Analysis
- max time kernel
58s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 20:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe
- Size 208KB
- Sample260629-zhp35sf14m
- SHA256 c7721a73e446b0df69c4bfcd06c7ee01e05c877be6dbc37080b80d78d8d64d7b
- MD5 a17c5866e6e1bb927d3a6c4d053b18f3
- SHA1 60d8f5fa207822705896e2f9723694d63e191001
- SHA512 602c96d688522812c7fcae399620e12fee9abe392f7082b6317678862de2e3ee735e3047ac25d270312f1d76b5bef2a2a0846a0752a4e4fb744b8b859226153a
- SSDEEP 3072:oLQaL9tbLkRIgd1Lye9yjE2hWAN5XbclcdL+LOfF4NLthEjQT6c:MlZtbLWIgd1LZ9oECZbclc5+LOtQEju
- TLSH T10F247D2236D2C073E4B7023188F6C7787BB6BD919B36928B77C03B4D6E715A68A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 4176 LHFXM.exe 420 BPI.exe 1820 JVMQOXQ.exe 416 VVCBXX.exe 1152 ZOEDJCH.exe 4380 BMRY.exe 2024 WXAW.exe 2084 PAESKD.exe 2884 ZXRMR.exe 5004 KQMFA.exe 3692 FDROKS.exe 756 YGVSP.exe 5416 KOB.exe 1076 XMJEDM.exe 2996 OUYBQD.exe 6072 HXCFD.exe 2820 CIK.exe 3104 BTNUSKM.exe 3160 UOZP.exe 4128 DWTUJFY.exe 1120 SRKHU.exe 2144 NFPQFSN.exe 5484 PAMZ.exe 4876 TIAABK.exe 1560 DQU.exe 1980 URWS.exe 3372 WOK.exe 4332 CPSSGP.exe 296 GFY.exe 5900 VNZRRD.exe 5140 QIE.exe 5552 JBLULE.exe 4984 PWLU.exe 560 OME.exe 5468 XUGC.exe 2604 MKHUVFI.exe 5280 LVWCF.exe 3924 FLTWY.exe 2740 IXZV.exe 3024 XSIZJTC.exe 4184 RFNR.exe 4092 DYQCT.exe 1008 NVW.exe 1800 JWGY.exe 1984 GBQODIT.exe 1596 RUT.exe 4424 DCAOXI.exe 4472 YXE.exe 5684 SLJH.exe 2376 EDMASP.exe 4968 NDGFWMR.exe 4972 IRLO.exe 2000 DCBN.exe 4656 FZVHSMJ.exe 1308 HXICIUS.exe 3364 BKFL.exe 1832 AVQ.exe 708 VRVK.exe 4776 ARCYMCT.exe 5512 GRKMDEU.exe 4760 BEPV.exe 4808 SPFT.exe 1404 WXMTRR.exe 3352 WAQXE.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 63 IoCs
description ioc Process File created C:\windows\SysWOW64\ZOEDJCH.exe.bat VVCBXX.exe File created C:\windows\SysWOW64\URWS.exe.bat DQU.exe File created C:\windows\SysWOW64\DCAOXI.exe.bat RUT.exe File opened for modification C:\windows\SysWOW64\BEPV.exe GRKMDEU.exe File created C:\windows\SysWOW64\BMRY.exe.bat ZOEDJCH.exe File created C:\windows\SysWOW64\OUYBQD.exe.bat XMJEDM.exe File opened for modification C:\windows\SysWOW64\URWS.exe DQU.exe File created C:\windows\SysWOW64\WAQXE.exe.bat WXMTRR.exe File created C:\windows\SysWOW64\TUIR.exe.bat XOCU.exe File created C:\windows\SysWOW64\WAQXE.exe WXMTRR.exe File created C:\windows\SysWOW64\ZOEDJCH.exe VVCBXX.exe File created C:\windows\SysWOW64\FDROKS.exe KQMFA.exe File created C:\windows\SysWOW64\PAMZ.exe NFPQFSN.exe File created C:\windows\SysWOW64\IXZV.exe.bat FLTWY.exe File created C:\windows\SysWOW64\HXICIUS.exe.bat FZVHSMJ.exe File opened for modification C:\windows\SysWOW64\VRVK.exe AVQ.exe File opened for modification C:\windows\SysWOW64\BXVOFA.exe XPPGTQL.exe File created C:\windows\SysWOW64\UOZP.exe.bat BTNUSKM.exe File created C:\windows\SysWOW64\QIE.exe VNZRRD.exe File opened for modification C:\windows\SysWOW64\HXICIUS.exe FZVHSMJ.exe File created C:\windows\SysWOW64\KQMFA.exe ZXRMR.exe File created C:\windows\SysWOW64\FDROKS.exe.bat KQMFA.exe File opened for modification C:\windows\SysWOW64\OUYBQD.exe XMJEDM.exe File opened for modification C:\windows\SysWOW64\UOZP.exe BTNUSKM.exe File opened for modification C:\windows\SysWOW64\QIE.exe VNZRRD.exe File created C:\windows\SysWOW64\HXICIUS.exe FZVHSMJ.exe File created C:\windows\SysWOW64\VRVK.exe.bat AVQ.exe File opened for modification C:\windows\SysWOW64\ZOEDJCH.exe VVCBXX.exe File created C:\windows\SysWOW64\OUYBQD.exe XMJEDM.exe File opened for modification C:\windows\SysWOW64\SRKHU.exe DWTUJFY.exe File created