Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe
- Size 448KB
- Sample260701-ceqtyact6p
- SHA256 1b1b715c6c5930315461f7f0fbc33b936c650405bf173fe924f6725120bf592f
- MD5 faca10845e61b8b0318f716ae5a476fb
- SHA1 4fcaaceab8d15c317cdc5a7928f759219040a086
- SHA512 ea0569c11ccb379211cd8156f40af31f42186489f260b9a567d6ecddfc09ac95476dbfee7a16bad5c6637801124655f7dc6856141e60309a8450b4bf3976f872
- SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUS+LO9kEjiPISUOgW9X+hOGzC/NM:RLWI09QZb6LO9kmZzcukG2/
- TLSH T168A49F20B9D58673E2630135689AF1A4B3BABCA0F765C28B3158B71C2773B90173E75D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5028 JWPATR.exe 1388 SUJB.exe 3928 BCLGI.exe 4384 LARAXBL.exe 3000 YCHZELY.exe 2292 EYZ.exe 1028 DWSDDUW.exe 2228 XJXM.exe 1936 DEWNKW.exe 5976 TZFZ.exe 2896 CAHEH.exe 3564 MXNZO.exe 4136 OVSLWXU.exe 2572 IIXU.exe 2084 DECMQX.exe 4076 EZGHW.exe 2852 IPVHIFV.exe 912 OKM.exe 5832 IXRAP.exe 5988 MFXA.exe 3916 EOMF.exe 5452 HWSFAKM.exe 796 DBARC.exe 1416 SXK.exe 1736 SCKJ.exe 4192 WSQRIF.exe 5548 JDZIXQ.exe 3500 BDB.exe 4532 ETHVM.exe 2720 OJVQU.exe 4260 CPV.exe 2024 GXCBI.exe 2128 ASHLSSU.exe 5960 EANTE.exe 696 KWMTBFF.exe 5568 ARW.exe 5036 UEBHWSV.exe 2340 VHEL.exe 2604 OKIHPG.exe 6008 TKQ.exe 4108 TQQJ.exe 692 ODVAKN.exe 2288 ATB.exe 940 LMET.exe 3380 GZJCPM.exe 1884 KHQ.exe 1688 OXX.exe 1896 IKBUQ.exe 3128 DYGDAX.exe 1480 OQBWAE.exe 4320 JBSNO.exe 256 EOWEZHE.exe 4844 KKW.exe 5460 OSCFPCH.exe 4872 LSEPTGY.exe 1356 HYWFJ.exe 3412 SQZPSJ.exe 5972 KZT.exe 5324 ZULHGB.exe 2388 IUFM.exe 6016 OUMA.exe 6104 OINOC.exe 4888 JVRXMNG.exe 2236 YQBK.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\QKS.exe KJKDGH.exe File created C:\windows\SysWOW64\OQBWAE.exe.bat DYGDAX.exe File opened for modification C:\windows\SysWOW64\QKS.exe KJKDGH.exe File created C:\windows\SysWOW64\QKS.exe.bat KJKDGH.exe File created C:\windows\SysWOW64\MFA.exe.bat RSVLGZR.exe File created C:\windows\SysWOW64\WCBHQB.exe.bat AFVKJS.exe File created C:\windows\SysWOW64\MFA.exe RSVLGZR.exe File created C:\windows\SysWOW64\OEGJRVH.exe UGN.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe AFVKJS.exe File created C:\windows\SysWOW64\HWSFAKM.exe.bat EOMF.exe File created C:\windows\SysWOW64\BDB.exe.bat JDZIXQ.exe File created C:\windows\SysWOW64\EANTE.exe ASHLSSU.exe File created C:\windows\SysWOW64\JWPATR.exe 2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe File created C:\windows\SysWOW64\JWPATR.exe.bat 2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe File opened for modification C:\windows\SysWOW64\TZFZ.exe DEWNKW.exe File opened for modification C:\windows\SysWOW64\KKW.exe EOWEZHE.exe File created C:\windows\SysWOW64\XAZK.exe YQQ.exe File created C:\windows\SysWOW64\CAHEH.exe TZFZ.exe File opened for modification C:\windows\SysWOW64\CAHEH.exe TZFZ.exe File opened for modification C:\windows\SysWOW64\JDZIXQ.exe WSQRIF.exe File created C:\windows\SysWOW64\DGZMRPD.exe PJBPCFJ.exe File created C:\windows\SysWOW64\DGZMRPD.exe.bat PJBPCFJ.exe File created C:\windows\SysWOW64\WCBHQB.exe AFVKJS.exe File created C:\windows\SysWOW64\VHRCI.exe.bat BLM.exe File opened for modification C:\windows\SysWOW64\NVGMM.exe WPVUW.exe File created C:\windows\SysWOW64\TKQ.exe OKIHPG.exe File created C:\windows\SysWOW64\KJKDGH.exe.bat EJCQX.exe File created C:\windows\SysWOW64\YNJXNHW.exe.bat NVGMM.exe File created C:\windows\SysWOW64\TOGV.exe IVLKQ.exe File opened for modification C:\windows\SysWOW64\XAZK.exe YQQ.exe File created C:\windows\SysWOW64\IPVHIFV.exe.bat EZGHW.exe File created C:\windows\SysWOW64\JDZIXQ.exe.bat WSQRIF.exe File opened for modification C:\windows\SysWOW64\OQBWAE.exe DYGDAX.exe File created C:\windows\SysWOW64\KJKDGH.exe EJCQX.exe File opened for modification C:\windows\SysWOW64\OEGJRVH.exe UGN.exe File created C:\windows\SysWOW64\OEGJRVH.exe.bat UGN.exe File created C:\windows\SysWOW64\NVGMM.exe WPVUW.exe File created C:\windows\SysWOW64\XJXM.exe