Analysis
- max time kernel
55s - max time network
100s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 10:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe
- Size 208KB
- Sample260715-mdkxeahx2q
- SHA256 28d948ffe0e9d0e4486cd3cedead993179767d4179ac8685177b235a54afa64f
- MD5 34dbd9d6165b676f3fe67a318456ff0d
- SHA1 e515cdbbb8a55bf6f3c75a0f08f5693ecd3e3b86
- SHA512 d515b250c71ddb4fdf7f376765c99cfa8512a516c7108931b2ee210f46d6c9a4e8084f5baf114b9ed8c61a173edfa4cbea84a180ce198a2a40920425ad3fc691
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfD4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOLQEj6
- TLSH T1CC247D2235D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3380 WAOU.exe 4928 GTX.exe 5444 SIRU.exe 1212 YWQVI.exe 4144 PJANYAK.exe 6120 PPA.exe 5248 CZJSOP.exe 468 UALFRNC.exe 2304 MDPBXL.exe 4864 HQT.exe 4984 SJWD.exe 4360 WZDLBKE.exe 2756 HRY.exe 4868 WMPIVE.exe 1660 ICW.exe 4436 SDYN.exe 5684 SGC.exe 4196 JQFHY.exe 5720 WTJFEP.exe 3468 HZMLQWL.exe 5880 JPN.exe 1232 GULCEUW.exe 2524 WSSFPOL.exe 3548 KVO.exe 5624 ALV.exe 4400 CJO.exe 4668 NBRJNVS.exe 5108 BMV.exe 3652 MJYN.exe 3020 OHAIL.exe 3112 IVERVQL.exe 4364 QFFSJUZ.exe 4136 VQJZOL.exe 2688 XOCTMA.exe 4428 KRG.exe 4552 KJP.exe 2740 ORJBIC.exe 2976 FHIMUW.exe 2400 DXPOG.exe 3008 SCVLNRN.exe 1412 KGMPRWW.exe 2324 XIIVWN.exe 2808 XBRPKR.exe 5288 KENVPIA.exe 4956 BUTYTCP.exe 4600 ZRSJFOW.exe 1040 FUW.exe 4480 XXOLOK.exe 1028 UDTIWTC.exe 1732 OQYR.exe 5636 LWWP.exe 2240 AROTYQB.exe 4912 TMRXLF.exe 3860 KUTCPLF.exe 6048 DXXF.exe 3816 HFE.exe 4560 WVFFN.exe 2680 RJKOXH.exe 5356 GMTT.exe 2332 PMVYMZ.exe 404 IFYQUGY.exe 3580 QAHVF.exe 1988 SXBXL.exe 3212 QNHAX.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\HZMLQWL.exe WTJFEP.exe File created C:\windows\SysWOW64\SJWD.exe HQT.exe File created C:\windows\SysWOW64\HRY.exe.bat WZDLBKE.exe File created C:\windows\SysWOW64\MJYN.exe BMV.exe File created C:\windows\SysWOW64\KJP.exe.bat KRG.exe File opened for modification C:\windows\SysWOW64\FITL.exe UKH.exe File created C:\windows\SysWOW64\FITL.exe.bat UKH.exe File created C:\windows\SysWOW64\WZDLBKE.exe.bat SJWD.exe File created C:\windows\SysWOW64\SGC.exe SDYN.exe File created C:\windows\SysWOW64\XOCTMA.exe VQJZOL.exe File created C:\windows\SysWOW64\XIIVWN.exe KGMPRWW.exe File created C:\windows\SysWOW64\XIIVWN.exe.bat KGMPRWW.exe File created C:\windows\SysWOW64\RJKOXH.exe WVFFN.exe File created C:\windows\SysWOW64\JPN.exe.bat HZMLQWL.exe File created C:\windows\SysWOW64\GULCEUW.exe JPN.exe File opened for modification C:\windows\SysWOW64\IVERVQL.exe OHAIL.exe File created C:\windows\SysWOW64\LWWP.exe.bat OQYR.exe File created C:\windows\SysWOW64\HFE.exe DXXF.exe File created C:\windows\SysWOW64\UKH.exe QCNX.exe File created C:\windows\SysWOW64\PJANYAK.exe.bat YWQVI.exe File created C:\windows\SysWOW64\NBRJNVS.exe.bat CJO.exe File opened for modification C:\windows\SysWOW64\XOCTMA.exe VQJZOL.exe File created C:\windows\SysWOW64\TMRXLF.exe.bat AROTYQB.exe File opened for modification C:\windows\SysWOW64\HFE.exe DXXF.exe File created C:\windows\SysWOW64\QNHAX.exe SXBXL.exe File created C:\windows\SysWOW64\DRWJD.exe JDAZ.exe File created C:\windows\SysWOW64\JQFHY.exe.bat SGC.exe File opened for modification C:\windows\SysWOW64\CZJSOP.exe PPA.exe File created C:\windows\SysWOW64\JQFHY.exe SGC.exe File created C:\windows\SysWOW64\IVERVQL.exe OHAIL.exe File created C:\windows\SysWOW64\XOCTMA.exe.bat VQJZOL.exe