C:\windows\SysWOW64\SRKHU.exe.bat DWTUJFY.exe File opened for modification C:\windows\SysWOW64\PAMZ.exe NFPQFSN.exe File opened for modification C:\windows\SysWOW64\RUT.exe GBQODIT.exe File created C:\windows\SysWOW64\VRVK.exe AVQ.exe File created C:\windows\SysWOW64\BXVOFA.exe.bat XPPGTQL.exe File opened for modification C:\windows\SysWOW64\WAQXE.exe WXMTRR.exe File opened for modification C:\windows\SysWOW64\LVWCF.exe MKHUVFI.exe File created C:\windows\SysWOW64\LVWCF.exe.bat MKHUVFI.exe File opened for modification C:\windows\SysWOW64\DCAOXI.exe RUT.exe File created C:\windows\SysWOW64\UOZP.exe BTNUSKM.exe File created C:\windows\SysWOW64\QIE.exe.bat VNZRRD.exe File created C:\windows\SysWOW64\LVWCF.exe MKHUVFI.exe File created C:\windows\SysWOW64\NVW.exe.bat DYQCT.exe File created C:\windows\SysWOW64\RUT.exe GBQODIT.exe File created C:\windows\SysWOW64\BEPV.exe GRKMDEU.exe File created C:\windows\SysWOW64\PAMZ.exe.bat NFPQFSN.exe File created C:\windows\SysWOW64\RUT.exe.bat GBQODIT.exe File opened for modification C:\windows\SysWOW64\FDROKS.exe KQMFA.exe File created C:\windows\SysWOW64\SRKHU.exe DWTUJFY.exe File created C:\windows\SysWOW64\NVW.exe DYQCT.exe File created C:\windows\SysWOW64\BEPV.exe.bat GRKMDEU.exe File created C:\windows\SysWOW64\TUIR.exe XOCU.exe File opened for modification C:\windows\SysWOW64\KQMFA.exe ZXRMR.exe File created C:\windows\SysWOW64\BMRY.exe ZOEDJCH.exe File created C:\windows\SysWOW64\KQMFA.exe.bat ZXRMR.exe File opened for modification C:\windows\SysWOW64\IXZV.exe FLTWY.exe File opened for modification C:\windows\SysWOW64\NVW.exe DYQCT.exe File created C:\windows\SysWOW64\DCAOXI.exe RUT.exe File opened for modification C:\windows\SysWOW64\BMRY.exe ZOEDJCH.exe File created C:\windows\SysWOW64\URWS.exe DQU.exe File created C:\windows\SysWOW64\IXZV.exe FLTWY.exe File opened for modification C:\windows\SysWOW64\TUIR.exe XOCU.exe File created C:\windows\SysWOW64\BXVOFA.exe XPPGTQL.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\PAESKD.exe.bat WXAW.exe File created C:\windows\CIK.exe HXCFD.exe File opened for modification C:\windows\CIK.exe HXCFD.exe File created C:\windows\VNZRRD.exe.bat GFY.exe File created C:\windows\MKHUVFI.exe XUGC.exe File opened for modification C:\windows\system\YXE.exe DCAOXI.exe File created C:\windows\BKFL.exe.bat HXICIUS.exe File created C:\windows\system\WXMTRR.exe.bat SPFT.exe File created C:\windows\system\GFY.exe CPSSGP.exe File created C:\windows\VNZRRD.exe GFY.exe File opened for modification C:\windows\VNZRRD.exe GFY.exe File created C:\windows\MKHUVFI.exe.bat XUGC.exe File created C:\windows\system\FZVHSMJ.exe DCBN.exe File opened for modification C:\windows\XOCU.exe CBXLNBD.exe File created C:\windows\XOCU.exe.bat CBXLNBD.exe File created C:\windows\BKJILGR.exe.bat TUIR.exe File created C:\windows\TIAABK.exe PAMZ.exe File opened for modification C:\windows\system\JBLULE.exe QIE.exe File opened for modification C:\windows\BKJILGR.exe TUIR.exe File created C:\windows\JVMQOXQ.exe BPI.exe File created C:\windows\system\XMJEDM.exe.bat KOB.exe File created C:\windows\OME.exe.bat PWLU.exe File created C:\windows\system\XUGC.exe OME.exe File created C:\windows\DYQCT.exe.bat RFNR.exe File created C:\windows\ARCYMCT.exe.bat VRVK.exe File created C:\windows\system\LHFXM.exe 2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe File created C:\windows\YGVSP.exe.bat FDROKS.exe File opened for modification C:\windows\KOB.exe YGVSP.exe File created C:\windows\EDMASP.exe.bat SLJH.exe File created C:\windows\system\AVQ.exe.bat BKFL.exe File opened for