Analysis
- max time kernel
83s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe
- Size 448KB
- Sample260701-ec89lsfx3x
- SHA256 aa6e557fd3b3f35c020df9c4419f0ba059eb4246da37c8d998bc7eef4a100e4e
- MD5 91eebf5082602b99df6d9faadc6a016d
- SHA1 5b94f23432dba974a459df18dcf7773caafaec70
- SHA512 198f1235d1d0d4f28a5bfa1e4541b2aaefc61645a303f579521530cd7eb11c7350753d3c5ba21bda9d84f8ebffaf712e956af2dc9d60201ed9b43d9c5d4312c5
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOMkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOMkmZzcukG2/
- TLSH T1F9A49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6056 HSBQU.exe 3596 VARX.exe 5520 ODVAKN.exe 3648 HWCLBO.exe 944 REEQFLJ.exe 1552 VJX.exe 1488 VPX.exe 3912 WSBQC.exe 1352 QFFZMJE.exe 4072 EQOYBUS.exe 1908 YDTH.exe 3544 GJX.exe 2120 YRZTZ.exe 2748 SFEKJX.exe 3240 WVLK.exe 2004 RIPUYI.exe 2612 RLTX.exe 1728 KGFTRV.exe 1464 FTK.exe 616 ZPHMD.exe 4268 UCLVNVH.exe 5860 EAZQVD.exe 2916 NABVGBR.exe 2140 ZQIDS.exe 2096 FQPRBNP.exe 4316 JYWRO.exe 3416 URZJON.exe 2512 TKCZX.exe 5592 LFGDCRQ.exe 4424 MIJZPH.exe 6060 KIRNZJ.exe 3140 UGXHG.exe 1860 TRHX.exe 2308 TUYLD.exe 4480 LPEDLZ.exe 4728 TCIKO.exe 708 GNZ.exe 5836 NYORUH.exe 3888 YLNPZJL.exe 1532 IJBJ.exe 1924 SHGD.exe 5796 PIQ.exe 1244 CKYEOH.exe 5476 WDOPXI.exe 3748 OGSLD.exe 5688 YEXFSGZ.exe 3948 XOAVBM.exe 6016 SKF.exe 2008 HAGEKHZ.exe 2384 SSVPBIH.exe 252 EACP.exe 6108 SGCBPEE.exe 5100 MTHK.exe 4900 BOYWLRC.exe 5804 AZBFTF.exe 2944 CXHZ.exe 4988 DAK.exe 3716 SQLU.exe 5756 DJBF.exe 6012 EMF.exe 2644 PEIBKWW.exe 720 TMOBWP.exe 5616 QSUZDR.exe 4168 ZAWEPWW.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\VJX.exe REEQFLJ.exe File created C:\windows\SysWOW64\NABVGBR.exe EAZQVD.exe File opened for modification C:\windows\SysWOW64\JYWRO.exe FQPRBNP.exe File opened for modification C:\windows\SysWOW64\TKCZX.exe URZJON.exe File created C:\windows\SysWOW64\LPEDLZ.exe TUYLD.exe File opened for modification C:\windows\SysWOW64\EMF.exe DJBF.exe File created C:\windows\SysWOW64\GAU.exe.bat RFKWQ.exe File created C:\windows\SysWOW64\FZJWDX.exe.bat TRC.exe File created C:\windows\SysWOW64\VJX.exe.bat REEQFLJ.exe File opened for modification C:\windows\SysWOW64\SFEKJX.exe YRZTZ.exe File created C:\windows\SysWOW64\JYWRO.exe.bat FQPRBNP.exe File opened for modification C:\windows\SysWOW64\KIRNZJ.exe MIJZPH.exe File created C:\windows\SysWOW64\YEXFSGZ.exe OGSLD.exe File opened for modification C:\windows\SysWOW64\HHWT.exe NUSJDBG.exe File opened for modification C:\windows\SysWOW64\HUDX.exe DMWPRA.exe File created C:\windows\SysWOW64\YNNVUUH.exe CQIGNK.exe File opened for modification C:\windows\SysWOW64\KGFTRV.exe RLTX.exe File created C:\windows\SysWOW64\BNHEXE.exe OCZNJU.exe File created C:\windows\SysWOW64\YNNVUUH.exe.bat CQIGNK.exe File opened for modification C:\windows\SysWOW64\FZJWDX.exe TRC.exe File created C:\windows\SysWOW64\JYWRO.exe FQPRBNP.exe File created C:\windows\SysWOW64\TCIKO.exe LPEDLZ.exe File opened for modification C:\windows\SysWOW64\SHGD.exe IJBJ.exe File created C:\windows\SysWOW64\EMF.exe DJBF.exe File created C:\windows\SysWOW64\MROOX.exe.bat BYLV.exe File created C:\windows\SysWOW64\RQYYQ.exe.bat HHWT.exe File created C:\windows\SysWOW64\HUDX.exe DMWPRA.exe File created C:\windows\SysWOW64\VPX.exe VJX.exe File created C:\windows\SysWOW64\RIPUYI.exe WVLK.exe File created C:\windows\SysWOW64\UCLVNVH.exe