Analysis
- max time kernel
104s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe
- Size 448KB
- Sample260706-ss397acz2l
- SHA256 d8129e509df08abf016fe1835b478ccd643bcb5985096b95fb96766358988926
- MD5 2ad6bb9f89b706583337f780926d1338
- SHA1 9355e9817af37299939b58e91b69ea0ee2ea0c16
- SHA512 b7c5dc3ace57d8e024ff9e6b9ce59f3cde8f49c73b6178416b10266c46b8ea2270df71506043b9ebd85ac2c7103ff60b6012895258b4cc9b23183cec85bb632c
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LOKkEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LOKkmZzcukG2/
- TLSH T148A49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6960 MUEIG.exe 4380 RIWQXJB.exe 3816 JQKNKAD.exe 6788 WWSZML.exe 5748 EBXGX.exe 1272 OZC.exe 2444 WEPH.exe 6540 VXSXXX.exe 1952 QVMA.exe 4228 STS.exe 3112 AGF.exe 5840 OJNAPM.exe 2332 CEZTUIL.exe 4468 RUAS.exe 1936 OAKI.exe 5784 BGS.exe 5872 ETJV.exe 3040 WWNZSM.exe 2804 QKMXXN.exe 5540 AHZREW.exe 6544 UVJT.exe 616 KLS.exe 6364 ZGBWQX.exe 4948 FBA.exe 6812 JJHFGL.exe 1900 WUPW.exe 52 KAPHXHO.exe 3476 FCGGLKJ.exe 6860 DYF.exe 3516 NVLBXVH.exe 4996 RDRBJ.exe 6408 ZREQ.exe 6692 JPJCBVA.exe 1548 LMPXJD.exe 3736 VKDRQL.exe 2532 VNG.exe 4736 OIKQJ.exe 3892 SYRQ.exe 2940 HOSQC.exe 6888 PUFWM.exe 1388 TKLW.exe 3764 SVOMZC.exe 1716 HQFZ.exe 2252 CDKIVO.exe 3880 TLEN.exe 4204 XTTNKMG.exe 1848 SHQF.exe 5628 KKBAA.exe 2328 WAI.exe 2808 UNHJRP.exe 3340 ELN.exe 6312 GJS.exe 1248 SZHYS.exe 3436 LULU.exe 5704 LXPXLM.exe 4872 GKU.exe 4236 FDWXESB.exe 6656 HBCJLA.exe 6872 CDSI.exe 2448 KRXO.exe 2108 BCI.exe 6220 QSJE.exe 4536 LFONCL.exe 708 VDTHJ.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\RIWQXJB.exe MUEIG.exe File created C:\windows\SysWOW64\RUAS.exe CEZTUIL.exe File opened for modification C:\windows\SysWOW64\JKZ.exe OWUBACA.exe File created C:\windows\SysWOW64\RIWQXJB.exe.bat MUEIG.exe File created C:\windows\SysWOW64\DYF.exe FCGGLKJ.exe File created C:\windows\SysWOW64\SZHYS.exe GJS.exe File created C:\windows\SysWOW64\SZHYS.exe.bat GJS.exe File created C:\windows\SysWOW64\YEDRND.exe.bat JJU.exe File opened for modification C:\windows\SysWOW64\FSRTQM.exe WSX.exe File created C:\windows\SysWOW64\WBAGHQA.exe STUGV.exe File created C:\windows\SysWOW64\JPJCBVA.exe.bat ZREQ.exe File created C:\windows\SysWOW64\SVOMZC.exe.bat TKLW.exe File created C:\windows\SysWOW64\WAI.exe.bat KKBAA.exe File opened for modification C:\windows\SysWOW64\VDTHJ.exe LFONCL.exe File created C:\windows\SysWOW64\OXFK.exe.bat TNWLWB.exe File created C:\windows\SysWOW64\QDNMGB.exe HVLHC.exe File opened for modification C:\windows\SysWOW64\DYF.exe FCGGLKJ.exe File created C:\windows\SysWOW64\NOL.exe.bat KXFL.exe File opened for modification C:\windows\SysWOW64\GJS.exe ELN.exe File opened for modification C:\windows\SysWOW64\WUPW.exe JJHFGL.exe File created C:\windows\SysWOW64\OIKQJ.exe VNG.exe File created C:\windows\SysWOW64\OIKQJ.exe.bat VNG.exe File opened for modification C:\windows\SysWOW64\KRXO.exe CDSI.exe File created C:\windows\SysWOW64\CDSI.exe.bat HBCJLA.exe File created C:\windows\SysWOW64\KRXO.exe CDSI.exe File created C:\windows\SysWOW64\MII.exe OXFK.exe File created C:\windows\SysWOW64\WWNZSM.exe ETJV.exe File opened for modification C:\windows\SysWOW64\OIKQJ.exe VNG.exe File opened for modification C:\windows\SysWOW64\CDSI.exe HBCJLA.exe File created C:\windows\SysWOW64\NVJ.exe WUHJYF.exe File opened for modification C:\windows\SysWOW64\WBAGHQA.exe