modification C:\windows\GRKMDEU.exe ARCYMCT.exe File created C:\windows\JVMQOXQ.exe.bat BPI.exe File created C:\windows\system\BTNUSKM.exe.bat CIK.exe File opened for modification C:\windows\CBXLNBD.exe WAQXE.exe File created C:\windows\system\DQU.exe TIAABK.exe File opened for modification C:\windows\OME.exe PWLU.exe File opened for modification C:\windows\EDMASP.exe SLJH.exe File created C:\windows\NDGFWMR.exe.bat EDMASP.exe File opened for modification C:\windows\BKFL.exe HXICIUS.exe File created C:\windows\system\XPPGTQL.exe.bat BKJILGR.exe File created C:\windows\system\JWGY.exe NVW.exe File created C:\windows\GRKMDEU.exe.bat ARCYMCT.exe File created C:\windows\XOCU.exe CBXLNBD.exe File opened for modification C:\windows\system\LHFXM.exe 2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe File opened for modification C:\windows\system\IRLO.exe NDGFWMR.exe File created C:\windows\system\IRLO.exe.bat NDGFWMR.exe File opened for modification C:\windows\system\NFPQFSN.exe SRKHU.exe File created C:\windows\PWLU.exe JBLULE.exe File created C:\windows\system\XUGC.exe.bat OME.exe File opened for modification C:\windows\system\JWGY.exe NVW.exe File created C:\windows\DCBN.exe IRLO.exe File opened for modification C:\windows\DCBN.exe IRLO.exe File created C:\windows\HXCFD.exe.bat OUYBQD.exe File created C:\windows\CPSSGP.exe WOK.exe File created C:\windows\system\FZVHSMJ.exe.bat DCBN.exe File created C:\windows\NDGFWMR.exe EDMASP.exe File created C:\windows\ZXRMR.exe.bat PAESKD.exe File created C:\windows\YGVSP.exe FDROKS.exe File created C:\windows\GBQODIT.exe JWGY.exe File opened for modification C:\windows\GBQODIT.exe JWGY.exe File created C:\windows\system\AVQ.exe BKFL.exe File created C:\windows\SPFT.exe BEPV.exe File created C:\windows\BKJILGR.exe TUIR.exe File opened for modification C:\windows\system\VVCBXX.exe JVMQOXQ.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 5884 4500 WerFault.exe 86 1516 4176 WerFault.exe 91 3364 420 WerFault.exe 97 2672 1820 WerFault.exe 102 3120 416 WerFault.exe 107 3920 1152 WerFault.exe 112 2832 4380 WerFault.exe 117 1648 2024 WerFault.exe 122 5444 2084 WerFault.exe 127 1148 2884 WerFault.exe 132 4260 5004 WerFault.exe 137 3368 3692 WerFault.exe 142 5172 756 WerFault.exe 147 2476 5416 WerFault.exe 152 2876 1076 WerFault.exe 157 2332 2996 WerFault.exe 162 5420 6072 WerFault.exe 167 2148 2820 WerFault.exe 172 6016 3104 WerFault.exe 177 1320 3160 WerFault.exe 182 2512 4128 WerFault.exe 187 1312 1120 WerFault.exe 192 4972 2144 WerFault.exe 197 4900 5484 WerFault.exe 202 5272 4876 WerFault.exe 207 3360 1560 WerFault.exe 212 2108 1980 WerFault.exe 217 2900 3372 WerFault.exe 222 2812 4332 WerFault.exe 227 5504 296 WerFault.exe 232 2608 5900 WerFault.exe 237 3640 5140 WerFault.exe 242 3484 5552 WerFault.exe 247 4768 4984 WerFault.exe 252 960 560 WerFault.exe 259 752 5468 WerFault.exe 265 1600 2604 WerFault.exe 271 5168 5280 WerFault.exe 279 5964 3924 WerFault.exe 286 1472 2740 WerFault.exe 291 1184 3024 WerFault.exe 296 2628 4184 WerFault.exe 301 3460 4092 WerFault.exe 307 716 1008 WerFault.exe 312 4512 1800 WerFault.exe 317 4780 1984 WerFault.exe 322 4756 1596 WerFault.exe 327 4576 4424 WerFault.exe 332 5432 4472 WerFault.exe 337 1192 5684 WerFault.exe 342 2692 2376 WerFault.exe 347 1312 4968 WerFault.exe 352 2532 4972 WerFault.exe 357 4920 2000 WerFault.exe 362 5172 4656 WerFault.exe 367 4960 1308 WerFault.exe 372 4828 3364 WerFault.exe 377 3204 1832 WerFault.exe 382 5872 708 WerFault.exe 387 5040 4776 WerFault.exe 392 5184 5512 WerFault.exe 397 4900 4760 WerFault.exe 402 5836 