Analysis
- max time kernel
66s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/06/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe
- Size 208KB
- Sample260630-ejrcdaew8n
- SHA256 fdb416c70d4a13b694269c1e2a202a7e44c2231eda9f67528c6340dfd1f42841
- MD5 c191d32f87820cba3142629cd9b196f5
- SHA1 3894862b81045817800080c7acf43682df7c4219
- SHA512 d0bbcaa4ea7560241763ac9a2d50108b5846e9a389c2fc8fc9b43ab30b31b48798d893b9cff3cfda5a771832bee2902ac0280ee361f5524c85a07888916115b2
- SSDEEP 3072:jLQaL9tbLkRIgd1Lye9yjE2hWAN5Xbsl9dL+LOfj4pLthEjQT6j:vlZtbLWIgd1LZ9oECZbsl95+LOLkEj1
- TLSH T1FC247D1236D2C073E4B7023188F6C7787BB6BDA19B36928B7BC03B4D6E715968A35351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 64 IoCs
pid Process 3084 JULNNJ.exe 1120 MVOWEUS.exe 3460 CLP.exe 3232 YRZD.exe 5456 CUFYBEM.exe 5116 XPC.exe 4704 HFQCSM.exe 3264 IITYG.exe 3440 VTC.exe 1780 OWGAZDH.exe 3560 JYWRO.exe 4792 SHYERL.exe 5124 IXZV.exe 5832 VZHUMJP.exe 2100 SAR.exe 1456 DQYWCY.exe 1100 HYE.exe 2876 CLJOR.exe 2660 PRJ.exe 2352 TZQZFU.exe 668 JUHM.exe 4504 ADJRB.exe 4564 PTK.exe 5352 MYVX.exe 1968 MEVMA.exe 2532 HOD.exe 2200 MUEUL.exe 2616 GWXPK.exe 1632 ROSI.exe 1796 BMGC.exe 4104 UPKYF.exe 4644 QUQVMAY.exe 2536 SSVPBIH.exe 1260 PQBMIK.exe 6136 PDTTKXM.exe 1548 ZBHNRF.exe 3044 ZWL.exe 4540 DMRRJN.exe 3124 JNZ.exe 4948 YSFBH.exe 4444 AFKLRRC.exe 700 VTG.exe 1152 VYHJ.exe 4100 SEZ.exe 4320 HUAXSV.exe 3360 LKG.exe 1228 LFKBKDA.exe 4596 RFS.exe 4292 BOUUED.exe 5924 XTARLM.exe 2496 NJBI.exe 4696 HWGSCA.exe 4352 NXN.exe 4616 IKSPV.exe 5596 OKADEWJ.exe 3036 IYWU.exe 4220 ILXBQ.exe 352 DZBSAJ.exe 1868 JZJGJLQ.exe 4228 LPCAQAY.exe 4252 DSOEVQ.exe 5860 JSORES.exe 792 PSVF.exe 5888 EIEWUIZ.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\windows\SysWOW64\SAR.exe VZHUMJP.exe File created C:\windows\SysWOW64\PRJ.exe.bat CLJOR.exe File created C:\windows\SysWOW64\JNZ.exe DMRRJN.exe File created C:\windows\SysWOW64\VTC.exe IITYG.exe File created C:\windows\SysWOW64\HUAXSV.exe.bat SEZ.exe File opened for modification C:\windows\SysWOW64\XTARLM.exe BOUUED.exe File opened for modification C:\windows\SysWOW64\VTC.exe IITYG.exe File created C:\windows\SysWOW64\OWGAZDH.exe VTC.exe File opened for modification C:\windows\SysWOW64\SAR.exe VZHUMJP.exe File created C:\windows\SysWOW64\MYVX.exe.bat PTK.exe File created C:\windows\SysWOW64\GWXPK.exe MUEUL.exe File opened for modification C:\windows\SysWOW64\DMRRJN.exe ZWL.exe File created C:\windows\SysWOW64\GSBI.exe YMB.exe File created C:\windows\SysWOW64\MVOWEUS.exe.bat JULNNJ.exe File created C:\windows\SysWOW64\JYWRO.exe.bat OWGAZDH.exe File created C:\windows\SysWOW64\SHYERL.exe.bat JYWRO.exe File created C:\windows\SysWOW64\ZWL.exe.bat ZBHNRF.exe File created C:\windows\SysWOW64\DMRRJN.exe.bat ZWL.exe File created C:\windows\SysWOW64\RFS.exe.bat LFKBKDA.exe File opened for modification C:\windows\SysWOW64\QRT.exe NDPESL.exe File created C:\windows\SysWOW64\QRT.exe.bat NDPESL.exe File opened for modification C:\windows\SysWOW64\HUAXSV.exe SEZ.exe File created C:\windows\SysWOW64\MYVX.exe PTK.exe File created C:\windows\SysWOW64\GWXPK.exe.bat MUEUL.exe File created C:\windows\SysWOW64\SSVPBIH.exe QUQVMAY.exe File created C:\windows\SysWOW64\JUHM.exe.bat TZQZFU.exe File created C:\windows\SysWOW64\XTARLM.exe.bat BOUUED.exe File created C:\windows\SysWOW64\IKSPV.exe NXN.exe File created C:\windows\SysWOW64\IKSPV.exe.bat NXN.exe File created C:\windows\SysWOW64\PRJ.exe CLJOR.exe File created C:\windows\SysWOW64\KWSO.exe EVLAKZU.exe File created C:\windows\SysWOW64\SHYERL.exe JYWRO.exe File opened for modification C:\windows\SysWOW64\SHYERL.exe JYWRO.exe File created C:\windows\SysWOW64\IXZV.exe