.exe 192 5360 4192 WerFault.exe 197 896 5600 WerFault.exe 202 3704 4736 WerFault.exe 207 4588 3116 WerFault.exe 212 1696 828 WerFault.exe 217 4380 5180 WerFault.exe 222 3404 6044 WerFault.exe 227 4448 2960 WerFault.exe 232 5004 2468 WerFault.exe 237 5532 1844 WerFault.exe 242 4704 3748 WerFault.exe 247 1112 5032 WerFault.exe 252 5432 2744 WerFault.exe 257 2120 4068 WerFault.exe 262 3360 5124 WerFault.exe 267 4424 5984 WerFault.exe 272 3640 4688 WerFault.exe 277 3908 2188 WerFault.exe 282 3132 5444 WerFault.exe 287 5612 5252 WerFault.exe 292 4104 3848 WerFault.exe 297 3364 4812 WerFault.exe 302 2908 2496 WerFault.exe 307 2420 4704 WerFault.exe 312 4488 4948 WerFault.exe 317 468 1544 WerFault.exe 322 2616 1068 WerFault.exe 327 1344 5848 WerFault.exe 332 4344 1096 WerFault.exe 337 4644 1696 WerFault.exe 342 5264 4596 WerFault.exe 347 2444 5972 WerFault.exe 352 4492 3916 WerFault.exe 357 5940 1292 WerFault.exe 362 3040 3264 WerFault.exe 367 4984 5668 WerFault.exe 372 3604 6028 WerFault.exe 377 5440 5932 WerFault.exe 382 3232 1568 WerFault.exe 387 1264 6072 WerFault.exe 392 2000 4140 WerFault.exe 397 6116 2864 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRRTFR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OQVAID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QTU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBGII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLJXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQSWIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DOYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCLWCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAOLDC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMIRGZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QSZXLDE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPTDLLE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EUP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLVDPD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KXXBZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LWSK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZCHJJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XOFWNM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IBXFI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZRMPR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OAZDS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RNJNS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HSPKQC.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2396 2026-06-29_b4e0a3e3981156f3b3e5eddadcdd0033_elex_emotet_stop.exe 2396 2026-06-29_b4e0a3e3981156f3b3e5eddadcdd0033_elex_emotet_stop.exe 1376 KWM.exe 1376 KWM.exe 2692 NRVW.exe 2692 NRVW.exe 3348 PPWY.exe 3348 PPWY.exe 3444 YPYDIM.exe 3444 YPYDIM.exe 4996 PCJVXR.exe 4996 PCJVXR.exe 3208 UFF.exe 3208 UFF.exe 4220 WDG.exe 4220 WDG.exe 1928 TJE.exe 1928 TJE.exe 3104 POKQX.exe 3104 POKQX.exe 1852 PZSKL.exe 1852 PZSKL.exe 2284 ARVCTC.exe 2284 ARVCTC.exe 1356 CPPFRZC.exe 1356 CPPFRZC.exe 948 IPWSATD.exe 948 IPWSATD.exe 668 FVC.exe 668 FVC.exe 1840 KYY.exe 1840 KYY.exe 1792 GDEL.exe 1792 GDEL.exe 1232 IBXFI.exe 1232 IBXFI.exe 1076 OBFTR.exe 1076 OBFTR.exe 1796 DZKQYEN.exe 1796 DZKQYEN.exe 1300 ZFQN.exe 1300 ZFQN.exe 1268 NPM.exe 1268 NPM.exe 4192 JNSJ.exe 4192 JNSJ.exe 5600 UFNB.exe 5600 UFNB.exe 4736 GYQUI.exe 4736 GYQUI.exe 3116 DYYIZYK.exe 3116 DYYIZYK.exe 828 RJCGEX.exe 828 RJCGEX.exe 5180 THVICMU.exe 5180 THVICMU.exe 6044 ZHDW.exe 6044 ZHDW.exe 2960 VFITAQ.exe 2960 VFITAQ.exe 2468 AQESF.exe 2468 AQESF.exe 1844 XVKPMR.exe 1844 XVKPMR.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2396 2026-06-29_b4e0a3e3981156f3b3e5eddadcdd0033_elex_emotet_stop.exe 2396 2026-06-29_b4e0a3e3981156f3b3e5eddadcdd0033_elex_emotet_stop.exe 1376 KWM.exe 1376 KWM.exe 2692 NRVW.exe 2692 NRVW.exe 3348 PPWY.exe 3348 PPWY.exe 3444 YPYDIM.exe 3444 YPYDIM.exe 4996 PCJVXR.exe 4996 PCJVXR.exe 3208 UFF.exe 3208 UFF.exe 4220 WDG.exe 4220 WDG.exe 1928 TJE.exe 1928 TJE.exe 3104 POKQX.exe 3104 POKQX.exe 1852 PZSKL.exe 1852 PZSKL.exe 2284 ARVCTC.exe 2284 ARVCTC.exe 1356 CPPFRZC.exe 1356 CPPFRZC.exe 948 IPWSATD.exe 948 IPWSATD.exe 668 FVC.exe 668 FVC.exe 1840 KYY.exe 1840 KYY.exe 1792 GDEL.exe 1792 GDEL.exe 1232 IBXFI.exe 1232 IBXFI.exe 1076 OBFTR.exe 1076 OBFTR.exe 1796 DZKQYEN.exe 1796 DZKQYEN.exe 1300 ZFQN.exe 1300 ZFQN.exe 1268 NPM.exe 1268 NPM.exe 4192 JNSJ.exe 4192 JNSJ.exe 5600 UFNB.exe 5600 UFNB.exe 4736 GYQUI.exe 4736 GYQUI.exe 3116 DYYIZYK.exe 3116 DYYIZYK.exe 828 RJCGEX.exe 828 RJCGEX.exe 5180 THVICMU.exe 5180 THVICMU.exe 6044 ZHDW.exe 6044 ZHDW.exe 2960 VFITAQ.exe 2960 VFITAQ.exe 2468 AQESF.exe 2468 AQESF.exe 1844 XVKPMR.exe 1844 XVKPMR.