STUGV.exe File created C:\windows\SysWOW64\GJS.exe ELN.exe File opened for modification C:\windows\SysWOW64\MYVX.exe ZNMH.exe File created C:\windows\SysWOW64\PUFWM.exe.bat HOSQC.exe File created C:\windows\SysWOW64\TLEN.exe.bat CDKIVO.exe File created C:\windows\SysWOW64\LFONCL.exe QSJE.exe File created C:\windows\SysWOW64\BDB.exe.bat VDTHJ.exe File created C:\windows\SysWOW64\QDNMGB.exe.bat HVLHC.exe File created C:\windows\SysWOW64\CWOGS.exe DBPX.exe File created C:\windows\SysWOW64\DYF.exe.bat FCGGLKJ.exe File created C:\windows\SysWOW64\JPJCBVA.exe ZREQ.exe File opened for modification C:\windows\SysWOW64\LFONCL.exe QSJE.exe File opened for modification C:\windows\SysWOW64\YEDRND.exe JJU.exe File created C:\windows\SysWOW64\KAPHXHO.exe WUPW.exe File created C:\windows\SysWOW64\BDB.exe VDTHJ.exe File created C:\windows\SysWOW64\WWNZSM.exe.bat ETJV.exe File opened for modification C:\windows\SysWOW64\JJHFGL.exe FBA.exe File opened for modification C:\windows\SysWOW64\SVOMZC.exe TKLW.exe File created C:\windows\SysWOW64\KLS.exe UVJT.exe File opened for modification C:\windows\SysWOW64\KLS.exe UVJT.exe File created C:\windows\SysWOW64\JJHFGL.exe FBA.exe File created C:\windows\SysWOW64\WUHJYF.exe JKZ.exe File opened for modification C:\windows\SysWOW64\JPJCBVA.exe ZREQ.exe File created C:\windows\SysWOW64\PUFWM.exe HOSQC.exe File created C:\windows\SysWOW64\GJS.exe.bat ELN.exe File created C:\windows\SysWOW64\LFONCL.exe.bat QSJE.exe File created C:\windows\SysWOW64\OXFK.exe TNWLWB.exe File created C:\windows\SysWOW64\CWOGS.exe.bat DBPX.exe File created C:\windows\SysWOW64\OJNAPM.exe.bat AGF.exe File opened for modification C:\windows\SysWOW64\SZHYS.exe GJS.exe File opened for modification C:\windows\SysWOW64\IMTEAGG.exe GZOVQ.exe File opened for modification C:\windows\SysWOW64\CWOGS.exe DBPX.exe File created C:\windows\SysWOW64\SVOMZC.exe TKLW.exe File created C:\windows\SysWOW64\VDTHJ.exe LFONCL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\EAX.exe LII.exe File created C:\windows\system\TBHKSOO.exe.bat KAFFPI.exe File created C:\windows\EEIDZLF.exe.bat GOX.exe File created C:\windows\system\MUEIG.exe.bat 2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe File created C:\windows\AGF.exe STS.exe File opened for modification C:\windows\system\LMPXJD.exe JPJCBVA.exe File created C:\windows\system\HBCJLA.exe.bat FDWXESB.exe File opened for modification C:\windows\KVNPK.exe TKWZD.exe File created C:\windows\system\JJU.exe.bat OWPDSQ.exe File created C:\windows\system\OZC.exe EBXGX.exe File opened for modification C:\windows\NVLBXVH.exe DYF.exe File created C:\windows\system\LMPXJD.exe JPJCBVA.exe File opened for modification C:\windows\system\LXPXLM.exe LULU.exe File opened for modification C:\windows\FZIKOT.exe KMDA.exe File created C:\windows\EQOYBUS.exe JVJOQ.exe File created C:\windows\system\EZOGSUR.exe.bat MWKLN.exe File created C:\windows\RRX.exe CWOGS.exe File created C:\windows\system\QKMXXN.exe WWNZSM.exe File opened for modification C:\windows\FBA.exe ZGBWQX.exe File created C:\windows\EQOYBUS.exe.bat JVJOQ.exe File created C:\windows\system\RIGT.exe.bat FSRTQM.exe File opened for modification C:\windows\system\OZC.exe EBXGX.exe File opened for modification C:\windows\WEPH.exe OZC.exe File created C:\windows\system\AHZREW.exe QKMXXN.exe File created C:\windows\HQFZ.exe SVOMZC.exe File opened for modification