Analysis
- max time kernel
93s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 14:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_e3d4992f135ad933f3c21349ef59a684_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-08-20_e3d4992f135ad933f3c21349ef59a684_elex_emotet_stop.exe
- Size 208KB
- Sample260820-rl3veadn8v
- SHA256 1c8c46cfba7bb434e4ef72c0a6cdd14462adbf47426508b49ce7dd072d8c098f
- MD5 e3d4992f135ad933f3c21349ef59a684
- SHA1 90fe929137c22a98f54d13cae1dd57ea3d4c145f
- SHA512 75f1571dfbf0fcc81c4d6b7c6538bef20198694f3218f521b4cbff756ee65da96046f7ef621204dc35a591a43eb7d0aded115511b4968cb90f9a25d168de161f
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfw4NLthEjQT6j:MlZtbLWIgd1LZ9oECZbclc5+LOIQEj1
- TLSH T171247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5028 FZIKOT.exe 6108 VXODI.exe 1920 DNP.exe 2540 PVWCTO.exe 1468 TLD.exe 6036 RWFAOMG.exe 3380 KZJW.exe 6012 LUV.exe 1092 WUC.exe 4540 XPGHW.exe 3852 VARX.exe 1604 ODVAKN.exe 5092 PGZW.exe 4608 NWK.exe 6128 GZOVQ.exe 3016 OMAB.exe 1520 WSNI.exe 5760 DYULRDL.exe 6044 BVFGEI.exe 3132 YOPQP.exe 860 IMUD.exe 3892 ZUJIK.exe 3260 FPUB.exe 5896 PNAV.exe 4676 XDBVLEU.exe 2636 JLIVQ.exe 2980 ATWSC.exe 4788 TWAWQDM.exe 1556 TSERVT.exe 5684 VPR.exe 4916 LFSLJP.exe 2904 PVZL.exe 3900 PQD.exe 3844 DBLGPI.exe 5700 SRUF.exe 2264 OXSC.exe 2576 JKXLNF.exe 4948 SSZR.exe 1588 INIVC.exe 3460 ZOK.exe 5428 MZBZBG.exe 1116 FCECH.exe 2840 FXIYMLD.exe 244 YAMC.exe 5616 ZDQ.exe 2312 RGUBL.exe 1912 UTLDE.exe 6092 JJMC.exe 4728 CMQYQM.exe 4736 IMX.exe 5296 ZNZR.exe 4408 LFPC.exe 2236 JYS.exe 5956 VRVK.exe 2992 ZZBSPAG.exe 2272 ZCFO.exe 3252 DKM.exe 4672 WCBHQB.exe 4116 GKDM.exe 5656 VBEEAU.exe 4668 KWOQ.exe 4860 UEQVX.exe 1900 JZZ.exe 4232 AZBFTF.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\XPGHW.exe.bat WUC.exe File created C:\windows\SysWOW64\PVZL.exe LFSLJP.exe File created C:\windows\SysWOW64\FXIYMLD.exe FCECH.exe File created C:\windows\SysWOW64\CMQYQM.exe JJMC.exe File created C:\windows\SysWOW64\FPUB.exe ZUJIK.exe File opened for modification C:\windows\SysWOW64\FXIYMLD.exe FCECH.exe File opened for modification C:\windows\SysWOW64\YKGTZA.exe EWBK.exe File created C:\windows\SysWOW64\VPSHMSR.exe.bat ABNYBS.exe File created C:\windows\SysWOW64\FOS.exe ZOLHC.exe File opened for modification C:\windows\SysWOW64\TSERVT.exe TWAWQDM.exe File created C:\windows\SysWOW64\TSERVT.exe.bat TWAWQDM.exe File created C:\windows\SysWOW64\SRUF.exe.bat DBLGPI.exe File created C:\windows\SysWOW64\FCECH.exe MZBZBG.exe File created C:\windows\SysWOW64\DNP.exe VXODI.exe File created C:\windows\SysWOW64\BVFGEI.exe.bat DYULRDL.exe File created C:\windows\SysWOW64\PVZL.exe.bat LFSLJP.exe File created C:\windows\SysWOW64\VPR.exe.bat TSERVT.exe File created C:\windows\SysWOW64\FCECH.exe.bat MZBZBG.exe File created C:\windows\SysWOW64\FXIYMLD.exe.bat FCECH.exe File created C:\windows\SysWOW64\UTLDE.exe RGUBL.exe File created C:\windows\SysWOW64\WCBHQB.exe.bat DKM.exe File created C:\windows\SysWOW64\GVTQRX.exe.bat IAUPUU.exe File created C:\windows\SysWOW64\BMJLUUN.exe CCG.exe File created C:\windows\SysWOW64\ABXE.exe.bat FOS.exe File created C:\windows\SysWOW64\UTLDE.exe.bat RGUBL.exe File created C:\windows\SysWOW64\JYS.exe LFPC.exe File opened for modification C:\windows\SysWOW64\VRVK.exe JYS.exe File created C:\windows\SysWOW64\DMQOQA.exe ZWBG.exe File opened for modification C:\windows\SysWOW64\HJI.exe XMDSNG.exe File created C:\windows\SysWOW64\NFINAR.exe.bat HJI.exe File created C:\windows\SysWOW64\ISM.exe NFINAR.exe File created C:\windows\SysWOW64\ISM.exe.bat