DWSDDUW.exe File created C:\windows\SysWOW64\XJXM.exe.bat DWSDDUW.exe File created C:\windows\SysWOW64\EANTE.exe.bat ASHLSSU.exe File created C:\windows\SysWOW64\GVQ.exe QKS.exe File opened for modification C:\windows\SysWOW64\TOGV.exe IVLKQ.exe File created C:\windows\SysWOW64\TOGV.exe.bat IVLKQ.exe File opened for modification C:\windows\SysWOW64\XJXM.exe DWSDDUW.exe File created C:\windows\SysWOW64\TKQ.exe.bat OKIHPG.exe File opened for modification C:\windows\SysWOW64\GVQ.exe QKS.exe File created C:\windows\SysWOW64\NVGMM.exe.bat WPVUW.exe File created C:\windows\SysWOW64\KHQ.exe.bat GZJCPM.exe File created C:\windows\SysWOW64\AFVKJS.exe.bat UEOW.exe File opened for modification C:\windows\SysWOW64\YNJXNHW.exe NVGMM.exe File created C:\windows\SysWOW64\DBARC.exe HWSFAKM.exe File opened for modification C:\windows\SysWOW64\DBARC.exe HWSFAKM.exe File opened for modification C:\windows\SysWOW64\EANTE.exe ASHLSSU.exe File created C:\windows\SysWOW64\LMET.exe.bat ATB.exe File created C:\windows\SysWOW64\KHQ.exe GZJCPM.exe File created C:\windows\SysWOW64\OQBWAE.exe DYGDAX.exe File created C:\windows\SysWOW64\MXNYLOD.exe VPLLZR.exe File created C:\windows\SysWOW64\IPVHIFV.exe EZGHW.exe File created C:\windows\SysWOW64\LMET.exe ATB.exe File opened for modification C:\windows\SysWOW64\KHQ.exe GZJCPM.exe File opened for modification C:\windows\SysWOW64\KJKDGH.exe EJCQX.exe File opened for modification C:\windows\SysWOW64\MFA.exe RSVLGZR.exe File opened for modification C:\windows\SysWOW64\JWPATR.exe 2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe File created C:\windows\SysWOW64\MXNYLOD.exe.bat VPLLZR.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\windows\VHEL.exe UEBHWSV.exe File opened for modification C:\windows\ODVAKN.exe TQQJ.exe File created C:\windows\GZJCPM.exe LMET.exe File created C:\windows\OSCFPCH.exe KKW.exe File opened for modification C:\windows\EBNYQC.exe STGY.exe File opened for modification C:\windows\system\SGCBPEE.exe MLLAL.exe File created C:\windows\WPVUW.exe.bat WCVG.exe File opened for modification C:\windows\system\WSQRIF.exe SCKJ.exe File opened for modification C:\windows\system\ETHVM.exe BDB.exe File created C:\windows\system\GXCBI.exe CPV.exe File created C:\windows\system\ARW.exe.bat KWMTBFF.exe File opened for modification C:\windows\GZJCPM.exe LMET.exe File opened for modification C:\windows\LSEPTGY.exe OSCFPCH.exe File opened for modification C:\windows\system\KZT.exe SQZPSJ.exe File opened for modification C:\windows\system\UTAJ.exe MFA.exe File created C:\windows\system\MFXA.exe.bat IXRAP.exe File opened for modification C:\windows\KWMTBFF.exe EANTE.exe File opened for modification C:\windows\UEBHWSV.exe ARW.exe File created C:\windows\EBNYQC.exe STGY.exe File created C:\windows\UEOW.exe OEGJRVH.exe File opened for modification C:\windows\LARAXBL.exe BCLGI.exe File opened for modification C:\windows\system\DWSDDUW.exe EYZ.exe File opened for modification C:\windows\OKM.exe IPVHIFV.exe File created C:\windows\DYGDAX.exe.bat IKBUQ.exe File created C:\windows\system\XPEX.exe.bat PJL.exe File created C:\windows\LROY.exe EBNYQC.exe File created C:\windows\IVLKQ.exe.bat YNJXNHW.exe File opened for modification C:\windows\EYZ.exe YCHZELY.exe File created C:\windows\system\GXCBI.exe.bat CPV.exe File created C:\windows\system\JBSNO.exe OQBWAE.exe File created C:\windows\system\SGCBPEE.exe MLLAL.exe File created C:\windows\system\WCVG.exe.bat VHRCI.exe File opened for modification C:\windows\system\MXNZO.exe CAHEH.exe File created C:\windows\OKM.exe IPVHIFV.exe File created C:\windows\IXRAP.exe.bat OKM.exe File opened for modification C:\windows\system\ARW.exe KWMTBFF.exe File created C:\windows\system\SQZPSJ.exe HYWFJ.exe File created C:\windows\BIVQZ.exe GVQ.exe File opened for modification C:\windows\system\YAUBXYB.exe WCBHQB.exe File opened for modification C:\windows\system\BLM.exe SGCBPEE.exe File opened for