Analysis
- max time kernel
56s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe
- Size 208KB
- Sample260709-vm97naet2l
- SHA256 052471e701487528b892bca10ff7dedea92c2092c49c1fe323701bf80bfa5f31
- MD5 7b062c4c5784926e0d585a97e8152820
- SHA1 afdd3e8b5f386dc2231eefd8ddb903430761c222
- SHA512 0a7958d0119f930e751a95e1861b584a7acb98f2e36b94c40fb62b03b1f607b7a59f569697f42540bd0511d5136590ab8d372402e1e77c7b1c14c376cbf9dfa0
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOf64NLthEjQT6c:MlZtbLWIgd1LZ9oECZbclc5+LOyQEje
- TLSH T1FD247D2235D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E315A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 5888 NJXYQ.exe 5832 NMPJ.exe 2900 CCDAHQ.exe 6116 QNLZ.exe 2384 QIP.exe 1004 SGVPQR.exe 2684 KOXUUWE.exe 3224 IZIKDC.exe 5464 BCLGI.exe 2480 FKSOUKQ.exe 1608 YCHZELY.exe 1956 EYZ.exe 5764 DWSDDUW.exe 2520 VRWYJJ.exe 4732 QMAITJU.exe 1264 LKATVV.exe 5104 ENE.exe 5896 DCXSVQ.exe 3868 BNAIW.exe 2880 WJFSGWY.exe 564 VTIIPK.exe 1716 YBP.exe 1808 HPPE.exe 864 KXVE.exe 4512 ONCEBS.exe 2024 SVR.exe 4220 TYUIT.exe 4880 GWUU.exe 5052 IUA.exe 1376 JXESQ.exe 3872 GCWHGF.exe 1860 MYVICI.exe 4480 QGCIPB.exe 1140 FBLU.exe 1696 FEPQND.exe 4892 YHBTTTW.exe 1268 CPITFLK.exe 1016 DSLP.exe 2440 VVPTYZ.exe 2452 LLQS.exe 5088 VBWF.exe 3900 ILMDAGO.exe 1700 OHLE.exe 2792 QFRYMRM.exe 1064 RIVCSH.exe 3376 WICQBB.exe 2844 KLTGPM.exe 3064 BTNUSKM.exe 2324 FBBUF.exe 4496 YEFP.exe 4740 PEHCV.exe 4828 JAMMYXB.exe 1836 VSUXPQJ.exe 5380 TDWN.exe 1600 UGI.exe 5460 HRRHRF.exe 2932 IHYQUPS.exe 2592 VSHPISN.exe 6024 LII.exe 3616 ADZKAA.exe 5080 LVUDIHS.exe 3912 PLBLU.exe 8 LJJ.exe 1776 YUR.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 57 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\NJXYQ.exe 2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\DCXSVQ.exe ENE.exe File opened for modification C:\windows\SysWOW64\VBWF.exe LLQS.exe File created C:\windows\SysWOW64\KLTGPM.exe WICQBB.exe File created C:\windows\SysWOW64\NABVGBR.exe TNWLWB.exe File created C:\windows\SysWOW64\NJXYQ.exe.bat 2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\QIP.exe QNLZ.exe File created C:\windows\SysWOW64\LKATVV.exe QMAITJU.exe File created C:\windows\SysWOW64\LKATVV.exe.bat QMAITJU.exe File created C:\windows\SysWOW64\VVPTYZ.exe.bat DSLP.exe File created C:\windows\SysWOW64\VBWF.exe.bat LLQS.exe File opened for modification C:\windows\SysWOW64\KLTGPM.exe WICQBB.exe File opened for modification C:\windows\SysWOW64\FBLU.exe QGCIPB.exe File created C:\windows\SysWOW64\FBLU.exe.bat QGCIPB.exe File opened for modification C:\windows\SysWOW64\PEHCV.exe YEFP.exe File opened for modification C:\windows\SysWOW64\ADZKAA.exe LII.exe File created C:\windows\SysWOW64\QIP.exe.bat QNLZ.exe File created C:\windows\SysWOW64\LJJ.exe PLBLU.exe File opened for modification C:\windows\SysWOW64\NABVGBR.exe TNWLWB.exe File created C:\windows\SysWOW64\ENE.exe.bat LKATVV.exe File created C:\windows\SysWOW64\DCXSVQ.exe ENE.exe File created C:\windows\SysWOW64\UGI.exe TDWN.exe File created C:\windows\SysWOW64\FEPQND.exe FBLU.exe File created C:\windows\SysWOW64\QMAITJU.exe VRWYJJ.exe File opened for modification C:\windows\SysWOW64\ENE.exe LKATVV.exe File created C:\windows\SysWOW64\QGCIPB.exe.bat MYVICI.exe File created C:\windows\SysWOW64\VVPTYZ.exe DSLP.exe File opened for modification C:\windows\SysWOW64\VVPTYZ.exe DSLP.exe File created C:\windows\SysWOW64\KLTGPM.exe.bat WICQBB.exe File created C:\windows\SysWOW64\QIP.exe QNLZ.exe File opened for modification C:\windows\SysWOW64\QMAITJU.exe