File opened for modification C:\windows\SysWOW64\LPFZSH.exe JREWMK.exe File created C:\windows\SysWOW64\LPFZSH.exe.bat JREWMK.exe File opened for modification C:\windows\SysWOW64\JQFHY.exe SGC.exe File opened for modification C:\windows\SysWOW64\GULCEUW.exe JPN.exe File opened for modification C:\windows\SysWOW64\MJYN.exe BMV.exe File opened for modification C:\windows\SysWOW64\ORJBIC.exe KJP.exe File created C:\windows\SysWOW64\UKH.exe.bat QCNX.exe File created C:\windows\SysWOW64\LPFZSH.exe JREWMK.exe File created C:\windows\SysWOW64\CZJSOP.exe.bat PPA.exe File opened for modification C:\windows\SysWOW64\NBRJNVS.exe CJO.exe File created C:\windows\SysWOW64\ORJBIC.exe KJP.exe File opened for modification C:\windows\SysWOW64\XIIVWN.exe KGMPRWW.exe File created C:\windows\SysWOW64\TMRXLF.exe AROTYQB.exe File created C:\windows\SysWOW64\CZJSOP.exe PPA.exe File opened for modification C:\windows\SysWOW64\MDPBXL.exe UALFRNC.exe File created C:\windows\SysWOW64\KVO.exe WSSFPOL.exe File created C:\windows\SysWOW64\HFE.exe.bat DXXF.exe File opened for modification C:\windows\SysWOW64\RJKOXH.exe WVFFN.exe File created C:\windows\SysWOW64\WZDLBKE.exe SJWD.exe File opened for modification C:\windows\SysWOW64\WZDLBKE.exe SJWD.exe File created C:\windows\SysWOW64\GULCEUW.exe.bat JPN.exe File created C:\windows\SysWOW64\RJKOXH.exe.bat WVFFN.exe File opened for modification C:\windows\SysWOW64\QNHAX.exe SXBXL.exe File opened for modification C:\windows\SysWOW64\PJANYAK.exe YWQVI.exe File created C:\windows\SysWOW64\MDPBXL.exe UALFRNC.exe File created C:\windows\SysWOW64\SJWD.exe.bat HQT.exe File opened for modification C:\windows\SysWOW64\HZMLQWL.exe WTJFEP.exe File created C:\windows\SysWOW64\KENVPIA.exe.bat XBRPKR.exe File opened for modification C:\windows\SysWOW64\LWWP.exe OQYR.exe File opened for modification C:\windows\SysWOW64\TMRXLF.exe AROTYQB.exe File created C:\windows\SysWOW64\IVERVQL.exe.bat OHAIL.exe File opened for modification C:\windows\SysWOW64\HQT.exe MDPBXL.exe File created C:\windows\SysWOW64\HQT.exe.bat MDPBXL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\IFYQUGY.exe PMVYMZ.exe File created C:\windows\system\QAHVF.exe.bat IFYQUGY.exe File created C:\windows\system\SDYN.exe ICW.exe File opened for modification C:\windows\system\SIRU.exe GTX.exe File created C:\windows\YWQVI.exe SIRU.exe File created C:\windows\CJO.exe.bat ALV.exe File created C:\windows\XXOLOK.exe FUW.exe File opened for modification C:\windows\system\DXXF.exe KUTCPLF.exe File opened for modification C:\windows\system\SDYN.exe ICW.exe File opened for modification C:\windows\system\ALV.exe KVO.exe File created C:\windows\system\GMTT.exe RJKOXH.exe File created C:\windows\QCNX.exe.bat UULPMH.exe File created C:\windows\system\HGMF.exe FITL.exe File created C:\windows\system\WAOU.exe 2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe File created C:\windows\system\ALV.exe.bat KVO.exe File created C:\windows\QFFSJUZ.exe IVERVQL.exe File created C:\windows\SCVLNRN.exe DXPOG.exe File opened for modification C:\windows\XXOLOK.exe FUW.exe File opened for modification C:\windows\OQYR.exe UDTIWTC.exe File created C:\windows\WVFFN.exe HFE.exe File opened for modification C:\windows\JREWMK.exe DRWJD.exe File created C:\windows\system\PPA.exe.bat PJANYAK.exe File created C:\windows\VQJZOL.exe.bat QFFSJUZ.exe File opened for modification C:\windows\system\HGMF.exe FITL.exe File opened for modification