Analysis
- max time kernel
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 22:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe
- Size 208KB
- Sample260702-2s2wssf15y
- SHA256 6ac30ca2ada77ca9be362c846492a354ac7dfec5c81b25da9ac60d1479ca17db
- MD5 4e758577d3f68fcf098255117e782a6f
- SHA1 2bc0f27e188225faebdf60bb5af9effdf05132c2
- SHA512 018f896b5e1e9ea5d81fe62ac6d23defd27b8139946b10f5d785f31881af0b7a813205630252eefce0bb72b92a0476a3524ac6556b695e16625ae157b68e1edf
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfG4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOeQEjK
- TLSH T14A247D2235D2C073E4B7023188F6C7787BB6BD919B36928B7BC03B4D6E315A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4556 CZB.exe 3904 QUZWSEY.exe 2920 ASFI.exe 2284 LGMOF.exe 2324 MJQKKMF.exe 3332 QRWSXW.exe 820 FUGW.exe 2872 LHFXM.exe 988 AKO.exe 1072 TFAFL.exe 3196 TIEJ.exe 1776 XQKJDF.exe 4892 HYMOGKT.exe 592 HCQSLA.exe 4212 CPV.exe 2968 PAESKD.exe 2896 PFEGLQH.exe 1980 IYLRDQX.exe 6120 YOURJ.exe 936 LYD.exe 3888 APEHWCW.exe 1496 VCI.exe 1508 QPNIR.exe 5612 LAW.exe 3676 EDZCL.exe 3652 NDB.exe 5000 RJUWEDB.exe 2412 BRW.exe 5864 VEBLS.exe 2004 FCGF.exe 3792 ENJ.exe 4416 RYZUWA.exe 6128 QICCF.exe 2220 WJK.exe 5416 FJMD.exe 4884 QCPVA.exe 1728 RFTRFLB.exe 4284 KIWVTB.exe 5560 QIE.exe 2524 KVJSM.exe 3648 FGR.exe 564 ATWSC.exe 6108 REUQK.exe 4948 ASXISW.exe 2652 BNJMF.exe 5312 TQNHLK.exe 2080 LYP.exe 4704 ATYZHC.exe 6136 CRELO.exe 3464 EEIDZLF.exe 5540 OEK.exe 5036 XNMNGGJ.exe 4412 CSFCW.exe 2996 NLAVEQ.exe 5044 HYE.exe 3244 RGGJ.exe 1588 GBQODIT.exe 2572 LCAYHE.exe 2768 UCCDS.exe 5928 ADJRB.exe 3980 JDD.exe 4172 WOUUTM.exe 4076 IGXNBBS.exe 2128 OGWBK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\RFTRFLB.exe QCPVA.exe File created C:\windows\SysWOW64\REUQK.exe ATWSC.exe File created C:\windows\SysWOW64\LCAYHE.exe GBQODIT.exe File created C:\windows\SysWOW64\KBQNORU.exe EBIZF.exe File created C:\windows\SysWOW64\YNROJ.exe GKN.exe File opened for modification C:\windows\SysWOW64\TMEDDD.exe ZZZM.exe File created C:\windows\SysWOW64\SMX.exe.bat TBUZOL.exe File created C:\windows\SysWOW64\QCAQMIA.exe MUL.exe File opened for modification C:\windows\SysWOW64\FUGW.exe QRWSXW.exe File created C:\windows\SysWOW64\VEBLS.exe BRW.exe File opened for modification C:\windows\SysWOW64\OGWBK.exe IGXNBBS.exe File created C:\windows\SysWOW64\GLP.exe DYKEMY.exe File created C:\windows\SysWOW64\YNJXNHW.exe VFCX.exe File created C:\windows\SysWOW64\YNJXNHW.exe.bat VFCX.exe File created C:\windows\SysWOW64\OSDEE.exe SMX.exe File created C:\windows\SysWOW64\FFNWUYN.exe OSDEE.exe File created C:\windows\SysWOW64\ASFI.exe QUZWSEY.exe File opened for modification C:\windows\SysWOW64\MJQKKMF.exe LGMOF.exe File opened for modification C:\windows\SysWOW64\NHZJOJ.exe YMI.exe File opened for modification C:\windows\SysWOW64\YNJXNHW.exe VFCX.exe File created C:\windows\SysWOW64\WQGUHAZ.exe CDBCXB.exe File created C:\windows\SysWOW64\IJW.exe CJO.exe File created C:\windows\SysWOW64\RNLTPZ.exe WZGC.exe File created C:\windows\SysWOW64\XQKJDF.exe.bat TIEJ.exe File created C:\windows\SysWOW64\CSFCW.exe XNMNGGJ.exe File created C:\windows\SysWOW64\SMX.exe TBUZOL.exe File opened for modification C:\windows\SysWOW64\ASFI.exe QUZWSEY.exe File created C:\windows\SysWOW64\MJQKKMF.exe.bat LGMOF.exe File created C:\windows\SysWOW64\TMEDDD.exe.bat ZZZM.exe File opened for modification C:\windows\SysWOW64\TBUZOL.exe RDOFHDA.exe File created C:\windows\SysWOW64\RFTRFLB.exe QCPVA.exe File created C:\windows\SysWOW64\FGR.exe.bat KVJSM.exe File opened for modification C:\windows\SysWOW64\ATYZHC.exe LYP.exe File created C:\windows\SysWOW64\JDD.exe.bat ADJRB.exe File created C:\windows\SysWOW64\JEYL.exe.bat KTVVI.exe File created C:\windows\SysWOW64\BRW.exe RJUWEDB.exe File opened for modification C:\windows\SysWOW64\QICCF.exe RYZUWA.exe