4808 WerFault.exe 407 4212 1404 WerFault.exe 412 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FZVHSMJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NFPQFSN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DQU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VNZRRD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TIAABK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDMASP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VVCBXX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BKFL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GRKMDEU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NVW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JWGY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARCYMCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KOB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DYQCT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UOZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OME.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OUYBQD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YXE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VRVK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GBQODIT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IRLO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WXMTRR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KQMFA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FLTWY.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 35 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{2F823651-B6D4-480D-9794-49723754C4D5} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{326A9262-ADFC-4956-850F-C10819FBE2AD} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4500 2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe 4500 2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe 4176 LHFXM.exe 4176 LHFXM.exe 420 BPI.exe 420 BPI.exe 1820 JVMQOXQ.exe 1820 JVMQOXQ.exe 416 VVCBXX.exe 416 VVCBXX.exe 1152 ZOEDJCH.exe 1152 ZOEDJCH.exe 4380 BMRY.exe 4380 BMRY.exe 2024 WXAW.exe 2024 WXAW.exe 2084 PAESKD.exe 2084 PAESKD.exe 2884 ZXRMR.exe 2884 ZXRMR.exe 5004 KQMFA.exe 5004 KQMFA.exe 3692 FDROKS.exe 3692 FDROKS.exe 756 YGVSP.exe 756 YGVSP.exe 5416 KOB.exe 5416 KOB.exe 1076 XMJEDM.exe 1076 XMJEDM.exe 2996 OUYBQD.exe 2996 OUYBQD.exe 6072 HXCFD.exe 6072 HXCFD.exe 2820 CIK.exe 2820 CIK.exe 3104 BTNUSKM.exe 3104 BTNUSKM.exe 3160 UOZP.exe 3160 UOZP.exe 4128 DWTUJFY.exe 4128 DWTUJFY.exe 1120 SRKHU.exe 1120 SRKHU.exe 2144 NFPQFSN.exe 2144 NFPQFSN.exe 5484 PAMZ.exe 5484 PAMZ.exe 4876 TIAABK.exe 4876 TIAABK.exe 1560 DQU.exe 1560 DQU.exe 1980 URWS.exe 1980 URWS.exe 3372 WOK.exe 3372 WOK.exe 4332 CPSSGP.exe 4332 CPSSGP.exe 296 GFY.exe 296 GFY.exe 5900 VNZRRD.exe 5900 VNZRRD.exe 5140 QIE.exe 5140 QIE.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 200 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe Token: SeShutdownPrivilege 200 explorer.exe Token: SeCreatePagefilePrivilege 200 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1484 sihost.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe 200 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4500 2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe 4500 2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe 4176 LHFXM.exe 4176 LHFXM.exe 420 BPI.exe 420 BPI.exe 1820 JVMQOXQ.exe 1820 JVMQOXQ.exe 416 VVCBXX.exe 416 VVCBXX.exe 1152 ZOEDJCH.exe 1152 ZOEDJCH.exe 4380 BMRY.exe 4380 BMRY.exe 2024 WXAW.exe 2024 WXAW.exe 2084 PAESKD.exe 2084 PAESKD.exe 2884 ZXRMR.exe 2884 ZXRMR.exe 5004 KQMFA.exe 5004 KQMFA.exe 3692 FDROKS.exe 