C:\windows\system\UALFRNC.exe CZJSOP.exe File opened for modification C:\windows\FHIMUW.exe ORJBIC.exe File opened for modification C:\windows\KGMPRWW.exe SCVLNRN.exe File opened for modification C:\windows\system\SXBXL.exe QAHVF.exe File created C:\windows\KGMPRWW.exe SCVLNRN.exe File created C:\windows\ZRSJFOW.exe.bat BUTYTCP.exe File created C:\windows\FUW.exe.bat ZRSJFOW.exe File created C:\windows\system\UOKJGM.exe HLGL.exe File created C:\windows\system\ICW.exe WMPIVE.exe File created C:\windows\system\SDYN.exe.bat ICW.exe File created C:\windows\system\AROTYQB.exe LWWP.exe File opened for modification C:\windows\system\BMV.exe NBRJNVS.exe File created C:\windows\FHIMUW.exe.bat ORJBIC.exe File created C:\windows\system\GMTT.exe.bat RJKOXH.exe File created C:\windows\system\SXBXL.exe.bat QAHVF.exe File opened for modification C:\windows\system\JDAZ.exe HGMF.exe File created C:\windows\system\OHAIL.exe MJYN.exe File created C:\windows\system\KRG.exe.bat XOCTMA.exe File opened for modification C:\windows\system\WWMFAN.exe ZZGQT.exe File created C:\windows\system\JDAZ.exe HGMF.exe File opened for modification C:\windows\system\KRG.exe XOCTMA.exe File created C:\windows\system\DXPOG.exe FHIMUW.exe File created C:\windows\system\XBRPKR.exe XIIVWN.exe File opened for modification C:\windows\system\QAHVF.exe IFYQUGY.exe File created C:\windows\system\ZZGQT.exe.bat UOKJGM.exe File created C:\windows\system\SIRU.exe GTX.exe File opened for modification C:\windows\YWQVI.exe SIRU.exe File created C:\windows\system\BUTYTCP.exe KENVPIA.exe File created C:\windows\XXOLOK.exe.bat FUW.exe File opened for modification C:\windows\PMVYMZ.exe GMTT.exe File created C:\windows\HLGL.exe.bat QNHAX.exe File created C:\windows\OQYR.exe.bat UDTIWTC.exe File created C:\windows\GTX.exe WAOU.exe File opened for modification C:\windows\system\DXPOG.exe FHIMUW.exe File opened for modification C:\windows\system\XBRPKR.exe XIIVWN.exe File created C:\windows\FUW.exe ZRSJFOW.exe File created C:\windows\system\SXBXL.exe QAHVF.exe File created C:\windows\system\ZZGQT.exe UOKJGM.exe File created C:\windows\system\UULPMH.exe WWMFAN.exe File opened for modification C:\windows\system\UULPMH.exe WWMFAN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 4048 956 WerFault.exe 85 1228 3380 WerFault.exe 90 4872 4928 WerFault.exe 96 5360 5444 WerFault.exe 101 4172 1212 WerFault.exe 106 2288 4144 WerFault.exe 111 5860 6120 WerFault.exe 116 1480 5248 WerFault.exe 121 4188 468 WerFault.exe 126 2188 2304 WerFault.exe 131 4584 4864 WerFault.exe 136 1868 4984 WerFault.exe 141 5376 4360 WerFault.exe 146 5048 2756 WerFault.exe 151 2496 4868 WerFault.exe 156 720 1660 WerFault.exe 161 3008 4436 WerFault.exe 166 4216 5684 WerFault.exe 171 2552 4196 WerFault.exe 176 5340 5720 WerFault.exe 181 5148 3468 WerFault.exe 186 2916 5880 WerFault.exe 191 5232 1232 WerFault.exe 196 1500 2524 WerFault.exe 201 3396 3548 WerFault.exe 206 5724 5624 WerFault.exe 211 5576 4400 WerFault.exe 216 3992 4668 WerFault.exe 220 2080 5108 WerFault.exe 226 5040 3652 WerFault.exe 231 4128 3020 WerFault.exe 236 3316 3112 WerFault.exe 241 1288 4364 WerFault.exe 246 5216 4136 WerFault.exe 251 5472 2688 WerFault.exe 256 4636 4428 WerFault.exe 261 3360 4552 WerFault.exe 266 4904 2740 WerFault.exe 270 1952 2976 WerFault.exe 276 2080 2400 WerFault.exe 281 5860 3008 WerFault.exe 286 3288 1412 WerFault.exe 292 5020 2324 WerFault.exe 297 4208 2808 WerFault.exe 