ZPHMD.exe File created C:\windows\SysWOW64\MIJZPH.exe.bat LFGDCRQ.exe File created C:\windows\SysWOW64\XOAVBM.exe YEXFSGZ.exe File created C:\windows\SysWOW64\SSVPBIH.exe.bat HAGEKHZ.exe File opened for modification C:\windows\SysWOW64\MTHK.exe SGCBPEE.exe File created C:\windows\SysWOW64\EMF.exe.bat DJBF.exe File opened for modification C:\windows\SysWOW64\NABVGBR.exe EAZQVD.exe File opened for modification C:\windows\SysWOW64\DJBF.exe SQLU.exe File opened for modification C:\windows\SysWOW64\BNHEXE.exe OCZNJU.exe File created C:\windows\SysWOW64\BNHEXE.exe.bat OCZNJU.exe File opened for modification C:\windows\SysWOW64\MROOX.exe BYLV.exe File created C:\windows\SysWOW64\NVWVFIZ.exe RQYYQ.exe File opened for modification C:\windows\SysWOW64\YNNVUUH.exe CQIGNK.exe File created C:\windows\SysWOW64\GAU.exe RFKWQ.exe File opened for modification C:\windows\SysWOW64\REEQFLJ.exe HWCLBO.exe File created C:\windows\SysWOW64\REEQFLJ.exe.bat HWCLBO.exe File opened for modification C:\windows\SysWOW64\VJX.exe REEQFLJ.exe File created C:\windows\SysWOW64\AJMEO.exe CYCOFA.exe File opened for modification C:\windows\SysWOW64\GAU.exe RFKWQ.exe File opened for modification C:\windows\SysWOW64\RIPUYI.exe WVLK.exe File created C:\windows\SysWOW64\KGFTRV.exe.bat RLTX.exe File opened for modification C:\windows\SysWOW64\YEXFSGZ.exe OGSLD.exe File created C:\windows\SysWOW64\DJBF.exe SQLU.exe File opened for modification C:\windows\SysWOW64\NJOA.exe FVO.exe File created C:\windows\SysWOW64\TJSN.exe YNNVUUH.exe File opened for modification C:\windows\SysWOW64\HWCLBO.exe ODVAKN.exe File created C:\windows\SysWOW64\REEQFLJ.exe HWCLBO.exe File created C:\windows\SysWOW64\UCLVNVH.exe.bat ZPHMD.exe File opened for modification C:\windows\SysWOW64\SSVPBIH.exe HAGEKHZ.exe File created C:\windows\SysWOW64\HHWT.exe NUSJDBG.exe File created C:\windows\SysWOW64\TJSN.exe.bat YNNVUUH.exe File opened for modification C:\windows\SysWOW64\ZKWU.exe MEWIKJ.exe File created C:\windows\SysWOW64\GNHLIN.exe.bat OFFYFQP.exe File created C:\windows\SysWOW64\TKCZX.exe URZJON.exe File created C:\windows\SysWOW64\SHGD.exe.bat IJBJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\system\OFFYFQP.exe ZKWU.exe File opened for modification C:\windows\system\QFFZMJE.exe WSBQC.exe File created C:\windows\YDTH.exe EQOYBUS.exe File opened for modification C:\windows\NYORUH.exe GNZ.exe File created C:\windows\system\SKF.exe XOAVBM.exe File opened for modification C:\windows\system\SQLU.exe DAK.exe File opened for modification C:\windows\ZAWEPWW.exe QSUZDR.exe File created C:\windows\DZKSXYE.exe.bat TBEXQ.exe File opened for modification C:\windows\FTK.exe KGFTRV.exe File created C:\windows\system\PIQ.exe.bat SHGD.exe File created C:\windows\system\SGCBPEE.exe EACP.exe File opened for modification C:\windows\DAK.exe CXHZ.exe File created C:\windows\system\SQLU.exe.bat DAK.exe File opened for modification C:\windows\system\QSUZDR.exe TMOBWP.exe File created C:\windows\system\MEWIKJ.exe TJSN.exe File created C:\windows\EWTJG.exe.bat GAU.exe File created C:\windows\system\QFFZMJE.exe.bat WSBQC.exe File opened for modification C:\windows\EQOYBUS.exe QFFZMJE.exe File opened for modification C:\windows\WDOPXI.exe CKYEOH.exe File created C:\windows\HAGEKHZ.exe.bat SKF.exe File opened for modification C:\windows\system\EACP.exe SSVPBIH.exe File created C:\windows\system\EACP.exe.bat