SHYERL.exe File created C:\windows\SysWOW64\TZQZFU.exe PRJ.exe File opened for modification C:\windows\SysWOW64\MYVX.exe PTK.exe File opened for modification C:\windows\SysWOW64\SSVPBIH.exe QUQVMAY.exe File created C:\windows\SysWOW64\QRT.exe NDPESL.exe File opened for modification C:\windows\SysWOW64\MVOWEUS.exe JULNNJ.exe File created C:\windows\SysWOW64\JYWRO.exe OWGAZDH.exe File opened for modification C:\windows\SysWOW64\JNZ.exe DMRRJN.exe File opened for modification C:\windows\SysWOW64\IKSPV.exe NXN.exe File opened for modification C:\windows\SysWOW64\UYF.exe PXXSTOK.exe File created C:\windows\SysWOW64\KWSO.exe.bat EVLAKZU.exe File opened for modification C:\windows\SysWOW64\GSBI.exe YMB.exe File opened for modification C:\windows\SysWOW64\NDPESL.exe EVMZP.exe File created C:\windows\SysWOW64\JUHM.exe TZQZFU.exe File created C:\windows\SysWOW64\JNZ.exe.bat DMRRJN.exe File created C:\windows\SysWOW64\RFS.exe LFKBKDA.exe File created C:\windows\SysWOW64\NDPESL.exe.bat EVMZP.exe File created C:\windows\SysWOW64\IXZV.exe.bat SHYERL.exe File opened for modification C:\windows\SysWOW64\GWXPK.exe MUEUL.exe File opened for modification C:\windows\SysWOW64\PRJ.exe CLJOR.exe File created C:\windows\SysWOW64\ZWL.exe ZBHNRF.exe File created C:\windows\SysWOW64\UYF.exe PXXSTOK.exe File created C:\windows\SysWOW64\GSBI.exe.bat YMB.exe File created C:\windows\SysWOW64\XTARLM.exe BOUUED.exe File created C:\windows\SysWOW64\VTC.exe.bat IITYG.exe File opened for modification C:\windows\SysWOW64\IXZV.exe SHYERL.exe File opened for modification C:\windows\SysWOW64\JUHM.exe TZQZFU.exe File created C:\windows\SysWOW64\SSVPBIH.exe.bat QUQVMAY.exe File opened for modification C:\windows\SysWOW64\ZWL.exe ZBHNRF.exe File created C:\windows\SysWOW64\NDPESL.exe EVMZP.exe File created C:\windows\SysWOW64\MVOWEUS.exe JULNNJ.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\windows\system\PDTTKXM.exe PQBMIK.exe File created C:\windows\BOUUED.exe.bat RFS.exe File opened for modification C:\windows\system\LPCAQAY.exe JZJGJLQ.exe File created C:\windows\FJXXLT.exe KWSO.exe File created C:\windows\EVMZP.exe PFLAIS.exe File opened for modification C:\windows\system\CLJOR.exe HYE.exe File created C:\windows\VTG.exe.bat AFKLRRC.exe File created C:\windows\system\HUKWU.exe VBHD.exe File opened for modification C:\windows\VZHUMJP.exe IXZV.exe File created C:\windows\UPKYF.exe.bat BMGC.exe File created C:\windows\system\ZBHNRF.exe.bat PDTTKXM.exe File opened for modification C:\windows\system\AFKLRRC.exe YSFBH.exe File opened for modification C:\windows\IYWU.exe OKADEWJ.exe File created C:\windows\QBZ.exe EIEWUIZ.exe File opened for modification C:\windows\system\DQYWCY.exe SAR.exe File created C:\windows\ADJRB.exe.bat JUHM.exe File opened for modification C:\windows\QUQVMAY.exe UPKYF.exe File created C:\windows\system\PQBMIK.exe SSVPBIH.exe File created C:\windows\system\PQBMIK.exe.bat SSVPBIH.exe File opened for modification C:\windows\HWGSCA.exe NJBI.exe File opened for modification C:\windows\system\HUKWU.exe VBHD.exe File created C:\windows\JULNNJ.exe.bat 2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe File opened for modification C:\windows\BMGC.exe ROSI.exe File created C:\windows\KUZX.exe.bat NUSJDBG.exe File created C:\windows\system\CLJOR.exe HYE.exe File created C:\windows\ADJRB.exe JUHM.exe File opened for modification C:\windows\VYHJ.exe VTG.exe File created C:\windows\PSVF.exe.bat JSORES.exe File created C:\windows\VBHD.exe QBZ.exe File created C:\windows\VZHUMJP.exe IXZV.exe File created C:\windows\HYE.exe DQYWCY.exe File created C:\windows\UPKYF.exe BMGC.exe File opened for modification