NFINAR.exe File opened for modification C:\windows\SysWOW64\PNAV.exe FPUB.exe File created C:\windows\SysWOW64\VPR.exe TSERVT.exe File opened for modification C:\windows\SysWOW64\PVZL.exe LFSLJP.exe File opened for modification C:\windows\SysWOW64\FCECH.exe MZBZBG.exe File opened for modification C:\windows\SysWOW64\JYS.exe LFPC.exe File created C:\windows\SysWOW64\YKGTZA.exe EWBK.exe File created C:\windows\SysWOW64\HJI.exe XMDSNG.exe File created C:\windows\SysWOW64\BVFGEI.exe DYULRDL.exe File created C:\windows\SysWOW64\PNAV.exe.bat FPUB.exe File created C:\windows\SysWOW64\VPSHMSR.exe ABNYBS.exe File opened for modification C:\windows\SysWOW64\NFINAR.exe HJI.exe File created C:\windows\SysWOW64\VXODI.exe.bat FZIKOT.exe File opened for modification C:\windows\SysWOW64\BVFGEI.exe DYULRDL.exe File created C:\windows\SysWOW64\SRUF.exe DBLGPI.exe File created C:\windows\SysWOW64\JYS.exe.bat LFPC.exe File created C:\windows\SysWOW64\GKDM.exe WCBHQB.exe File created C:\windows\SysWOW64\GKDM.exe.bat WCBHQB.exe File created C:\windows\SysWOW64\KWOQ.exe.bat VBEEAU.exe File created C:\windows\SysWOW64\YKGTZA.exe.bat EWBK.exe File opened for modification C:\windows\SysWOW64\VPR.exe TSERVT.exe File created C:\windows\SysWOW64\PQD.exe PVZL.exe File created C:\windows\SysWOW64\ZNZR.exe IMX.exe File opened for modification C:\windows\SysWOW64\WCBHQB.exe DKM.exe File created C:\windows\SysWOW64\KWOQ.exe VBEEAU.exe File created C:\windows\SysWOW64\GVTQRX.exe IAUPUU.exe File created C:\windows\SysWOW64\VQDU.exe GVTQRX.exe File opened for modification C:\windows\SysWOW64\DMQOQA.exe ZWBG.exe File opened for modification C:\windows\SysWOW64\DNP.exe VXODI.exe File created C:\windows\SysWOW64\ZUJIK.exe.bat IMUD.exe File created C:\windows\SysWOW64\FPUB.exe.bat ZUJIK.exe File created C:\windows\SysWOW64\PNAV.exe FPUB.exe File opened for modification C:\windows\SysWOW64\ZNZR.exe IMX.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\UMK.exe.bat DMQOQA.exe File created C:\windows\WUC.exe.bat LUV.exe File created C:\windows\DBLGPI.exe PQD.exe File created C:\windows\system\XNYHSTR.exe.bat FMWCO.exe File created C:\windows\system\INIVC.exe SSZR.exe File opened for modification C:\windows\IMX.exe CMQYQM.exe File created C:\windows\system\ZOLHC.exe FSOY.exe File created C:\windows\XTWXWR.exe OSUST.exe File created C:\windows\system\LFPC.exe.bat ZNZR.exe File opened for modification C:\windows\system\DKM.exe ZCFO.exe File opened for modification C:\windows\system\MZBZBG.exe ZOK.exe File created C:\windows\TLD.exe.bat PVWCTO.exe File created C:\windows\ODVAKN.exe VARX.exe File created C:\windows\AZBFTF.exe JZZ.exe File opened for modification C:\windows\system\UTVJ.exe OTNVPKX.exe File opened for modification C:\windows\OSUST.exe ISM.exe File created C:\windows\ODVAKN.exe.bat VARX.exe File opened for modification C:\windows\system\IMUD.exe YOPQP.exe File created C:\windows\DBLGPI.exe.bat PQD.exe File created C:\windows\SSZR.exe.bat JKXLNF.exe File created C:\windows\system\UEQVX.exe.bat KWOQ.exe File created C:\windows\RAC.exe.bat XNYHSTR.exe File created C:\windows\system\JJMC.exe UTLDE.exe File created C:\windows\VVADKU.exe FMZ.exe File opened for modification C:\windows\BWP.exe XOIUQL.exe File opened for modification C:\windows\ATWSC.exe JLIVQ.exe File created C:\windows\system\QPC.exe AZBFTF.exe File created C:\windows\system\AAQWQ.exe.bat WPSBIWJ.exe File created C:\windows\CQIGNK.exe JXAVE.exe File created C:\windows\DYULRDL.exe WSNI.exe File opened for modification C:\windows\system\INIVC.exe SSZR.exe