VRWYJJ.exe File opened for modification C:\windows\SysWOW64\LKATVV.exe QMAITJU.exe File opened for modification C:\windows\SysWOW64\YBP.exe VTIIPK.exe File created C:\windows\SysWOW64\YBP.exe.bat VTIIPK.exe File created C:\windows\SysWOW64\FEPQND.exe.bat FBLU.exe File created C:\windows\SysWOW64\VBWF.exe LLQS.exe File created C:\windows\SysWOW64\PEHCV.exe YEFP.exe File created C:\windows\SysWOW64\FBBUF.exe BTNUSKM.exe File created C:\windows\SysWOW64\FBBUF.exe.bat BTNUSKM.exe File created C:\windows\SysWOW64\UGI.exe.bat TDWN.exe File created C:\windows\SysWOW64\DCXSVQ.exe.bat ENE.exe File created C:\windows\SysWOW64\NABVGBR.exe.bat TNWLWB.exe File created C:\windows\SysWOW64\FBLU.exe QGCIPB.exe File opened for modification C:\windows\SysWOW64\FBBUF.exe BTNUSKM.exe File created C:\windows\SysWOW64\ADZKAA.exe LII.exe File created C:\windows\SysWOW64\ADZKAA.exe.bat LII.exe File created C:\windows\SysWOW64\NJXYQ.exe 2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\QGCIPB.exe MYVICI.exe File opened for modification C:\windows\SysWOW64\FEPQND.exe FBLU.exe File opened for modification C:\windows\SysWOW64\UGI.exe TDWN.exe File opened for modification C:\windows\SysWOW64\LJJ.exe PLBLU.exe File created C:\windows\SysWOW64\QMAITJU.exe.bat VRWYJJ.exe File created C:\windows\SysWOW64\YBP.exe VTIIPK.exe File created C:\windows\SysWOW64\PEHCV.exe.bat YEFP.exe File created C:\windows\SysWOW64\QGCIPB.exe MYVICI.exe File created C:\windows\SysWOW64\LJJ.exe.bat PLBLU.exe File created C:\windows\SysWOW64\ENE.exe LKATVV.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\CPITFLK.exe.bat YHBTTTW.exe File created C:\windows\system\HRRHRF.exe UGI.exe File opened for modification C:\windows\system\QNLZ.exe CCDAHQ.exe File opened for modification C:\windows\CPITFLK.exe YHBTTTW.exe File created C:\windows\system\QFRYMRM.exe.bat OHLE.exe File created C:\windows\LII.exe.bat VSHPISN.exe File created C:\windows\YEFP.exe FBBUF.exe File opened for modification C:\windows\system\CCDAHQ.exe NMPJ.exe File created C:\windows\SVR.exe ONCEBS.exe File opened for modification C:\windows\GWUU.exe TYUIT.exe File opened for modification C:\windows\system\GCWHGF.exe JXESQ.exe File opened for modification C:\windows\system\VSUXPQJ.exe JAMMYXB.exe File opened for modification C:\windows\system\PLBLU.exe LVUDIHS.exe File created C:\windows\system\QNLZ.exe CCDAHQ.exe File created C:\windows\system\VRWYJJ.exe.bat DWSDDUW.exe File opened for modification C:\windows\system\YZRC.exe YUR.exe File created C:\windows\YHBTTTW.exe.bat FEPQND.exe File opened for modification C:\windows\YEFP.exe FBBUF.exe File created C:\windows\NMPJ.exe.bat NJXYQ.exe File created C:\windows\SVR.exe.bat ONCEBS.exe File created C:\windows\YUR.exe.bat LJJ.exe File created C:\windows\KOXUUWE.exe SGVPQR.exe File opened for modification C:\windows\system\VRWYJJ.exe DWSDDUW.exe File opened for modification C:\windows\system\ONCEBS.exe KXVE.exe File created C:\windows\GWUU.exe TYUIT.exe File created C:\windows\system\GCWHGF.exe JXESQ.exe File created C:\windows\system\GCWHGF.exe.bat JXESQ.exe File created C:\windows\SGVPQR.exe.bat QIP.exe File created C:\windows\BCLGI.exe.bat IZIKDC.exe File opened for modification C:\windows\DSLP.exe CPITFLK.exe File created C:\windows\system\VSUXPQJ.exe JAMMYXB.exe File created C:\windows\NMPJ.exe NJXYQ.exe File created C:\windows\WJFSGWY.exe.bat BNAIW.exe File created C:\windows\MYVICI.exe.bat GCWHGF.exe File opened for modification C:\windows\system\LLQS.exe VVPTYZ.exe File opened for modification C:\windows\system\RIVCSH.exe