Analysis
- max time kernel
37s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 06:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe
- Size 208KB
- Sample260629-gr8bzaev3w
- SHA256 1a2835d152675cf0a579fc3064b28611ca56c0190eff7d964848a66dfe5e2323
- MD5 755546c964c64fb22baeaab1c375e377
- SHA1 f75a0f7c80092d9dd0edc4d22c58c9906552a107
- SHA512 4a37d61376b5d76f207d1a3e8a1234f0734041ff2c98ba287fe57abdeb17bcf1e230956a14573295acd1a171477e29064a767736c77fb1474627c246477b7f6b
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfP4NLthEjQT6E:MlZtbLWIgd1LZ9oECZbclc5+LOHQEj6
- TLSH T105247D2235D2C073E4B7023188F6C7787BB6BD919B36928B7BC03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 38 IoCs
pid Process 6052 LJZR.exe 2860 JNYIIGG.exe 3772 BNMNUXI.exe 700 MFUYMYQ.exe 4992 UTGFWWM.exe 792 RJUWEDB.exe 4020 HZHO.exe 3572 LCFBUET.exe 3964 OXX.exe 3380 KYYNRTK.exe 5972 SDLTUR.exe 6108 OOTS.exe 4772 ZBAQN.exe 5048 CPSSGP.exe 5256 PMSD.exe 2576 SIJNU.exe 1732 JQXKG.exe 1744 MYYHNF.exe 2380 UELOYE.exe 5136 LMZLLV.exe 5696 PUG.exe 2628 IXKPC.exe 1156 XNLO.exe 6100 SAPXT.exe 2796 TDTTZGC.exe 6092 LHXXEE.exe 3328 QMPMU.exe 2856 FCQ.exe 1636 SFZCPY.exe 5288 IVIBW.exe 4804 GYTL.exe 3104 LCAYHE.exe 2928 CCOV.exe 988 HBRN.exe 2112 UEHM.exe 1252 EBNYQC.exe 3080 RHVK.exe 5112 GCEWLIL.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\RHVK.exe EBNYQC.exe File created C:\windows\SysWOW64\OOTS.exe.bat SDLTUR.exe File created C:\windows\SysWOW64\FCQ.exe QMPMU.exe File created C:\windows\SysWOW64\RHVK.exe EBNYQC.exe File created C:\windows\SysWOW64\TDTTZGC.exe SAPXT.exe File opened for modification C:\windows\SysWOW64\SDLTUR.exe KYYNRTK.exe File created C:\windows\SysWOW64\SDLTUR.exe.bat KYYNRTK.exe File created C:\windows\SysWOW64\OOTS.exe SDLTUR.exe File created C:\windows\SysWOW64\LCAYHE.exe.bat GYTL.exe File opened for modification C:\windows\SysWOW64\XNLO.exe IXKPC.exe File opened for modification C:\windows\SysWOW64\BNMNUXI.exe JNYIIGG.exe File created C:\windows\SysWOW64\KYYNRTK.exe OXX.exe File created C:\windows\SysWOW64\PMSD.exe CPSSGP.exe File created C:\windows\SysWOW64\XNLO.exe IXKPC.exe File created C:\windows\SysWOW64\TDTTZGC.exe.bat SAPXT.exe File opened for modification C:\windows\SysWOW64\FCQ.exe QMPMU.exe File opened for modification C:\windows\SysWOW64\OOTS.exe SDLTUR.exe File created C:\windows\SysWOW64\UELOYE.exe MYYHNF.exe File created C:\windows\SysWOW64\QMPMU.exe.bat LHXXEE.exe File created C:\windows\SysWOW64\FCQ.exe.bat QMPMU.exe File created C:\windows\SysWOW64\LCAYHE.exe GYTL.exe File created C:\windows\SysWOW64\UEHM.exe HBRN.exe File opened for modification C:\windows\SysWOW64\LJZR.exe 2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe File created C:\windows\SysWOW64\SDLTUR.exe KYYNRTK.exe File created C:\windows\SysWOW64\PMSD.exe.bat CPSSGP.exe File created C:\windows\SysWOW64\UELOYE.exe.bat MYYHNF.exe File opened for modification C:\windows\SysWOW64\PUG.exe LMZLLV.exe File created C:\windows\SysWOW64\PUG.exe.bat LMZLLV.exe File created C:\windows\SysWOW64\QMPMU.exe LHXXEE.exe File created C:\windows\SysWOW64\LJZR.exe.bat 2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe File created C:\windows\SysWOW64\BNMNUXI.exe JNYIIGG.exe File opened for modification C:\windows\SysWOW64\PMSD.exe CPSSGP.exe File opened for modification C:\windows\SysWOW64\UELOYE.exe MYYHNF.exe File created C:\windows\SysWOW64\XNLO.exe.bat IXKPC.exe File opened for modification C:\windows\SysWOW64\TDTTZGC.exe SAPXT.exe File created C:\windows\SysWOW64\LJZR.exe 2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe File created C:\windows\SysWOW64\BNMNUXI.exe.bat JNYIIGG.exe File opened for modification C:\windows\SysWOW64\KYYNRTK.exe OXX.exe File created C:\windows\SysWOW64\PUG.exe LMZLLV.exe File created C:\windows\SysWOW64\UEHM.exe.bat HBRN.exe File created C:\windows\SysWOW64\RHVK.exe.bat EBNYQC.exe File created C:\windows\SysWOW64\KYYNRTK.exe.bat OXX.exe File opened for modification C:\windows\SysWOW64\QMPMU.exe LHXXEE.exe File opened for modification C:\windows\SysWOW64\LCAYHE.exe GYTL.exe File opened for modification C:\windows\SysWOW64\UEHM.exe HBRN.