File created C:\windows\PRQWF.exe VEL.exe File opened for modification C:\windows\SOB.exe XTWXWR.exe File created C:\windows\SOB.exe.bat XTWXWR.exe File opened for modification C:\windows\system\RGUBL.exe ZDQ.exe File created C:\windows\system\EOVSV.exe CQIGNK.exe File opened for modification C:\windows\RAC.exe XNYHSTR.exe File created C:\windows\IMX.exe.bat CMQYQM.exe File created C:\windows\system\GZOVQ.exe NWK.exe File created C:\windows\JKXLNF.exe OXSC.exe File created C:\windows\system\VBEEAU.exe.bat GKDM.exe File created C:\windows\system\ZOLHC.exe.bat FSOY.exe File created C:\windows\FMWCO.exe BWP.exe File opened for modification C:\windows\system\PGZW.exe ODVAKN.exe File created C:\windows\NWK.exe.bat PGZW.exe File created C:\windows\system\WSNI.exe.bat OMAB.exe File created C:\windows\system\LFSLJP.exe VPR.exe File created C:\windows\system\RGUBL.exe ZDQ.exe File created C:\windows\system\JZZ.exe.bat UEQVX.exe File opened for modification C:\windows\FZIKOT.exe 2026-08-20_e3d4992f135ad933f3c21349ef59a684_elex_emotet_stop.exe File opened for modification C:\windows\VEL.exe DVJIRXF.exe File opened for modification C:\windows\UMK.exe DMQOQA.exe File created C:\windows\system\DKM.exe ZCFO.exe File opened for modification C:\windows\JIEYH.exe ZAKL.exe File opened for modification C:\windows\system\AAQWQ.exe WPSBIWJ.exe File opened for modification C:\windows\CQIGNK.exe JXAVE.exe File created C:\windows\VOPGGY.exe EOVSV.exe File created C:\windows\VEL.exe.bat DVJIRXF.exe File created C:\windows\JKXLNF.exe.bat OXSC.exe File created C:\windows\system\ZZBSPAG.exe.bat VRVK.exe File created C:\windows\system\QPC.exe.bat AZBFTF.exe File created C:\windows\system\EWBK.exe BJWAEAO.exe File created C:\windows\ZAKL.exe PCXZ.exe File opened for modification C:\windows\system\UEQVX.exe KWOQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2772 cmd.exe 1064 cmd.exe 5988 cmd.exe 3400 cmd.exe 4776 cmd.exe 3264 cmd.exe 964 cmd.exe 5152 cmd.exe 1708 cmd.exe 748 cmd.exe 3416 cmd.exe 4796 cmd.exe 6032 cmd.exe 4660 cmd.exe 2384 cmd.exe 3792 cmd.exe 2360 cmd.exe 2648 cmd.exe 3736 cmd.exe 2760 cmd.exe 5520 cmd.exe 4468 cmd.exe 2832 cmd.exe 236 cmd.exe 1084 cmd.exe 4664 cmd.exe 5432 cmd.exe 1876 cmd.exe 5548 cmd.exe 5444 cmd.exe 3468 cmd.exe 5768 cmd.exe 4312 cmd.exe 3580 cmd.exe 4836 cmd.exe 5184 cmd.exe 3052 cmd.exe 2028 cmd.exe 5544 cmd.exe 5968 cmd.exe 3656 cmd.exe 6124 cmd.exe 5464 cmd.exe 3064 cmd.exe 2128 cmd.exe 1988 cmd.exe 4976 cmd.exe 5396 cmd.exe 6004 cmd.exe 4876 cmd.exe 2556 cmd.exe 1532 cmd.exe 1516 cmd.exe 3708 cmd.exe 4368 cmd.exe 5460 cmd.exe 3496 cmd.exe 2640 cmd.exe 5504 cmd.exe 2952 cmd.exe 5848 cmd.exe 4896 cmd.exe 612 cmd.exe 4384 cmd.exe - Program crash 64 IoCs
pid pid_target Process procid_target 2820 5260 WerFault.exe 87 3928 5028 WerFault.exe 93 2236 6108 WerFault.exe 99 2132 1920 WerFault.exe 104 5236 2540 WerFault.exe 109 4720 1468 WerFault.exe 114 4528 6036 WerFault.exe 119 4384 3380 WerFault.exe 124 6076 6012 WerFault.exe 129 4280 1092 WerFault.exe 134 5332 4540 WerFault.exe 139 108 3852 WerFault.exe 144 2516 1604 WerFault.exe 149 4572 5092 WerFault.exe 154 5832 4608 WerFault.exe 159 5716 6128 WerFault.exe 164 928 3016 WerFault.exe 169 4528 1520 WerFault.exe 174 1592 5760 WerFault.exe 179 1416 6044 WerFault.exe 184 2104 3132 WerFault.exe 189 3092 860 WerFault.exe 194 3900 3892 WerFault.exe 199 3740 3260 WerFault.exe 204 1188 5896 WerFault.exe 209 6032 4676 WerFault.exe 214 3624 2636 WerFault.exe 219 5792 2980 WerFault.exe 224 4524 4788 WerFault.exe 229 4396 1556 WerFault.exe 