QFRYMRM.exe File opened for modification C:\windows\YUR.exe LJJ.exe File opened for modification C:\windows\BCLGI.exe IZIKDC.exe File created C:\windows\system\ILMDAGO.exe VBWF.exe File created C:\windows\OHLE.exe.bat ILMDAGO.exe File created C:\windows\system\BTNUSKM.exe.bat KLTGPM.exe File created C:\windows\VSHPISN.exe IHYQUPS.exe File created C:\windows\VSHPISN.exe.bat IHYQUPS.exe File created C:\windows\system\DWSDDUW.exe.bat EYZ.exe File opened for modification C:\windows\system\BNAIW.exe DCXSVQ.exe File created C:\windows\BCLGI.exe IZIKDC.exe File created C:\windows\WJFSGWY.exe BNAIW.exe File created C:\windows\system\HPPE.exe YBP.exe File created C:\windows\system\TDWN.exe VSUXPQJ.exe File created C:\windows\IHYQUPS.exe HRRHRF.exe File created C:\windows\LVUDIHS.exe ADZKAA.exe File opened for modification C:\windows\system\TNWLWB.exe YZRC.exe File created C:\windows\system\TNWLWB.exe.bat YZRC.exe File created C:\windows\YCHZELY.exe FKSOUKQ.exe File created C:\windows\YUR.exe LJJ.exe File created C:\windows\TYUIT.exe SVR.exe File opened for modification C:\windows\system\IUA.exe GWUU.exe File created C:\windows\system\LLQS.exe.bat VVPTYZ.exe File created C:\windows\system\BTNUSKM.exe KLTGPM.exe File created C:\windows\system\PLBLU.exe.bat LVUDIHS.exe File created C:\windows\system\TNWLWB.exe YZRC.exe File created C:\windows\system\CCDAHQ.exe.bat NMPJ.exe File created C:\windows\system\QNLZ.exe.bat CCDAHQ.exe File opened for modification C:\windows\SVR.exe ONCEBS.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 2692 5404 WerFault.exe 87 628 5888 WerFault.exe 92 2620 5832 WerFault.exe 98 5212 2900 WerFault.exe 103 5372 6116 WerFault.exe 108 2180 2384 WerFault.exe 113 1068 1004 WerFault.exe 118 4112 2684 WerFault.exe 123 1796 3224 WerFault.exe 128 1704 5464 WerFault.exe 133 1144 2480 WerFault.exe 138 5188 1608 WerFault.exe 143 5696 1956 WerFault.exe 148 4552 5764 WerFault.exe 153 3500 2520 WerFault.exe 158 4820 4732 WerFault.exe 163 4472 1264 WerFault.exe 168 3124 5104 WerFault.exe 173 1684 5896 WerFault.exe 178 1920 3868 WerFault.exe 183 3136 2880 WerFault.exe 188 3404 564 WerFault.exe 192 5956 1716 WerFault.exe 198 2992 1808 WerFault.exe 203 3692 864 WerFault.exe 208 3488 4512 WerFault.exe 213 4088 2024 WerFault.exe 218 4544 4220 WerFault.exe 223 8 4880 WerFault.exe 228 5256 5052 WerFault.exe 233 4720 1376 WerFault.exe 238 6132 3872 WerFault.exe 243 2832 1860 WerFault.exe 248 5720 4480 WerFault.exe 253 2844 1140 WerFault.exe 258 3064 1696 WerFault.exe 263 2696 4892 WerFault.exe 268 480 1268 WerFault.exe 273 3244 1016 WerFault.exe 278 5724 2440 WerFault.exe 283 2080 2452 WerFault.exe 288 5292 5088 WerFault.exe 293 3948 3900 WerFault.exe 298 4900 1700 WerFault.exe 303 2796 2792 WerFault.exe 308 2864 1064 WerFault.exe 313 5264 3376 WerFault.exe 318 2672 2844 WerFault.exe 323 2516 3064 WerFault.exe 328 1904 2324 WerFault.exe 333 5280 4496 WerFault.exe 338 2260 4740 WerFault.exe 343 4984 4828 WerFault.exe 348 5844 1836 WerFault.exe 353 5760 5380 WerFault.exe 358 5296 1600 WerFault.exe 363 5708 5460 WerFault.exe 368 1220 2932 WerFault.exe 373 1108 2592 WerFault.exe 378 5360 6024 WerFault.exe 383 1440 3616 WerFault.exe 388 3496 5080 WerFault.exe 393 1208 3912 WerFault.exe 398 3280 8 WerFault.exe 403 