Analysis
- max time kernel
75s - max time network
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 15:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe
- Size 282KB
- Sample260705-tce34ahs2n
- SHA256 31d03df8fb4ee8f3642e6e39ed0ae0f62419fa01948854bfe640fb2ebc858d8f
- MD5 bf50946fb901fd9756e65ef97974588d
- SHA1 b20142c0acf88cdc815a0dcbe3f958eaa432303a
- SHA512 926709173c0b14a493a5857ab06b204f8494606f02cc940ca71541f2c9e159a643eb53b52cae4a33399517ae940bd723d658af9aed2d7021b8c00b889cad7d75
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOKkEjiPISUOgW9X+hOGzC/:RLWI09QZb6LOKkmZzcukG2/
- TLSH T122549F1776C28273D5A3037209DAC6E9B73ABC71573686C72794730D2B72EA5873A381
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 2248 NXANGA.exe 5976 FBKXP.exe 2656 YOE.exe 3788 ZRHRJPE.exe 3104 MCQQX.exe 2592 GUFBH.exe 5876 AIKKRAW.exe 1536 BLOG.exe 3688 VYTQH.exe 2444 FYVD.exe 4400 CZW.exe 2192 AXQAJX.exe 1992 PFRZQ.exe 2380 LPZ.exe 1560 UYBD.exe 5468 AYJRQV.exe 6060 POKQX.exe 5292 GZNY.exe 5428 BKDXUHZ.exe 5224 RAEWA.exe 1052 NXW.exe 2108 TTNMNT.exe 1680 VQBH.exe 2692 KLKLOWP.exe 3032 CUM.exe 4168 WHRZC.exe 1604 AXYH.exe 2764 TSCDTB.exe 4464 TVF.exe 2728 XDMHLKB.exe 1616 SYRQ.exe 5096 CWFLDSZ.exe 6132 BHHBLY.exe 5204 TKLW.exe 5572 DIRRGEF.exe 5264 HQFZ.exe 2576 XGG.exe 1532 PJKUE.exe 4196 EEU.exe 3932 VPK.exe 108 CFDRCU.exe 1108 AACA.exe 1752 PVMEAKU.exe 3432 PIMTBPX.exe 3468 ZGSNJ.exe 5812 ABWJ.exe 4572 NMEHCYC.exe 5944 FPQDQO.exe 5716 XPKITTG.exe 3112 MKBUE.exe 1568 HGGEOGD.exe 468 SYB.exe 1524 WGIXB.exe 4812 CCHXGJ.exe 5724 GKNFS.exe 5948 VNF.exe 4708 QACTN.exe 2564 QGCIPB.exe 3656 FBLU.exe 1360 WJNZL.exe 4276 RWSIVSC.exe 1240 VEZJ.exe 1500 ENBWL.exe 2776 GAGFNIP.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\SYB.exe HGGEOGD.exe File created C:\windows\SysWOW64\QIIKZG.exe.bat GAGFNIP.exe File created C:\windows\SysWOW64\LJZR.exe.bat VTY.exe File created C:\windows\SysWOW64\RCNPDGV.exe.bat LCFBUET.exe File created C:\windows\SysWOW64\XQVRV.exe NITM.exe File opened for modification C:\windows\SysWOW64\MGK.exe MLYCDP.exe File created C:\windows\SysWOW64\NXANGA.exe 2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe File created C:\windows\SysWOW64\FBKXP.exe NXANGA.exe File created C:\windows\SysWOW64\CWFLDSZ.exe.bat SYRQ.exe File created C:\windows\SysWOW64\QGCIPB.exe QACTN.exe File opened for modification C:\windows\SysWOW64\RCNPDGV.exe LCFBUET.exe File opened for modification C:\windows\SysWOW64\AACA.exe CFDRCU.exe File created C:\windows\SysWOW64\NMEHCYC.exe ABWJ.exe File opened for modification C:\windows\SysWOW64\POKQX.exe AYJRQV.exe File created C:\windows\SysWOW64\POKQX.exe.bat AYJRQV.exe File created C:\windows\SysWOW64\XGG.exe HQFZ.exe File created C:\windows\SysWOW64\AACA.exe CFDRCU.exe File created C:\windows\SysWOW64\FPQDQO.exe.bat NMEHCYC.exe File opened for modification C:\windows\SysWOW64\URWS.exe XLZV.exe File created C:\windows\SysWOW64\BKDXUHZ.exe GZNY.exe File created C:\windows\SysWOW64\KLKLOWP.exe VQBH.exe File opened for modification C:\windows\SysWOW64\PJKUE.exe XGG.exe File created C:\windows\SysWOW64\MGK.exe MLYCDP.exe File created C:\windows\SysWOW64\FPQDQO.exe NMEHCYC.exe File created C:\windows\SysWOW64\MGK.exe.bat MLYCDP.exe File created C:\windows\SysWOW64\KJDWTA.exe.bat TQNHLK.exe File created C:\windows\SysWOW64\POKQX.exe AYJRQV.exe File created C:\windows\SysWOW64\BKDXUHZ.exe.bat GZNY.exe File created C:\windows\SysWOW64\VQBH.exe.bat TTNMNT.exe File opened for modification C:\windows\SysWOW64\KLKLOWP.exe VQBH.exe File created C:\windows\SysWOW64\AXYH.exe.bat WHRZC.exe File opened