234 6088 5684 WerFault.exe 239 416 4916 WerFault.exe 244 1924 2904 WerFault.exe 249 5676 3900 WerFault.exe 254 3876 3844 WerFault.exe 259 1724 5700 WerFault.exe 264 2652 2264 WerFault.exe 270 3340 2576 WerFault.exe 275 6008 4948 WerFault.exe 280 4592 1588 WerFault.exe 285 6004 3460 WerFault.exe 290 4240 5428 WerFault.exe 295 1216 1116 WerFault.exe 300 5152 2840 WerFault.exe 305 1448 244 WerFault.exe 310 3100 5616 WerFault.exe 315 4584 2312 WerFault.exe 320 4460 1912 WerFault.exe 325 1632 6092 WerFault.exe 330 1824 4728 WerFault.exe 335 4980 4736 WerFault.exe 340 1924 5296 WerFault.exe 345 6104 4408 WerFault.exe 350 3816 2236 WerFault.exe 355 5832 5956 WerFault.exe 360 5716 2992 WerFault.exe 365 4752 2272 WerFault.exe 370 5660 3252 WerFault.exe 375 2964 4672 WerFault.exe 380 1956 4116 WerFault.exe 385 2776 5656 WerFault.exe 390 1524 4668 WerFault.exe 395 2260 4860 WerFault.exe 400 2560 1900 WerFault.exe 405 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OMAB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FXIYMLD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FSOY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ONPG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VEL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMWCO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TWAWQDM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JIEYH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JZZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IAUPUU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DVJIRXF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language THRW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CQIGNK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PRQWF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBEEAU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FMZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YOPQP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PGZW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVADKU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LFSLJP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BJWAEAO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YKGTZA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRUF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBLGPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQDU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INIVC.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5260 2026-08-20_e3d4992f135ad933f3c21349ef59a684_elex_emotet_stop.exe 5260 2026-08-20_e3d4992f135ad933f3c21349ef59a684_elex_emotet_stop.exe 5028 FZIKOT.exe 5028 FZIKOT.exe 6108 VXODI.exe 6108 VXODI.exe 1920 DNP.exe 1920 DNP.exe 2540 PVWCTO.exe 2540 PVWCTO.exe 1468 TLD.exe 1468 TLD.exe 6036 RWFAOMG.exe 6036 RWFAOMG.exe 3380 KZJW.exe 3380 KZJW.exe 6012 LUV.exe 6012 LUV.exe 1092 WUC.exe 1092 WUC.exe 4540 XPGHW.exe 4540 XPGHW.exe 3852 VARX.exe 3852 VARX.exe 1604 ODVAKN.exe 1604 ODVAKN.exe 5092 PGZW.exe 5092 PGZW.exe 4608 NWK.exe 4608 NWK.exe 6128 GZOVQ.exe 6128 GZOVQ.exe 3016 OMAB.exe 3016 OMAB.exe 1520 WSNI.exe 1520 WSNI.exe 5760 DYULRDL.exe 5760 DYULRDL.exe 6044 BVFGEI.exe 6044 BVFGEI.exe 3132 YOPQP.exe 3132 YOPQP.exe 860 IMUD.exe 860 IMUD.exe 3892 ZUJIK.exe 3892 ZUJIK.exe 3260 FPUB.exe 3260 FPUB.exe 5896 PNAV.exe 5896 PNAV.exe 4676 XDBVLEU.exe 4676 XDBVLEU.exe 2636 JLIVQ.exe 2636 JLIVQ.exe 2980 ATWSC.exe 2980 ATWSC.exe 4788 TWAWQDM.exe 4788 TWAWQDM.exe 1556 TSERVT.exe 1556 TSERVT.exe 5684 VPR.exe 5684 VPR.exe 4916 LFSLJP.exe 4916 LFSLJP.