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTIIPK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYVICI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RIVCSH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCDAHQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YCHZELY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HRRHRF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YBP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DSLP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVPTYZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONCEBS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOXUUWE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCXSVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LLQS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCLGI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GWUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YHBTTTW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IHYQUPS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BTNUSKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IUA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPITFLK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KLTGPM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGVPQR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DWSDDUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TNWLWB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YEFP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JXESQ.exe - Checks SCSI registry key(s) 3 TTPs 46 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{422FFBCA-5AD4-4ECB-91FF-9CE7BA17D18F} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{142B44C5-AD36-4B40-AE45-BB3D84E0489F} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\MuiCache SearchHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5404 2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe 5404 2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe 5888 NJXYQ.exe 5888 NJXYQ.exe 5832 NMPJ.exe 5832 NMPJ.exe 2900 CCDAHQ.exe 2900 CCDAHQ.exe 6116 QNLZ.exe 6116 QNLZ.exe 2384 QIP.exe 2384 QIP.exe 1004 SGVPQR.exe 1004 SGVPQR.exe 2684 KOXUUWE.exe 2684 KOXUUWE.exe 3224 IZIKDC.exe 3224 IZIKDC.exe 5464 BCLGI.exe 5464 BCLGI.exe 2480 FKSOUKQ.exe 2480 FKSOUKQ.exe 1608 YCHZELY.exe 1608 YCHZELY.exe 1956 EYZ.exe 1956 EYZ.exe 5764 DWSDDUW.exe 5764 DWSDDUW.exe 2520 VRWYJJ.exe 2520 VRWYJJ.exe 4732 QMAITJU.exe 4732 QMAITJU.exe 1264 LKATVV.exe 1264 LKATVV.exe 5104 ENE.exe 5104 ENE.exe 5896 DCXSVQ.exe 5896 DCXSVQ.exe 3868 BNAIW.exe 3868 BNAIW.exe 2880 WJFSGWY.exe 2880 WJFSGWY.exe 564 VTIIPK.exe 564 VTIIPK.exe 1716 YBP.exe 1716 YBP.exe 1808 HPPE.exe 1808 HPPE.exe 864 KXVE.exe 864 KXVE.exe 4512 ONCEBS.exe 4512 ONCEBS.exe 2024 SVR.exe 2024 SVR.exe 4220 TYUIT.exe 4220 TYUIT.exe 4880 GWUU.exe 4880 GWUU.exe 5052 IUA.exe 5052 IUA.exe 1376 JXESQ.exe 1376 JXESQ.exe 3872 GCWHGF.exe 3872 GCWHGF.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 2332 explorer.exe Token: SeCreatePagefilePrivilege 2332 explorer.exe Token: SeShutdownPrivilege 2332 explorer.exe Token: SeCreatePagefilePrivilege 2332 explorer.exe Token: SeShutdownPrivilege 2332 explorer.exe Token: SeCreatePagefilePrivilege 2332 explorer.exe Token: SeShutdownPrivilege 2332 explorer.exe Token: SeCreatePagefilePrivilege 2332 explorer.exe Token: SeShutdownPrivilege 2332 explorer.exe Token: SeCreatePagefilePrivilege 2332 explorer.exe Token: SeShutdownPrivilege 2332 explorer.exe Token: SeCreatePagefilePrivilege 2332 explorer.exe Token: SeShutdownPrivilege 2332 explorer.exe Token: SeCreatePagefilePrivilege 2332 explorer.exe Token: SeShutdownPrivilege 2332 explorer.exe Token: SeCreatePagefilePrivilege 2332 explorer.exe Token: SeShutdownPrivilege 2332 explorer.exe Token: SeCreatePagefilePrivilege 2332 explorer.exe - Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 4484 sihost.