C:\windows\HOD.exe MEVMA.exe File created C:\windows\SEZ.exe VYHJ.exe File created C:\windows\system\ILXBQ.exe.bat IYWU.exe File created C:\windows\QBZ.exe.bat EIEWUIZ.exe File created C:\windows\JULNNJ.exe 2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe File created C:\windows\system\XPC.exe CUFYBEM.exe File created C:\windows\HFQCSM.exe XPC.exe File opened for modification C:\windows\system\MEVMA.exe MYVX.exe File created C:\windows\QUQVMAY.exe UPKYF.exe File opened for modification C:\windows\system\YSFBH.exe JNZ.exe File created C:\windows\system\JSORES.exe DSOEVQ.exe File opened for modification C:\windows\EIEWUIZ.exe PSVF.exe File opened for modification C:\windows\system\CUFYBEM.exe YRZD.exe File opened for modification C:\windows\system\XPC.exe CUFYBEM.exe File created C:\windows\IITYG.exe.bat HFQCSM.exe File opened for modification C:\windows\HYE.exe DQYWCY.exe File opened for modification C:\windows\SEZ.exe VYHJ.exe File created C:\windows\system\LPCAQAY.exe JZJGJLQ.exe File created C:\windows\HWGSCA.exe NJBI.exe File created C:\windows\NXN.exe HWGSCA.exe File created C:\windows\OKADEWJ.exe IKSPV.exe File created C:\windows\EIEWUIZ.exe.bat PSVF.exe File created C:\windows\system\YMB.exe FJXXLT.exe File opened for modification C:\windows\EVMZP.exe PFLAIS.exe File opened for modification C:\windows\YRZD.exe CLP.exe File created C:\windows\PTK.exe.bat ADJRB.exe File opened for modification C:\windows\system\PQBMIK.exe SSVPBIH.exe File opened for modification C:\windows\system\JZJGJLQ.exe DZBSAJ.exe File created C:\windows\IYWU.exe.bat OKADEWJ.exe File created C:\windows\system\ILXBQ.exe IYWU.exe File created C:\windows\system\DQYWCY.exe SAR.exe File created C:\windows\HOD.exe.bat MEVMA.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 64 IoCs
pid pid_target Process procid_target 2336 5080 WerFault.exe 86 2192 3084 WerFault.exe 91 5816 1120 WerFault.exe 97 3176 3460 WerFault.exe 102 3660 3232 WerFault.exe 107 5084 5456 WerFault.exe 112 1376 5116 WerFault.exe 117 3920 4704 WerFault.exe 122 3988 3264 WerFault.exe 127 2976 3440 WerFault.exe 132 4684 1780 WerFault.exe 137 1588 3560 WerFault.exe 142 5356 4792 WerFault.exe 147 5476 5124 WerFault.exe 152 5328 5832 WerFault.exe 157 5996 2100 WerFault.exe 162 2376 1456 WerFault.exe 167 3228 1100 WerFault.exe 172 5260 2876 WerFault.exe 177 5244 2660 WerFault.exe 182 4572 2352 WerFault.exe 187 5492 668 WerFault.exe 192 5808 4504 WerFault.exe 197 420 4564 WerFault.exe 202 5984 5352 WerFault.exe 209 6064 1968 WerFault.exe 215 1768 2532 WerFault.exe 224 1492 2200 WerFault.exe 231 4148 2616 WerFault.exe 236 4936 1632 WerFault.exe 241 3540 1796 WerFault.exe 247 4640 4104 WerFault.exe 252 4244 4644 WerFault.exe 257 4048 2536 WerFault.exe 262 5820 1260 WerFault.exe 267 936 6136 WerFault.exe 272 3556 1548 WerFault.exe 277 4248 3044 WerFault.exe 282 2648 4540 WerFault.exe 287 4180 3124 WerFault.exe 292 5448 4948 WerFault.exe 297 3456 4444 WerFault.exe 302 2824 700 WerFault.exe 307 4676 1152 WerFault.exe 312 3820 4100 WerFault.exe 317 4632 4320 WerFault.exe 322 5400 3360 WerFault.exe 327 3352 1228 WerFault.exe 332 3420 4596 WerFault.exe 337 3348 4292 WerFault.exe 342 2924 5924 WerFault.exe 347 5024 2496 WerFault.exe 352 4628 4696 WerFault.exe 357 4124 4352 WerFault.exe 362 5680 4616 WerFault.exe 367 4724 5596 WerFault.exe 372 5808 3036 WerFault.exe 377 2072 4220 WerFault.exe 382 3304 352 WerFault.exe 387 1936 1868 WerFault.exe 392 2648 4228 WerFault.exe 397 4592 4252 WerFault.exe 402 2564 5860 WerFault.exe 407 5624 792 WerFault.exe 412 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUHM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PSVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PFLAIS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OGFQPY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SSVPBIH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SEZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OKADEWJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DSOEVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PXXSTOK.