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\HZHO.exe RJUWEDB.exe File created C:\windows\system\ZBAQN.exe.bat OOTS.exe File created C:\windows\system\IXKPC.exe.bat PUG.exe File opened for modification C:\windows\EBNYQC.exe UEHM.exe File created C:\windows\CPSSGP.exe.bat ZBAQN.exe File created C:\windows\LMZLLV.exe.bat UELOYE.exe File created C:\windows\CCOV.exe LCAYHE.exe File created C:\windows\EBNYQC.exe UEHM.exe File created C:\windows\UTGFWWM.exe MFUYMYQ.exe File created C:\windows\system\IXKPC.exe PUG.exe File opened for modification C:\windows\SAPXT.exe XNLO.exe File opened for modification C:\windows\SFZCPY.exe FCQ.exe File opened for modification C:\windows\system\GCEWLIL.exe RHVK.exe File created C:\windows\system\JNYIIGG.exe LJZR.exe File opened for modification C:\windows\RJUWEDB.exe UTGFWWM.exe File created C:\windows\OXX.exe.bat LCFBUET.exe File created C:\windows\system\ZBAQN.exe OOTS.exe File opened for modification C:\windows\system\LHXXEE.exe TDTTZGC.exe File created C:\windows\system\LHXXEE.exe.bat TDTTZGC.exe File created C:\windows\CCOV.exe.bat LCAYHE.exe File created C:\windows\system\LHXXEE.exe TDTTZGC.exe File created C:\windows\MYYHNF.exe.bat JQXKG.exe File created C:\windows\LMZLLV.exe UELOYE.exe File opened for modification C:\windows\LMZLLV.exe UELOYE.exe File opened for modification C:\windows\IVIBW.exe SFZCPY.exe File created C:\windows\GYTL.exe IVIBW.exe File created C:\windows\HZHO.exe.bat RJUWEDB.exe File opened for modification C:\windows\CPSSGP.exe ZBAQN.exe File opened for modification C:\windows\system\JNYIIGG.exe LJZR.exe File created C:\windows\system\JNYIIGG.exe.bat LJZR.exe File created C:\windows\MFUYMYQ.exe.bat BNMNUXI.exe File created C:\windows\UTGFWWM.exe.bat MFUYMYQ.exe File created C:\windows\JQXKG.exe.bat SIJNU.exe File created C:\windows\MFUYMYQ.exe BNMNUXI.exe File opened for modification C:\windows\OXX.exe LCFBUET.exe File created C:\windows\SAPXT.exe XNLO.exe File created C:\windows\MYYHNF.exe JQXKG.exe File created C:\windows\SFZCPY.exe.bat FCQ.exe File created C:\windows\IVIBW.exe.bat SFZCPY.exe File opened for modification C:\windows\MYYHNF.exe JQXKG.exe File opened for modification C:\windows\GYTL.exe IVIBW.exe File created C:\windows\CPSSGP.exe ZBAQN.exe File opened for modification C:\windows\JQXKG.exe SIJNU.exe File created C:\windows\GYTL.exe.bat IVIBW.exe File created C:\windows\system\GCEWLIL.exe RHVK.exe File created C:\windows\system\GCEWLIL.exe.bat RHVK.exe File opened for modification C:\windows\CCOV.exe LCAYHE.exe File created C:\windows\RJUWEDB.exe.bat UTGFWWM.exe File opened for modification C:\windows\HZHO.exe RJUWEDB.exe File opened for modification C:\windows\system\LCFBUET.exe HZHO.exe File opened for modification C:\windows\system\IXKPC.exe PUG.exe File created C:\windows\EBNYQC.exe.bat UEHM.exe File opened for modification C:\windows\MFUYMYQ.exe BNMNUXI.exe File opened for modification C:\windows\UTGFWWM.exe MFUYMYQ.exe File created C:\windows\system\LCFBUET.exe HZHO.exe File created C:\windows\OXX.exe LCFBUET.exe File opened for modification C:\windows\system\ZBAQN.exe OOTS.exe File created C:\windows\SIJNU.exe PMSD.exe File created C:\windows\JQXKG.exe SIJNU.exe File created C:\windows\system\HBRN.exe CCOV.exe File created C:\windows\system\LCFBUET.exe.bat HZHO.exe File created C:\windows\SIJNU.exe.bat PMSD.exe File created C:\windows\SAPXT.exe.bat XNLO.exe File created C:\windows\SFZCPY.exe FCQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 6104 5328 WerFault.exe 88 712 6052 WerFault.exe 93 4364 2860 WerFault.exe 99 2576 