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2332 explorer.exe 2332 explorer.exe 2332 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5404 2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe 5404 2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe 5888 NJXYQ.exe 5888 NJXYQ.exe 5832 NMPJ.exe 5832 NMPJ.exe 2900 CCDAHQ.exe 2900 CCDAHQ.exe 6116 QNLZ.exe 6116 QNLZ.exe 2384 QIP.exe 2384 QIP.exe 1004 SGVPQR.exe 1004 SGVPQR.exe 2684 KOXUUWE.exe 2684 KOXUUWE.exe 3224 IZIKDC.exe 3224 IZIKDC.exe 5464 BCLGI.exe 5464 BCLGI.exe 2480 FKSOUKQ.exe 2480 FKSOUKQ.exe 1608 YCHZELY.exe 1608 YCHZELY.exe 1956 EYZ.exe 1956 EYZ.exe 5764 DWSDDUW.exe 5764 DWSDDUW.exe 2520 VRWYJJ.exe 2520 VRWYJJ.exe 4732 QMAITJU.exe 4732 QMAITJU.exe 1264 LKATVV.exe 1264 LKATVV.exe 5104 ENE.exe 5104 ENE.exe 5896 DCXSVQ.exe 5896 DCXSVQ.exe 3868 BNAIW.exe 3868 BNAIW.exe 2880 WJFSGWY.exe 2880 WJFSGWY.exe 564 VTIIPK.exe 564 VTIIPK.exe 1716 YBP.exe 1716 YBP.exe 1808 HPPE.exe 1808 HPPE.exe 864 KXVE.exe 864 KXVE.exe 4512 ONCEBS.exe 4512 ONCEBS.exe 2024 SVR.exe 2024 SVR.exe 4220 TYUIT.exe 4220 TYUIT.exe 4880 GWUU.exe 4880 GWUU.exe 5052 IUA.exe 5052 IUA.exe 1376 JXESQ.exe 1376 JXESQ.exe 3872 GCWHGF.exe 3872 GCWHGF.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5404 wrote to memory of 5804 5404 2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe 88 PID 5804 wrote to memory of 5888 5804 cmd.exe 92 PID 5888 wrote to memory of 3988 5888 NJXYQ.exe 94 PID 3988 wrote to memory of 5832 3988 cmd.exe 98 PID 5832 wrote to memory of 5196 5832 NMPJ.exe 99 PID 5196 wrote to memory of 2900 5196 cmd.exe 103 PID 2900 wrote to memory of 5864 2900 CCDAHQ.exe 104 PID 5864 wrote to memory of 6116 5864 cmd.exe 108 PID 6116 wrote to memory of 2584 6116 QNLZ.exe 109 PID 2584 wrote to memory of 2384 2584 cmd.exe 113 PID 2384 wrote to memory of 5968 2384 QIP.exe 114 PID 5968 wrote to memory of 1004 5968 cmd.exe 118 PID 1004 wrote to memory of 5448 1004 SGVPQR.exe 119 PID 5448 wrote to memory of 2684 5448 cmd.exe 123 PID 2684 wrote to memory of 512 2684 KOXUUWE.exe 124 PID 512 wrote to memory of 3224 512 cmd.exe 128 PID 3224 wrote to memory of 5476 3224 IZIKDC.exe 129 PID 5476 wrote to memory of 5464 5476 cmd.exe 133 PID 5464 wrote to memory of 3336 5464 BCLGI.exe 134 PID 3336 wrote to memory of 2480 3336 cmd.exe 138 PID 2480 wrote to memory of 3856 2480 FKSOUKQ.exe 139 PID 3856 wrote to memory of 1608 3856 cmd.exe 143 PID 1608 wrote to memory of 5948 1608 YCHZELY.exe 144 PID 5948 wrote to memory of 1956 5948 cmd.exe 148 PID 1956 wrote to memory of 3968 1956 EYZ.exe 149 PID 3968 wrote to memory of 5764 3968 cmd.exe 153 PID 5764 wrote to memory of 5628 5764 DWSDDUW.exe 154 PID 5628 wrote to memory of 2520 5628 cmd.exe 158 PID 2520 wrote to memory of 2564 2520 VRWYJJ.exe 159 PID 2564 wrote to memory of 4732 2564 cmd.exe 163 PID 4732 wrote to memory of 2148 4732 QMAITJU.exe 164 PID 2148 wrote to memory of 1264 2148 cmd.exe 168 PID 1264 wrote to memory of 2156 1264 LKATVV.exe 169 PID 2156 wrote to memory of 5104 2156 cmd.exe 173 PID 5104 wrote to memory of 5952 5104 ENE.exe 174 PID 5952 wrote to memory of 5896 5952 cmd.exe 178 PID 5896 wrote to memory of 5276 5896 DCXSVQ.exe 179 PID 5276 wrote to memory of 3868 5276 cmd.exe 183 PID 3868 wrote to memory of 4308 3868 BNAIW.exe 184 PID 4308 wrote to memory of 2880 4308 cmd.exe 188 PID 2880 wrote to memory of 3172 2880 WJFSGWY.exe 189 PID 3172 wrote to memory of 564 3172 cmd.exe 192 PID 564 wrote to memory of 5216 564 VTIIPK.exe 194 PID 