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EVMZP.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUQVMAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EIEWUIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KUZX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JULNNJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ILXBQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LPCAQAY.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFKLRRC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CUFYBEM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HYE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TZQZFU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JYWRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BOUUED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MUEUL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XPC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HFQCSM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MYVX.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDTTKXM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YRZD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IKSPV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OWGAZDH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IXZV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VTG.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{6181360C-0E80-4A3A-A076-965B079E3011} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{8374A908-CD9B-4E46-A436-176CD77E4188} explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\NotificationData explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache SearchHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5080 2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe 5080 2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe 3084 JULNNJ.exe 3084 JULNNJ.exe 1120 MVOWEUS.exe 1120 MVOWEUS.exe 3460 CLP.exe 3460 CLP.exe 3232 YRZD.exe 3232 YRZD.exe 5456 CUFYBEM.exe 5456 CUFYBEM.exe 5116 XPC.exe 5116 XPC.exe 4704 HFQCSM.exe 4704 HFQCSM.exe 3264 IITYG.exe 3264 IITYG.exe 3440 VTC.exe 3440 VTC.exe 1780 OWGAZDH.exe 1780 OWGAZDH.exe 3560 JYWRO.exe 3560 JYWRO.exe 4792 SHYERL.exe 4792 SHYERL.exe 5124 IXZV.exe 5124 IXZV.exe 5832 VZHUMJP.exe 5832 VZHUMJP.exe 2100 SAR.exe 2100 SAR.exe 1456 DQYWCY.exe 1456 DQYWCY.exe 1100 HYE.exe 1100 HYE.exe 2876 CLJOR.exe 2876 CLJOR.exe 2660 PRJ.exe 2660 PRJ.exe 2352 TZQZFU.exe 2352 TZQZFU.exe 668 JUHM.exe 668 JUHM.exe 4504 ADJRB.exe 4504 ADJRB.exe 4564 PTK.exe 4564 PTK.exe 5352 MYVX.exe 5352 MYVX.exe 1968 MEVMA.exe 1968 MEVMA.exe 1664 explorer.exe 1664 explorer.exe 2532 HOD.exe 2532 HOD.exe 2200 MUEUL.exe 2200 MUEUL.exe 2616 GWXPK.exe 2616 GWXPK.exe 1632 ROSI.exe 1632 ROSI.exe 1796 BMGC.exe 1796 BMGC.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1664 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe Token: SeShutdownPrivilege 1664 explorer.exe Token: SeCreatePagefilePrivilege 1664 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 1280 sihost.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe 1664 explorer.