File opened for modification C:\windows\SysWOW64\MQDOM.exe MLLAL.exe File opened for modification C:\windows\SysWOW64\YNN.exe MFGCZQ.exe File opened for modification C:\windows\SysWOW64\CZV.exe MJUX.exe File created C:\windows\SysWOW64\BOXT.exe PGQLDI.exe File opened for modification C:\windows\SysWOW64\FGR.exe KVJSM.exe File created C:\windows\SysWOW64\FGR.exe KVJSM.exe File created C:\windows\SysWOW64\ATYZHC.exe.bat LYP.exe File created C:\windows\SysWOW64\UCCDS.exe LCAYHE.exe File created C:\windows\SysWOW64\OSDEE.exe.bat SMX.exe File created C:\windows\SysWOW64\ASFI.exe.bat QUZWSEY.exe File opened for modification C:\windows\SysWOW64\XQKJDF.exe TIEJ.exe File opened for modification C:\windows\SysWOW64\VEBLS.exe BRW.exe File created C:\windows\SysWOW64\REUQK.exe.bat ATWSC.exe File created C:\windows\SysWOW64\OGWBK.exe.bat IGXNBBS.exe File opened for modification C:\windows\SysWOW64\WQGUHAZ.exe CDBCXB.exe File opened for modification C:\windows\SysWOW64\WFAIC.exe BJV.exe File created C:\windows\SysWOW64\FYNT.exe BQGTLJI.exe File opened for modification C:\windows\SysWOW64\GLP.exe DYKEMY.exe File created C:\windows\SysWOW64\FFNWUYN.exe.bat OSDEE.exe File opened for modification C:\windows\SysWOW64\IJW.exe CJO.exe File created C:\windows\SysWOW64\FUGW.exe QRWSXW.exe File created C:\windows\SysWOW64\QIE.exe KIWVTB.exe File created C:\windows\SysWOW64\KGE.exe.bat YNJXNHW.exe File opened for modification C:\windows\SysWOW64\SMX.exe TBUZOL.exe File opened for modification C:\windows\SysWOW64\BOXT.exe PGQLDI.exe File opened for modification C:\windows\SysWOW64\LCAYHE.exe GBQODIT.exe File created C:\windows\SysWOW64\LCAYHE.exe.bat GBQODIT.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\PAESKD.exe CPV.exe File opened for modification C:\windows\system\YMI.exe NUNLVP.exe File created C:\windows\system\EBIZF.exe KGE.exe File created C:\windows\KUYEC.exe ZBDL.exe File opened for modification C:\windows\system\AKO.exe LHFXM.exe File opened for modification C:\windows\PAESKD.exe CPV.exe File opened for modification C:\windows\system\WJK.exe QICCF.exe File created C:\windows\IGXNBBS.exe.bat WOUUTM.exe File created C:\windows\system\LYHC.exe FXZPFT.exe File created C:\windows\system\ELYXH.exe.bat KXU.exe File created C:\windows\system\TIEJ.exe TFAFL.exe File created C:\windows\BNJMF.exe ASXISW.exe File opened for modification C:\windows\GBQODIT.exe RGGJ.exe File created C:\windows\system\OWQZ.exe OEIYXOG.exe File created C:\windows\system\QPP.exe.bat KBQNORU.exe File opened for modification C:\windows\system\GNN.exe PFLAIS.exe File opened for modification C:\windows\system\BQGTLJI.exe HXDAKC.exe File created C:\windows\TQNHLK.exe.bat BNJMF.exe File created C:\windows\IGXNBBS.exe WOUUTM.exe File opened for modification C:\windows\system\EBIZF.exe KGE.exe File opened for modification C:\windows\system\WDOOU.exe QCH.exe File created C:\windows\system\UECT.exe.bat OEVFSL.exe File opened for modification C:\windows\PFEGLQH.exe PAESKD.exe File opened for modification C:\windows\system\NUNLVP.exe JEYL.exe File created C:\windows\ZPTKLH.exe OWQZ.exe File created C:\windows\system\DXA.exe.bat ZPTKLH.exe File created C:\windows\XKZAEG.exe QPP.exe File created C:\windows\UCNSG.exe QUGSTE.exe File created C:\windows\system\GNN.exe.bat PFLAIS.exe File opened for modification C:\windows\system\OSHCM.exe UECT.exe File created C:\windows\system\IYLRDQX.exe PFEGLQH.exe File opened for modification C:\windows\XNMNGGJ.exe OEK.exe File created C:\windows\JCFV.exe TMEDDD.exe File created C:\windows\OEVFSL.exe IJW.exe File created C:\windows\HCQSLA.exe HYMOGKT.exe File created C:\windows\system\IYLRDQX.exe.bat PFEGLQH.exe File created C:\windows\KIWVTB.exe.bat RFTRFLB.exe File created C:\windows\RLWL.exe.bat WAOU.exe File created C:\windows\DBYD.exe QQIMFJ.exe File opened for modification C:\windows\system\QCPVA.exe