for modification C:\windows\SysWOW64\CWFLDSZ.exe SYRQ.exe File created C:\windows\SysWOW64\DIRRGEF.exe.bat TKLW.exe File opened for modification C:\windows\SysWOW64\RWSIVSC.exe WJNZL.exe File created C:\windows\SysWOW64\TSCDTB.exe AXYH.exe File created C:\windows\SysWOW64\FBLU.exe QGCIPB.exe File created C:\windows\SysWOW64\VEZJ.exe RWSIVSC.exe File created C:\windows\SysWOW64\QIIKZG.exe GAGFNIP.exe File created C:\windows\SysWOW64\WCWJJPB.exe HHFXY.exe File created C:\windows\SysWOW64\NXANGA.exe.bat 2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\FBKXP.exe NXANGA.exe File created C:\windows\SysWOW64\DIRRGEF.exe TKLW.exe File opened for modification C:\windows\SysWOW64\MCQQX.exe ZRHRJPE.exe File created C:\windows\SysWOW64\TKLW.exe BHHBLY.exe File opened for modification C:\windows\SysWOW64\ZGSNJ.exe PIMTBPX.exe File created C:\windows\SysWOW64\SYB.exe HGGEOGD.exe File created C:\windows\SysWOW64\CCHXGJ.exe.bat WGIXB.exe File created C:\windows\SysWOW64\MFH.exe RSCXSF.exe File created C:\windows\SysWOW64\URWS.exe.bat XLZV.exe File opened for modification C:\windows\SysWOW64\KJDWTA.exe TQNHLK.exe File created C:\windows\SysWOW64\FYVD.exe.bat VYTQH.exe File opened for modification C:\windows\SysWOW64\BKDXUHZ.exe GZNY.exe File created C:\windows\SysWOW64\TSCDTB.exe.bat AXYH.exe File opened for modification C:\windows\SysWOW64\FPQDQO.exe NMEHCYC.exe File opened for modification C:\windows\SysWOW64\QGCIPB.exe QACTN.exe File created C:\windows\SysWOW64\QGCIPB.exe.bat QACTN.exe File opened for modification C:\windows\SysWOW64\LJZR.exe VTY.exe File created C:\windows\SysWOW64\MCQQX.exe ZRHRJPE.exe File created C:\windows\SysWOW64\MCQQX.exe.bat ZRHRJPE.exe File opened for modification C:\windows\SysWOW64\AXYH.exe WHRZC.exe File created C:\windows\SysWOW64\CWFLDSZ.exe SYRQ.exe File opened for modification C:\windows\SysWOW64\DIRRGEF.exe TKLW.exe File opened for modification C:\windows\SysWOW64\VEZJ.exe RWSIVSC.exe File opened for modification C:\windows\SysWOW64\XQVRV.exe NITM.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\ZRHRJPE.exe YOE.exe File created C:\windows\PFRZQ.exe AXQAJX.exe File created C:\windows\system\NXW.exe.bat RAEWA.exe File created C:\windows\system\CUM.exe.bat KLKLOWP.exe File opened for modification C:\windows\TVF.exe TSCDTB.exe File created C:\windows\system\XDMHLKB.exe.bat TVF.exe File created C:\windows\system\PVMEAKU.exe AACA.exe File created C:\windows\PIMTBPX.exe.bat PVMEAKU.exe File created C:\windows\system\RAEWA.exe.bat BKDXUHZ.exe File opened for modification C:\windows\system\BHHBLY.exe CWFLDSZ.exe File created C:\windows\XPKITTG.exe.bat FPQDQO.exe File opened for modification C:\windows\system\MKBUE.exe XPKITTG.exe File created C:\windows\QACTN.exe VNF.exe File opened for modification C:\windows\system\CCB.exe LCHSIMK.exe File opened for modification C:\windows\system\MLYCDP.exe TIUYYZD.exe File created C:\windows\system\MLYCDP.exe.bat TIUYYZD.exe File created C:\windows\GUFBH.exe MCQQX.exe File created C:\windows\CZW.exe.bat FYVD.exe File created C:\windows\system\LPZ.exe.bat PFRZQ.exe File opened for modification C:\windows\system\ENBWL.exe VEZJ.exe File opened for modification C:\windows\system\LCFBUET.exe CCDW.exe File created C:\windows\AIKKRAW.exe GUFBH.exe File created C:\windows\PFRZQ.exe.bat AXQAJX.exe File created C:\windows\system\LCHSIMK.exe LJZR.exe File created C:\windows\system\TPN.exe.bat BOLYDMR.exe File created C:\windows\TQNHLK.exe.bat KPLCH.exe File created C:\windows\AXQAJX.exe CZW.exe File created C:\windows\system\UYBD.exe LPZ.exe File created C:\windows\HQFZ.exe