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 5080 2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe 5080 2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe 3084 JULNNJ.exe 3084 JULNNJ.exe 1120 MVOWEUS.exe 1120 MVOWEUS.exe 3460 CLP.exe 3460 CLP.exe 3232 YRZD.exe 3232 YRZD.exe 5456 CUFYBEM.exe 5456 CUFYBEM.exe 5116 XPC.exe 5116 XPC.exe 4704 HFQCSM.exe 4704 HFQCSM.exe 3264 IITYG.exe 3264 IITYG.exe 3440 VTC.exe 3440 VTC.exe 1780 OWGAZDH.exe 1780 OWGAZDH.exe 3560 JYWRO.exe 3560 JYWRO.exe 4792 SHYERL.exe 4792 SHYERL.exe 5124 IXZV.exe 5124 IXZV.exe 5832 VZHUMJP.exe 5832 VZHUMJP.exe 2100 SAR.exe 2100 SAR.exe 1456 DQYWCY.exe 1456 DQYWCY.exe 1100 HYE.exe 1100 HYE.exe 2876 CLJOR.exe 2876 CLJOR.exe 2660 PRJ.exe 2660 PRJ.exe 2352 TZQZFU.exe 2352 TZQZFU.exe 668 JUHM.exe 668 JUHM.exe 4504 ADJRB.exe 4504 ADJRB.exe 4564 PTK.exe 4564 PTK.exe 5352 MYVX.exe 5352 MYVX.exe 1968 MEVMA.exe 1968 MEVMA.exe 688 StartMenuExperienceHost.exe 5672 SearchHost.exe 2532 HOD.exe 2532 HOD.exe 1664 explorer.exe 2200 MUEUL.exe 2200 MUEUL.exe 2616 GWXPK.exe 2616 GWXPK.exe 1632 ROSI.exe 1632 ROSI.exe 1796 BMGC.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5080 wrote to memory of 4480 5080 2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe 87 PID 4480 wrote to memory of 3084 4480 cmd.exe 91 PID 3084 wrote to memory of 3936 3084 JULNNJ.exe 93 PID 3936 wrote to memory of 1120 3936 cmd.exe 97 PID 1120 wrote to memory of 424 1120 MVOWEUS.exe 98 PID 424 wrote to memory of 3460 424 cmd.exe 102 PID 3460 wrote to memory of 916 3460 CLP.exe 103 PID 916 wrote to memory of 3232 916 cmd.exe 107 PID 3232 wrote to memory of 1716 3232 YRZD.exe 108 PID 1716 wrote to memory of 5456 1716 cmd.exe 112 PID 5456 wrote to memory of 4496 5456 CUFYBEM.exe 113 PID 4496 wrote to memory of 5116 4496 cmd.exe 117 PID 5116 wrote to memory of 4232 5116 XPC.exe 118 PID 4232 wrote to memory of 4704 4232 cmd.exe 122 PID 4704 wrote to memory of 1484 4704 HFQCSM.exe 123 PID 1484 wrote to memory of 3264 1484 cmd.exe 127 PID 3264 wrote to memory of 4968 3264 IITYG.exe 128 PID 4968 wrote to memory of 3440 4968 cmd.exe 132 PID 3440 wrote to memory of 4000 3440 VTC.exe 133 PID 4000 wrote to memory of 1780 4000 cmd.exe 137 PID 1780 wrote to memory of 1336 1780 OWGAZDH.exe 138 PID 1336 wrote to memory of 3560 1336 cmd.exe 142 PID 3560 wrote to memory of 3884 3560 JYWRO.exe 143 PID 3884 wrote to memory of 4792 3884 cmd.exe 147 PID 4792 wrote to memory of 5436 4792 SHYERL.exe 148 PID 5436 wrote to memory of 5124 5436 cmd.exe 152 PID 5124 wrote to memory of 240 5124 IXZV.exe 153 PID 240 wrote to memory of 5832 240 cmd.exe 157 PID 5832 wrote to memory of 2892 5832 VZHUMJP.exe 158 PID 2892 wrote to memory of 2100 2892 cmd.exe 162 PID 2100 wrote to memory of 5428 2100 SAR.exe 163 PID 5428 wrote to memory of 1456 5428 cmd.exe 167 PID 1456 wrote to memory of 2844 1456 DQYWCY.exe 168 PID 2844 wrote to memory of 1100 2844 cmd.exe 172 PID 1100 wrote to memory of 3212 1100 HYE.exe 173 PID 3212 wrote to memory of 2876 3212 cmd.exe 177 PID 2876 wrote to memory of 4392 2876 CLJOR.exe 178 PID 4392 wrote to memory of 2660 4392 cmd.exe 182 PID 2660 wrote to memory of 6032 2660 PRJ.exe 183 PID 6032 wrote to memory of 2352 6032 cmd.exe 187 PID 2352 wrote to memory of 5136 2352 TZQZFU.exe 188 PID 5136 wrote to memory of 668 5136 cmd.exe 192 PID 668 wrote to memory of 3272 668 JUHM.exe 193 PID 3272 wrote to memory of 4504 3272 cmd.exe 197 PID 4504 wrote to memory of 4684 4504 ADJRB.exe 198 PID 4684 wrote to memory of 4564 4684 cmd.exe 202 PID 4564 wrote to memory of 5780 4564 PTK.exe 205 PID 5780 wrote to memory of 5352 5780 cmd.exe 209 PID 5352 wrote to memory of 4804 5352 MYVX.exe 211 PID 4804 wrote to memory of 1968 4804 cmd.exe 215 PID 1280 wrote to memory of 1664 1280 sihost.exe 216 PID 1968 wrote to memory of 4012 