C:\windows\system\HBCJLA.exe FDWXESB.exe File opened for modification C:\windows\system\OXNEV.exe FZIKOT.exe File created C:\windows\system\UBKT.exe.bat NOL.exe File opened for modification C:\windows\system\PSKKBHC.exe NVEQ.exe File created C:\windows\NWK.exe DYE.exe File created C:\windows\JQKNKAD.exe RIWQXJB.exe File opened for modification C:\windows\LII.exe CZOBLIA.exe File created C:\windows\system\EZOGSUR.exe MWKLN.exe File created C:\windows\system\STUGV.exe MYVX.exe File created C:\windows\system\RDRBJ.exe NVLBXVH.exe File opened for modification C:\windows\JKSNGBZ.exe OXNEV.exe File created C:\windows\STS.exe QVMA.exe File opened for modification C:\windows\AGF.exe STS.exe File created C:\windows\system\TNWLWB.exe YZRC.exe File created C:\windows\FDWXESB.exe.bat GKU.exe File created C:\windows\LII.exe CZOBLIA.exe File created C:\windows\EAX.exe LII.exe File opened for modification C:\windows\system\TBHKSOO.exe KAFFPI.exe File created C:\windows\STS.exe.bat QVMA.exe File created C:\windows\JKSNGBZ.exe.bat OXNEV.exe File created C:\windows\LII.exe.bat CZOBLIA.exe File opened for modification C:\windows\system\MWKLN.exe RIGT.exe File created C:\windows\system\OEEKUG.exe WBAGHQA.exe File created C:\windows\JQKNKAD.exe.bat RIWQXJB.exe File created C:\windows\system\UBKT.exe NOL.exe File created C:\windows\QCUDH.exe IMTEAGG.exe File created C:\windows\QCUDH.exe.bat IMTEAGG.exe File created C:\windows\FBA.exe.bat ZGBWQX.exe File created C:\windows\system\LMPXJD.exe.bat JPJCBVA.exe File created C:\windows\FDWXESB.exe GKU.exe File opened for modification C:\windows\KXFL.exe PKABPVA.exe File opened for modification C:\windows\HVLHC.exe TSCIO.exe File created C:\windows\HVLHC.exe.bat TSCIO.exe File created C:\windows\system\NVEQ.exe.bat YEDRND.exe File created C:\windows\TSCIO.exe.bat VHEKP.exe File created C:\windows\AGF.exe.bat STS.exe File created C:\windows\system\OXNEV.exe FZIKOT.exe File opened for modification C:\windows\system\EZOGSUR.exe MWKLN.exe File created C:\windows\system\OAKI.exe RUAS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 2604 716 WerFault.exe 88 7016 6960 WerFault.exe 93 4784 4380 WerFault.exe 99 2744 3816 WerFault.exe 104 5660 6788 WerFault.exe 109 4356 5748 WerFault.exe 114 3812 1272 WerFault.exe 119 6548 2444 WerFault.exe 124 4920 6540 WerFault.exe 129 1532 1952 WerFault.exe 134 5924 4228 WerFault.exe 139 2968 3112 WerFault.exe 144 2904 5840 WerFault.exe 149 6828 2332 WerFault.exe 154 2184 4468 WerFault.exe 159 3604 1936 WerFault.exe 164 2756 5784 WerFault.exe 169 5400 5872 WerFault.exe 174 6808 3040 WerFault.exe 179 5140 2804 WerFault.exe 184 4612 5540 WerFault.exe 189 4408 6544 WerFault.exe 194 6304 616 WerFault.exe 199 2748 6364 WerFault.exe 204 6388 4948 WerFault.exe 209 1976 6812 WerFault.exe 214 4992 1900 WerFault.exe 219 900 52 WerFault.exe 224 2144 3476 WerFault.exe 229 1888 6860 WerFault.exe 234 7144 3516 WerFault.exe 238 3524 4996 WerFault.exe 244 5112 6408 WerFault.exe 249 7156 6692 WerFault.exe 254 6580 1548 WerFault.exe 259 6300 3736 WerFault.exe 264 5736 2532 WerFault.exe 269 5504 4736 WerFault.exe 274 2976 3892 WerFault.exe 279 6456 2940 WerFault.exe 284 2456 6888 WerFault.exe 289 2684 1388 WerFault.exe 294 3916 3764 WerFault.exe 299 2208 1716 WerFault.exe 304 108 2252 WerFault.exe 309 548 3880 WerFault.exe 314 6424 4204 WerFault.exe 319 860 1848 WerFault.exe 324 6600 5628 WerFault.exe 