SSVPBIH.exe File opened for modification C:\windows\system\CYCOFA.exe FAERY.exe File created C:\windows\system\CYCOFA.exe.bat FAERY.exe File created C:\windows\FTK.exe KGFTRV.exe File opened for modification C:\windows\LFGDCRQ.exe TKCZX.exe File opened for modification C:\windows\UGXHG.exe KIRNZJ.exe File opened for modification C:\windows\system\TRHX.exe UGXHG.exe File opened for modification C:\windows\CXHZ.exe AZBFTF.exe File opened for modification C:\windows\system\IWTKVC.exe NJOA.exe File opened for modification C:\windows\system\WPSBIWJ.exe QPKOZ.exe File opened for modification C:\windows\DZKSXYE.exe TBEXQ.exe File created C:\windows\UGXHG.exe KIRNZJ.exe File created C:\windows\EQOYBUS.exe.bat QFFZMJE.exe File opened for modification C:\windows\YDTH.exe EQOYBUS.exe File opened for modification C:\windows\system\ZPHMD.exe FTK.exe File opened for modification C:\windows\system\GNZ.exe TCIKO.exe File opened for modification C:\windows\CKYEOH.exe PIQ.exe File created C:\windows\OCZNJU.exe.bat OZVK.exe File created C:\windows\system\NUSJDBG.exe.bat MROOX.exe File opened for modification C:\windows\system\VARX.exe HSBQU.exe File created C:\windows\WSBQC.exe.bat VPX.exe File created C:\windows\system\YRZTZ.exe GJX.exe File created C:\windows\system\TRHX.exe UGXHG.exe File opened for modification C:\windows\AZBFTF.exe BOYWLRC.exe File opened for modification C:\windows\system\FAERY.exe ZAWEPWW.exe File created C:\windows\FVO.exe BNHEXE.exe File created C:\windows\VHBI.exe.bat IWTKVC.exe File created C:\windows\CKYEOH.exe PIQ.exe File created C:\windows\system\OGSLD.exe.bat WDOPXI.exe File created C:\windows\BOYWLRC.exe.bat MTHK.exe File created C:\windows\system\OZVK.exe CHS.exe File opened for modification C:\windows\ZPI.exe VHBI.exe File created C:\windows\ZPI.exe.bat VHBI.exe File created C:\windows\system\CDZEA.exe RLWL.exe File created C:\windows\LDBJEJ.exe.bat CDZEA.exe File created C:\windows\WSBQC.exe VPX.exe File created C:\windows\system\FQPRBNP.exe.bat ZQIDS.exe File created C:\windows\system\TUYLD.exe TRHX.exe File opened for modification C:\windows\OCZNJU.exe OZVK.exe File opened for modification C:\windows\FVO.exe BNHEXE.exe File opened for modification C:\windows\system\BYLV.exe LDBJEJ.exe File created C:\windows\IJBE.exe NVWVFIZ.exe File created C:\windows\system\BZRFO.exe DZKSXYE.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 3384 2056 WerFault.exe 87 3240 6056 WerFault.exe 92 5588 3596 WerFault.exe 98 768 5520 WerFault.exe 103 260 3648 WerFault.exe 108 3132 944 WerFault.exe 113 5396 1552 WerFault.exe 118 5796 1488 WerFault.exe 123 2376 3912 WerFault.exe 128 5388 1352 WerFault.exe 133 4292 4072 WerFault.exe 138 5800 1908 WerFault.exe 143 1348 3544 WerFault.exe 148 2328 2120 WerFault.exe 153 4696 2748 WerFault.exe 158 4592 3240 WerFault.exe 163 1876 2004 WerFault.exe 168 2320 2612 WerFault.exe 173 4428 1728 WerFault.exe 178 1184 1464 WerFault.exe 183 5840 616 WerFault.exe 187 1368 4268 WerFault.exe 193 3704 5860 WerFault.exe 198 1696 2916 WerFault.exe 203 4472 2140 WerFault.exe 208 708 2096 WerFault.exe 213 2148 4316 WerFault.exe 218 2388 3416 WerFault.exe 223 6084 2512 WerFault.exe 228 3192 5592 WerFault.exe 233 5396 4424 WerFault.exe 238 5300 6060 WerFault.exe 243 4100 3140 WerFault.exe 248 2836 1860 WerFault.exe 253 4896 2308 WerFault.exe 258 3376 4480 WerFault.exe 263 5936 4728 