DIRRGEF.exe File created C:\windows\system\PVMEAKU.exe.bat AACA.exe File opened for modification C:\windows\VTY.exe ZNSCHC.exe File opened for modification C:\windows\system\RAEWA.exe BKDXUHZ.exe File created C:\windows\system\XDMHLKB.exe TVF.exe File created C:\windows\system\SYRQ.exe.bat XDMHLKB.exe File created C:\windows\HGGEOGD.exe MKBUE.exe File opened for modification C:\windows\system\GKNFS.exe CCHXGJ.exe File created C:\windows\system\CCB.exe LCHSIMK.exe File created C:\windows\BORZPEB.exe JLN.exe File created C:\windows\JMOWTZD.exe URWS.exe File opened for modification C:\windows\PFRZQ.exe AXQAJX.exe File created C:\windows\system\BOLYDMR.exe HBHHT.exe File created C:\windows\system\TPN.exe BOLYDMR.exe File created C:\windows\ASXISW.exe TPN.exe File created C:\windows\TQNHLK.exe KPLCH.exe File created C:\windows\TVF.exe TSCDTB.exe File created C:\windows\PIMTBPX.exe PVMEAKU.exe File created C:\windows\system\RSCXSF.exe CCB.exe File opened for modification C:\windows\JMOWTZD.exe URWS.exe File created C:\windows\YOE.exe.bat FBKXP.exe File opened for modification C:\windows\CZW.exe FYVD.exe File created C:\windows\AXQAJX.exe.bat CZW.exe File created C:\windows\TTNMNT.exe NXW.exe File opened for modification C:\windows\system\VNF.exe GKNFS.exe File opened for modification C:\windows\QACTN.exe VNF.exe File opened for modification C:\windows\JLN.exe MFH.exe File created C:\windows\CCDW.exe WBW.exe File opened for modification C:\windows\AIKKRAW.exe GUFBH.exe File created C:\windows\system\GKNFS.exe CCHXGJ.exe File opened for modification C:\windows\GAGFNIP.exe ENBWL.exe File opened for modification C:\windows\HHFXY.exe JMOWTZD.exe File created C:\windows\system\TIUYYZD.exe.bat WCWJJPB.exe File created C:\windows\AIKKRAW.exe.bat GUFBH.exe File created C:\windows\VYTQH.exe BLOG.exe File opened for modification C:\windows\VYTQH.exe BLOG.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 720 1056 WerFault.exe 87 4176 2248 WerFault.exe 92 4948 5976 WerFault.exe 98 4672 2656 WerFault.exe 103 2628 3788 WerFault.exe 108 2800 3104 WerFault.exe 113 2480 2592 WerFault.exe 118 4520 5876 WerFault.exe 123 2556 1536 WerFault.exe 128 2260 3688 WerFault.exe 133 2896 2444 WerFault.exe 138 2576 4400 WerFault.exe 143 5856 2192 WerFault.exe 148 1316 1992 WerFault.exe 153 3804 2380 WerFault.exe 158 1612 1560 WerFault.exe 163 5480 5468 WerFault.exe 168 5332 6060 WerFault.exe 173 5980 5292 WerFault.exe 178 5660 5428 WerFault.exe 183 3424 5224 WerFault.exe 188 1928 1052 WerFault.exe 193 5084 2108 WerFault.exe 198 2820 1680 WerFault.exe 203 964 2692 WerFault.exe 208 3232 3032 WerFault.exe 213 2184 4168 WerFault.exe 218 4180 1604 WerFault.exe 223 2648 2764 WerFault.exe 228 1088 4464 WerFault.exe 233 4112 2728 WerFault.exe 238 5948 1616 WerFault.exe 243 4380 5096 WerFault.exe 248 5044 6132 WerFault.exe 253 5272 5204 WerFault.exe 258 1352 5572 WerFault.exe 263 3656 5264 WerFault.exe 268 2744 2576 WerFault.exe 273 4888 1532 WerFault.exe 278 5880 4196 WerFault.exe 282 1696 3932 WerFault.exe 288 6116 108 WerFault.exe 293 4448 1108 WerFault.exe 298 2416 1752 WerFault.exe 303 1264 3432 WerFault.exe 308 5288 3468 WerFault.exe 313 5708 5812 WerFault.exe 318 2400 4572 WerFault.exe 323 4592 5944 WerFault.exe 328 5116 5716 WerFault.exe 333 4836 3112 WerFault.exe 338 5744 1568 WerFault.exe 343 3236 468 WerFault.exe 348 3044 1524 WerFault.exe 353 4472 4812 WerFault.exe 358 2456 5724 WerFault.exe 363 3332 5948 WerFault.exe 368 5520 4708 WerFault.exe 373 1624 2564 WerFault.exe 378 6036 3656 WerFault.exe 383 1136 1360 WerFault.exe 388 1464 4276 WerFault.exe 