329 1128 2328 WerFault.exe 334 3636 2808 WerFault.exe 339 5476 3340 WerFault.exe 344 2060 6312 WerFault.exe 349 6764 1248 WerFault.exe 354 5060 3436 WerFault.exe 359 1432 5704 WerFault.exe 363 1264 4872 WerFault.exe 369 3352 4236 WerFault.exe 374 6980 6656 WerFault.exe 379 5632 6872 WerFault.exe 384 6624 2448 WerFault.exe 389 1392 2108 WerFault.exe 394 2872 6220 WerFault.exe 399 2572 4536 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCGGLKJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTTNKMG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OJNAPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEEKUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KDABQKY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NWK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTAJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PKABPVA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OZC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HQFZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WBAGHQA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKWZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDRBJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUEIG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MII.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language STS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWPDSQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBCJLA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZIKOT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WWNZSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMPXJD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMTEAGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MWKLN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEZTUIL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GJS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 716 2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe 716 2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe 6960 MUEIG.exe 6960 MUEIG.exe 4380 RIWQXJB.exe 4380 RIWQXJB.exe 3816 JQKNKAD.exe 3816 JQKNKAD.exe 6788 WWSZML.exe 6788 WWSZML.exe 5748 EBXGX.exe 5748 EBXGX.exe 1272 OZC.exe 1272 OZC.exe 2444 WEPH.exe 2444 WEPH.exe 6540 VXSXXX.exe 6540 VXSXXX.exe 1952 QVMA.exe 1952 QVMA.exe 4228 STS.exe 4228 STS.exe 3112 AGF.exe 3112 AGF.exe 5840 OJNAPM.exe 5840 OJNAPM.exe 2332 CEZTUIL.exe 2332 CEZTUIL.exe 4468 RUAS.exe 4468 RUAS.exe 1936 OAKI.exe 1936 OAKI.exe 5784 BGS.exe 5784 BGS.exe 5872 ETJV.exe 5872 ETJV.exe 3040 WWNZSM.exe 3040 WWNZSM.exe 2804 QKMXXN.exe 2804 QKMXXN.exe 5540 AHZREW.exe 5540 AHZREW.exe 6544 UVJT.exe 6544 UVJT.exe 616 KLS.exe 616 KLS.exe 6364 ZGBWQX.exe 6364 ZGBWQX.exe 4948 FBA.exe 4948 FBA.exe 6812 JJHFGL.exe 6812 JJHFGL.exe 1900 WUPW.exe 1900 WUPW.exe 52 KAPHXHO.exe 52 KAPHXHO.exe 3476 FCGGLKJ.exe 3476 FCGGLKJ.exe 6860 DYF.exe 6860 DYF.exe 3516 NVLBXVH.exe 3516 NVLBXVH.exe 4996 RDRBJ.exe 4996 RDRBJ.