WerFault.exe 268 940 708 WerFault.exe 274 4536 5836 WerFault.exe 279 4508 3888 WerFault.exe 284 2820 1532 WerFault.exe 289 544 1924 WerFault.exe 294 2184 5796 WerFault.exe 299 1420 1244 WerFault.exe 304 5264 5476 WerFault.exe 309 1652 3748 WerFault.exe 314 5572 5688 WerFault.exe 319 1148 3948 WerFault.exe 324 1832 6016 WerFault.exe 329 4468 2008 WerFault.exe 334 4276 2384 WerFault.exe 339 2212 252 WerFault.exe 344 3012 6108 WerFault.exe 349 5680 5100 WerFault.exe 354 5496 4900 WerFault.exe 359 5108 5804 WerFault.exe 364 3400 2944 WerFault.exe 369 5488 4988 WerFault.exe 374 5740 3716 WerFault.exe 379 1768 5756 WerFault.exe 384 1236 6012 WerFault.exe 389 1756 2644 WerFault.exe 394 5968 720 WerFault.exe 399 3528 5616 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJOA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QFFZMJE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YDTH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WDOPXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SKF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNHEXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GNZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CKYEOH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IWTKVC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HSBQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SQLU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OCZNJU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPSBIWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPEDLZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSVPBIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBEXQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRZTZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ODVAKN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WSBQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGSLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFKWQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGCBPEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VARX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKCZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TCIKO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFEKJX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RLTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHBI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FTK.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2056 2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe 2056 2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe 6056 HSBQU.exe 6056 HSBQU.exe 3596 VARX.exe 3596 VARX.exe 5520 ODVAKN.exe 5520 ODVAKN.exe 3648 HWCLBO.exe 3648 HWCLBO.exe 944 REEQFLJ.exe 944 REEQFLJ.exe 1552 VJX.exe 1552 VJX.exe 1488 VPX.exe 1488 VPX.exe 3912 WSBQC.exe 3912 WSBQC.exe 1352 QFFZMJE.exe 1352 QFFZMJE.exe 4072 EQOYBUS.exe 4072 EQOYBUS.exe 1908 YDTH.exe 1908 YDTH.exe 3544 GJX.exe 3544 GJX.exe 2120 YRZTZ.exe 2120 YRZTZ.exe 2748 SFEKJX.exe 2748 SFEKJX.exe 3240 WVLK.exe 3240 WVLK.exe 2004 RIPUYI.exe 2004 RIPUYI.exe 2612 RLTX.exe 2612 RLTX.exe 1728 KGFTRV.exe 1728 KGFTRV.exe 1464 FTK.exe 1464 FTK.exe 616 ZPHMD.exe 616 ZPHMD.exe 4268 UCLVNVH.exe 4268 UCLVNVH.exe 5860 EAZQVD.exe 5860 EAZQVD.exe 2916 NABVGBR.exe 2916 NABVGBR.exe 2140 ZQIDS.exe 2140 ZQIDS.exe 2096 FQPRBNP.exe 2096 FQPRBNP.exe 4316 JYWRO.exe 4316 JYWRO.exe 3416 URZJON.exe 3416 