3692 FDROKS.exe 756 YGVSP.exe 756 YGVSP.exe 5416 KOB.exe 5416 KOB.exe 1076 XMJEDM.exe 1076 XMJEDM.exe 2996 OUYBQD.exe 2996 OUYBQD.exe 6072 HXCFD.exe 6072 HXCFD.exe 2820 CIK.exe 2820 CIK.exe 3104 BTNUSKM.exe 3104 BTNUSKM.exe 3160 UOZP.exe 3160 UOZP.exe 4128 DWTUJFY.exe 4128 DWTUJFY.exe 1120 SRKHU.exe 1120 SRKHU.exe 2144 NFPQFSN.exe 2144 NFPQFSN.exe 5484 PAMZ.exe 5484 PAMZ.exe 4876 TIAABK.exe 4876 TIAABK.exe 1560 DQU.exe 1560 DQU.exe 1980 URWS.exe 1980 URWS.exe 3372 WOK.exe 3372 WOK.exe 4332 CPSSGP.exe 4332 CPSSGP.exe 296 GFY.exe 296 GFY.exe 5900 VNZRRD.exe 5900 VNZRRD.exe 5140 QIE.exe 5140 QIE.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4500 wrote to memory of 4216 4500 2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe 87 PID 4216 wrote to memory of 4176 4216 cmd.exe 91 PID 4176 wrote to memory of 2280 4176 LHFXM.exe 93 PID 2280 wrote to memory of 420 2280 cmd.exe 97 PID 420 wrote to memory of 1556 420 BPI.exe 98 PID 1556 wrote to memory of 1820 1556 cmd.exe 102 PID 1820 wrote to memory of 5804 1820 JVMQOXQ.exe 103 PID 5804 wrote to memory of 416 5804 cmd.exe 107 PID 416 wrote to memory of 204 416 VVCBXX.exe 108 PID 204 wrote to memory of 1152 204 cmd.exe 112 PID 1152 wrote to memory of 4136 1152 ZOEDJCH.exe 113 PID 4136 wrote to memory of 4380 4136 cmd.exe 117 PID 4380 wrote to memory of 3580 4380 BMRY.exe 118 PID 3580 wrote to memory of 2024 3580 cmd.exe 122 PID 2024 wrote to memory of 1392 2024 WXAW.exe 123 PID 1392 wrote to memory of 2084 1392 cmd.exe 127 PID 2084 wrote to memory of 6104 2084 PAESKD.exe 128 PID 6104 wrote to memory of 2884 6104 cmd.exe 132 PID 2884 wrote to memory of 2480 2884 ZXRMR.exe 133 PID 2480 wrote to memory of 5004 2480 cmd.exe 137 PID 5004 wrote to memory of 820 5004 KQMFA.exe 138 PID 820 wrote to memory of 3692 820 cmd.exe 142 PID 3692 wrote to memory of 4624 3692 FDROKS.exe 143 PID 4624 wrote to memory of 756 4624 cmd.exe 147 PID 756 wrote to memory of 5160 756 YGVSP.exe 148 PID 5160 wrote to memory of 5416 5160 cmd.exe 152 PID 5416 wrote to memory of 5148 5416 KOB.exe 153 PID 5148 wrote to memory of 1076 5148 cmd.exe 157 PID 1076 wrote to memory of 5960 1076 XMJEDM.exe 158 PID 5960 wrote to memory of 2996 5960 cmd.exe 162 PID 2996 wrote to memory of 3056 2996 OUYBQD.exe 163 PID 3056 wrote to memory of 6072 3056 cmd.exe 167 PID 6072 wrote to memory of 6024 6072 HXCFD.exe 168 PID 6024 wrote to memory of 2820 6024 cmd.exe 172 PID 2820 wrote to memory of 1432 2820 CIK.exe 173 PID 1432 wrote to memory of 3104 1432 cmd.exe 177 PID 3104 wrote to memory of 6052 3104 BTNUSKM.exe 178 PID 6052 wrote to memory of 3160 6052 cmd.exe 182 PID 3160 wrote to memory of 1288 3160 UOZP.exe 183 PID 1288 wrote to memory of 4128 1288 cmd.exe 187 PID 4128 wrote to memory of 2684 4128 DWTUJFY.exe 188 PID 2684 wrote to memory of 1120 2684 cmd.exe 192 PID 1120 wrote to memory of 2196 1120 SRKHU.exe 193 PID 2196 wrote to memory of 2144 2196 cmd.exe 197 PID 2144 wrote to memory of 4996 2144 NFPQFSN.exe 198 PID 4996 wrote to memory of 5484 4996 cmd.exe 202 PID 5484 wrote to memory of 4392 5484 PAMZ.exe 203 PID 4392 wrote to memory of 4876 4392 cmd.exe 207 PID 4876 wrote to memory of 2872 4876 TIAABK.exe 208 PID 2872 wrote to memory of 1560 2872 cmd.exe 212 PID 1560 wrote to memory of 5768 1560 DQU.exe 213 PID 5768 wrote to memory of 1980 5768 cmd.exe 217 PID 1980 wrote to memory of 5740 1980 URWS.exe 218 PID 5740 wrote to memory of 3372 5740 cmd.exe 222 PID 3372 wrote to memory of 3464 3372 WOK.exe 223 PID 3464 wrote to memory of 4332 3464 cmd.exe 227 PID 4332 wrote to memory of 4692 4332 CPSSGP.exe 228 PID 4692 wrote to memory of 296 4692 cmd.exe 232 PID 296 wrote to memory of 4684 296 GFY.exe 233 PID 4684 wrote to memory of 5900 4684 cmd.exe 237 PID 5900 wrote to memory of 5308 5900 VNZRRD.exe 238 PID 5308 wrote to memory of 5140 5308 cmd.exe 242 PID 5140 wrote to memory of 3248 5140 QIE.exe 243 PID 3248 wrote to memory of 5552 3248 cmd.exe 247