3772 WerFault.exe 104 716 700 WerFault.exe 109 3560 4992 WerFault.exe 114 4168 792 WerFault.exe 119 3432 4020 WerFault.exe 124 3320 3572 WerFault.exe 129 3288 3964 WerFault.exe 134 6024 3380 WerFault.exe 139 4084 5972 WerFault.exe 144 3932 6108 WerFault.exe 149 3936 4772 WerFault.exe 154 6092 5048 WerFault.exe 159 1148 5256 WerFault.exe 164 2240 2576 WerFault.exe 169 2724 1732 WerFault.exe 174 2680 1744 WerFault.exe 179 5312 2380 WerFault.exe 184 5548 5136 WerFault.exe 189 4496 5696 WerFault.exe 194 1944 2628 WerFault.exe 199 2588 1156 WerFault.exe 204 4220 6100 WerFault.exe 209 5000 2796 WerFault.exe 214 1700 6092 WerFault.exe 219 2412 3328 WerFault.exe 224 3436 2856 WerFault.exe 232 4488 1636 WerFault.exe 237 5300 5288 WerFault.exe 243 2724 4804 WerFault.exe 250 4732 3104 WerFault.exe 257 2304 2928 WerFault.exe 264 3116 988 WerFault.exe 270 932 2112 WerFault.exe 275 4276 1252 WerFault.exe 280 2096 3080 WerFault.exe 285 884 5112 WerFault.exe 290 3228 5516 WerFault.exe 295 4580 4712 WerFault.exe 300 4324 5908 WerFault.exe 305 4920 3684 WerFault.exe 310 1644 5716 WerFault.exe 315 1504 4276 WerFault.exe 320 4716 1916 WerFault.exe 325 856 5928 WerFault.exe 330 4360 2852 WerFault.exe 335 5012 4592 WerFault.exe 340 6020 3156 WerFault.exe 345 4860 4952 WerFault.exe 350 3016 4220 WerFault.exe 355 5372 3188 WerFault.exe 360 5184 4800 WerFault.exe 365 4556 5872 WerFault.exe 370 4412 4936 WerFault.exe 375 3400 3068 WerFault.exe 380 1804 2412 WerFault.exe 385 2588 3276 WerFault.exe 390 1076 2096 WerFault.exe 395 3360 4868 WerFault.exe 400 2592 5004 WerFault.exe 405 4516 2896 WerFault.exe 410 2516 5300 WerFault.exe 415 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SDLTUR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HZHO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KYYNRTK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PMSD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UEHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBNYQC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CPSSGP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LHXXEE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IVIBW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RHVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UELOYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXKPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PUG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GYTL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LJZR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BNMNUXI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SFZCPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JNYIIGG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MFUYMYQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZBAQN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SIJNU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAPXT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCFBUET.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JQXKG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QMPMU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UTGFWWM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LCAYHE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYYHNF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCOV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HBRN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{4F7B1296-BFC7-4C94-B953-00701E34B26D} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{3CC7469E-CBA3-4003-B15A-768D87D45D13} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5328 2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe 5328 2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe 6052 LJZR.exe 6052 LJZR.exe 2860 JNYIIGG.exe 2860 JNYIIGG.exe 3772 BNMNUXI.exe 3772 BNMNUXI.exe 700 MFUYMYQ.exe 700 MFUYMYQ.exe 