URZJON.exe 2512 TKCZX.exe 2512 TKCZX.exe 5592 LFGDCRQ.exe 5592 LFGDCRQ.exe 4424 MIJZPH.exe 4424 MIJZPH.exe 6060 KIRNZJ.exe 6060 KIRNZJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2056 2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe 2056 2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe 6056 HSBQU.exe 6056 HSBQU.exe 3596 VARX.exe 3596 VARX.exe 5520 ODVAKN.exe 5520 ODVAKN.exe 3648 HWCLBO.exe 3648 HWCLBO.exe 944 REEQFLJ.exe 944 REEQFLJ.exe 1552 VJX.exe 1552 VJX.exe 1488 VPX.exe 1488 VPX.exe 3912 WSBQC.exe 3912 WSBQC.exe 1352 QFFZMJE.exe 1352 QFFZMJE.exe 4072 EQOYBUS.exe 4072 EQOYBUS.exe 1908 YDTH.exe 1908 YDTH.exe 3544 GJX.exe 3544 GJX.exe 2120 YRZTZ.exe 2120 YRZTZ.exe 2748 SFEKJX.exe 2748 SFEKJX.exe 3240 WVLK.exe 3240 WVLK.exe 2004 RIPUYI.exe 2004 RIPUYI.exe 2612 RLTX.exe 2612 RLTX.exe 1728 KGFTRV.exe 1728 KGFTRV.exe 1464 FTK.exe 1464 FTK.exe 616 ZPHMD.exe 616 ZPHMD.exe 4268 UCLVNVH.exe 4268 UCLVNVH.exe 5860 EAZQVD.exe 5860 EAZQVD.exe 2916 NABVGBR.exe 2916 NABVGBR.exe 2140 ZQIDS.exe 2140 ZQIDS.exe 2096 FQPRBNP.exe 2096 FQPRBNP.exe 4316 JYWRO.exe 4316 JYWRO.exe 3416 URZJON.exe 3416 URZJON.exe 2512 TKCZX.exe 2512 TKCZX.exe 5592 LFGDCRQ.exe 5592 LFGDCRQ.exe 4424 MIJZPH.exe 4424 MIJZPH.exe 6060 KIRNZJ.exe 6060 KIRNZJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2524 2056 2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe 88 PID 2524 wrote to memory of 6056 2524 cmd.exe 92 PID 6056 wrote to memory of 1780 6056 HSBQU.exe 94 PID 1780 wrote to memory of 3596 1780 cmd.exe 98 PID 3596 wrote to memory of 5508 3596 VARX.exe 99 PID 5508 wrote to memory of 5520 5508 cmd.exe 103 PID 5520 wrote to memory of 3764 5520 ODVAKN.exe 104 PID 3764 wrote to memory of 3648 3764 cmd.exe 108 PID 3648 wrote to memory of 5960 3648 HWCLBO.exe 109 PID 5960 wrote to memory of 944 5960 cmd.exe 113 PID 944 wrote to memory of 5696 944 REEQFLJ.exe 114 PID 5696 wrote to memory of 1552 5696 cmd.exe 118 PID 1552 wrote to memory of 4996 1552 VJX.exe 119 PID 4996 wrote to memory of 1488 4996 cmd.exe 123 PID 1488 wrote to memory of 3396 1488 VPX.exe 124 PID 3396 wrote to memory of 3912 3396 cmd.exe 128 PID 3912 wrote to memory of 5044 3912 WSBQC.exe 129 PID 5044 wrote to memory of 1352 5044 cmd.exe 133 PID 1352 wrote to memory of 4848 1352 QFFZMJE.exe 134 PID 4848 wrote to memory of 4072 4848 cmd.exe 138 PID 4072 wrote to memory of 1484 4072 EQOYBUS.exe 139 PID 1484 wrote to memory of 1908 1484 cmd.exe 143 PID 1908 wrote to memory of 2484 1908 YDTH.exe 144 PID 2484 wrote to memory of 3544 2484 cmd.exe 148 PID 3544 wrote to memory of 424 3544 GJX.exe 149 PID 424 wrote to memory of 2120 424 cmd.exe 153 PID 2120 wrote to memory of 3268 2120 YRZTZ.exe 154 PID 3268 wrote to memory of 2748 3268 cmd.exe 158 PID 2748 wrote to memory of 5372 2748 SFEKJX.exe 159 PID 5372 wrote to memory of 3240 5372 cmd.exe 163 PID 3240 wrote to memory of 2604 3240 WVLK.exe 164 PID 2604 wrote to memory of 2004 2604 cmd.exe 168 PID 2004 wrote to memory of 2500 2004 RIPUYI.exe 169 PID 2500 wrote to memory of 2612 2500 cmd.exe 173 PID 2612 wrote to memory of 2632 2612 RLTX.exe 174 PID 2632 wrote to memory of 1728 2632 cmd.exe 178 PID 1728 wrote to memory of 2592 1728 KGFTRV.exe 179 PID 2592 wrote to memory of 1464 2592 cmd.exe 183 PID 1464 wrote to memory of 4228 1464 FTK.exe 184 PID 4228 wrote to memory of 616 4228 cmd.exe 187 PID 616 wrote to memory of 4064 