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 716 2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe 716 2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe 6960 MUEIG.exe 6960 MUEIG.exe 4380 RIWQXJB.exe 4380 RIWQXJB.exe 3816 JQKNKAD.exe 3816 JQKNKAD.exe 6788 WWSZML.exe 6788 WWSZML.exe 5748 EBXGX.exe 5748 EBXGX.exe 1272 OZC.exe 1272 OZC.exe 2444 WEPH.exe 2444 WEPH.exe 6540 VXSXXX.exe 6540 VXSXXX.exe 1952 QVMA.exe 1952 QVMA.exe 4228 STS.exe 4228 STS.exe 3112 AGF.exe 3112 AGF.exe 5840 OJNAPM.exe 5840 OJNAPM.exe 2332 CEZTUIL.exe 2332 CEZTUIL.exe 4468 RUAS.exe 4468 RUAS.exe 1936 OAKI.exe 1936 OAKI.exe 5784 BGS.exe 5784 BGS.exe 5872 ETJV.exe 5872 ETJV.exe 3040 WWNZSM.exe 3040 WWNZSM.exe 2804 QKMXXN.exe 2804 QKMXXN.exe 5540 AHZREW.exe 5540 AHZREW.exe 6544 UVJT.exe 6544 UVJT.exe 616 KLS.exe 616 KLS.exe 6364 ZGBWQX.exe 6364 ZGBWQX.exe 4948 FBA.exe 4948 FBA.exe 6812 JJHFGL.exe 6812 JJHFGL.exe 1900 WUPW.exe 1900 WUPW.exe 52 KAPHXHO.exe 52 KAPHXHO.exe 3476 FCGGLKJ.exe 3476 FCGGLKJ.exe 6860 DYF.exe 6860 DYF.exe 3516 NVLBXVH.exe 3516 NVLBXVH.exe 4996 RDRBJ.exe 4996 RDRBJ.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 716 wrote to memory of 1120 716 2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe 89 PID 1120 wrote to memory of 6960 1120 cmd.exe 93 PID 6960 wrote to memory of 3120 6960 MUEIG.exe 95 PID 3120 wrote to memory of 4380 3120 cmd.exe 99 PID 4380 wrote to memory of 5532 4380 RIWQXJB.exe 100 PID 5532 wrote to memory of 3816 5532 cmd.exe 104 PID 3816 wrote to memory of 2004 3816 JQKNKAD.exe 105 PID 2004 wrote to memory of 6788 2004 cmd.exe 109 PID 6788 wrote to memory of 3180 6788 WWSZML.exe 110 PID 3180 wrote to memory of 5748 3180 cmd.exe 114 PID 5748 wrote to memory of 6876 5748 EBXGX.exe 115 PID 6876 wrote to memory of 1272 6876 cmd.exe 119 PID 1272 wrote to memory of 4672 1272 OZC.exe 120 PID 4672 wrote to memory of 2444 4672 cmd.exe 124 PID 2444 wrote to memory of 2520 2444 WEPH.exe 125 PID 2520 wrote to memory of 6540 2520 cmd.exe 129 PID 6540 wrote to memory of 6352 6540 VXSXXX.exe 130 PID 6352 wrote to memory of 1952 6352 cmd.exe 134 PID 1952 wrote to memory of 988 1952 QVMA.exe 135 PID 988 wrote to memory of 4228 988 cmd.exe 139 PID 4228 wrote to memory of 1216 4228 STS.exe 140 PID 1216 wrote to memory of 3112 1216 cmd.exe 144 PID 3112 wrote to memory of 776 3112 AGF.exe 145 PID 776 wrote to memory of 5840 776 cmd.exe 149 PID 5840 wrote to memory of 6736 5840 OJNAPM.exe 150 PID 6736 wrote to memory of 2332 6736 cmd.exe 154 PID 2332 wrote to memory of 1356 2332 CEZTUIL.exe 155 PID 1356 wrote to memory of 4468 1356 cmd.exe 159 PID 4468 wrote to memory of 1456 4468 RUAS.exe 160 PID 1456 wrote to memory of 1936 1456 cmd.exe 164 PID 1936 wrote to memory of 4956 1936 OAKI.exe 165 PID 4956 wrote to memory of 5784 4956 cmd.exe 169 PID 5784 wrote to memory of 5348 5784 BGS.exe 170 PID 5348 wrote to memory of 5872 5348 cmd.exe 174 PID 5872 wrote to memory of 6772 5872 ETJV.exe 175 PID 6772 wrote to memory of 3040 6772 cmd.exe 179 PID 3040 wrote to memory of 5592 3040 WWNZSM.exe 180 PID 5592 wrote to memory of 2804 5592 cmd.exe 184 PID 2804 wrote to memory of 5712 2804 QKMXXN.exe 185 PID 5712 wrote to memory of 5540 5712 cmd.exe 189 PID 5540 wrote to memory of 5460 5540 AHZREW.exe 190 PID 5460 wrote to memory of 6544 5460 cmd.exe 194 PID 6544 wrote to memory of 1460 6544 UVJT.exe 195 PID 1460 wrote to memory of 616 1460 cmd.exe 199 PID 616 wrote to memory of 4704 616 KLS.exe 200 PID 4704 wrote to memory of 6364 4704 cmd.exe 204 PID 6364 wrote to memory of 4936 6364 ZGBWQX.exe 205 PID 4936 wrote to memory of 4948 4936 cmd.exe 209 PID 4948 wrote to memory of 6444 4948 FBA.exe 210 PID 6444 wrote to memory of 6812 6444 cmd.exe 214 PID 6812 wrote to memory of 1420 6812 JJHFGL.exe 215 PID 1420 wrote to memory of 1900 1420 cmd.exe 219 PID 1900 wrote to memory of 1864 