4992 UTGFWWM.exe 4992 UTGFWWM.exe 792 RJUWEDB.exe 792 RJUWEDB.exe 4020 HZHO.exe 4020 HZHO.exe 3572 LCFBUET.exe 3572 LCFBUET.exe 3964 OXX.exe 3964 OXX.exe 3380 KYYNRTK.exe 3380 KYYNRTK.exe 5972 SDLTUR.exe 5972 SDLTUR.exe 6108 OOTS.exe 6108 OOTS.exe 4772 ZBAQN.exe 4772 ZBAQN.exe 5048 CPSSGP.exe 5048 CPSSGP.exe 5256 PMSD.exe 5256 PMSD.exe 2576 SIJNU.exe 2576 SIJNU.exe 1732 JQXKG.exe 1732 JQXKG.exe 1744 MYYHNF.exe 1744 MYYHNF.exe 2380 UELOYE.exe 2380 UELOYE.exe 5136 LMZLLV.exe 5136 LMZLLV.exe 5696 PUG.exe 5696 PUG.exe 2628 IXKPC.exe 2628 IXKPC.exe 1156 XNLO.exe 1156 XNLO.exe 6100 SAPXT.exe 6100 SAPXT.exe 2796 TDTTZGC.exe 2796 TDTTZGC.exe 6092 LHXXEE.exe 6092 LHXXEE.exe 3328 QMPMU.exe 3328 QMPMU.exe 2856 FCQ.exe 2856 FCQ.exe 1636 SFZCPY.exe 1636 SFZCPY.exe 1940 explorer.exe 1940 explorer.exe 5288 IVIBW.exe 5288 IVIBW.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe Token: SeShutdownPrivilege 1940 explorer.exe Token: SeCreatePagefilePrivilege 1940 explorer.exe - Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 2052 sihost.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe - Suspicious use of SendNotifyMessage 38 IoCs
pid Process 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe 1940 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5328 2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe 5328 2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe 6052 LJZR.exe 6052 LJZR.exe 2860 JNYIIGG.exe 2860 JNYIIGG.exe 3772 BNMNUXI.exe 3772 BNMNUXI.exe 700 MFUYMYQ.exe 700 MFUYMYQ.exe 4992 UTGFWWM.exe 4992 UTGFWWM.exe 792 RJUWEDB.exe 792 RJUWEDB.exe 4020 HZHO.exe 4020 HZHO.exe 3572 LCFBUET.exe 3572 LCFBUET.exe 3964 OXX.exe 3964 OXX.exe 3380 KYYNRTK.exe 3380 KYYNRTK.exe 5972 SDLTUR.exe 5972 SDLTUR.exe 6108 OOTS.exe 6108 OOTS.exe 4772 ZBAQN.exe 4772 ZBAQN.exe 5048 CPSSGP.exe 5048 CPSSGP.exe 5256 PMSD.exe 5256 PMSD.exe 2576 SIJNU.exe 2576 SIJNU.exe 1732 JQXKG.exe 1732 JQXKG.exe 1744 MYYHNF.exe 1744 MYYHNF.exe 2380 UELOYE.exe 2380 UELOYE.exe 5136 LMZLLV.exe 5136 LMZLLV.exe 5696 PUG.exe 5696 PUG.exe 2628 IXKPC.exe 2628 IXKPC.exe 1156 XNLO.exe 1156 XNLO.exe 6100 SAPXT.exe 6100 SAPXT.exe 2796 TDTTZGC.exe 2796 TDTTZGC.exe 6092 LHXXEE.exe 6092 LHXXEE.exe 3328 QMPMU.exe 3328 QMPMU.exe 2856 FCQ.exe 2856 FCQ.exe 1636 SFZCPY.exe 1636 SFZCPY.exe 5288 IVIBW.exe 5288 IVIBW.exe 2420 StartMenuExperienceHost.exe 1940 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5328 wrote to memory of 4760 5328 2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe 89 PID 4760 wrote to memory of 6052 4760 cmd.exe 93 PID 6052 wrote to memory of 1100 6052 LJZR.exe 95 PID 1100 wrote to memory of 2860 1100 cmd.exe 99 PID 2860 wrote to memory of 264 2860 JNYIIGG.exe 100 PID 264 wrote to memory of 3772 264 cmd.exe 104 PID 3772 wrote to memory of 2236 3772 BNMNUXI.exe 105 PID 2236 wrote to memory of 700 2236 cmd.exe 109 PID 700 wrote to memory of 2356 700 MFUYMYQ.exe 110 PID 2356 wrote to memory of 4992 2356 cmd.exe 114 PID 4992 wrote to memory of 5180 4992 UTGFWWM.exe 115 PID 5180 wrote to memory of 792 5180 cmd.exe 119 PID 792 wrote to memory of 1784 792 RJUWEDB.exe 120 PID 1784 wrote to memory of 4020 1784 cmd.exe 124 PID 4020 wrote to memory of 1624 4020 HZHO.exe 125 PID 1624 wrote to memory of 3572 1624 cmd.exe 129 PID 3572 wrote to memory of 2760 3572 LCFBUET.exe 130 PID 2760 wrote to memory of 3964 2760 cmd.exe 134 PID 3964 wrote to memory of 2712 3964 OXX.exe 135 PID 2712 wrote to memory of 3380 2712 cmd.exe 139 PID 3380 wrote to memory of 3040 3380 KYYNRTK.exe 140 PID 3040 wrote to memory of 5972 3040 cmd.exe 144 PID 5972 wrote to memory of 5860 5972 SDLTUR.exe 145 PID 5860 wrote to memory of 6108 5860 cmd.exe 149 PID 6108 wrote to memory of 2876 6108 OOTS.exe 150 PID 2876 wrote to memory of 4772 2876 cmd.exe 154 PID 4772 wrote to memory of 2812 4772 ZBAQN.exe 155 PID 2812 wrote to memory of 5048 