616 ZPHMD.exe 189 PID 4064 wrote to memory of 4268 4064 cmd.exe 193 PID 4268 wrote to memory of 2376 4268 UCLVNVH.exe 194 PID 2376 wrote to memory of 5860 2376 cmd.exe 198 PID 5860 wrote to memory of 2776 5860 EAZQVD.exe 199 PID 2776 wrote to memory of 2916 2776 cmd.exe 203 PID 2916 wrote to memory of 5168 2916 NABVGBR.exe 204 PID 5168 wrote to memory of 2140 5168 cmd.exe 208 PID 2140 wrote to memory of 4992 2140 ZQIDS.exe 209 PID 4992 wrote to memory of 2096 4992 cmd.exe 213 PID 2096 wrote to memory of 5148 2096 FQPRBNP.exe 214 PID 5148 wrote to memory of 4316 5148 cmd.exe 218 PID 4316 wrote to memory of 2576 4316 JYWRO.exe 219 PID 2576 wrote to memory of 3416 2576 cmd.exe 223 PID 3416 wrote to memory of 5516 3416 URZJON.exe 224 PID 5516 wrote to memory of 2512 5516 cmd.exe 228 PID 2512 wrote to memory of 5028 2512 TKCZX.exe 229 PID 5028 wrote to memory of 5592 5028 cmd.exe 233 PID 5592 wrote to memory of 3204 5592 LFGDCRQ.exe 234 PID 3204 wrote to memory of 4424 3204 cmd.exe 238 PID 4424 wrote to memory of 4892 4424 MIJZPH.exe 239 PID 4892 wrote to memory of 6060 4892 cmd.exe 243 PID 6060 wrote to memory of 5912 6060 KIRNZJ.exe 244 PID 5912 wrote to memory of 3140 5912 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_91eebf5082602b99df6d9faadc6a016d_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HSBQU.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\windows\HSBQU.exeC:\windows\HSBQU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VARX.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\windows\system\VARX.exeC:\windows\system\VARX.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWCLBO.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\windows\SysWOW64\HWCLBO.exeC:\windows\system32\HWCLBO.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\REEQFLJ.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\SysWOW64\REEQFLJ.exeC:\windows\system32\REEQFLJ.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VJX.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\windows\SysWOW64\VJX.exeC:\windows\system32\VJX.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPX.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\windows\SysWOW64\VPX.exeC:\windows\system32\VPX.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WSBQC.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\windows\WSBQC.exeC:\windows\WSBQC.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFFZMJE.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\system\QFFZMJE.exeC:\windows\system\QFFZMJE.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EQOYBUS.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\windows\EQOYBUS.exeC:\windows\EQOYBUS.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YDTH.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\YDTH.exeC:\windows\YDTH.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GJX.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\windows\GJX.exeC:\windows\GJX.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YRZTZ.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:424 -