modification C:\windows\OVSLWXU.exe MXNZO.exe File created C:\windows\system\SUJB.exe JWPATR.exe File created C:\windows\system\SUJB.exe.bat JWPATR.exe File created C:\windows\VHEL.exe.bat UEBHWSV.exe File created C:\windows\IKBUQ.exe OXX.exe File opened for modification C:\windows\DYGDAX.exe IKBUQ.exe File created C:\windows\system\SQZPSJ.exe.bat HYWFJ.exe File created C:\windows\system\XPEX.exe PJL.exe File created C:\windows\YCHZELY.exe LARAXBL.exe File opened for modification C:\windows\system\MFXA.exe IXRAP.exe File created C:\windows\KWMTBFF.exe EANTE.exe File opened for modification C:\windows\system\XPEX.exe PJL.exe File opened for modification C:\windows\system\SVF.exe BIVQZ.exe File created C:\windows\IVLKQ.exe YNJXNHW.exe File created C:\windows\OXX.exe.bat KHQ.exe File created C:\windows\system\SVF.exe.bat BIVQZ.exe File opened for modification C:\windows\SCKJ.exe SXK.exe File created C:\windows\OJVQU.exe.bat ETHVM.exe File opened for modification C:\windows\system\CPV.exe OJVQU.exe File created C:\windows\system\CPV.exe.bat OJVQU.exe File created C:\windows\BIVQZ.exe.bat GVQ.exe File opened for modification C:\windows\WPVUW.exe WCVG.exe File opened for modification C:\windows\system\EOMF.exe MFXA.exe File opened for modification C:\windows\system\OKIHPG.exe VHEL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 2412 1972 WerFault.exe 87 4112 5028 WerFault.exe 92 876 1388 WerFault.exe 98 2584 3928 WerFault.exe 103 5620 4384 WerFault.exe 108 808 3000 WerFault.exe 113 4764 2292 WerFault.exe 118 892 1028 WerFault.exe 123 4824 2228 WerFault.exe 128 6020 1936 WerFault.exe 132 6080 5976 WerFault.exe 138 2496 2896 WerFault.exe 143 5516 3564 WerFault.exe 148 540 4136 WerFault.exe 153 5268 2572 WerFault.exe 158 2320 2084 WerFault.exe 163 3420 4076 WerFault.exe 168 2332 2852 WerFault.exe 173 3456 912 WerFault.exe 178 940 5832 WerFault.exe 183 2884 5988 WerFault.exe 188 3416 3916 WerFault.exe 193 3156 5452 WerFault.exe 198 4512 796 WerFault.exe 203 3728 1416 WerFault.exe 208 1568 1736 WerFault.exe 213 1596 4192 WerFault.exe 218 6104 5548 WerFault.exe 223 3600 3500 WerFault.exe 228 108 4532 WerFault.exe 233 4476 2720 WerFault.exe 238 3784 4260 WerFault.exe 243 3268 2024 WerFault.exe 248 1672 2128 WerFault.exe 253 4460 5960 WerFault.exe 258 3080 696 WerFault.exe 263 4480 5568 WerFault.exe 268 1480 5036 WerFault.exe 273 5888 2340 WerFault.exe 279 5856 2604 WerFault.exe 284 5108 6008 WerFault.exe 289 5124 4108 WerFault.exe 294 4416 692 WerFault.exe 299 4128 2288 WerFault.exe 304 1516 940 WerFault.exe 309 2824 3380 WerFault.exe 314 2736 1884 WerFault.exe 319 1396 1688 WerFault.exe 324 4636 1896 WerFault.exe 329 4528 3128 WerFault.exe 334 1860 1480 WerFault.exe 339 4880 4320 WerFault.exe 344 3484 256 WerFault.exe 349 2848 4844 WerFault.exe 354 5956 5460 WerFault.exe 359 2112 4872 WerFault.exe 364 3876 1356 WerFault.exe 369 2116 3412 WerFault.exe 374 1212 5972 WerFault.exe 379 3116 5324 WerFault.exe 384 1592 2388 WerFault.exe 389 5128 6016 WerFault.exe 394 3484 6104 WerFault.exe 399 2864 4888 WerFault.exe 404 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOMF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LMET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VPLLZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EJCQX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OEGJRVH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWPATR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EZGHW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YAUBXYB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IPVHIFV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KWMTBFF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OINOC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MLLAL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWSFAKM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EANTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EOWEZHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LROY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VHRCI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYWFJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGCBPEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WPVUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YQBK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVLKQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JBSNO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KKW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PJL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XJXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DGZMRPD.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1972 2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe 1972 2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe 5028 JWPATR.exe 5028 JWPATR.exe 1388 SUJB.exe 1388 SUJB.exe 3928 BCLGI.exe 3928 BCLGI.exe 4384 LARAXBL.exe 4384 LARAXBL.exe 3000 YCHZELY.exe 3000 YCHZELY.exe 2292 EYZ.exe 2292 EYZ.exe 1028 DWSDDUW.exe 1028 DWSDDUW.exe 2228 XJXM.exe 2228 XJXM.exe 1936 DEWNKW.exe 1936 DEWNKW.exe 5976 TZFZ.exe 5976 TZFZ.exe 2896 CAHEH.exe 2896 CAHEH.exe 3564 MXNZO.exe 3564 MXNZO.exe 4136 OVSLWXU.exe 4136 OVSLWXU.exe 2572 IIXU.exe 2572 IIXU.exe 2084 DECMQX.exe 2084 DECMQX.exe 4076 EZGHW.exe 4076 EZGHW.exe 2852 IPVHIFV.exe 2852 IPVHIFV.exe 912 OKM.exe 912 OKM.exe 5832 IXRAP.exe 5832 IXRAP.exe 5988 MFXA.exe 5988 MFXA.exe 3916 EOMF.exe 3916 EOMF.exe 5452 HWSFAKM.exe 5452 HWSFAKM.exe 796 DBARC.exe 796 DBARC.exe 1416 SXK.exe 1416 SXK.exe 1736 SCKJ.exe 1736 SCKJ.exe 4192 WSQRIF.exe 4192 WSQRIF.exe 5548 JDZIXQ.exe 5548 JDZIXQ.exe 3500 BDB.exe 3500 BDB.exe 4532 ETHVM.exe 4532 ETHVM.exe 2720 OJVQU.exe 2720 OJVQU.exe 4260 CPV.exe 4260 CPV.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1972 2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe 1972 2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe 5028 JWPATR.exe 5028 JWPATR.exe 1388 SUJB.exe 1388 SUJB.exe 3928 BCLGI.exe 3928 BCLGI.exe 4384 LARAXBL.exe 4384 LARAXBL.exe 3000 YCHZELY.exe 3000 YCHZELY.exe 2292 EYZ.exe 2292 EYZ.exe 1028 DWSDDUW.exe 1028 DWSDDUW.exe 2228 XJXM.exe 2228 XJXM.exe 1936 DEWNKW.exe 1936 DEWNKW.exe 5976 TZFZ.exe 5976 TZFZ.exe 2896 CAHEH.exe 2896 CAHEH.exe 3564 MXNZO.exe 3564 MXNZO.exe 4136 OVSLWXU.exe 4136 OVSLWXU.exe 2572 IIXU.exe 2572 IIXU.exe 2084 DECMQX.exe 2084 DECMQX.exe 4076 EZGHW.exe 4076 EZGHW.exe 2852 IPVHIFV.exe 2852 IPVHIFV.exe 912 OKM.exe 912 OKM.exe 5832 IXRAP.exe 5832 IXRAP.exe 5988 MFXA.exe 5988 MFXA.exe 3916 EOMF.exe 3916 EOMF.exe 5452 HWSFAKM.exe 5452 HWSFAKM.exe 796 DBARC.exe 796 DBARC.exe 1416 SXK.exe 1416 SXK.exe 1736 SCKJ.exe 1736 SCKJ.exe 4192 WSQRIF.exe 4192 WSQRIF.exe 5548 JDZIXQ.exe 5548 JDZIXQ.exe 3500 BDB.exe 3500 BDB.exe 4532 ETHVM.exe 4532 ETHVM.exe 2720 OJVQU.exe 2720 OJVQU.exe 4260 CPV.exe 4260 CPV.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1628 1972 2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe 88 PID 1628 wrote to memory of 5028 1628 cmd.exe 92 PID 5028 wrote to memory of 456 5028 JWPATR.exe 94 PID 456 wrote to memory of 1388 456 cmd.exe 98 PID 1388 wrote to memory of 1080 1388 SUJB.exe 99 PID 1080 wrote to memory of 3928 1080 cmd.exe 103 PID 3928 wrote to memory of 2148 3928 BCLGI.exe 104 PID 2148 wrote to memory of 4384 2148 cmd.exe 108 PID 4384 wrote to memory of 5668 4384 LARAXBL.exe 109 PID 5668 wrote to memory of 3000 5668 cmd.exe 113 PID 3000 wrote to memory of 4632 3000 YCHZELY.exe 114 PID 4632 wrote to memory of 2292 4632 cmd.exe 118 PID 2292 wrote to memory of 2368 2292 EYZ.exe 119 PID 2368 wrote to memory of 1028 2368 cmd.exe 123 PID 1028 wrote to memory of 4676 1028 DWSDDUW.exe 124 PID 4676 wrote to memory of 2228 4676 cmd.exe 128 PID 2228 wrote to memory of 5644 2228 XJXM.exe 129 PID 5644 wrote to memory of 1936 5644 cmd.exe 132 PID 1936 wrote to memory of 1044 1936 DEWNKW.exe 