5216 wrote to memory of 1716 5216 cmd.exe 198 PID 1716 wrote to memory of 2340 1716 YBP.exe 199 PID 2340 wrote to memory of 1808 2340 cmd.exe 203 PID 1808 wrote to memory of 3688 1808 HPPE.exe 204 PID 3688 wrote to memory of 864 3688 cmd.exe 208 PID 864 wrote to memory of 2008 864 KXVE.exe 209 PID 2008 wrote to memory of 4512 2008 cmd.exe 213 PID 4512 wrote to memory of 2996 4512 ONCEBS.exe 214 PID 2996 wrote to memory of 2024 2996 cmd.exe 218 PID 2024 wrote to memory of 2448 2024 SVR.exe 219 PID 2448 wrote to memory of 4220 2448 cmd.exe 223 PID 4220 wrote to memory of 5140 4220 TYUIT.exe 224 PID 5140 wrote to memory of 4880 5140 cmd.exe 228 PID 4880 wrote to memory of 1924 4880 GWUU.exe 229 PID 1924 wrote to memory of 5052 1924 cmd.exe 233 PID 5052 wrote to memory of 476 5052 IUA.exe 234 PID 476 wrote to memory of 1376 476 cmd.exe 238 PID 1376 wrote to memory of 2628 1376 JXESQ.exe 239 PID 2628 wrote to memory of 3872 2628 cmd.exe 243 PID 3872 wrote to memory of 1068 3872 GCWHGF.exe 244 PID 1068 wrote to memory of 1860 1068 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_7b062c4c5784926e0d585a97e8152820_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NJXYQ.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\windows\SysWOW64\NJXYQ.exeC:\windows\system32\NJXYQ.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NMPJ.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\windows\NMPJ.exeC:\windows\NMPJ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CCDAHQ.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\windows\system\CCDAHQ.exeC:\windows\system\CCDAHQ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QNLZ.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\windows\system\QNLZ.exeC:\windows\system\QNLZ.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIP.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\windows\SysWOW64\QIP.exeC:\windows\system32\QIP.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SGVPQR.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\windows\SGVPQR.exeC:\windows\SGVPQR.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KOXUUWE.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\windows\KOXUUWE.exeC:\windows\KOXUUWE.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IZIKDC.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:512 -
C:\windows\IZIKDC.exeC:\windows\IZIKDC.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCLGI.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\windows\BCLGI.exeC:\windows\BCLGI.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKSOUKQ.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\windows\system\FKSOUKQ.exeC:\windows\system\FKSOUKQ.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCHZELY.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\windows\YCHZELY.exeC:\windows\YCHZELY.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYZ.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\windows\EYZ.exeC:\windows\EYZ.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWSDDUW.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\windows\system\DWSDDUW.exeC:\windows\system\DWSDDUW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VRWYJJ.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\windows\system\VRWYJJ.exeC:\windows\system\VRWYJJ.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QMAITJU.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\windows\SysWOW64\QMAITJU.exeC:\windows\system32\QMAITJU.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LKATVV.