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 1528 2396 2026-06-29_b4e0a3e3981156f3b3e5eddadcdd0033_elex_emotet_stop.exe 87 PID 1528 wrote to memory of 1376 1528 cmd.exe 91 PID 1376 wrote to memory of 4224 1376 KWM.exe 93 PID 4224 wrote to memory of 2692 4224 cmd.exe 97 PID 2692 wrote to memory of 4664 2692 NRVW.exe 98 PID 4664 wrote to memory of 3348 4664 cmd.exe 102 PID 3348 wrote to memory of 2816 3348 PPWY.exe 103 PID 2816 wrote to memory of 3444 2816 cmd.exe 107 PID 3444 wrote to memory of 3856 3444 YPYDIM.exe 108 PID 3856 wrote to memory of 4996 3856 cmd.exe 112 PID 4996 wrote to memory of 240 4996 PCJVXR.exe 113 PID 240 wrote to memory of 3208 240 cmd.exe 117 PID 3208 wrote to memory of 1784 3208 UFF.exe 118 PID 1784 wrote to memory of 4220 1784 cmd.exe 122 PID 4220 wrote to memory of 1656 4220 WDG.exe 123 PID 1656 wrote to memory of 1928 1656 cmd.exe 127 PID 1928 wrote to memory of 5132 1928 TJE.exe 128 PID 5132 wrote to memory of 3104 5132 cmd.exe 132 PID 3104 wrote to memory of 5616 3104 POKQX.exe 133 PID 5616 wrote to memory of 1852 5616 cmd.exe 137 PID 1852 wrote to memory of 1404 1852 PZSKL.exe 138 PID 1404 wrote to memory of 2284 1404 cmd.exe 142 PID 2284 wrote to memory of 5580 2284 ARVCTC.exe 143 PID 5580 wrote to memory of 1356 5580 cmd.exe 147 PID 1356 wrote to memory of 3516 1356 CPPFRZC.exe 148 PID 3516 wrote to memory of 948 3516 cmd.exe 152 PID 948 wrote to memory of 4452 948 IPWSATD.exe 153 PID 4452 wrote to memory of 668 4452 cmd.exe 157 PID 668 wrote to memory of 3412 668 FVC.exe 158 PID 3412 wrote to memory of 1840 3412 cmd.exe 162 PID 1840 wrote to memory of 4824 1840 KYY.exe 163 PID 4824 wrote to memory of 1792 4824 cmd.exe 167 PID 1792 wrote to memory of 1612 1792 GDEL.exe 168 PID 1612 wrote to memory of 1232 1612 cmd.exe 172 PID 1232 wrote to memory of 3380 1232 IBXFI.exe 173 PID 3380 wrote to memory of 1076 3380 cmd.exe 177 PID 1076 wrote to memory of 3712 1076 OBFTR.exe 178 PID 3712 wrote to memory of 1796 3712 cmd.exe 182 PID 1796 wrote to memory of 4412 1796 DZKQYEN.exe 183 PID 4412 wrote to memory of 1300 4412 cmd.exe 187 PID 1300 wrote to memory of 4432 1300 ZFQN.exe 188 PID 4432 wrote to memory of 1268 4432 cmd.exe 192 PID 1268 wrote to memory of 4324 1268 NPM.exe 193 PID 4324 wrote to memory of 4192 4324 cmd.exe 197 PID 4192 wrote to memory of 5768 4192 JNSJ.exe 198 PID 5768 wrote to memory of 5600 5768 cmd.exe 202 PID 5600 wrote to memory of 4524 5600 UFNB.exe 203 PID 4524 wrote to memory of 4736 4524 cmd.exe 207 PID 4736 wrote to memory of 1684 4736 GYQUI.exe 208 PID 1684 wrote to memory of 3116 1684 cmd.exe 212 PID 3116 wrote to memory of 2800 3116 DYYIZYK.exe 213 PID 2800 wrote to memory of 828 2800 cmd.exe 217 PID 828 wrote to memory of 3272 828 RJCGEX.exe 218 PID 3272 wrote to memory of 5180 3272 cmd.exe 222 PID 5180 wrote to memory of 2660 5180 THVICMU.exe 223 PID 2660 wrote to memory of 6044 2660 cmd.exe 227 PID 6044 wrote to memory of 1472 6044 ZHDW.exe 228 PID 1472 wrote to memory of 2960 1472 cmd.exe 232 PID 2960 wrote to memory of 3352 2960 VFITAQ.exe 233 PID 3352 wrote to memory of 2468 3352 cmd.exe 237 PID 2468 wrote to memory of 4328 2468 AQESF.exe 238 PID 4328 wrote to memory of 1844 4328 cmd.exe 242 PID 1844 wrote to memory of 4360 1844 XVKPMR.exe 243 PID 4360 wrote to memory of 3748 4360 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_b4e0a3e3981156f3b3e5eddadcdd0033_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b4e0a3e3981156f3b3e5eddadcdd0033_elex_emotet_stop.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KWM.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\windows\system\KWM.exeC:\windows\system\KWM.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NRVW.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\windows\SysWOW64\NRVW.exeC:\windows\system32\NRVW.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PPWY.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\windows\system\PPWY.exeC:\windows\system\PPWY.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YPYDIM.