1900 WUPW.exe 220 PID 1864 wrote to memory of 52 1864 cmd.exe 224 PID 52 wrote to memory of 2012 52 KAPHXHO.exe 225 PID 2012 wrote to memory of 3476 2012 cmd.exe 229 PID 3476 wrote to memory of 1648 3476 FCGGLKJ.exe 230 PID 1648 wrote to memory of 6860 1648 cmd.exe 234 PID 6860 wrote to memory of 696 6860 DYF.exe 235 PID 696 wrote to memory of 3516 696 cmd.exe 238 PID 3516 wrote to memory of 1860 3516 NVLBXVH.exe 240 PID 1860 wrote to memory of 4996 1860 cmd.exe 244 PID 4996 wrote to memory of 692 4996 RDRBJ.exe 245 PID 692 wrote to memory of 6408 692 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_2ad6bb9f89b706583337f780926d1338_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MUEIG.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\windows\system\MUEIG.exeC:\windows\system\MUEIG.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RIWQXJB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\windows\SysWOW64\RIWQXJB.exeC:\windows\system32\RIWQXJB.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQKNKAD.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\windows\JQKNKAD.exeC:\windows\JQKNKAD.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WWSZML.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\windows\system\WWSZML.exeC:\windows\system\WWSZML.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EBXGX.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\windows\system\EBXGX.exeC:\windows\system\EBXGX.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OZC.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:6876 -
C:\windows\system\OZC.exeC:\windows\system\OZC.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WEPH.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\windows\WEPH.exeC:\windows\WEPH.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VXSXXX.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\windows\VXSXXX.exeC:\windows\VXSXXX.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QVMA.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6352 -
C:\windows\QVMA.exeC:\windows\QVMA.exe19⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\STS.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\windows\STS.exeC:\windows\STS.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AGF.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\windows\AGF.exeC:\windows\AGF.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OJNAPM.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\windows\SysWOW64\OJNAPM.exeC:\windows\system32\OJNAPM.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CEZTUIL.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:6736 -
C:\windows\system\CEZTUIL.exeC:\windows\system\CEZTUIL.exe27⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUAS.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\windows\SysWOW64\RUAS.exeC:\windows\system32\RUAS.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OAKI.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\windows\system\OAKI.exeC:\windows\system\OAKI.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BGS.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\windows\BGS.exeC:\windows\BGS.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ETJV.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\windows\system\ETJV.exeC:\windows\system\ETJV.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WWNZSM.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:6772 -