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\SysWOW64\LKATVV.exeC:\windows\system32\LKATVV.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ENE.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\windows\SysWOW64\ENE.exeC:\windows\system32\ENE.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCXSVQ.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\windows\SysWOW64\DCXSVQ.exeC:\windows\system32\DCXSVQ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BNAIW.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\windows\system\BNAIW.exeC:\windows\system\BNAIW.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WJFSGWY.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\windows\WJFSGWY.exeC:\windows\WJFSGWY.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTIIPK.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\windows\VTIIPK.exeC:\windows\VTIIPK.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YBP.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\windows\SysWOW64\YBP.exeC:\windows\system32\YBP.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HPPE.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\windows\system\HPPE.exeC:\windows\system\HPPE.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KXVE.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\windows\KXVE.exeC:\windows\KXVE.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ONCEBS.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\windows\system\ONCEBS.exeC:\windows\system\ONCEBS.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SVR.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\windows\SVR.exeC:\windows\SVR.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TYUIT.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\windows\TYUIT.exeC:\windows\TYUIT.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWUU.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\windows\GWUU.exeC:\windows\GWUU.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IUA.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\windows\system\IUA.exeC:\windows\system\IUA.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JXESQ.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:476 -
C:\windows\system\JXESQ.exeC:\windows\system\JXESQ.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCWHGF.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\windows\system\GCWHGF.exeC:\windows\system\GCWHGF.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYVICI.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\windows\MYVICI.exeC:\windows\MYVICI.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QGCIPB.exe.bat" "66⤵PID:2316
-
C:\windows\SysWOW64\QGCIPB.exeC:\windows\system32\QGCIPB.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBLU.exe.bat" "68⤵PID:4156
-
C:\windows\SysWOW64\FBLU.exeC:\windows\system32\FBLU.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FEPQND.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1704 -
C:\windows\SysWOW64\FEPQND.exeC:\windows\system32\FEPQND.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YHBTTTW.exe.bat" "72⤵PID:5660
-
C:\windows\YHBTTTW.exeC:\windows\YHBTTTW.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPITFLK.exe.bat" "74⤵PID:3108
-
C:\windows\CPITFLK.exeC:\windows\CPITFLK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DSLP.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\windows\DSLP.exeC:\windows\DSLP.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VVPTYZ.exe.bat" "78⤵
- System Location Discovery: System Language Discovery