FJMD.exe File created C:\windows\system\NLAVEQ.exe CSFCW.exe File opened for modification C:\windows\system\RDOFHDA.exe JYOQFQ.exe File created C:\windows\GLGMNWB.exe LYBCC.exe File created C:\windows\system\BQGTLJI.exe.bat HXDAKC.exe File created C:\windows\system\NUNLVP.exe.bat JEYL.exe File created C:\windows\system\YMI.exe NUNLVP.exe File created C:\windows\QDO.exe.bat ELYXH.exe File created C:\windows\HYE.exe.bat NLAVEQ.exe File created C:\windows\system\CDBCXB.exe YNN.exe File opened for modification C:\windows\MJUX.exe QDO.exe File created C:\windows\NDB.exe.bat EDZCL.exe File opened for modification C:\windows\FJMD.exe WJK.exe File created C:\windows\system\MLLAL.exe WQTOAOO.exe File opened for modification C:\windows\system\EOVSV.exe GNN.exe File created C:\windows\ZPTKLH.exe.bat OWQZ.exe File created C:\windows\system\DXA.exe ZPTKLH.exe File opened for modification C:\windows\system\CDBCXB.exe YNN.exe File opened for modification C:\windows\OEVFSL.exe IJW.exe File created C:\windows\system\BJV.exe CZV.exe File opened for modification C:\windows\HYMOGKT.exe XQKJDF.exe File created C:\windows\EEIDZLF.exe.bat CRELO.exe File created C:\windows\system\NLAVEQ.exe.bat CSFCW.exe File created C:\windows\XKZAEG.exe.bat QPP.exe File created C:\windows\system\MCAQX.exe.bat DBYD.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 5480 1472 WerFault.exe 87 5824 4556 WerFault.exe 92 4532 3904 WerFault.exe 98 5448 2920 WerFault.exe 103 4076 2284 WerFault.exe 108 6108 2324 WerFault.exe 113 2912 3332 WerFault.exe 118 5048 820 WerFault.exe 123 2300 2872 WerFault.exe 128 2220 988 WerFault.exe 133 5092 1072 WerFault.exe 138 2020 3196 WerFault.exe 143 4584 1776 WerFault.exe 148 2436 4892 WerFault.exe 153 2492 592 WerFault.exe 158 2064 4212 WerFault.exe 163 6040 2968 WerFault.exe 168 2276 2896 WerFault.exe 173 3544 1980 WerFault.exe 178 3664 6120 WerFault.exe 183 4984 936 WerFault.exe 188 1772 3888 WerFault.exe 193 5848 1496 WerFault.exe 198 3024 1508 WerFault.exe 203 3944 5612 WerFault.exe 208 1092 3676 WerFault.exe 213 5824 3652 WerFault.exe 218 2824 5000 WerFault.exe 223 1048 2412 WerFault.exe 228 6032 5864 WerFault.exe 233 3952 2004 WerFault.exe 238 1624 3792 WerFault.exe 243 2652 4416 WerFault.exe 248 6072 6128 WerFault.exe 253 5784 2220 WerFault.exe 258 6084 5416 WerFault.exe 263 4328 4884 WerFault.exe 268 5668 1728 WerFault.exe 273 672 4284 WerFault.exe 278 356 5560 WerFault.exe 283 2568 2524 WerFault.exe 288 2276 3648 WerFault.exe 293 1640 564 WerFault.exe 298 2000 6108 WerFault.exe 303 2280 4948 WerFault.exe 308 5160 2652 WerFault.exe 313 5784 5312 WerFault.exe 318 5924 2080 WerFault.exe 323 2544 4704 WerFault.exe 328 2288 6136 WerFault.exe 333 5780 3464 WerFault.exe 338 1236 5540 WerFault.exe 343 5788 5036 WerFault.exe 348 4124 4412 WerFault.exe 353 3760 2996 WerFault.exe 358 4824 5044 WerFault.exe 363 5160 3244 WerFault.exe 368 2376 1588 WerFault.exe 373 2052 2572 WerFault.exe 378 1796 2768 WerFault.exe 383 4572 5928 WerFault.exe 388 5496 3980 WerFault.exe 393 2712 4172 WerFault.exe 398 4228 4076 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MJUX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHFXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYOQFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TQNHLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FYNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WQTOAOO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGQLDI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WFAIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CRELO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NLAVEQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLGMNWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOURJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEIYXOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