393 5648 1240 WerFault.exe 398 5100 1500 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GAGFNIP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MGK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBHHT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCHXGJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFRZQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKLW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJKUE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XLZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KPLCH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WGIXB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEZJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NMEHCYC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NXW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQBH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XDMHLKB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PVMEAKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RAEWA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BHHBLY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPKITTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NITM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASXISW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCHSIMK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLOG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QGCIPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language URWS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TTNMNT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SYRQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CWFLDSZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZGSNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CZW.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{F07BE91C-404D-4D81-BECE-2F9B8F924600} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{DDD7E7DC-7DE1-4B74-8F7A-02D66BE05B2B} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1056 2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe 1056 2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe 2248 NXANGA.exe 2248 NXANGA.exe 5976 FBKXP.exe 5976 FBKXP.exe 2656 YOE.exe 2656 YOE.exe 3788 ZRHRJPE.exe 3788 ZRHRJPE.exe 3104 MCQQX.exe 3104 MCQQX.exe 2592 GUFBH.exe 2592 GUFBH.exe 5876 AIKKRAW.exe 5876 AIKKRAW.exe 1536 BLOG.exe 1536 BLOG.exe 3688 VYTQH.exe 3688 VYTQH.exe 2444 FYVD.exe 2444 FYVD.exe 4400 CZW.exe 4400 CZW.exe 2192 AXQAJX.exe 2192 AXQAJX.exe 1992 PFRZQ.exe 1992 PFRZQ.exe 2380 LPZ.exe 2380 LPZ.exe 1560 UYBD.exe 1560 UYBD.exe 5468 AYJRQV.exe 5468 AYJRQV.exe 6060 POKQX.exe 6060 POKQX.exe 5292 GZNY.exe 5292 GZNY.exe 5428 BKDXUHZ.exe 5428 BKDXUHZ.exe 5224 RAEWA.exe 5224 RAEWA.exe 1052 NXW.exe 1052 NXW.exe 2108 TTNMNT.exe 2108 TTNMNT.exe 1680 VQBH.exe 1680 VQBH.exe 2692 KLKLOWP.exe 2692 KLKLOWP.exe 3032 CUM.exe 3032 CUM.exe 4168 WHRZC.exe 4168 WHRZC.exe 1604 AXYH.exe 1604 AXYH.exe 2764 TSCDTB.exe 2764 TSCDTB.exe 4464 TVF.exe 4464 TVF.exe 2728 XDMHLKB.exe 2728 XDMHLKB.exe 1616 SYRQ.exe 1616 SYRQ.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeShutdownPrivilege 3020 explorer.exe Token: SeCreatePagefilePrivilege 3020 explorer.exe Token: SeShutdownPrivilege 3020 explorer.exe Token: SeCreatePagefilePrivilege 3020 explorer.exe Token: SeShutdownPrivilege 3020 explorer.exe Token: SeCreatePagefilePrivilege 3020 explorer.exe Token: SeShutdownPrivilege 3020 explorer.exe Token: SeCreatePagefilePrivilege 3020 explorer.exe Token: SeShutdownPrivilege 3020 explorer.exe Token: SeCreatePagefilePrivilege 3020 explorer.exe Token: SeShutdownPrivilege 3020 explorer.exe Token: SeCreatePagefilePrivilege 3020 explorer.exe Token: SeShutdownPrivilege 3020 explorer.exe Token: SeCreatePagefilePrivilege 3020 explorer.exe - Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 3456 sihost.exe 3020 explorer.exe 3020 explorer.exe 3020 explorer.exe 3020 explorer.exe 3020 explorer.exe 3020 explorer.