C:\windows\SysWOW64\WWNZSM.exeC:\windows\system32\WWNZSM.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QKMXXN.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\windows\system\QKMXXN.exeC:\windows\system\QKMXXN.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AHZREW.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\windows\system\AHZREW.exeC:\windows\system\AHZREW.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UVJT.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\windows\UVJT.exeC:\windows\UVJT.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6544 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLS.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\windows\SysWOW64\KLS.exeC:\windows\system32\KLS.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGBWQX.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\windows\ZGBWQX.exeC:\windows\ZGBWQX.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FBA.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\windows\FBA.exeC:\windows\FBA.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JJHFGL.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:6444 -
C:\windows\SysWOW64\JJHFGL.exeC:\windows\system32\JJHFGL.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WUPW.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\windows\SysWOW64\WUPW.exeC:\windows\system32\WUPW.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KAPHXHO.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\windows\SysWOW64\KAPHXHO.exeC:\windows\system32\KAPHXHO.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FCGGLKJ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\windows\system\FCGGLKJ.exeC:\windows\system\FCGGLKJ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DYF.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\windows\SysWOW64\DYF.exeC:\windows\system32\DYF.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NVLBXVH.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:696 -
C:\windows\NVLBXVH.exeC:\windows\NVLBXVH.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RDRBJ.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\windows\system\RDRBJ.exeC:\windows\system\RDRBJ.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZREQ.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692 -
C:\windows\ZREQ.exeC:\windows\ZREQ.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JPJCBVA.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5352 -
C:\windows\SysWOW64\JPJCBVA.exeC:\windows\system32\JPJCBVA.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:6692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LMPXJD.exe.bat" "68⤵PID:948
-
C:\windows\system\LMPXJD.exeC:\windows\system\LMPXJD.exe69⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VKDRQL.exe.bat" "70⤵PID:6596
-
C:\windows\system\VKDRQL.exeC:\windows\system\VKDRQL.exe71⤵
- Executes dropped EXE
PID:3736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VNG.exe.bat" "72⤵PID:5584
-
C:\windows\system\VNG.exeC:\windows\system\VNG.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OIKQJ.exe.bat" "74⤵PID:2388
-
C:\windows\SysWOW64\OIKQJ.exeC:\windows\system32\OIKQJ.exe75⤵
- Executes dropped EXE
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SYRQ.exe.bat" "76⤵PID:2920
-
C:\windows\system\SYRQ.exeC:\windows\system\SYRQ.exe77⤵
- Executes dropped EXE