UCNSG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDBCXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JFEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QXGMCRV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NDB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VFCX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBYD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JEYL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFNWUYN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TBUZOL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YNROJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUYEC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBQODIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KTVVI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1472 2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe 1472 2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe 4556 CZB.exe 4556 CZB.exe 3904 QUZWSEY.exe 3904 QUZWSEY.exe 2920 ASFI.exe 2920 ASFI.exe 2284 LGMOF.exe 2284 LGMOF.exe 2324 MJQKKMF.exe 2324 MJQKKMF.exe 3332 QRWSXW.exe 3332 QRWSXW.exe 820 FUGW.exe 820 FUGW.exe 2872 LHFXM.exe 2872 LHFXM.exe 988 AKO.exe 988 AKO.exe 1072 TFAFL.exe 1072 TFAFL.exe 3196 TIEJ.exe 3196 TIEJ.exe 1776 XQKJDF.exe 1776 XQKJDF.exe 4892 HYMOGKT.exe 4892 HYMOGKT.exe 592 HCQSLA.exe 592 HCQSLA.exe 4212 CPV.exe 4212 CPV.exe 2968 PAESKD.exe 2968 PAESKD.exe 2896 PFEGLQH.exe 2896 PFEGLQH.exe 1980 IYLRDQX.exe 1980 IYLRDQX.exe 6120 YOURJ.exe 6120 YOURJ.exe 936 LYD.exe 936 LYD.exe 3888 APEHWCW.exe 3888 APEHWCW.exe 1496 VCI.exe 1496 VCI.exe 1508 QPNIR.exe 1508 QPNIR.exe 5612 LAW.exe 5612 LAW.exe 3676 EDZCL.exe 3676 EDZCL.exe 3652 NDB.exe 3652 NDB.exe 5000 RJUWEDB.exe 5000 RJUWEDB.exe 2412 BRW.exe 2412 BRW.exe 5864 VEBLS.exe 5864 VEBLS.exe 2004 FCGF.exe 2004 FCGF.exe 3792 ENJ.exe 3792 ENJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1472 2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe 1472 2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe 4556 CZB.exe 4556 CZB.exe 3904 QUZWSEY.exe 3904 QUZWSEY.exe 2920 ASFI.exe 2920 ASFI.exe 2284 LGMOF.exe 2284 LGMOF.exe 2324 MJQKKMF.exe 2324 MJQKKMF.exe 3332 QRWSXW.exe 3332 QRWSXW.exe 820 FUGW.exe 820 FUGW.exe 2872 LHFXM.exe 2872 LHFXM.exe 988 AKO.exe 988 AKO.exe 1072 TFAFL.exe 1072 TFAFL.exe 3196 TIEJ.exe 3196 TIEJ.exe 1776 XQKJDF.exe 1776 XQKJDF.exe 4892 HYMOGKT.exe 4892 HYMOGKT.exe 592 HCQSLA.exe 592 HCQSLA.exe 4212 CPV.exe 4212 CPV.exe 2968 PAESKD.exe 2968 PAESKD.exe 2896 PFEGLQH.exe 2896 PFEGLQH.exe 1980 IYLRDQX.exe 1980 IYLRDQX.exe 6120 YOURJ.exe 6120 YOURJ.exe 936 LYD.exe 936 LYD.exe 3888 APEHWCW.exe 3888 APEHWCW.exe 1496 VCI.exe 1496 VCI.exe 1508 QPNIR.exe 1508 QPNIR.exe 5612 LAW.exe 5612 LAW.exe 3676 EDZCL.exe 3676 EDZCL.exe 3652 NDB.exe 3652 NDB.exe 5000 RJUWEDB.exe 5000 RJUWEDB.exe 2412 BRW.exe 2412 BRW.exe 5864 VEBLS.exe 5864 VEBLS.exe 2004 FCGF.exe 2004 FCGF.exe 3792 ENJ.exe 3792 ENJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1472 wrote to memory of 5492 1472 2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe 88 PID 5492 wrote to memory of 4556 5492 cmd.exe 92 PID 4556 wrote to memory of 2116 4556 CZB.exe 94 PID 2116 wrote to memory of 3904 2116 cmd.exe 98 PID 3904 wrote to memory of 940 3904 QUZWSEY.exe 99 PID 940 wrote to memory of 2920 940 cmd.exe 103 PID 2920 wrote to memory of 2668 2920 ASFI.exe 104 PID 2668 wrote to memory of 2284 2668 cmd.exe 108 PID 2284 wrote to memory of 4220 2284 LGMOF.exe 109 PID 4220 wrote to memory of 2324 4220 cmd.exe 113 PID 2324 wrote to memory of 4836 2324 MJQKKMF.exe 114 PID 4836 wrote to memory of 3332 4836 cmd.exe 118 PID 3332 wrote to memory of 1312 3332 QRWSXW.exe 119 PID 1312 wrote to memory of 820 1312 cmd.exe 123 PID 820 wrote to memory of 5356 820 FUGW.exe 124 PID 5356 wrote to memory of 2872 5356 cmd.exe 128 PID 2872 