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3020 explorer.exe 3020 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1056 2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe 1056 2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe 2248 NXANGA.exe 2248 NXANGA.exe 5976 FBKXP.exe 5976 FBKXP.exe 2656 YOE.exe 2656 YOE.exe 3788 ZRHRJPE.exe 3788 ZRHRJPE.exe 3104 MCQQX.exe 3104 MCQQX.exe 2592 GUFBH.exe 2592 GUFBH.exe 5876 AIKKRAW.exe 5876 AIKKRAW.exe 1536 BLOG.exe 1536 BLOG.exe 3688 VYTQH.exe 3688 VYTQH.exe 2444 FYVD.exe 2444 FYVD.exe 4400 CZW.exe 4400 CZW.exe 2192 AXQAJX.exe 2192 AXQAJX.exe 1992 PFRZQ.exe 1992 PFRZQ.exe 2380 LPZ.exe 2380 LPZ.exe 1560 UYBD.exe 1560 UYBD.exe 5468 AYJRQV.exe 5468 AYJRQV.exe 6060 POKQX.exe 6060 POKQX.exe 5292 GZNY.exe 5292 GZNY.exe 5428 BKDXUHZ.exe 5428 BKDXUHZ.exe 5224 RAEWA.exe 5224 RAEWA.exe 1052 NXW.exe 1052 NXW.exe 2108 TTNMNT.exe 2108 TTNMNT.exe 1680 VQBH.exe 1680 VQBH.exe 2692 KLKLOWP.exe 2692 KLKLOWP.exe 3032 CUM.exe 3032 CUM.exe 4168 WHRZC.exe 4168 WHRZC.exe 1604 AXYH.exe 1604 AXYH.exe 2764 TSCDTB.exe 2764 TSCDTB.exe 4464 TVF.exe 4464 TVF.exe 2728 XDMHLKB.exe 2728 XDMHLKB.exe 1616 SYRQ.exe 1616 SYRQ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1056 wrote to memory of 1860 1056 2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe 88 PID 1860 wrote to memory of 2248 1860 cmd.exe 92 PID 2248 wrote to memory of 4852 2248 NXANGA.exe 94 PID 4852 wrote to memory of 5976 4852 cmd.exe 98 PID 5976 wrote to memory of 5376 5976 FBKXP.exe 99 PID 5376 wrote to memory of 2656 5376 cmd.exe 103 PID 2656 wrote to memory of 3796 2656 YOE.exe 104 PID 3796 wrote to memory of 3788 3796 cmd.exe 108 PID 3788 wrote to memory of 3584 3788 ZRHRJPE.exe 109 PID 3584 wrote to memory of 3104 3584 cmd.exe 113 PID 3104 wrote to memory of 120 3104 MCQQX.exe 114 PID 120 wrote to memory of 2592 120 cmd.exe 118 PID 2592 wrote to memory of 3272 2592 GUFBH.exe 119 PID 3272 wrote to memory of 5876 3272 cmd.exe 123 PID 5876 wrote to memory of 3712 5876 AIKKRAW.exe 124 PID 3712 wrote to memory of 1536 3712 cmd.exe 128 PID 1536 wrote to memory of 5828 1536 BLOG.exe 129 PID 5828 wrote to memory of 3688 5828 cmd.exe 133 PID 3688 wrote to memory of 5872 3688 VYTQH.exe 134 PID 5872 wrote to memory of 2444 5872 cmd.exe 138 PID 2444 wrote to memory of 5544 2444 FYVD.exe 139 PID 5544 wrote to memory of 4400 5544 cmd.exe 143 PID 4400 wrote to memory of 3632 4400 CZW.exe 144 PID 3632 wrote to memory of 2192 3632 cmd.exe 148 PID 2192 wrote to memory of 2396 2192 AXQAJX.exe 149 PID 2396 wrote to memory of 1992 2396 cmd.exe 153 PID 1992 wrote to memory of 2980 1992 PFRZQ.exe 154 PID 2980 wrote to memory of 2380 2980 cmd.exe 158 PID 2380 wrote to memory of 4804 2380 LPZ.exe 159 PID 4804 wrote to memory of 1560 4804 cmd.exe 163 PID 1560 wrote to memory of 3172 1560 UYBD.exe 164 PID 3172 wrote to memory of 5468 3172 cmd.exe 168 PID 5468 wrote to memory of 1968 5468 AYJRQV.exe 169 PID 1968 wrote to memory of 6060 1968 cmd.exe 173 PID 6060 wrote to memory of 6084 6060 POKQX.exe 174 PID 6084 wrote to memory of 5292 6084 cmd.exe 178 PID 5292 wrote to memory of 2780 5292 GZNY.exe 179 PID 2780 wrote to memory of 5428 2780 cmd.exe 183 PID 5428 wrote to memory