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5260 2026-08-20_e3d4992f135ad933f3c21349ef59a684_elex_emotet_stop.exe 5260 2026-08-20_e3d4992f135ad933f3c21349ef59a684_elex_emotet_stop.exe 5028 FZIKOT.exe 5028 FZIKOT.exe 6108 VXODI.exe 6108 VXODI.exe 1920 DNP.exe 1920 DNP.exe 2540 PVWCTO.exe 2540 PVWCTO.exe 1468 TLD.exe 1468 TLD.exe 6036 RWFAOMG.exe 6036 RWFAOMG.exe 3380 KZJW.exe 3380 KZJW.exe 6012 LUV.exe 6012 LUV.exe 1092 WUC.exe 1092 WUC.exe 4540 XPGHW.exe 4540 XPGHW.exe 3852 VARX.exe 3852 VARX.exe 1604 ODVAKN.exe 1604 ODVAKN.exe 5092 PGZW.exe 5092 PGZW.exe 4608 NWK.exe 4608 NWK.exe 6128 GZOVQ.exe 6128 GZOVQ.exe 3016 OMAB.exe 3016 OMAB.exe 1520 WSNI.exe 1520 WSNI.exe 5760 DYULRDL.exe 5760 DYULRDL.exe 6044 BVFGEI.exe 6044 BVFGEI.exe 3132 YOPQP.exe 3132 YOPQP.exe 860 IMUD.exe 860 IMUD.exe 3892 ZUJIK.exe 3892 ZUJIK.exe 3260 FPUB.exe 3260 FPUB.exe 5896 PNAV.exe 5896 PNAV.exe 4676 XDBVLEU.exe 4676 XDBVLEU.exe 2636 JLIVQ.exe 2636 JLIVQ.exe 2980 ATWSC.exe 2980 ATWSC.exe 4788 TWAWQDM.exe 4788 TWAWQDM.exe 1556 TSERVT.exe 1556 TSERVT.exe 5684 VPR.exe 5684 VPR.exe 4916 LFSLJP.exe 4916 LFSLJP.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5260 wrote to memory of 2444 5260 2026-08-20_e3d4992f135ad933f3c21349ef59a684_elex_emotet_stop.exe 89 PID 2444 wrote to memory of 5028 2444 cmd.exe 93 PID 5028 wrote to memory of 3732 5028 FZIKOT.exe 95 PID 3732 wrote to memory of 6108 3732 cmd.exe 99 PID 6108 wrote to memory of 3184 6108 VXODI.exe 100 PID 3184 wrote to memory of 1920 3184 cmd.exe 104 PID 1920 wrote to memory of 1712 1920 DNP.exe 105 PID 1712 wrote to memory of 2540 1712 cmd.exe 109 PID 2540 wrote to memory of 2800 2540 PVWCTO.exe 110 PID 2800 wrote to memory of 1468 2800 cmd.exe 114 PID 1468 wrote to memory of 3752 1468 TLD.exe 115 PID 3752 wrote to memory of 6036 3752 cmd.exe 119 PID 6036 wrote to memory of 3668 6036 RWFAOMG.exe 120 PID 3668 wrote to memory of 3380 3668 cmd.exe 124 PID 3380 wrote to memory of 3736 3380 KZJW.exe 125 PID 3736 wrote to memory of 6012 3736 cmd.exe 129 PID 6012 wrote to memory of 4876 6012 LUV.exe 130 PID 4876 wrote to memory of 1092 4876 cmd.exe 134 PID 1092 wrote to memory of 3264 1092 WUC.exe 135 PID 3264 wrote to memory of 4540 3264 cmd.exe 139 PID 4540 wrote to memory of 5044 4540 XPGHW.exe 140 PID 5044 wrote to memory of 3852 5044 cmd.exe 144 PID 3852 wrote to memory of 4796 3852 VARX.exe 145 PID 4796 wrote to memory of 1604 4796 cmd.exe 149 PID 1604 wrote to memory of 5432 1604 ODVAKN.exe 150 PID 5432 wrote to memory of 5092 5432 cmd.exe 154 PID 5092 wrote to memory of 3076 5092 PGZW.exe 155 PID 3076 wrote to memory of 4608 3076 cmd.exe 159 PID 4608 wrote to memory of 3724 4608 NWK.exe 160 PID 3724 wrote to memory of 6128 3724 cmd.exe 164 PID 6128 wrote to memory of 4228 6128 GZOVQ.exe 165 PID 4228 wrote to memory of 3016 4228 cmd.exe 169 PID 3016 wrote to memory of 2880 3016 OMAB.exe 170 PID 2880 wrote to memory of 1520 2880 cmd.exe 174 PID 1520 wrote to memory of 2732 1520 WSNI.exe 175 PID 2732 wrote to memory of 5760 2732 cmd.exe 179 PID 5760 wrote to memory of 4380 5760 DYULRDL.exe 180 PID 4380 wrote to memory of 6044 4380 cmd.exe 184 PID 6044 wrote to memory of 2620 6044 BVFGEI.exe 185 PID 2620 wrote to memory of 3132 2620 cmd.exe 189 PID 3132 wrote to memory of 5848 3132 YOPQP.exe 190 PID 5848 wrote to memory of 860 5848 cmd.exe 194 PID 860 wrote to memory of 2760 860 IMUD.exe 195 PID 2760 wrote to memory of 3892 2760 cmd.exe 199 PID 3892 wrote to memory of 5520 3892 ZUJIK.exe 200 PID 5520 wrote to memory of 3260 5520 cmd.exe 204 PID 3260 wrote to memory of 5752 3260 