302 5872 5288 WerFault.exe 307 2864 4956 WerFault.exe 312 4692 4600 WerFault.exe 317 5360 1040 WerFault.exe 321 3748 4480 WerFault.exe 327 4544 1028 WerFault.exe 332 1296 1732 WerFault.exe 337 1396 5636 WerFault.exe 342 5000 2240 WerFault.exe 347 5520 4912 WerFault.exe 352 1788 3860 WerFault.exe 357 3496 6048 WerFault.exe 362 3368 3816 WerFault.exe 367 4464 4560 WerFault.exe 372 3464 2680 WerFault.exe 377 4108 5356 WerFault.exe 382 4056 2332 WerFault.exe 387 4968 404 WerFault.exe 392 2480 3580 WerFault.exe 397 4184 1988 WerFault.exe 402 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIRU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WZDLBKE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCVLNRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FUW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LWWP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BMV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BUTYTCP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GMTT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SXBXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQFHY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WAOU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WWMFAN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PPA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WVFFN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XXOLOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMVYMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QAHVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SJWD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JDAZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UDTIWTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GTX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UALFRNC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ICW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ALV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CJO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDPBXL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 956 2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe 956 2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe 3380 WAOU.exe 3380 WAOU.exe 4928 GTX.exe 4928 GTX.exe 5444 SIRU.exe 5444 SIRU.exe 1212 YWQVI.exe 1212 YWQVI.exe 4144 PJANYAK.exe 4144 PJANYAK.exe 6120 PPA.exe 6120 PPA.exe 5248 CZJSOP.exe 5248 CZJSOP.exe 468 UALFRNC.exe 468 UALFRNC.exe 2304 MDPBXL.exe 2304 MDPBXL.exe 4864 HQT.exe 4864 HQT.exe 4984 SJWD.exe 4984 SJWD.exe 4360 WZDLBKE.exe 4360 WZDLBKE.exe 2756 HRY.exe 2756 HRY.exe 4868 WMPIVE.exe 4868 WMPIVE.exe 1660 ICW.exe 1660 ICW.exe 4436 SDYN.exe 4436 SDYN.exe 5684 SGC.exe 5684 SGC.exe 4196 JQFHY.exe 4196 JQFHY.exe 5720 WTJFEP.exe 5720 WTJFEP.exe 3468 HZMLQWL.exe 3468 HZMLQWL.exe 5880 JPN.exe 5880 JPN.exe 1232 GULCEUW.exe 1232 GULCEUW.exe 2524 WSSFPOL.exe 2524 WSSFPOL.exe 3548 KVO.exe 3548 KVO.exe 5624 ALV.exe 5624 ALV.exe 4400 CJO.exe 4400 CJO.exe 4668 NBRJNVS.exe 4668 NBRJNVS.exe 5108 BMV.exe 5108 BMV.exe 3652 MJYN.exe 3652 MJYN.exe 3020 OHAIL.exe 3020 OHAIL.exe 3112 IVERVQL.exe 3112 IVERVQL.