1968 MEVMA.exe 217 PID 4012 wrote to memory of 2532 4012 cmd.exe 224 PID 2532 wrote to memory of 692 2532 HOD.exe 226 PID 692 wrote to memory of 2200 692 cmd.exe 231 PID 2200 wrote to memory of 3932 2200 MUEUL.exe 232 PID 3932 wrote to memory of 2616 3932 cmd.exe 236 PID 2616 wrote to memory of 3280 2616 GWXPK.exe 237 PID 3280 wrote to memory of 1632 3280 cmd.exe 241 PID 1632 wrote to memory of 5240 1632 ROSI.exe 243 PID 5240 wrote to memory of 1796 5240 cmd.exe 247 PID 1796 wrote to memory of 3168 1796 BMGC.exe 248 PID 3168 wrote to memory of 4104 3168 cmd.exe 252 PID 4104 wrote to memory of 3728 4104 UPKYF.exe 253
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_c191d32f87820cba3142629cd9b196f5_elex_emotet_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JULNNJ.exe.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\windows\JULNNJ.exeC:\windows\JULNNJ.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVOWEUS.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\windows\SysWOW64\MVOWEUS.exeC:\windows\system32\MVOWEUS.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CLP.exe.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:424 -
C:\windows\CLP.exeC:\windows\CLP.exe7⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YRZD.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\windows\YRZD.exeC:\windows\YRZD.exe9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CUFYBEM.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\windows\system\CUFYBEM.exeC:\windows\system\CUFYBEM.exe11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XPC.exe.bat" "12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\windows\system\XPC.exeC:\windows\system\XPC.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HFQCSM.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\windows\HFQCSM.exeC:\windows\HFQCSM.exe15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IITYG.exe.bat" "16⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\windows\IITYG.exeC:\windows\IITYG.exe17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VTC.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\windows\SysWOW64\VTC.exeC:\windows\system32\VTC.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OWGAZDH.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\windows\SysWOW64\OWGAZDH.exeC:\windows\system32\OWGAZDH.exe21⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JYWRO.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\windows\SysWOW64\JYWRO.exeC:\windows\system32\JYWRO.exe23⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SHYERL.exe.bat" "24⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\windows\SysWOW64\SHYERL.exeC:\windows\system32\SHYERL.exe25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IXZV.exe.bat" "26⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\windows\SysWOW64\IXZV.exeC:\windows\system32\IXZV.exe27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VZHUMJP.exe.bat" "28⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\windows\VZHUMJP.exeC:\windows\VZHUMJP.exe29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SAR.exe.bat" "30⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\windows\SysWOW64\SAR.exeC:\windows\system32\SAR.exe31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DQYWCY.exe.bat" "32⤵
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\windows\system\DQYWCY.exeC:\windows\system\DQYWCY.exe33⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HYE.exe.bat" "34⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\windows\HYE.exeC:\windows\HYE.exe35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CLJOR.exe.bat" "36⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\windows\system\CLJOR.exeC:\windows\system\CLJOR.exe37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PRJ.exe.bat" "38⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\windows\SysWOW64\PRJ.exeC:\windows\system32\PRJ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TZQZFU.exe.bat" "40⤵