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_a17c5866e6e1bb927d3a6c4d053b18f3_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LHFXM.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\windows\system\LHFXM.exeC:\windows\system\LHFXM.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BPI.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\windows\system\BPI.exeC:\windows\system\BPI.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JVMQOXQ.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\windows\JVMQOXQ.exeC:\windows\JVMQOXQ.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VVCBXX.exe.bat" "8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\windows\system\VVCBXX.exeC:\windows\system\VVCBXX.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZOEDJCH.exe.bat" "10⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:204 -
C:\windows\SysWOW64\ZOEDJCH.exeC:\windows\system32\ZOEDJCH.exe11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BMRY.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\windows\SysWOW64\BMRY.exeC:\windows\system32\BMRY.exe13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WXAW.exe.bat" "14⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\windows\system\WXAW.exeC:\windows\system\WXAW.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PAESKD.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\windows\PAESKD.exeC:\windows\PAESKD.exe17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXRMR.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\windows\ZXRMR.exeC:\windows\ZXRMR.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KQMFA.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\windows\SysWOW64\KQMFA.exeC:\windows\system32\KQMFA.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\FDROKS.exe.bat" "22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:820 -
C:\windows\SysWOW64\FDROKS.exeC:\windows\system32\FDROKS.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YGVSP.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\windows\YGVSP.exeC:\windows\YGVSP.exe25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KOB.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\windows\KOB.exeC:\windows\KOB.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XMJEDM.exe.bat" "28⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\windows\system\XMJEDM.exeC:\windows\system\XMJEDM.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OUYBQD.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\windows\SysWOW64\OUYBQD.exeC:\windows\system32\OUYBQD.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HXCFD.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\windows\HXCFD.exeC:\windows\HXCFD.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CIK.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\windows\CIK.exeC:\windows\CIK.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BTNUSKM.exe.bat" "36⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\windows\system\BTNUSKM.exeC:\windows\system\BTNUSKM.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UOZP.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\windows\SysWOW64\UOZP.exeC:\windows\system32\UOZP.