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\SysWOW64\YPYDIM.exeC:\windows\system32\YPYDIM.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PCJVXR.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\system\PCJVXR.exeC:\windows\system\PCJVXR.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UFF.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\windows\system\UFF.exeC:\windows\system\UFF.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WDG.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\windows\SysWOW64\WDG.exeC:\windows\system32\WDG.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TJE.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\windows\TJE.exeC:\windows\TJE.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\POKQX.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\windows\SysWOW64\POKQX.exeC:\windows\system32\POKQX.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PZSKL.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\windows\PZSKL.exeC:\windows\PZSKL.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARVCTC.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\windows\system\ARVCTC.exeC:\windows\system\ARVCTC.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CPPFRZC.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\windows\SysWOW64\CPPFRZC.exeC:\windows\system32\CPPFRZC.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IPWSATD.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\windows\IPWSATD.exeC:\windows\IPWSATD.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FVC.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\windows\FVC.exeC:\windows\FVC.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYY.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\windows\SysWOW64\KYY.exeC:\windows\system32\KYY.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GDEL.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SysWOW64\GDEL.exeC:\windows\system32\GDEL.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IBXFI.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\windows\IBXFI.exeC:\windows\IBXFI.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OBFTR.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\windows\system\OBFTR.exeC:\windows\system\OBFTR.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZKQYEN.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\DZKQYEN.exeC:\windows\DZKQYEN.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZFQN.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\windows\system\ZFQN.exeC:\windows\system\ZFQN.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NPM.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\windows\system\NPM.exeC:\windows\system\NPM.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNSJ.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\windows\JNSJ.exeC:\windows\JNSJ.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UFNB.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\SysWOW64\UFNB.exeC:\windows\system32\UFNB.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GYQUI.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\windows\system\GYQUI.exeC:\windows\system\GYQUI.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DYYIZYK.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\windows\system\DYYIZYK.exeC:\windows\system\DYYIZYK.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RJCGEX.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\system\RJCGEX.exeC:\windows\system\RJCGEX.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\THVICMU.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\windows\system\THVICMU.exeC:\windows\system\THVICMU.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZHDW.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\windows\SysWOW64\ZHDW.exeC:\windows\system32\ZHDW.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VFITAQ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\windows\system\VFITAQ.exeC:\windows\system\VFITAQ.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AQESF.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\windows\system\AQESF.exeC:\windows\system\AQESF.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XVKPMR.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\windows\system\XVKPMR.exeC:\windows\system\XVKPMR.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KYGNRJ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\windows\system\KYGNRJ.exeC:\windows\system\KYGNRJ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KRPPFV.exe.bat" "66⤵PID:4836