134 PID 1044 wrote to memory of 5976 1044 cmd.exe 138 PID 5976 wrote to memory of 5372 5976 TZFZ.exe 139 PID 5372 wrote to memory of 2896 5372 cmd.exe 143 PID 2896 wrote to memory of 1056 2896 CAHEH.exe 144 PID 1056 wrote to memory of 3564 1056 cmd.exe 148 PID 3564 wrote to memory of 4752 3564 MXNZO.exe 149 PID 4752 wrote to memory of 4136 4752 cmd.exe 153 PID 4136 wrote to memory of 5624 4136 OVSLWXU.exe 154 PID 5624 wrote to memory of 2572 5624 cmd.exe 158 PID 2572 wrote to memory of 5780 2572 IIXU.exe 159 PID 5780 wrote to memory of 2084 5780 cmd.exe 163 PID 2084 wrote to memory of 1324 2084 DECMQX.exe 164 PID 1324 wrote to memory of 4076 1324 cmd.exe 168 PID 4076 wrote to memory of 2868 4076 EZGHW.exe 169 PID 2868 wrote to memory of 2852 2868 cmd.exe 173 PID 2852 wrote to memory of 4492 2852 IPVHIFV.exe 174 PID 4492 wrote to memory of 912 4492 cmd.exe 178 PID 912 wrote to memory of 1576 912 OKM.exe 179 PID 1576 wrote to memory of 5832 1576 cmd.exe 183 PID 5832 wrote to memory of 2632 5832 IXRAP.exe 184 PID 2632 wrote to memory of 5988 2632 cmd.exe 188 PID 5988 wrote to memory of 1636 5988 MFXA.exe 189 PID 1636 wrote to memory of 3916 1636 cmd.exe 193 PID 3916 wrote to memory of 1708 3916 EOMF.exe 194 PID 1708 wrote to memory of 5452 1708 cmd.exe 198 PID 5452 wrote to memory of 1856 5452 HWSFAKM.exe 199 PID 1856 wrote to memory of 796 1856 cmd.exe 203 PID 796 wrote to memory of 5692 796 DBARC.exe 204 PID 5692 wrote to memory of 1416 5692 cmd.exe 208 PID 1416 wrote to memory of 3828 1416 SXK.exe 209 PID 3828 wrote to memory of 1736 3828 cmd.exe 213 PID 1736 wrote to memory of 2816 1736 SCKJ.exe 214 PID 2816 wrote to memory of 4192 2816 cmd.exe 218 PID 4192 wrote to memory of 1720 4192 WSQRIF.exe 219 PID 1720 wrote to memory of 5548 1720 cmd.exe 223 PID 5548 wrote to memory of 4816 5548 JDZIXQ.exe 224 PID 4816 wrote to memory of 3500 4816 cmd.exe 228 PID 3500 wrote to memory of 956 3500 BDB.exe 229 PID 956 wrote to memory of 4532 956 cmd.exe 233 PID 4532 wrote to memory of 5652 4532 ETHVM.exe 234 PID 5652 wrote to memory of 2720 5652 cmd.exe 238 PID 2720 wrote to memory of 5656 2720 OJVQU.exe 239 PID 5656 wrote to memory of 4260 5656 cmd.exe 243 PID 4260 wrote to memory of 5648 4260 CPV.exe 244 PID 5648 wrote to memory of 2024 5648 cmd.exe 248
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_faca10845e61b8b0318f716ae5a476fb_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JWPATR.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\windows\SysWOW64\JWPATR.exeC:\windows\system32\JWPATR.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SUJB.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\windows\system\SUJB.exeC:\windows\system\SUJB.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BCLGI.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\windows\BCLGI.exeC:\windows\BCLGI.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LARAXBL.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\windows\LARAXBL.exeC:\windows\LARAXBL.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YCHZELY.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\windows\YCHZELY.exeC:\windows\YCHZELY.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EYZ.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\windows\EYZ.exeC:\windows\EYZ.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWSDDUW.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\windows\system\DWSDDUW.exeC:\windows\system\DWSDDUW.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XJXM.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\windows\SysWOW64\XJXM.exeC:\windows\system32\XJXM.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DEWNKW.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\windows\DEWNKW.exeC:\windows\DEWNKW.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZFZ.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\windows\SysWOW64\TZFZ.exeC:\windows\system32\TZFZ.