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWTUJFY.exe.bat" "40⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\windows\system\DWTUJFY.exeC:\windows\system\DWTUJFY.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SRKHU.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\windows\SysWOW64\SRKHU.exeC:\windows\system32\SRKHU.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NFPQFSN.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\windows\system\NFPQFSN.exeC:\windows\system\NFPQFSN.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PAMZ.exe.bat" "46⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\windows\SysWOW64\PAMZ.exeC:\windows\system32\PAMZ.exe47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TIAABK.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\windows\TIAABK.exeC:\windows\TIAABK.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQU.exe.bat" "50⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\windows\system\DQU.exeC:\windows\system\DQU.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\URWS.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\windows\SysWOW64\URWS.exeC:\windows\system32\URWS.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WOK.exe.bat" "54⤵
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\windows\system\WOK.exeC:\windows\system\WOK.exe55⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CPSSGP.exe.bat" "56⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\windows\CPSSGP.exeC:\windows\CPSSGP.exe57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GFY.exe.bat" "58⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\windows\system\GFY.exeC:\windows\system\GFY.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VNZRRD.exe.bat" "60⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\VNZRRD.exeC:\windows\VNZRRD.exe61⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QIE.exe.bat" "62⤵
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\windows\SysWOW64\QIE.exeC:\windows\system32\QIE.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBLULE.exe.bat" "64⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\windows\system\JBLULE.exeC:\windows\system\JBLULE.exe65⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5552 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWLU.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:5864 -
C:\windows\PWLU.exeC:\windows\PWLU.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OME.exe.bat" "68⤵
- System Location Discovery: System Language Discovery
PID:1884 -
C:\windows\OME.exeC:\windows\OME.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XUGC.exe.bat" "70⤵PID:5812
-
C:\windows\system\XUGC.exeC:\windows\system\XUGC.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MKHUVFI.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:1808 -
C:\windows\MKHUVFI.exeC:\windows\MKHUVFI.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LVWCF.exe.bat" "74⤵PID:252
-
C:\windows\SysWOW64\LVWCF.exeC:\windows\system32\LVWCF.exe75⤵
- Executes dropped EXE
PID:5280 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FLTWY.exe.bat" "76⤵
- System Location Discovery: System Language Discovery
PID:1372 -
C:\windows\system\FLTWY.exeC:\windows\system\FLTWY.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "78⤵PID:1648
-
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XSIZJTC.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:4848 -
C:\windows\system\XSIZJTC.exeC:\windows\system\XSIZJTC.exe81⤵
- Executes dropped EXE
PID:3024 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RFNR.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:2792 -