FPUB.exe 205 PID 5752 wrote to memory of 5896 5752 cmd.exe 209 PID 5896 wrote to memory of 4572 5896 PNAV.exe 210 PID 4572 wrote to memory of 4676 4572 cmd.exe 214 PID 4676 wrote to memory of 964 4676 XDBVLEU.exe 215 PID 964 wrote to memory of 2636 964 cmd.exe 219 PID 2636 wrote to memory of 4896 2636 JLIVQ.exe 220 PID 4896 wrote to memory of 2980 4896 cmd.exe 224 PID 2980 wrote to memory of 2752 2980 ATWSC.exe 225 PID 2752 wrote to memory of 4788 2752 cmd.exe 229 PID 4788 wrote to memory of 2772 4788 TWAWQDM.exe 230 PID 2772 wrote to memory of 1556 2772 cmd.exe 234 PID 1556 wrote to memory of 788 1556 TSERVT.exe 235 PID 788 wrote to memory of 5684 788 cmd.exe 239 PID 5684 wrote to memory of 2032 5684 VPR.exe 240 PID 2032 wrote to memory of 4916 2032 cmd.exe 244 PID 4916 wrote to memory of 4180 4916 LFSLJP.exe 245 PID 4180 wrote to memory of 2904 4180 cmd.exe 249
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_e3d4992f135ad933f3c21349ef59a684_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e3d4992f135ad933f3c21349ef59a684_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FZIKOT.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\windows\FZIKOT.exeC:\windows\FZIKOT.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VXODI.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\windows\SysWOW64\VXODI.exeC:\windows\system32\VXODI.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DNP.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\windows\SysWOW64\DNP.exeC:\windows\system32\DNP.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PVWCTO.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\windows\system\PVWCTO.exeC:\windows\system\PVWCTO.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TLD.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\windows\TLD.exeC:\windows\TLD.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RWFAOMG.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\windows\RWFAOMG.exeC:\windows\RWFAOMG.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KZJW.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\windows\system\KZJW.exeC:\windows\system\KZJW.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LUV.exe.bat" "16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\windows\LUV.exeC:\windows\LUV.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WUC.exe.bat" "18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\windows\WUC.exeC:\windows\WUC.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XPGHW.exe.bat" "20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\windows\SysWOW64\XPGHW.exeC:\windows\system32\XPGHW.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VARX.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\windows\system\VARX.exeC:\windows\system\VARX.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ODVAKN.exe.bat" "24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\windows\ODVAKN.exeC:\windows\ODVAKN.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PGZW.exe.bat" "26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\windows\system\PGZW.exeC:\windows\system\PGZW.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NWK.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\windows\NWK.exeC:\windows\NWK.exe29⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GZOVQ.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\windows\system\GZOVQ.exeC:\windows\system\GZOVQ.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OMAB.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\windows\OMAB.exeC:\windows\OMAB.