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CAHEH.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\windows\SysWOW64\CAHEH.exeC:\windows\system32\CAHEH.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MXNZO.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\windows\system\MXNZO.exeC:\windows\system\MXNZO.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OVSLWXU.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\windows\OVSLWXU.exeC:\windows\OVSLWXU.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IIXU.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\windows\IIXU.exeC:\windows\IIXU.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DECMQX.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\system\DECMQX.exeC:\windows\system\DECMQX.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EZGHW.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\windows\system\EZGHW.exeC:\windows\system\EZGHW.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IPVHIFV.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\windows\SysWOW64\IPVHIFV.exeC:\windows\system32\IPVHIFV.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKM.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\windows\OKM.exeC:\windows\OKM.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IXRAP.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\windows\IXRAP.exeC:\windows\IXRAP.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MFXA.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\windows\system\MFXA.exeC:\windows\system\MFXA.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EOMF.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\windows\system\EOMF.exeC:\windows\system\EOMF.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HWSFAKM.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\windows\SysWOW64\HWSFAKM.exeC:\windows\system32\HWSFAKM.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DBARC.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\windows\SysWOW64\DBARC.exeC:\windows\system32\DBARC.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SXK.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\windows\system\SXK.exeC:\windows\system\SXK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCKJ.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\windows\SCKJ.exeC:\windows\SCKJ.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSQRIF.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\windows\system\WSQRIF.exeC:\windows\system\WSQRIF.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JDZIXQ.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\windows\SysWOW64\JDZIXQ.exeC:\windows\system32\JDZIXQ.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BDB.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\windows\SysWOW64\BDB.exeC:\windows\system32\BDB.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ETHVM.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:956 -
C:\windows\system\ETHVM.exeC:\windows\system\ETHVM.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OJVQU.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\windows\OJVQU.exeC:\windows\OJVQU.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CPV.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\windows\system\CPV.exeC:\windows\system\CPV.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GXCBI.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\windows\system\GXCBI.exeC:\windows\system\GXCBI.exe65⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ASHLSSU.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4180 -
C:\windows\system\ASHLSSU.exeC:\windows\system\ASHLSSU.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EANTE.exe.bat" "68⤵PID:2884
-
C:\windows\SysWOW64\EANTE.exeC:\windows\system32\EANTE.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KWMTBFF.exe.bat" "70⤵PID:1228
-