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 956 2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe 956 2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe 3380 WAOU.exe 3380 WAOU.exe 4928 GTX.exe 4928 GTX.exe 5444 SIRU.exe 5444 SIRU.exe 1212 YWQVI.exe 1212 YWQVI.exe 4144 PJANYAK.exe 4144 PJANYAK.exe 6120 PPA.exe 6120 PPA.exe 5248 CZJSOP.exe 5248 CZJSOP.exe 468 UALFRNC.exe 468 UALFRNC.exe 2304 MDPBXL.exe 2304 MDPBXL.exe 4864 HQT.exe 4864 HQT.exe 4984 SJWD.exe 4984 SJWD.exe 4360 WZDLBKE.exe 4360 WZDLBKE.exe 2756 HRY.exe 2756 HRY.exe 4868 WMPIVE.exe 4868 WMPIVE.exe 1660 ICW.exe 1660 ICW.exe 4436 SDYN.exe 4436 SDYN.exe 5684 SGC.exe 5684 SGC.exe 4196 JQFHY.exe 4196 JQFHY.exe 5720 WTJFEP.exe 5720 WTJFEP.exe 3468 HZMLQWL.exe 3468 HZMLQWL.exe 5880 JPN.exe 5880 JPN.exe 1232 GULCEUW.exe 1232 GULCEUW.exe 2524 WSSFPOL.exe 2524 WSSFPOL.exe 3548 KVO.exe 3548 KVO.exe 5624 ALV.exe 5624 ALV.exe 4400 CJO.exe 4400 CJO.exe 4668 NBRJNVS.exe 4668 NBRJNVS.exe 5108 BMV.exe 5108 BMV.exe 3652 MJYN.exe 3652 MJYN.exe 3020 OHAIL.exe 3020 OHAIL.exe 3112 IVERVQL.exe 3112 IVERVQL.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 956 wrote to memory of 2500 956 2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe 86 PID 2500 wrote to memory of 3380 2500 cmd.exe 90 PID 3380 wrote to memory of 4044 3380 WAOU.exe 92 PID 4044 wrote to memory of 4928 4044 cmd.exe 96 PID 4928 wrote to memory of 3004 4928 GTX.exe 97 PID 3004 wrote to memory of 5444 3004 cmd.exe 101 PID 5444 wrote to memory of 3328 5444 SIRU.exe 102 PID 3328 wrote to memory of 1212 3328 cmd.exe 106 PID 1212 wrote to memory of 5768 1212 YWQVI.exe 107 PID 5768 wrote to memory of 4144 5768 cmd.exe 111 PID 4144 wrote to memory of 2536 4144 PJANYAK.exe 112 PID 2536 wrote to memory of 6120 2536 cmd.exe 116 PID 6120 wrote to memory of 4740 6120 PPA.exe 117 PID 4740 wrote to memory of 5248 4740 cmd.exe 121 PID 5248 wrote to memory of 3068 5248 CZJSOP.exe 122 PID 3068 wrote to memory of 468 3068 cmd.exe 126 PID 468 wrote to memory of 2844 468 UALFRNC.exe 127 PID 2844 wrote to memory of 2304 2844 cmd.exe 131 PID 2304 wrote to memory of 5672 2304 MDPBXL.exe 132 PID 5672 wrote to memory of 4864 5672 cmd.exe 136 PID 4864 wrote to memory of 1280 4864 HQT.exe 137 PID 1280 wrote to memory of 4984 1280 cmd.exe 141 PID 4984 wrote to memory of 5276 4984 SJWD.exe 142 PID 4360 wrote to memory of 4020 4360 WZDLBKE.exe 147 PID 4020 wrote to memory of 2756 4020 cmd.exe 151 PID 2756 wrote to memory of 1268 2756 HRY.exe 152 PID 1268 wrote to memory of 4868 1268 cmd.exe 156 PID 4868 wrote to memory of 4988 4868 WMPIVE.exe 157 PID 4988 wrote to memory of 1660 4988 cmd.exe 161 PID 1660 wrote to memory of 4840 1660 ICW.exe 162 PID 4840 wrote to memory of 4436 4840 cmd.exe 166 PID 4436 wrote to memory of 4172 4436 SDYN.exe 167 PID 4172 wrote to memory of 5684 4172 cmd.exe 171 PID 5684 wrote to memory of 716 5684 SGC.exe 172 PID 716 wrote to memory of 4196 716 cmd.exe 176 PID 4196 wrote to memory of 3376 4196 JQFHY.exe 177 PID 3376 wrote to memory of 5720 3376 cmd.exe 181 PID 5720 wrote to memory of 5776 5720 WTJFEP.exe 182 PID 5776 wrote to memory of 3468 5776 cmd.exe 186 PID 3468 wrote to memory of 2664 3468 HZMLQWL.exe 187 PID 2664 wrote to memory of 5880 2664 cmd.exe 191 PID 5880 wrote to memory of 1456 5880 JPN.exe 192 PID 1456 wrote to memory of 1232 1456 cmd.exe 196 PID 1232 wrote to memory of 4640 1232 GULCEUW.exe 197 PID 4640 wrote to memory of 2524 4640 cmd.exe 201 PID 2524 wrote to memory of 4152 2524 WSSFPOL.exe 202 PID 4152 wrote to memory of 3548 4152 cmd.exe 206 PID 3548 wrote to memory of 3152 3548 KVO.exe 207 PID 3152 wrote to memory of 5624 3152 cmd.exe 211 PID 5624 wrote to memory of 4908 5624 ALV.exe 212 PID 4908 wrote to memory of 4400 4908 cmd.exe 