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\windows\SysWOW64\TZQZFU.exeC:\windows\system32\TZQZFU.exe41⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JUHM.exe.bat" "42⤵
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\windows\SysWOW64\JUHM.exeC:\windows\system32\JUHM.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ADJRB.exe.bat" "44⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\windows\ADJRB.exeC:\windows\ADJRB.exe45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PTK.exe.bat" "46⤵
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\windows\PTK.exeC:\windows\PTK.exe47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MYVX.exe.bat" "48⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\windows\SysWOW64\MYVX.exeC:\windows\system32\MYVX.exe49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MEVMA.exe.bat" "50⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\windows\system\MEVMA.exeC:\windows\system\MEVMA.exe51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOD.exe.bat" "52⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\windows\HOD.exeC:\windows\HOD.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\MUEUL.exe.bat" "54⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692 -
C:\windows\system\MUEUL.exeC:\windows\system\MUEUL.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GWXPK.exe.bat" "56⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\windows\SysWOW64\GWXPK.exeC:\windows\system32\GWXPK.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ROSI.exe.bat" "58⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\windows\system\ROSI.exeC:\windows\system\ROSI.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BMGC.exe.bat" "60⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\windows\BMGC.exeC:\windows\BMGC.exe61⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UPKYF.exe.bat" "62⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\windows\UPKYF.exeC:\windows\UPKYF.exe63⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\QUQVMAY.exe.bat" "64⤵PID:3728
-
C:\windows\QUQVMAY.exeC:\windows\QUQVMAY.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SSVPBIH.exe.bat" "66⤵
- System Location Discovery: System Language Discovery
PID:1768 -
C:\windows\SysWOW64\SSVPBIH.exeC:\windows\system32\SSVPBIH.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2536 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PQBMIK.exe.bat" "68⤵PID:1292
-
C:\windows\system\PQBMIK.exeC:\windows\system\PQBMIK.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PDTTKXM.exe.bat" "70⤵PID:1236
-
C:\windows\system\PDTTKXM.exeC:\windows\system\PDTTKXM.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZBHNRF.exe.bat" "72⤵
- System Location Discovery: System Language Discovery
PID:4808 -
C:\windows\system\ZBHNRF.exeC:\windows\system\ZBHNRF.exe73⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZWL.exe.bat" "74⤵PID:3816
-
C:\windows\SysWOW64\ZWL.exeC:\windows\system32\ZWL.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DMRRJN.exe.bat" "76⤵PID:2812
-
C:\windows\SysWOW64\DMRRJN.exeC:\windows\system32\DMRRJN.exe77⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JNZ.exe.bat" "78⤵PID:4640
-
C:\windows\SysWOW64\JNZ.exeC:\windows\system32\JNZ.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3124 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\YSFBH.exe.bat" "80⤵