C:\windows\KWMTBFF.exeC:\windows\KWMTBFF.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ARW.exe.bat" "72⤵PID:3560
-
C:\windows\system\ARW.exeC:\windows\system\ARW.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5568 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UEBHWSV.exe.bat" "74⤵PID:2104
-
C:\windows\UEBHWSV.exeC:\windows\UEBHWSV.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VHEL.exe.bat" "76⤵PID:5360
-
C:\windows\VHEL.exeC:\windows\VHEL.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2340 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OKIHPG.exe.bat" "78⤵PID:5252
-
C:\windows\system\OKIHPG.exeC:\windows\system\OKIHPG.exe79⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TKQ.exe.bat" "80⤵PID:2968
-
C:\windows\SysWOW64\TKQ.exeC:\windows\system32\TKQ.exe81⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TQQJ.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:3076 -
C:\windows\system\TQQJ.exeC:\windows\system\TQQJ.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3940 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe85⤵
- Executes dropped EXE
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ATB.exe.bat" "86⤵PID:4776
-
C:\windows\system\ATB.exeC:\windows\system\ATB.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LMET.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:5060 -
C:\windows\SysWOW64\LMET.exeC:\windows\system32\LMET.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:940 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GZJCPM.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4824 -
C:\windows\GZJCPM.exeC:\windows\GZJCPM.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KHQ.exe.bat" "92⤵PID:3204
-
C:\windows\SysWOW64\KHQ.exeC:\windows\system32\KHQ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXX.exe.bat" "94⤵PID:1632
-
C:\windows\OXX.exeC:\windows\OXX.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IKBUQ.exe.bat" "96⤵PID:1124
-
C:\windows\IKBUQ.exeC:\windows\IKBUQ.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYGDAX.exe.bat" "98⤵PID:2056
-
C:\windows\DYGDAX.exeC:\windows\DYGDAX.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OQBWAE.exe.bat" "100⤵PID:3752
-
C:\windows\SysWOW64\OQBWAE.exeC:\windows\system32\OQBWAE.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBSNO.exe.bat" "102⤵PID:2152
-
C:\windows\system\JBSNO.exeC:\windows\system\JBSNO.exe103⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EOWEZHE.exe.bat" "104⤵PID:6004
-
C:\windows\EOWEZHE.exeC:\windows\EOWEZHE.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KKW.exe.bat" "106⤵
- System Location Discovery: System Language Discovery
PID:2524 -
C:\windows\SysWOW64\KKW.exeC:\windows\system32\KKW.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OSCFPCH.exe.bat" "108⤵PID:5364
-
C:\windows\OSCFPCH.exeC:\windows\OSCFPCH.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LSEPTGY.exe.bat" "110⤵PID:5552
-
C:\windows\LSEPTGY.exeC:\windows\LSEPTGY.exe111⤵
- Executes dropped EXE
PID:4872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYWFJ.exe.bat" "112⤵PID:468
-
C:\windows\HYWFJ.exeC:\windows\HYWFJ.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SQZPSJ.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:6060 -
C:\windows\system\SQZPSJ.exeC:\windows\system\SQZPSJ.exe115⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZT.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\windows\system\KZT.exeC:\windows\system\KZT.exe117⤵
- Executes dropped EXE
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZULHGB.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:5520 -
C:\windows\system\ZULHGB.exeC:\windows\system\ZULHGB.exe119⤵
- Executes dropped EXE
PID:5324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IUFM.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5612 -
C:\windows\system\IUFM.exeC:\windows\system\IUFM.exe121⤵
- Executes dropped EXE
PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-