216 PID 4400 wrote to memory of 4276 4400 CJO.exe 217 PID 4276 wrote to memory of 4668 4276 cmd.exe 220 PID 4668 wrote to memory of 5424 4668 NBRJNVS.exe 222 PID 5424 wrote to memory of 5108 5424 cmd.exe 226 PID 5108 wrote to memory of 2104 5108 BMV.exe 227 PID 2104 wrote to memory of 3652 2104 cmd.exe 231 PID 3652 wrote to memory of 5748 3652 MJYN.exe 232 PID 5748 wrote to memory of 3020 5748 cmd.exe 236 PID 3020 wrote to memory of 364 3020 OHAIL.exe 237 PID 364 wrote to memory of 3112 364 cmd.exe 241 PID 3112 wrote to memory of 2336 3112 IVERVQL.exe 242 PID 2336 wrote to memory of 4364 2336 cmd.exe 246 PID 4364 wrote to memory of 3148 4364 QFFSJUZ.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_34dbd9d6165b676f3fe67a318456ff0d_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WAOU.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\windows\system\WAOU.exeC:\windows\system\WAOU.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GTX.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\windows\GTX.exeC:\windows\GTX.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SIRU.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\windows\system\SIRU.exeC:\windows\system\SIRU.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YWQVI.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\windows\YWQVI.exeC:\windows\YWQVI.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PJANYAK.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\SysWOW64\PJANYAK.exeC:\windows\system32\PJANYAK.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PPA.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\windows\system\PPA.exeC:\windows\system\PPA.exe13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CZJSOP.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\windows\SysWOW64\CZJSOP.exeC:\windows\system32\CZJSOP.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UALFRNC.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\windows\system\UALFRNC.exeC:\windows\system\UALFRNC.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MDPBXL.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\SysWOW64\MDPBXL.exeC:\windows\system32\MDPBXL.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HQT.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\windows\SysWOW64\HQT.exeC:\windows\system32\HQT.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SJWD.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\windows\SysWOW64\SJWD.exeC:\windows\system32\SJWD.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WZDLBKE.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
PID:5276 -
C:\windows\SysWOW64\WZDLBKE.exeC:\windows\system32\WZDLBKE.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HRY.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\windows\SysWOW64\HRY.exeC:\windows\system32\HRY.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WMPIVE.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\windows\system\WMPIVE.exeC:\windows\system\WMPIVE.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ICW.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\windows\system\ICW.exeC:\windows\system\ICW.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SDYN.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\windows\system\SDYN.exeC:\windows\system\SDYN.exe33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SGC.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\windows\SysWOW64\SGC.exeC:\windows\system32\SGC.