wrote to memory of 5712 2872 LHFXM.exe 129 PID 5712 wrote to memory of 988 5712 cmd.exe 133 PID 988 wrote to memory of 1000 988 AKO.exe 134 PID 1000 wrote to memory of 1072 1000 cmd.exe 138 PID 1072 wrote to memory of 1364 1072 TFAFL.exe 139 PID 1364 wrote to memory of 3196 1364 cmd.exe 143 PID 3196 wrote to memory of 5644 3196 TIEJ.exe 144 PID 5644 wrote to memory of 1776 5644 cmd.exe 148 PID 1776 wrote to memory of 4472 1776 XQKJDF.exe 149 PID 4472 wrote to memory of 4892 4472 cmd.exe 153 PID 4892 wrote to memory of 2148 4892 HYMOGKT.exe 154 PID 2148 wrote to memory of 592 2148 cmd.exe 158 PID 592 wrote to memory of 3816 592 HCQSLA.exe 159 PID 3816 wrote to memory of 4212 3816 cmd.exe 163 PID 4212 wrote to memory of 1200 4212 CPV.exe 164 PID 1200 wrote to memory of 2968 1200 cmd.exe 168 PID 2968 wrote to memory of 1944 2968 PAESKD.exe 169 PID 1944 wrote to memory of 2896 1944 cmd.exe 173 PID 2896 wrote to memory of 4304 2896 PFEGLQH.exe 174 PID 4304 wrote to memory of 1980 4304 cmd.exe 178 PID 1980 wrote to memory of 5364 1980 IYLRDQX.exe 179 PID 5364 wrote to memory of 6120 5364 cmd.exe 183 PID 6120 wrote to memory of 3260 6120 YOURJ.exe 184 PID 3260 wrote to memory of 936 3260 cmd.exe 188 PID 936 wrote to memory of 1652 936 LYD.exe 189 PID 1652 wrote to memory of 3888 1652 cmd.exe 193 PID 3888 wrote to memory of 3208 3888 APEHWCW.exe 194 PID 3208 wrote to memory of 1496 3208 cmd.exe 198 PID 1496 wrote to memory of 5336 1496 VCI.exe 199 PID 5336 wrote to memory of 1508 5336 cmd.exe 203 PID 1508 wrote to memory of 4084 1508 QPNIR.exe 204 PID 4084 wrote to memory of 5612 4084 cmd.exe 208 PID 5612 wrote to memory of 5832 5612 LAW.exe 209 PID 5832 wrote to memory of 3676 5832 cmd.exe 213 PID 3676 wrote to memory of 5480 3676 EDZCL.exe 214 PID 5480 wrote to memory of 3652 5480 cmd.exe 218 PID 3652 wrote to memory of 5236 3652 NDB.exe 219 PID 5236 wrote to memory of 5000 5236 cmd.exe 223 PID 5000 wrote to memory of 5476 5000 RJUWEDB.exe 224 PID 5476 wrote to memory of 2412 5476 cmd.exe 228 PID 2412 wrote to memory of 2024 2412 BRW.exe 229 PID 2024 wrote to memory of 5864 2024 cmd.exe 233 PID 5864 wrote to memory of 5844 5864 VEBLS.exe 234 PID 5844 wrote to memory of 2004 5844 cmd.exe 238 PID 2004 wrote to memory of 2924 2004 FCGF.exe 239 PID 2924 wrote to memory of 3792 2924 cmd.exe 243 PID 3792 wrote to memory of 4772 3792 ENJ.exe 244 PID 4772 wrote to memory of 4416 4772 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_4e758577d3f68fcf098255117e782a6f_elex_emotet_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CZB.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\windows\system\CZB.exeC:\windows\system\CZB.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUZWSEY.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\windows\QUZWSEY.exeC:\windows\QUZWSEY.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ASFI.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\windows\SysWOW64\ASFI.exeC:\windows\system32\ASFI.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LGMOF.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\windows\system\LGMOF.exeC:\windows\system\LGMOF.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJQKKMF.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\windows\SysWOW64\MJQKKMF.exeC:\windows\system32\MJQKKMF.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QRWSXW.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\windows\QRWSXW.exeC:\windows\QRWSXW.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FUGW.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\windows\SysWOW64\FUGW.exeC:\windows\system32\FUGW.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHFXM.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\windows\system\LHFXM.exeC:\windows\system\LHFXM.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AKO.