2812 cmd.exe 159 PID 5048 wrote to memory of 1192 5048 CPSSGP.exe 160 PID 1192 wrote to memory of 5256 1192 cmd.exe 164 PID 5256 wrote to memory of 2264 5256 PMSD.exe 165 PID 2264 wrote to memory of 2576 2264 cmd.exe 169 PID 2576 wrote to memory of 1856 2576 SIJNU.exe 170 PID 1856 wrote to memory of 1732 1856 cmd.exe 174 PID 1732 wrote to memory of 4316 1732 JQXKG.exe 175 PID 4316 wrote to memory of 1744 4316 cmd.exe 179 PID 1744 wrote to memory of 2176 1744 MYYHNF.exe 180 PID 2176 wrote to memory of 2380 2176 cmd.exe 184 PID 2380 wrote to memory of 2008 2380 UELOYE.exe 185 PID 2008 wrote to memory of 5136 2008 cmd.exe 189 PID 5136 wrote to memory of 1796 5136 LMZLLV.exe 190 PID 1796 wrote to memory of 5696 1796 cmd.exe 194 PID 5696 wrote to memory of 4252 5696 PUG.exe 195 PID 4252 wrote to memory of 2628 4252 cmd.exe 199 PID 2628 wrote to memory of 2700 2628 IXKPC.exe 200 PID 2700 wrote to memory of 1156 2700 cmd.exe 204 PID 1156 wrote to memory of 4824 1156 XNLO.exe 205 PID 4824 wrote to memory of 6100 4824 cmd.exe 209 PID 6100 wrote to memory of 2684 6100 SAPXT.exe 210 PID 2684 wrote to memory of 2796 2684 cmd.exe 214 PID 2796 wrote to memory of 3600 2796 TDTTZGC.exe 215 PID 3600 wrote to memory of 6092 3600 cmd.exe 219 PID 6092 wrote to memory of 2612 6092 LHXXEE.exe 220 PID 2612 wrote to memory of 3328 2612 cmd.exe 224 PID 3328 wrote to memory of 2572 3328 QMPMU.exe 227 PID 2572 wrote to memory of 2856 2572 cmd.exe 232 PID 2856 wrote to memory of 3008 2856 FCQ.exe 233 PID 3008 wrote to memory of 1636 3008 cmd.exe 237 PID 2052 wrote to memory of 1940 2052 sihost.exe 238 PID 1636 wrote to memory of 5296 1636 SFZCPY.exe 239 PID 5296 wrote to memory of 5288 5296 cmd.exe 243 PID 5288 wrote to memory of 5540 5288 IVIBW.exe 246 PID 5540 wrote to memory of 4804 5540 cmd.exe 250 PID 4804 wrote to memory of 3620 4804 GYTL.exe 253 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_755546c964c64fb22baeaab1c375e377_elex_emotet_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LJZR.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\windows\SysWOW64\LJZR.exeC:\windows\system32\LJZR.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JNYIIGG.exe.bat" "4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\windows\system\JNYIIGG.exeC:\windows\system\JNYIIGG.exe5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNMNUXI.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:264 -
C:\windows\SysWOW64\BNMNUXI.exeC:\windows\system32\BNMNUXI.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MFUYMYQ.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\windows\MFUYMYQ.exeC:\windows\MFUYMYQ.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UTGFWWM.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\windows\UTGFWWM.exeC:\windows\UTGFWWM.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RJUWEDB.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\windows\RJUWEDB.exeC:\windows\RJUWEDB.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HZHO.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\windows\HZHO.exeC:\windows\HZHO.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LCFBUET.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\windows\system\LCFBUET.exeC:\windows\system\LCFBUET.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OXX.exe.bat" "18⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\windows\OXX.exeC:\windows\OXX.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KYYNRTK.exe.bat" "20⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\windows\SysWOW64\KYYNRTK.exeC:\windows\system32\KYYNRTK.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SDLTUR.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\windows\SysWOW64\SDLTUR.exeC:\windows\system32\SDLTUR.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OOTS.exe.bat" "24⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\windows\SysWOW64\OOTS.exeC:\windows\system32\OOTS.