PID:960 -
C:\windows\SysWOW64\VVPTYZ.exeC:\windows\system32\VVPTYZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LLQS.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:5900 -
C:\windows\system\LLQS.exeC:\windows\system\LLQS.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VBWF.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5984 -
C:\windows\SysWOW64\VBWF.exeC:\windows\system32\VBWF.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILMDAGO.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:584 -
C:\windows\system\ILMDAGO.exeC:\windows\system\ILMDAGO.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OHLE.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:296 -
C:\windows\OHLE.exeC:\windows\OHLE.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QFRYMRM.exe.bat" "88⤵PID:2800
-
C:\windows\system\QFRYMRM.exeC:\windows\system\QFRYMRM.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RIVCSH.exe.bat" "90⤵PID:5576
-
C:\windows\system\RIVCSH.exeC:\windows\system\RIVCSH.exe91⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WICQBB.exe.bat" "92⤵PID:3252
-
C:\windows\WICQBB.exeC:\windows\WICQBB.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KLTGPM.exe.bat" "94⤵PID:5024
-
C:\windows\SysWOW64\KLTGPM.exeC:\windows\system32\KLTGPM.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTNUSKM.exe.bat" "96⤵
- System Location Discovery: System Language Discovery
PID:1280 -
C:\windows\system\BTNUSKM.exeC:\windows\system\BTNUSKM.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3064 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FBBUF.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3048 -
C:\windows\SysWOW64\FBBUF.exeC:\windows\system32\FBBUF.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEFP.exe.bat" "100⤵PID:2988
-
C:\windows\YEFP.exeC:\windows\YEFP.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PEHCV.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:2184 -
C:\windows\SysWOW64\PEHCV.exeC:\windows\system32\PEHCV.exe103⤵
- Executes dropped EXE
PID:4740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JAMMYXB.exe.bat" "104⤵PID:4788
-
C:\windows\JAMMYXB.exeC:\windows\JAMMYXB.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4828 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VSUXPQJ.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:5752 -
C:\windows\system\VSUXPQJ.exeC:\windows\system\VSUXPQJ.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDWN.exe.bat" "108⤵PID:1516
-
C:\windows\system\TDWN.exeC:\windows\system\TDWN.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UGI.exe.bat" "110⤵PID:1420
-
C:\windows\SysWOW64\UGI.exeC:\windows\system32\UGI.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HRRHRF.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2460 -
C:\windows\system\HRRHRF.exeC:\windows\system\HRRHRF.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IHYQUPS.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:3348 -
C:\windows\IHYQUPS.exeC:\windows\IHYQUPS.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2932 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VSHPISN.exe.bat" "116⤵PID:4528
-
C:\windows\VSHPISN.exeC:\windows\VSHPISN.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LII.exe.bat" "118⤵PID:5484
-
C:\windows\LII.exeC:\windows\LII.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ADZKAA.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:3776 -
C:\windows\SysWOW64\ADZKAA.exeC:\windows\system32\ADZKAA.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-