-
C:\windows\SysWOW64\KRPPFV.exeC:\windows\system32\KRPPFV.exe67⤵
- Executes dropped EXE
PID:5032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MGQJMK.exe.bat" "68⤵PID:6048
-
C:\windows\MGQJMK.exeC:\windows\MGQJMK.exe69⤵
- Executes dropped EXE
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZRMPR.exe.bat" "70⤵PID:2804
-
C:\windows\system\ZRMPR.exeC:\windows\system\ZRMPR.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZCV.exe.bat" "72⤵PID:944
-
C:\windows\ZCV.exeC:\windows\ZCV.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BAOLDC.exe.bat" "74⤵PID:896
-
C:\windows\SysWOW64\BAOLDC.exeC:\windows\system32\BAOLDC.exe75⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JSW.exe.bat" "76⤵PID:1488
-
C:\windows\JSW.exeC:\windows\JSW.exe77⤵
- Executes dropped EXE
PID:4688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVSLWXU.exe.bat" "78⤵PID:4920
-
C:\windows\OVSLWXU.exeC:\windows\OVSLWXU.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QTU.exe.bat" "80⤵PID:2952
-
C:\windows\QTU.exeC:\windows\QTU.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJS.exe.bat" "82⤵PID:6012
-
C:\windows\SysWOW64\GJS.exeC:\windows\system32\GJS.exe83⤵
- Executes dropped EXE
PID:5252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DOYN.exe.bat" "84⤵PID:3884
-
C:\windows\SysWOW64\DOYN.exeC:\windows\system32\DOYN.exe85⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZUEK.exe.bat" "86⤵PID:1084
-
C:\windows\system\ZUEK.exeC:\windows\system\ZUEK.exe87⤵
- Executes dropped EXE
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WZCHJJ.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1548 -
C:\windows\WZCHJJ.exeC:\windows\WZCHJJ.exe89⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YPDBPY.exe.bat" "90⤵PID:4968
-
C:\windows\system\YPDBPY.exeC:\windows\system\YPDBPY.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MVJYWI.exe.bat" "92⤵PID:1692
-
C:\windows\system\MVJYWI.exeC:\windows\system\MVJYWI.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UNKAKM.exe.bat" "94⤵PID:4308
-
C:\windows\system\UNKAKM.exeC:\windows\system\UNKAKM.exe95⤵
- Executes dropped EXE
PID:1544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FGNLSBD.exe.bat" "96⤵PID:1736
-
C:\windows\system\FGNLSBD.exeC:\windows\system\FGNLSBD.exe97⤵
- Executes dropped EXE
PID:1068 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWG.exe.bat" "98⤵PID:5744
-
C:\windows\HWG.exeC:\windows\HWG.exe99⤵
- Executes dropped EXE
PID:5848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EBMKG.exe.bat" "100⤵PID:5632
-
C:\windows\SysWOW64\EBMKG.exeC:\windows\system32\EBMKG.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EUUDM.exe.bat" "102⤵PID:4888
-
C:\windows\EUUDM.exeC:\windows\EUUDM.exe103⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YHZNWER.exe.bat" "104⤵PID:1448
-
C:\windows\system\YHZNWER.exeC:\windows\system\YHZNWER.exe105⤵
- Executes dropped EXE
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KAC.exe.bat" "106⤵PID:4436
-
C:\windows\system\KAC.exeC:\windows\system\KAC.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYVICI.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5612 -
C:\windows\MYVICI.exeC:\windows\MYVICI.exe109⤵
- Executes dropped EXE
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TIEJ.exe.bat" "110⤵PID:3428
-
C:\windows\system\TIEJ.exeC:\windows\system\TIEJ.exe111⤵
- Executes dropped EXE
PID:1292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IOC.exe.bat" "112⤵PID:544
-
C:\windows\system\IOC.exeC:\windows\system\IOC.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DBGII.exe.bat" "114⤵PID:3944
-
C:\windows\system\DBGII.exeC:\windows\system\DBGII.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZHMFPGV.exe.bat" "116⤵PID:3160
-
C:\windows\ZHMFPGV.exeC:\windows\ZHMFPGV.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BEOHVVE.exe.bat" "118⤵PID:2308
-
C:\windows\BEOHVVE.exeC:\windows\BEOHVVE.exe119⤵
- Executes dropped EXE
PID:5932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YCLWCEF.exe.bat" "120⤵PID:1768
-
C:\windows\system\YCLWCEF.exeC:\windows\system\YCLWCEF.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-