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBAQN.exe.bat" "26⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\windows\system\ZBAQN.exeC:\windows\system\ZBAQN.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPSSGP.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\windows\CPSSGP.exeC:\windows\CPSSGP.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PMSD.exe.bat" "30⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\windows\SysWOW64\PMSD.exeC:\windows\system32\PMSD.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SIJNU.exe.bat" "32⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\windows\SIJNU.exeC:\windows\SIJNU.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JQXKG.exe.bat" "34⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\windows\JQXKG.exeC:\windows\JQXKG.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MYYHNF.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\windows\MYYHNF.exeC:\windows\MYYHNF.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UELOYE.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\windows\SysWOW64\UELOYE.exeC:\windows\system32\UELOYE.exe39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LMZLLV.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\windows\LMZLLV.exeC:\windows\LMZLLV.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PUG.exe.bat" "42⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\windows\SysWOW64\PUG.exeC:\windows\system32\PUG.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IXKPC.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\windows\system\IXKPC.exeC:\windows\system\IXKPC.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XNLO.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\windows\SysWOW64\XNLO.exeC:\windows\system32\XNLO.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SAPXT.exe.bat" "48⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\windows\SAPXT.exeC:\windows\SAPXT.exe49⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TDTTZGC.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\windows\SysWOW64\TDTTZGC.exeC:\windows\system32\TDTTZGC.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHXXEE.exe.bat" "52⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\windows\system\LHXXEE.exeC:\windows\system\LHXXEE.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QMPMU.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\windows\SysWOW64\QMPMU.exeC:\windows\system32\QMPMU.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FCQ.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\windows\SysWOW64\FCQ.exeC:\windows\system32\FCQ.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SFZCPY.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\windows\SFZCPY.exeC:\windows\SFZCPY.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IVIBW.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\windows\IVIBW.exeC:\windows\IVIBW.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GYTL.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\windows\GYTL.exeC:\windows\GYTL.exe63⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCAYHE.exe.bat" "64⤵
- System Location Discovery: System Language Discovery
PID:3620 -
C:\windows\SysWOW64\LCAYHE.exeC:\windows\system32\LCAYHE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CCOV.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:4576 -
C:\windows\CCOV.exeC:\windows\CCOV.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HBRN.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1072 -
C:\windows\system\HBRN.exeC:\windows\system\HBRN.exe69⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UEHM.exe.bat" "70⤵
- System Location Discovery: System Language Discovery
PID:1232 -