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JQFHY.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\windows\SysWOW64\JQFHY.exeC:\windows\system32\JQFHY.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WTJFEP.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\windows\system\WTJFEP.exeC:\windows\system\WTJFEP.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HZMLQWL.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\windows\SysWOW64\HZMLQWL.exeC:\windows\system32\HZMLQWL.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JPN.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\windows\SysWOW64\JPN.exeC:\windows\system32\JPN.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GULCEUW.exe.bat" "44⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\windows\SysWOW64\GULCEUW.exeC:\windows\system32\GULCEUW.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSSFPOL.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\windows\system\WSSFPOL.exeC:\windows\system\WSSFPOL.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KVO.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\windows\SysWOW64\KVO.exeC:\windows\system32\KVO.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ALV.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\windows\system\ALV.exeC:\windows\system\ALV.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CJO.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\windows\CJO.exeC:\windows\CJO.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NBRJNVS.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\windows\SysWOW64\NBRJNVS.exeC:\windows\system32\NBRJNVS.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BMV.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\windows\system\BMV.exeC:\windows\system\BMV.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MJYN.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\windows\SysWOW64\MJYN.exeC:\windows\system32\MJYN.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OHAIL.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\windows\system\OHAIL.exeC:\windows\system\OHAIL.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IVERVQL.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:364 -
C:\windows\SysWOW64\IVERVQL.exeC:\windows\system32\IVERVQL.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QFFSJUZ.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\windows\QFFSJUZ.exeC:\windows\QFFSJUZ.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VQJZOL.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:3148 -
C:\windows\VQJZOL.exeC:\windows\VQJZOL.exe67⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XOCTMA.exe.bat" "68⤵PID:3372
-
C:\windows\SysWOW64\XOCTMA.exeC:\windows\system32\XOCTMA.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KRG.exe.bat" "70⤵PID:248
-
C:\windows\system\KRG.exeC:\windows\system\KRG.exe71⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KJP.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:2784 -
C:\windows\SysWOW64\KJP.exeC:\windows\system32\KJP.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ORJBIC.exe.bat" "74⤵PID:3276
-
C:\windows\SysWOW64\ORJBIC.exeC:\windows\system32\ORJBIC.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FHIMUW.exe.bat" "76⤵PID:3424
-
C:\windows\FHIMUW.exeC:\windows\FHIMUW.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2976 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DXPOG.exe.bat" "78⤵PID:1860