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WSNI.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\windows\system\WSNI.exeC:\windows\system\WSNI.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYULRDL.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\windows\DYULRDL.exeC:\windows\DYULRDL.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVFGEI.exe.bat" "38⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\windows\SysWOW64\BVFGEI.exeC:\windows\system32\BVFGEI.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YOPQP.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\system\YOPQP.exeC:\windows\system\YOPQP.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IMUD.exe.bat" "42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\windows\system\IMUD.exeC:\windows\system\IMUD.exe43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZUJIK.exe.bat" "44⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\windows\SysWOW64\ZUJIK.exeC:\windows\system32\ZUJIK.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FPUB.exe.bat" "46⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\windows\SysWOW64\FPUB.exeC:\windows\system32\FPUB.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PNAV.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\windows\SysWOW64\PNAV.exeC:\windows\system32\PNAV.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XDBVLEU.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\windows\XDBVLEU.exeC:\windows\XDBVLEU.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JLIVQ.exe.bat" "52⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:964 -
C:\windows\JLIVQ.exeC:\windows\JLIVQ.exe53⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ATWSC.exe.bat" "54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\windows\ATWSC.exeC:\windows\ATWSC.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWAWQDM.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\windows\system\TWAWQDM.exeC:\windows\system\TWAWQDM.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TSERVT.exe.bat" "58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\windows\SysWOW64\TSERVT.exeC:\windows\system32\TSERVT.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPR.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:788 -
C:\windows\SysWOW64\VPR.exeC:\windows\system32\VPR.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFSLJP.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\windows\system\LFSLJP.exeC:\windows\system\LFSLJP.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PVZL.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\windows\SysWOW64\PVZL.exeC:\windows\system32\PVZL.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PQD.exe.bat" "66⤵PID:6060
-
C:\windows\SysWOW64\PQD.exeC:\windows\system32\PQD.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DBLGPI.exe.bat" "68⤵PID:5784
-
C:\windows\DBLGPI.exeC:\windows\DBLGPI.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3844 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRUF.exe.bat" "70⤵PID:5392
-
C:\windows\SysWOW64\SRUF.exeC:\windows\system32\SRUF.exe71⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OXSC.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:5736 -
C:\windows\system\OXSC.exeC:\windows\system\OXSC.exe73⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JKXLNF.exe.bat" "74⤵PID:5100
-
C:\windows\JKXLNF.exeC:\windows\JKXLNF.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SSZR.exe.bat" "76⤵
- Executes a command shell one-liner
PID:2128 -