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOSQC.exe.bat" "78⤵PID:2024
-
C:\windows\HOSQC.exeC:\windows\HOSQC.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUFWM.exe.bat" "80⤵PID:6664
-
C:\windows\SysWOW64\PUFWM.exeC:\windows\system32\PUFWM.exe81⤵
- Executes dropped EXE
PID:6888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKLW.exe.bat" "82⤵PID:3912
-
C:\windows\SysWOW64\TKLW.exeC:\windows\system32\TKLW.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SVOMZC.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:5856 -
C:\windows\SysWOW64\SVOMZC.exeC:\windows\system32\SVOMZC.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HQFZ.exe.bat" "86⤵PID:2708
-
C:\windows\HQFZ.exeC:\windows\HQFZ.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CDKIVO.exe.bat" "88⤵PID:1508
-
C:\windows\CDKIVO.exeC:\windows\CDKIVO.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TLEN.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:2084 -
C:\windows\SysWOW64\TLEN.exeC:\windows\system32\TLEN.exe91⤵
- Executes dropped EXE
PID:3880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XTTNKMG.exe.bat" "92⤵PID:4992
-
C:\windows\XTTNKMG.exeC:\windows\XTTNKMG.exe93⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SHQF.exe.bat" "94⤵PID:900
-
C:\windows\system\SHQF.exeC:\windows\system\SHQF.exe95⤵
- Executes dropped EXE
PID:1848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KKBAA.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:6644 -
C:\windows\system\KKBAA.exeC:\windows\system\KKBAA.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WAI.exe.bat" "98⤵PID:5468
-
C:\windows\SysWOW64\WAI.exeC:\windows\system32\WAI.exe99⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UNHJRP.exe.bat" "100⤵PID:4112
-
C:\windows\UNHJRP.exeC:\windows\UNHJRP.exe101⤵
- Executes dropped EXE
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ELN.exe.bat" "102⤵PID:2472
-
C:\windows\system\ELN.exeC:\windows\system\ELN.exe103⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GJS.exe.bat" "104⤵PID:2364
-
C:\windows\SysWOW64\GJS.exeC:\windows\system32\GJS.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SZHYS.exe.bat" "106⤵PID:2432
-
C:\windows\SysWOW64\SZHYS.exeC:\windows\system32\SZHYS.exe107⤵
- Executes dropped EXE
PID:1248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LULU.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:2040 -
C:\windows\LULU.exeC:\windows\LULU.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LXPXLM.exe.bat" "110⤵PID:6488
-
C:\windows\system\LXPXLM.exeC:\windows\system\LXPXLM.exe111⤵
- Executes dropped EXE
PID:5704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GKU.exe.bat" "112⤵PID:3024
-
C:\windows\system\GKU.exeC:\windows\system\GKU.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FDWXESB.exe.bat" "114⤵PID:2232
-
C:\windows\FDWXESB.exeC:\windows\FDWXESB.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBCJLA.exe.bat" "116⤵PID:6720
-
C:\windows\system\HBCJLA.exeC:\windows\system\HBCJLA.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CDSI.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:4668 -
C:\windows\SysWOW64\CDSI.exeC:\windows\system32\CDSI.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KRXO.exe.bat" "120⤵PID:5424
-
C:\windows\SysWOW64\KRXO.exeC:\windows\system32\KRXO.exe121⤵
- Executes dropped EXE
PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-