of 3316 5428 BKDXUHZ.exe 184 PID 3316 wrote to memory of 5224 3316 cmd.exe 188 PID 5224 wrote to memory of 2160 5224 RAEWA.exe 189 PID 2160 wrote to memory of 1052 2160 cmd.exe 193 PID 1052 wrote to memory of 3620 1052 NXW.exe 194 PID 3620 wrote to memory of 2108 3620 cmd.exe 198 PID 2108 wrote to memory of 6012 2108 TTNMNT.exe 199 PID 6012 wrote to memory of 1680 6012 cmd.exe 203 PID 1680 wrote to memory of 988 1680 VQBH.exe 204 PID 988 wrote to memory of 2692 988 cmd.exe 208 PID 2692 wrote to memory of 2684 2692 KLKLOWP.exe 209 PID 2684 wrote to memory of 3032 2684 cmd.exe 213 PID 3032 wrote to memory of 724 3032 CUM.exe 214 PID 724 wrote to memory of 4168 724 cmd.exe 218 PID 4168 wrote to memory of 2452 4168 WHRZC.exe 219 PID 2452 wrote to memory of 1604 2452 cmd.exe 223 PID 1604 wrote to memory of 2708 1604 AXYH.exe 224 PID 2708 wrote to memory of 2764 2708 cmd.exe 228 PID 2764 wrote to memory of 5552 2764 TSCDTB.exe 229 PID 5552 wrote to memory of 4464 5552 cmd.exe 233 PID 4464 wrote to memory of 2572 4464 TVF.exe 234 PID 2572 wrote to memory of 2728 2572 cmd.exe 238 PID 2728 wrote to memory of 2328 2728 XDMHLKB.exe 239 PID 2328 wrote to memory of 1616 2328 cmd.exe 243 PID 1616 wrote to memory of 4460 1616 SYRQ.exe 244 PID 4460 wrote to memory of 5096 4460 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_bf50946fb901fd9756e65ef97974588d_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NXANGA.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\windows\SysWOW64\NXANGA.exeC:\windows\system32\NXANGA.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBKXP.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\windows\SysWOW64\FBKXP.exeC:\windows\system32\FBKXP.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YOE.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\windows\YOE.exeC:\windows\YOE.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRHRJPE.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\windows\ZRHRJPE.exeC:\windows\ZRHRJPE.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MCQQX.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\windows\SysWOW64\MCQQX.exeC:\windows\system32\MCQQX.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GUFBH.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:120 -
C:\windows\GUFBH.exeC:\windows\GUFBH.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AIKKRAW.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\windows\AIKKRAW.exeC:\windows\AIKKRAW.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BLOG.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\windows\BLOG.exeC:\windows\BLOG.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VYTQH.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\windows\VYTQH.exeC:\windows\VYTQH.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FYVD.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\windows\SysWOW64\FYVD.exeC:\windows\system32\FYVD.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CZW.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\windows\CZW.exeC:\windows\CZW.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AXQAJX.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\windows\AXQAJX.exeC:\windows\AXQAJX.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PFRZQ.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\windows\PFRZQ.exeC:\windows\PFRZQ.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPZ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\windows\system\LPZ.exeC:\windows\system\LPZ.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UYBD.