C:\windows\system\YRZTZ.exeC:\windows\system\YRZTZ.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SFEKJX.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\windows\SysWOW64\SFEKJX.exeC:\windows\system32\SFEKJX.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVLK.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\windows\system\WVLK.exeC:\windows\system\WVLK.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIPUYI.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\windows\SysWOW64\RIPUYI.exeC:\windows\system32\RIPUYI.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RLTX.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\system\RLTX.exeC:\windows\system\RLTX.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KGFTRV.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\SysWOW64\KGFTRV.exeC:\windows\system32\KGFTRV.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTK.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\windows\FTK.exeC:\windows\FTK.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZPHMD.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\system\ZPHMD.exeC:\windows\system\ZPHMD.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCLVNVH.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\windows\SysWOW64\UCLVNVH.exeC:\windows\system32\UCLVNVH.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EAZQVD.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\windows\EAZQVD.exeC:\windows\EAZQVD.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NABVGBR.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\windows\SysWOW64\NABVGBR.exeC:\windows\system32\NABVGBR.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZQIDS.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\windows\ZQIDS.exeC:\windows\ZQIDS.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FQPRBNP.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\windows\system\FQPRBNP.exeC:\windows\system\FQPRBNP.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYWRO.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\windows\SysWOW64\JYWRO.exeC:\windows\system32\JYWRO.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\URZJON.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\windows\system\URZJON.exeC:\windows\system\URZJON.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKCZX.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\windows\SysWOW64\TKCZX.exeC:\windows\system32\TKCZX.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFGDCRQ.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\windows\LFGDCRQ.exeC:\windows\LFGDCRQ.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MIJZPH.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\windows\SysWOW64\MIJZPH.exeC:\windows\system32\MIJZPH.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KIRNZJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\windows\SysWOW64\KIRNZJ.exeC:\windows\system32\KIRNZJ.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UGXHG.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\windows\UGXHG.exeC:\windows\UGXHG.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TRHX.exe.bat" "66⤵PID:2968
-
C:\windows\system\TRHX.exeC:\windows\system\TRHX.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TUYLD.exe.bat" "68⤵PID:4484
-
C:\windows\system\TUYLD.exeC:\windows\system\TUYLD.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LPEDLZ.exe.bat" "70⤵PID:3224
-
C:\windows\SysWOW64\LPEDLZ.exeC:\windows\system32\LPEDLZ.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TCIKO.exe.bat" "72⤵PID:2816
-
C:\windows\SysWOW64\TCIKO.exeC:\windows\system32\TCIKO.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GNZ.exe.bat" "74⤵PID:4972