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\windows\system\AKO.exeC:\windows\system\AKO.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TFAFL.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\windows\system\TFAFL.exeC:\windows\system\TFAFL.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TIEJ.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\windows\system\TIEJ.exeC:\windows\system\TIEJ.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XQKJDF.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\SysWOW64\XQKJDF.exeC:\windows\system32\XQKJDF.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYMOGKT.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\windows\HYMOGKT.exeC:\windows\HYMOGKT.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HCQSLA.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\HCQSLA.exeC:\windows\HCQSLA.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPV.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\windows\system\CPV.exeC:\windows\system\CPV.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PAESKD.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\windows\PAESKD.exeC:\windows\PAESKD.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFEGLQH.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\windows\PFEGLQH.exeC:\windows\PFEGLQH.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IYLRDQX.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\windows\system\IYLRDQX.exeC:\windows\system\IYLRDQX.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOURJ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\windows\system\YOURJ.exeC:\windows\system\YOURJ.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LYD.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\windows\system\LYD.exeC:\windows\system\LYD.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\APEHWCW.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\windows\system\APEHWCW.exeC:\windows\system\APEHWCW.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VCI.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\windows\system\VCI.exeC:\windows\system\VCI.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPNIR.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\windows\QPNIR.exeC:\windows\QPNIR.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LAW.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\windows\SysWOW64\LAW.exeC:\windows\system32\LAW.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDZCL.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\windows\EDZCL.exeC:\windows\EDZCL.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDB.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\windows\NDB.exeC:\windows\NDB.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJUWEDB.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\windows\RJUWEDB.exeC:\windows\RJUWEDB.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BRW.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\windows\SysWOW64\BRW.exeC:\windows\system32\BRW.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VEBLS.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\windows\SysWOW64\VEBLS.exeC:\windows\system32\VEBLS.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCGF.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\windows\system\FCGF.exeC:\windows\system\FCGF.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ENJ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\windows\ENJ.exeC:\windows\ENJ.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RYZUWA.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\windows\system\RYZUWA.exeC:\windows\system\RYZUWA.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QICCF.exe.bat" "66⤵PID:6064
-
C:\windows\SysWOW64\QICCF.exeC:\windows\system32\QICCF.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WJK.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:5976 -