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\system\UYBD.exeC:\windows\system\UYBD.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AYJRQV.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\windows\AYJRQV.exeC:\windows\AYJRQV.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\POKQX.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\windows\SysWOW64\POKQX.exeC:\windows\system32\POKQX.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6060 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZNY.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\windows\GZNY.exeC:\windows\GZNY.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BKDXUHZ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\windows\SysWOW64\BKDXUHZ.exeC:\windows\system32\BKDXUHZ.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RAEWA.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\windows\system\RAEWA.exeC:\windows\system\RAEWA.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NXW.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\windows\system\NXW.exeC:\windows\system\NXW.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TTNMNT.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\windows\TTNMNT.exeC:\windows\TTNMNT.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VQBH.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\windows\SysWOW64\VQBH.exeC:\windows\system32\VQBH.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLKLOWP.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\windows\SysWOW64\KLKLOWP.exeC:\windows\system32\KLKLOWP.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CUM.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\windows\system\CUM.exeC:\windows\system\CUM.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WHRZC.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:724 -
C:\windows\WHRZC.exeC:\windows\WHRZC.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AXYH.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\windows\SysWOW64\AXYH.exeC:\windows\system32\AXYH.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TSCDTB.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\windows\SysWOW64\TSCDTB.exeC:\windows\system32\TSCDTB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TVF.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\windows\TVF.exeC:\windows\TVF.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XDMHLKB.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\system\XDMHLKB.exeC:\windows\system\XDMHLKB.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SYRQ.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\windows\system\SYRQ.exeC:\windows\system\SYRQ.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CWFLDSZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\windows\SysWOW64\CWFLDSZ.exeC:\windows\system32\CWFLDSZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5096 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BHHBLY.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5180 -
C:\windows\system\BHHBLY.exeC:\windows\system\BHHBLY.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKLW.exe.bat" "68⤵PID:5816
-
C:\windows\SysWOW64\TKLW.exeC:\windows\system32\TKLW.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DIRRGEF.exe.bat" "70⤵PID:4064
-
C:\windows\SysWOW64\DIRRGEF.exeC:\windows\system32\DIRRGEF.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HQFZ.exe.bat" "72⤵PID:4532
-
C:\windows\HQFZ.exeC:\windows\HQFZ.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XGG.exe.bat" "74⤵
- System Location Discovery: System Language Discovery