- System Location Discovery: System Language Discovery
PID:3024 -
C:\windows\system\YSFBH.exeC:\windows\system\YSFBH.exe81⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AFKLRRC.exe.bat" "82⤵
- System Location Discovery: System Language Discovery
PID:5220 -
C:\windows\system\AFKLRRC.exeC:\windows\system\AFKLRRC.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VTG.exe.bat" "84⤵
- System Location Discovery: System Language Discovery
PID:3992 -
C:\windows\VTG.exeC:\windows\VTG.exe85⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:700 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VYHJ.exe.bat" "86⤵PID:2872
-
C:\windows\VYHJ.exeC:\windows\VYHJ.exe87⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SEZ.exe.bat" "88⤵
- System Location Discovery: System Language Discovery
PID:4044 -
C:\windows\SEZ.exeC:\windows\SEZ.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HUAXSV.exe.bat" "90⤵PID:5920
-
C:\windows\SysWOW64\HUAXSV.exeC:\windows\system32\HUAXSV.exe91⤵
- Executes dropped EXE
PID:4320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LKG.exe.bat" "92⤵PID:5828
-
C:\windows\LKG.exeC:\windows\LKG.exe93⤵
- Executes dropped EXE
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LFKBKDA.exe.bat" "94⤵PID:236
-
C:\windows\LFKBKDA.exeC:\windows\LFKBKDA.exe95⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1228 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFS.exe.bat" "96⤵PID:1844
-
C:\windows\SysWOW64\RFS.exeC:\windows\system32\RFS.exe97⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\BOUUED.exe.bat" "98⤵
- System Location Discovery: System Language Discovery
PID:1740 -
C:\windows\BOUUED.exeC:\windows\BOUUED.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4292 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XTARLM.exe.bat" "100⤵PID:768
-
C:\windows\SysWOW64\XTARLM.exeC:\windows\system32\XTARLM.exe101⤵
- Executes dropped EXE
PID:5924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NJBI.exe.bat" "102⤵PID:4908
-
C:\windows\NJBI.exeC:\windows\NJBI.exe103⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HWGSCA.exe.bat" "104⤵
- System Location Discovery: System Language Discovery
PID:3128 -
C:\windows\HWGSCA.exeC:\windows\HWGSCA.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NXN.exe.bat" "106⤵PID:5948
-
C:\windows\NXN.exeC:\windows\NXN.exe107⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IKSPV.exe.bat" "108⤵PID:1216
-
C:\windows\SysWOW64\IKSPV.exeC:\windows\system32\IKSPV.exe109⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OKADEWJ.exe.bat" "110⤵PID:1020
-
C:\windows\OKADEWJ.exeC:\windows\OKADEWJ.exe111⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\IYWU.exe.bat" "112⤵PID:896
-
C:\windows\IYWU.exeC:\windows\IYWU.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3036 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ILXBQ.exe.bat" "114⤵
- System Location Discovery: System Language Discovery
PID:4664 -
C:\windows\system\ILXBQ.exeC:\windows\system\ILXBQ.exe115⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4220 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DZBSAJ.exe.bat" "116⤵PID:4380
-
C:\windows\DZBSAJ.exeC:\windows\DZBSAJ.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JZJGJLQ.exe.bat" "118⤵PID:4688
-
C:\windows\system\JZJGJLQ.exeC:\windows\system\JZJGJLQ.exe119⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\LPCAQAY.exe.bat" "120⤵
- System Location Discovery: System Language Discovery
PID:4604 -
C:\windows\system\LPCAQAY.exeC:\windows\system\LPCAQAY.exe121⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-