C:\windows\SSZR.exeC:\windows\SSZR.exe77⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\INIVC.exe.bat" "78⤵PID:5904
-
C:\windows\system\INIVC.exeC:\windows\system\INIVC.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZOK.exe.bat" "80⤵
- Executes a command shell one-liner
PID:1876 -
C:\windows\ZOK.exeC:\windows\ZOK.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MZBZBG.exe.bat" "82⤵
- Executes a command shell one-liner
PID:3580 -
C:\windows\system\MZBZBG.exeC:\windows\system\MZBZBG.exe83⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCECH.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:1792 -
C:\windows\SysWOW64\FCECH.exeC:\windows\system32\FCECH.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FXIYMLD.exe.bat" "86⤵
- System Location Discovery: System Language Discovery
PID:252 -
C:\windows\SysWOW64\FXIYMLD.exeC:\windows\system32\FXIYMLD.exe87⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAMC.exe.bat" "88⤵
- Executes a command shell one-liner
PID:2556 -
C:\windows\system\YAMC.exeC:\windows\system\YAMC.exe89⤵
- Executes dropped EXE
PID:244 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZDQ.exe.bat" "90⤵PID:3876
-
C:\windows\system\ZDQ.exeC:\windows\system\ZDQ.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RGUBL.exe.bat" "92⤵PID:3564
-
C:\windows\system\RGUBL.exeC:\windows\system\RGUBL.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UTLDE.exe.bat" "94⤵PID:2712
-
C:\windows\SysWOW64\UTLDE.exeC:\windows\system32\UTLDE.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJMC.exe.bat" "96⤵PID:5792
-
C:\windows\system\JJMC.exeC:\windows\system\JJMC.exe97⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CMQYQM.exe.bat" "98⤵PID:2796
-
C:\windows\SysWOW64\CMQYQM.exeC:\windows\system32\CMQYQM.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IMX.exe.bat" "100⤵PID:1828
-
C:\windows\IMX.exeC:\windows\IMX.exe101⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZNZR.exe.bat" "102⤵PID:5336
-
C:\windows\SysWOW64\ZNZR.exeC:\windows\system32\ZNZR.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LFPC.exe.bat" "104⤵PID:2400
-
C:\windows\system\LFPC.exeC:\windows\system\LFPC.exe105⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYS.exe.bat" "106⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4836 -
C:\windows\SysWOW64\JYS.exeC:\windows\system32\JYS.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2236 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRVK.exe.bat" "108⤵PID:3204
-
C:\windows\SysWOW64\VRVK.exeC:\windows\system32\VRVK.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZZBSPAG.exe.bat" "110⤵PID:1188
-
C:\windows\system\ZZBSPAG.exeC:\windows\system\ZZBSPAG.exe111⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZCFO.exe.bat" "112⤵PID:2432
-
C:\windows\system\ZCFO.exeC:\windows\system\ZCFO.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2272 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DKM.exe.bat" "114⤵PID:688
-
C:\windows\system\DKM.exeC:\windows\system\DKM.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WCBHQB.exe.bat" "116⤵PID:4060
-
C:\windows\SysWOW64\WCBHQB.exeC:\windows\system32\WCBHQB.exe117⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4672 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GKDM.exe.bat" "118⤵PID:5780
-
C:\windows\SysWOW64\GKDM.exeC:\windows\system32\GKDM.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VBEEAU.exe.bat" "120⤵
- Executes a command shell one-liner
PID:2028 -
C:\windows\system\VBEEAU.exeC:\windows\system\VBEEAU.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-