PID:5656 -
C:\windows\SysWOW64\XGG.exeC:\windows\system32\XGG.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJKUE.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:5532 -
C:\windows\SysWOW64\PJKUE.exeC:\windows\system32\PJKUE.exe77⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EEU.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:2580 -
C:\windows\EEU.exeC:\windows\EEU.exe79⤵
- Executes dropped EXE
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VPK.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:6048 -
C:\windows\system\VPK.exeC:\windows\system\VPK.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CFDRCU.exe.bat" "82⤵PID:3904
-
C:\windows\CFDRCU.exeC:\windows\CFDRCU.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AACA.exe.bat" "84⤵PID:5240
-
C:\windows\SysWOW64\AACA.exeC:\windows\system32\AACA.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PVMEAKU.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:5332 -
C:\windows\system\PVMEAKU.exeC:\windows\system\PVMEAKU.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PIMTBPX.exe.bat" "88⤵PID:3880
-
C:\windows\PIMTBPX.exeC:\windows\PIMTBPX.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZGSNJ.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:3200 -
C:\windows\SysWOW64\ZGSNJ.exeC:\windows\system32\ZGSNJ.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ABWJ.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:5968 -
C:\windows\system\ABWJ.exeC:\windows\system\ABWJ.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NMEHCYC.exe.bat" "94⤵PID:4696
-
C:\windows\SysWOW64\NMEHCYC.exeC:\windows\system32\NMEHCYC.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPQDQO.exe.bat" "96⤵PID:3108
-
C:\windows\SysWOW64\FPQDQO.exeC:\windows\system32\FPQDQO.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XPKITTG.exe.bat" "98⤵PID:1792
-
C:\windows\XPKITTG.exeC:\windows\XPKITTG.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MKBUE.exe.bat" "100⤵PID:2488
-
C:\windows\system\MKBUE.exeC:\windows\system\MKBUE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HGGEOGD.exe.bat" "102⤵PID:4100
-
C:\windows\HGGEOGD.exeC:\windows\HGGEOGD.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SYB.exe.bat" "104⤵PID:5880
-
C:\windows\SysWOW64\SYB.exeC:\windows\system32\SYB.exe105⤵
- Executes dropped EXE
PID:468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WGIXB.exe.bat" "106⤵PID:4516
-
C:\windows\system\WGIXB.exeC:\windows\system\WGIXB.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CCHXGJ.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:3116 -
C:\windows\SysWOW64\CCHXGJ.exeC:\windows\system32\CCHXGJ.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKNFS.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:3612 -
C:\windows\system\GKNFS.exeC:\windows\system\GKNFS.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNF.exe.bat" "112⤵PID:4736
-
C:\windows\system\VNF.exeC:\windows\system\VNF.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QACTN.exe.bat" "114⤵PID:4396
-
C:\windows\QACTN.exeC:\windows\QACTN.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGCIPB.exe.bat" "116⤵PID:676
-
C:\windows\SysWOW64\QGCIPB.exeC:\windows\system32\QGCIPB.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBLU.exe.bat" "118⤵PID:1352
-
C:\windows\SysWOW64\FBLU.exeC:\windows\system32\FBLU.exe119⤵
- Executes dropped EXE
PID:3656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJNZL.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:2080 -
C:\windows\WJNZL.exeC:\windows\WJNZL.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-