-
C:\windows\system\DXPOG.exeC:\windows\system\DXPOG.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SCVLNRN.exe.bat" "80⤵PID:5540
-
C:\windows\SCVLNRN.exeC:\windows\SCVLNRN.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KGMPRWW.exe.bat" "82⤵PID:2460
-
C:\windows\KGMPRWW.exeC:\windows\KGMPRWW.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XIIVWN.exe.bat" "84⤵PID:200
-
C:\windows\SysWOW64\XIIVWN.exeC:\windows\system32\XIIVWN.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XBRPKR.exe.bat" "86⤵PID:4628
-
C:\windows\system\XBRPKR.exeC:\windows\system\XBRPKR.exe87⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KENVPIA.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:2316 -
C:\windows\SysWOW64\KENVPIA.exeC:\windows\system32\KENVPIA.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BUTYTCP.exe.bat" "90⤵
- System Location Discovery: System Language Discovery
PID:4652 -
C:\windows\system\BUTYTCP.exeC:\windows\system\BUTYTCP.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRSJFOW.exe.bat" "92⤵
- System Location Discovery: System Language Discovery
PID:1876 -
C:\windows\ZRSJFOW.exeC:\windows\ZRSJFOW.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FUW.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:4872 -
C:\windows\FUW.exeC:\windows\FUW.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1040 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XXOLOK.exe.bat" "96⤵PID:6088
-
C:\windows\XXOLOK.exeC:\windows\XXOLOK.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDTIWTC.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:3904 -
C:\windows\system\UDTIWTC.exeC:\windows\system\UDTIWTC.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OQYR.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:3248 -
C:\windows\OQYR.exeC:\windows\OQYR.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LWWP.exe.bat" "102⤵PID:2268
-
C:\windows\SysWOW64\LWWP.exeC:\windows\system32\LWWP.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AROTYQB.exe.bat" "104⤵PID:2220
-
C:\windows\system\AROTYQB.exeC:\windows\system\AROTYQB.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TMRXLF.exe.bat" "106⤵PID:3288
-
C:\windows\SysWOW64\TMRXLF.exeC:\windows\system32\TMRXLF.exe107⤵
- Executes dropped EXE
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KUTCPLF.exe.bat" "108⤵PID:5020
-
C:\windows\system\KUTCPLF.exeC:\windows\system\KUTCPLF.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DXXF.exe.bat" "110⤵
- System Location Discovery: System Language Discovery
PID:4208 -
C:\windows\system\DXXF.exeC:\windows\system\DXXF.exe111⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HFE.exe.bat" "112⤵
- System Location Discovery: System Language Discovery
PID:2916 -
C:\windows\SysWOW64\HFE.exeC:\windows\system32\HFE.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WVFFN.exe.bat" "114⤵PID:5388
-
C:\windows\WVFFN.exeC:\windows\WVFFN.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RJKOXH.exe.bat" "116⤵PID:2028
-
C:\windows\SysWOW64\RJKOXH.exeC:\windows\system32\RJKOXH.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GMTT.exe.bat" "118⤵PID:6016
-
C:\windows\system\GMTT.exeC:\windows\system\GMTT.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PMVYMZ.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\windows\PMVYMZ.exeC:\windows\PMVYMZ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-