C:\windows\system\WJK.exeC:\windows\system\WJK.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FJMD.exe.bat" "70⤵PID:904
-
C:\windows\FJMD.exeC:\windows\FJMD.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QCPVA.exe.bat" "72⤵PID:2100
-
C:\windows\system\QCPVA.exeC:\windows\system\QCPVA.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFTRFLB.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:3024 -
C:\windows\SysWOW64\RFTRFLB.exeC:\windows\system32\RFTRFLB.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KIWVTB.exe.bat" "76⤵PID:2604
-
C:\windows\KIWVTB.exeC:\windows\KIWVTB.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIE.exe.bat" "78⤵PID:2932
-
C:\windows\SysWOW64\QIE.exeC:\windows\system32\QIE.exe79⤵
- Executes dropped EXE
PID:5560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KVJSM.exe.bat" "80⤵PID:2464
-
C:\windows\KVJSM.exeC:\windows\KVJSM.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FGR.exe.bat" "82⤵PID:3032
-
C:\windows\SysWOW64\FGR.exeC:\windows\system32\FGR.exe83⤵
- Executes dropped EXE
PID:3648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATWSC.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1952 -
C:\windows\ATWSC.exeC:\windows\ATWSC.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\REUQK.exe.bat" "86⤵PID:4512
-
C:\windows\SysWOW64\REUQK.exeC:\windows\system32\REUQK.exe87⤵
- Executes dropped EXE
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ASXISW.exe.bat" "88⤵PID:852
-
C:\windows\ASXISW.exeC:\windows\ASXISW.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BNJMF.exe.bat" "90⤵PID:5796
-
C:\windows\BNJMF.exeC:\windows\BNJMF.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TQNHLK.exe.bat" "92⤵PID:6100
-
C:\windows\TQNHLK.exeC:\windows\TQNHLK.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LYP.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:1904 -
C:\windows\LYP.exeC:\windows\LYP.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATYZHC.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:5252 -
C:\windows\SysWOW64\ATYZHC.exeC:\windows\system32\ATYZHC.exe97⤵
- Executes dropped EXE
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CRELO.exe.bat" "98⤵PID:3108
-
C:\windows\CRELO.exeC:\windows\CRELO.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEIDZLF.exe.bat" "100⤵PID:3808
-
C:\windows\EEIDZLF.exeC:\windows\EEIDZLF.exe101⤵
- Executes dropped EXE
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OEK.exe.bat" "102⤵PID:4996
-
C:\windows\SysWOW64\OEK.exeC:\windows\system32\OEK.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XNMNGGJ.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:4116 -
C:\windows\XNMNGGJ.exeC:\windows\XNMNGGJ.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CSFCW.exe.bat" "106⤵PID:6040
-
C:\windows\SysWOW64\CSFCW.exeC:\windows\system32\CSFCW.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NLAVEQ.exe.bat" "108⤵PID:5700
-
C:\windows\system\NLAVEQ.exeC:\windows\system\NLAVEQ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYE.exe.bat" "110⤵PID:2364
-
C:\windows\HYE.exeC:\windows\HYE.exe111⤵
- Executes dropped EXE
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGGJ.exe.bat" "112⤵PID:1416
-
C:\windows\system\RGGJ.exeC:\windows\system\RGGJ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:2800 -
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCAYHE.exe.bat" "116⤵PID:3088
-
C:\windows\SysWOW64\LCAYHE.exeC:\windows\system32\LCAYHE.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UCCDS.exe.bat" "118⤵PID:704
-
C:\windows\SysWOW64\UCCDS.exeC:\windows\system32\UCCDS.exe119⤵
- Executes dropped EXE
PID:2768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADJRB.exe.bat" "120⤵PID:3264
-
C:\windows\ADJRB.exeC:\windows\ADJRB.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-