C:\windows\SysWOW64\UEHM.exeC:\windows\system32\UEHM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EBNYQC.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4572 -
C:\windows\EBNYQC.exeC:\windows\EBNYQC.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1252 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RHVK.exe.bat" "74⤵PID:4548
-
C:\windows\SysWOW64\RHVK.exeC:\windows\system32\RHVK.exe75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GCEWLIL.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1552 -
C:\windows\system\GCEWLIL.exeC:\windows\system\GCEWLIL.exe77⤵
- Executes dropped EXE
PID:5112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FYDXI.exe.bat" "78⤵PID:3052
-
C:\windows\FYDXI.exeC:\windows\FYDXI.exe79⤵PID:5516
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FTHTVBC.exe.bat" "80⤵PID:1500
-
C:\windows\FTHTVBC.exeC:\windows\FTHTVBC.exe81⤵PID:4712
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JJOB.exe.bat" "82⤵PID:4332
-
C:\windows\system\JJOB.exeC:\windows\system\JJOB.exe83⤵PID:5908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGTV.exe.bat" "84⤵PID:1356
-
C:\windows\SysWOW64\TGTV.exeC:\windows\system32\TGTV.exe85⤵PID:3684
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EZJG.exe.bat" "86⤵PID:4984
-
C:\windows\EZJG.exeC:\windows\EZJG.exe87⤵PID:5716
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FCNCEK.exe.bat" "88⤵PID:1316
-
C:\windows\FCNCEK.exeC:\windows\FCNCEK.exe89⤵PID:4276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HASWT.exe.bat" "90⤵PID:5008
-
C:\windows\SysWOW64\HASWT.exeC:\windows\system32\HASWT.exe91⤵PID:1916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YAUBXYB.exe.bat" "92⤵PID:716
-
C:\windows\system\YAUBXYB.exeC:\windows\system\YAUBXYB.exe93⤵PID:5928
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\STKMGRJ.exe.bat" "94⤵PID:5532
-
C:\windows\SysWOW64\STKMGRJ.exeC:\windows\system32\STKMGRJ.exe95⤵PID:2852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KWOQ.exe.bat" "96⤵PID:4692
-
C:\windows\SysWOW64\KWOQ.exeC:\windows\system32\KWOQ.exe97⤵PID:4592
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AMPHACA.exe.bat" "98⤵PID:4356
-
C:\windows\system\AMPHACA.exeC:\windows\system\AMPHACA.exe99⤵PID:3156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NWXGG.exe.bat" "100⤵PID:1588
-
C:\windows\system\NWXGG.exeC:\windows\system\NWXGG.exe101⤵PID:4952
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ORJC.exe.bat" "102⤵PID:2728
-
C:\windows\system\ORJC.exeC:\windows\system\ORJC.exe103⤵PID:4220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QPOWBM.exe.bat" "104⤵PID:256
-
C:\windows\QPOWBM.exeC:\windows\QPOWBM.exe105⤵PID:3188
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EKA.exe.bat" "106⤵PID:5652
-
C:\windows\SysWOW64\EKA.exeC:\windows\system32\EKA.exe107⤵PID:4800
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UDDNQOS.exe.bat" "108⤵PID:3460
-
C:\windows\system\UDDNQOS.exeC:\windows\system\UDDNQOS.exe109⤵PID:5872
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GLJNC.exe.bat" "110⤵PID:5528
-
C:\windows\system\GLJNC.exeC:\windows\system\GLJNC.exe111⤵PID:4936
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IJXHRHP.exe.bat" "112⤵PID:4344
-
C:\windows\system\IJXHRHP.exeC:\windows\system\IJXHRHP.exe113⤵PID:3068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FKZ.exe.bat" "114⤵PID:2460
-
C:\windows\FKZ.exeC:\windows\FKZ.exe115⤵PID:2412
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NPL.exe.bat" "116⤵PID:4112
-
C:\windows\NPL.exeC:\windows\NPL.exe117⤵PID:3276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MAOGO.exe.bat" "118⤵PID:5384
-
C:\windows\SysWOW64\MAOGO.exeC:\windows\system32\MAOGO.exe119⤵PID:2096
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FAERY.exe.bat" "120⤵PID:1104
-
C:\windows\system\FAERY.exeC:\windows\system\FAERY.exe121⤵PID:4868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-