C:\windows\RFNR.exeC:\windows\RFNR.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4184 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DYQCT.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3176 -
C:\windows\DYQCT.exeC:\windows\DYQCT.exe85⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NVW.exe.bat" "86⤵PID:4548
-
C:\windows\SysWOW64\NVW.exeC:\windows\system32\NVW.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1008 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JWGY.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\windows\system\JWGY.exeC:\windows\system\JWGY.exe89⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GBQODIT.exe.bat" "90⤵PID:5756
-
C:\windows\GBQODIT.exeC:\windows\GBQODIT.exe91⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RUT.exe.bat" "92⤵PID:5272
-
C:\windows\SysWOW64\RUT.exeC:\windows\system32\RUT.exe93⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DCAOXI.exe.bat" "94⤵
- System Location Discovery: System Language Discovery
PID:712 -
C:\windows\SysWOW64\DCAOXI.exeC:\windows\system32\DCAOXI.exe95⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4424 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YXE.exe.bat" "96⤵PID:5152
-
C:\windows\system\YXE.exeC:\windows\system\YXE.exe97⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SLJH.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:2564 -
C:\windows\SLJH.exeC:\windows\SLJH.exe99⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EDMASP.exe.bat" "100⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\windows\EDMASP.exeC:\windows\EDMASP.exe101⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NDGFWMR.exe.bat" "102⤵
- System Location Discovery: System Language Discovery
PID:3284 -
C:\windows\NDGFWMR.exeC:\windows\NDGFWMR.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRLO.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3268 -
C:\windows\system\IRLO.exeC:\windows\system\IRLO.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DCBN.exe.bat" "106⤵PID:5060
-
C:\windows\DCBN.exeC:\windows\DCBN.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2000 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FZVHSMJ.exe.bat" "108⤵
- System Location Discovery: System Language Discovery
PID:5396 -
C:\windows\system\FZVHSMJ.exeC:\windows\system\FZVHSMJ.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4656 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HXICIUS.exe.bat" "110⤵PID:3468
-
C:\windows\SysWOW64\HXICIUS.exeC:\windows\system32\HXICIUS.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1308 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BKFL.exe.bat" "112⤵PID:1752
-
C:\windows\BKFL.exeC:\windows\BKFL.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVQ.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4048 -
C:\windows\system\AVQ.exeC:\windows\system\AVQ.exe115⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VRVK.exe.bat" "116⤵
- System Location Discovery: System Language Discovery
PID:4488 -
C:\windows\SysWOW64\VRVK.exeC:\windows\system32\VRVK.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ARCYMCT.exe.bat" "118⤵
- System Location Discovery: System Language Discovery
PID:2868 -
C:\windows\ARCYMCT.exeC:\windows\ARCYMCT.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4776 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GRKMDEU.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:5808 -
C:\windows\GRKMDEU.exeC:\windows\GRKMDEU.exe121⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-