-
C:\windows\system\GNZ.exeC:\windows\system\GNZ.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NYORUH.exe.bat" "76⤵PID:5764
-
C:\windows\NYORUH.exeC:\windows\NYORUH.exe77⤵
- Executes dropped EXE
PID:5836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YLNPZJL.exe.bat" "78⤵PID:5952
-
C:\windows\YLNPZJL.exeC:\windows\YLNPZJL.exe79⤵
- Executes dropped EXE
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJBJ.exe.bat" "80⤵PID:1088
-
C:\windows\system\IJBJ.exeC:\windows\system\IJBJ.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHGD.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5948 -
C:\windows\SysWOW64\SHGD.exeC:\windows\system32\SHGD.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PIQ.exe.bat" "84⤵PID:4392
-
C:\windows\system\PIQ.exeC:\windows\system\PIQ.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CKYEOH.exe.bat" "86⤵PID:2372
-
C:\windows\CKYEOH.exeC:\windows\CKYEOH.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDOPXI.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1476 -
C:\windows\WDOPXI.exeC:\windows\WDOPXI.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OGSLD.exe.bat" "90⤵PID:2884
-
C:\windows\system\OGSLD.exeC:\windows\system\OGSLD.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YEXFSGZ.exe.bat" "92⤵PID:5820
-
C:\windows\SysWOW64\YEXFSGZ.exeC:\windows\system32\YEXFSGZ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOAVBM.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1404 -
C:\windows\SysWOW64\XOAVBM.exeC:\windows\system32\XOAVBM.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKF.exe.bat" "96⤵PID:1904
-
C:\windows\system\SKF.exeC:\windows\system\SKF.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HAGEKHZ.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3436 -
C:\windows\HAGEKHZ.exeC:\windows\HAGEKHZ.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSVPBIH.exe.bat" "100⤵PID:768
-
C:\windows\SysWOW64\SSVPBIH.exeC:\windows\system32\SSVPBIH.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EACP.exe.bat" "102⤵PID:1856
-
C:\windows\system\EACP.exeC:\windows\system\EACP.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SGCBPEE.exe.bat" "104⤵PID:4932
-
C:\windows\system\SGCBPEE.exeC:\windows\system\SGCBPEE.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MTHK.exe.bat" "106⤵PID:3004
-
C:\windows\SysWOW64\MTHK.exeC:\windows\system32\MTHK.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOYWLRC.exe.bat" "108⤵PID:3048
-
C:\windows\BOYWLRC.exeC:\windows\BOYWLRC.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AZBFTF.exe.bat" "110⤵PID:2492
-
C:\windows\AZBFTF.exeC:\windows\AZBFTF.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CXHZ.exe.bat" "112⤵PID:4612
-
C:\windows\CXHZ.exeC:\windows\CXHZ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DAK.exe.bat" "114⤵PID:1808
-
C:\windows\DAK.exeC:\windows\DAK.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQLU.exe.bat" "116⤵PID:5600
-
C:\windows\system\SQLU.exeC:\windows\system\SQLU.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DJBF.exe.bat" "118⤵PID:3112
-
C:\windows\SysWOW64\DJBF.exeC:\windows\system32\DJBF.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EMF.exe.bat" "120⤵PID:6084
-
C:\windows\SysWOW64\EMF.exeC:\windows\system32\EMF.exe121⤵
- Executes dropped EXE
PID:6012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-